6

Summary, Conclusions, and Recommendations

Gas transmission and hazardous liquid pipelines are among the safest and most efficient modes of long-distance bulk freight transportation. However, when the integrity of a pipeline is compromised, the consequences can be catastrophic because of the hazardous nature and high volumes of the commodities being transported under pressure and the frequency with which pipelines traverse populated and environmentally sensitive areas. When a pipeline rupture occurs, it can lead to an explosion, fire, asphyxiation hazard, or discharge of toxic material into the environment. The National Transportation Safety Board (NTSB) has been investigating major pipeline ruptures and their causes for more than 50 years, including factors contributing to the severity of outcomes. Following investigations of catastrophic pipeline ruptures in which the consequences were made worse by prolonged releases of the hazardous material, NTSB has made repeated recommendations for more stringent federal standards governing the timely isolation and shutdown of failed pipeline segments, including requirements for the use of automatic and remote-control shutoff valves.

In response to NTSB’s recommendations and concerns raised by Congress and others, during the early 2000s, the U.S. Department of Transportation (U.S. DOT) issued a series of rulemakings requiring operators of pipelines in populated and environmentally sensitive areas, designated as high consequence areas (HCAs), to establish integrity management (IM) programs. The IM regulations do not prescribe the use of specific risk reduction measures, such as automatic and remote-control shutoff valves, but obligate operators to institute and demonstrate that they have established a deliberate program for risk management involving risk identification and

assessment to make choices about where and when to take additional preventive and mitigative actions beyond those already required by regulation.

NTSB was initially satisfied with U.S. DOT’s IM rules as a response to its earlier recommendations for the expanded use of rupture mitigation valves (RMVs). However, following an investigation of a 2010 gas transmission pipeline rupture in San Bruno, California, in which eight people died, many more were injured, and more than 100 homes burned, NTSB determined that the pipeline operator had not been diligent in developing and implementing a high-quality IM program. Furthermore, the pipeline operator’s lengthy delay in isolating the ruptured pipe segment by having to dispatch qualified personnel to close valves manually had contributed to the incident’s severity, including added exposure to emergency response personnel.¹ Thus, NTSB repeated its recommendation that U.S. DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) require the installation of automatic and remote-control shutoff valves on transmission pipelines in HCAs and populated locations (Class 3 and 4 locations). These devices, which are now referred to by PHMSA as RMVs,² can isolate a failed pipe segment either through automatic activation or remotely from commands by personnel in a control center once the rupture is detected and confirmed. NTSB raised concerns that PHMSA’s regulations did not establish a maximum expected response time to isolate a rupture or mandate the installation of RMVs for faster valve closures (i.e., operators were allowed to make their own determinations about whether to install the devices). NTSB noted that a decade before the San Bruno rupture, following a gas transmission pipeline explosion in Edison, New Jersey, it had recommended expedited requirements for RMVs on high-pressure pipelines in urban and environmentally sensitive areas.³

Following NTSB’s recommendations, Congress passed legislation in 2011 that directed PHMSA to issue requirements for the installation of RMVs or equivalent technologies on newly constructed or entirely replaced segments of pipelines in HCAs when economically, technically, and operationally feasible. When PHMSA proposed a rule to comply with this statutory requirement for affected new pipelines, NTSB and pipeline safety advocates expressed concern that RMVs were not being required on existing transmission pipelines, especially in populated and environmentally

___________________

¹ NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010. Pipeline Accident Report NTSB/PAR-11/01. Washington, DC.

² For the remainder of this chapter, automatic and remote-control shutoff valves and other emergency flow restricting devices are referred to as RMVs.

³ NTSB. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New Jersey, March 23, 1994. Pipeline Accident Report NTSB/PAR-95/01. Washington, DC.

sensitive areas. NTSB noted that in a January 2020 response to another NTSB safety recommendation,⁴ PHMSA had maintained that it could only issue advisory bulletins for existing pipeline facilities due to a “nonapplication” clause in Title 49 USC § 60104(b) that states that a “design, installation, construction, initial inspection, or initial testing standard does not apply to a pipeline facility existing when the standard is adopted.” NTSB countered that PHMSA does have the authority to require the installation of RMVs on existing pipelines but nevertheless requested that Congress make this authority explicit by exempting RMV installations from the nonapplication clause.

In 2020, Congress passed the Protecting Our Infrastructure of Pipelines and Enhancing Safety Act, which directed PHMSA to commission this study by an independent committee to examine methodologies, standards, and regulatory criteria for deciding when RMVs should be installed on existing transmission pipelines in HCAs and populated locations. The committee was also asked to consider how these criteria and methodologies treat public safety and environmental risks as well as the economic, technical, and operational feasibility of RMVs. Based on this review, the study committee was asked to make recommendations on regulatory or statutory changes that should be considered at the federal and state levels about shutoff valve requirements in HCAs and populated locations.

On April 10, 2022, during this study, PHMSA finalized its rule requiring RMVs on most newly constructed and entirely replaced segments of hazardous liquid and gas transmission pipelines. The new rule established a minimum performance standard for an RMV to enable isolation of a rupture in 30 minutes or less when measured from an operator’s identification of a rupture after notification of a potential rupture. The rule affords operators the ability to propose the use of manual valves as an alternative equivalent technology, but only if the operator demonstrates that it can meet the 30-minute performance standard and if an RMV’s technical, operational, or economic infeasibility can be established to PHMSA’s satisfaction. The reasoning behind the rule and the information developed to support it proved helpful to the committee in conducting this related study focused on existing pipelines.

A synopsis of the study approach is provided next, followed by a recap of findings from a pipeline incident data review and information on the prevalence of RMVs, operator-reported reasons for installing them and their cost ranges, and the direction and guidance provided by PHMSA on the methods and criteria to be used by operators in making RMV installation decisions. The chapter concludes with observations about the current

___________________

⁴ Official correspondence from Howard R. Elliott, PHMSA administrator, to NTSB regarding NTSB Recommendation P-19-014, January 22, 2020.

regulatory direction and guidance that is provided to pipeline operators for deciding when to install RMVs on existing pipelines and for inspectors to verify that all obligations for deliberate and informed decisions are being met. Conclusions based on this assessment are presented along with recommendations for strengthening the direction and guidance provided and the verification methods used for ensuring sound decisions.

SYNOPSIS OF STUDY APPROACH

To fulfill its charge, the study committee reviewed the use, scope, and age profile of the U.S. hazardous liquid and gas transmission pipeline networks; the means by which pipeline operators monitor the status and control the operations of their systems; and the types and prevalence of valves that are used to isolate and shut down pipelines in an emergency. The committee reviewed the current pipeline safety assurance framework, including regulations obligating pipeline operators to plan and implement IM programs for pipelines in HCAs and Class 3 and 4 locations. The committee considered how pipeline operators conduct their IM-required risk analyses and how federal and state safety regulators support, monitor, evaluate, and enforce operator compliance with IM requirements. The committee examined the IM requirements pertaining to operator evaluations of RMVs and PHMSA enforcement records for information on inspector verifications of the evaluations.

The study committee reviewed the recent history of pipeline incidents in HCAs and populated areas to identify any discernible trends and patterns, including incidents where the timeliness of valve closures could have affected outcome severity. The committee consulted NTSB and PHMSA investigations of several major pipeline ruptures, noting how and when shutoff valves were deployed, as reported by investigators. By consulting and surveying pipeline operators, the committee gained a better understanding of the prevalence of RMVs on existing pipelines in HCAs and populated (Class 3 and 4) locations, the magnitude and types of costs incurred by operators when installing RMVs, and how operators make choices about when to install RMVs on existing pipelines. This information proved helpful when reviewing existing regulatory requirements for operators to evaluate the need for RMVs as part of their IM obligations for conducting risk assessments and implementing protective and mitigative measures beyond those already required by federal regulation.

SUMMARY OF KEY POINTS FROM CHAPTERS

Pipeline Miles in High Concentration Areas and Current Use of Rupture Mitigation Valves (Chapter 2)

Most Pipeline Miles in High Concentration Areas Are Part of Large Systems

As reported by operators, at year-end 2021 about 40% of hazardous liquid pipeline mileage was located in HCAs, while 19% of gas transmission pipeline mileage was located in HCAs and Class 3 or 4 locations. Large shares of this HCA mileage were found to be managed by a relatively small number of operators with large pipeline systems. In the case of gas transmission pipelines, 12 operators managed more than 60% of the mileage in HCAs and Class 3 and 4 locations. In the case of hazardous liquid pipelines, 18 operators managed more than 75% of the HCA mileage.

Rupture Mitigation Valves Are Being Used on Existing Transmission Pipelines in High Concentration Areas

A combination of operator survey results and data from incident reports suggests that about 60% of mainline or sectionalizing valves currently installed on gas and hazardous liquid pipelines in HCAs are manual valves; however, RMVs are common, accounting for about 35% to 40% of valves. Although RMVs are more common in hazardous liquid pipelines than gas transmission pipelines, operators of both types of pipelines have significant operational experience using RMVs. The data suggest that for both types of pipelines, valves are currently spaced at intervals that, in general, accord with the spacing requirements for RMVs on newly constructed and entirely replaced segments of pipelines. Furthermore, the data suggest that supervisory control and data acquisition (SCADA) systems are almost universal on existing hazardous liquid and gas transmission pipelines, meaning that much of the connectivity and telemetry required for RMVs may already be in place. Existing valve spacings and the prevalence of SCADA systems suggest that it may be possible to add RMVs to many existing pipelines through manual valve retrofits and replacements rather than investments in new valve locations and centralized control mechanisms.

Pipeline Safety Regulatory Framework (Chapter 3)

Pipeline Safety Regulation Is a Federal and State Responsibility

The federal government and states are responsible for regulating pipeline safety. Most inspections to verify compliance with the federal regulations are performed by state inspectors under PHMSA-delegated authorities.

Pipeline Operators Face Challenges Implementing Integrity Management Risk Management Processes and Inspectors Face Challenges Verifying Compliance

In the 20 years since the IM requirements were introduced for pipelines in HCAs, NTSB and others have raised concerns about whether pipeline operators have the capacity to employ rigorous risk assessment methods and tools and whether they are consistently using them for IM planning and decision making, including to inform choices about when to use RMVs. PHMSA, standards organizations, and industry have introduced guidance, training, and other support for industry and pipeline safety inspectors. Federal and state inspectors nevertheless face challenges in verifying compliance with IM obligations because of the need to assess whether operators are following all required processes, using appropriate methods and tools to assess risk and decide on appropriate risk reduction actions, and implementing such actions in the field.

Mandates for Rupture Mitigation Valve Installations Diverge from the Integrity Management Approach

The current policy approach to RMV installation on existing pipelines is to incorporate the decision into the IM program, which gives pipeline operators leeway to make choices about their use of risk reduction measures that exceed the federal minimums. The new rule requiring the installation of RMVs on newly constructed and entirely replaced segments of pipelines mandates a specific protective measure unless it is infeasible; in this respect, it is similar to the many other requirements in federal pipeline safety regulations that apply generally.

Safety Data Review (Chapter 4)

Key Factors Affecting Release Volumes and Consequence Severity Following a Rupture

After a pipeline rupture, two important factors associated with the pipeline design and installation that affect the volume of gas or hazardous liquid released are

1. the elapsed time from identifying and confirming the failure and the release of material to closing valves or using other means to shut in and isolate the failed segment; and
2. the pipeline diameter and spacing between valves to isolate a failed segment and, in the case of gases, the pressure at which the pipeline was being operated.

Factors that affect the magnitude of the consequences include the physical and chemical properties of the product released including its flammable and toxic properties, and the nature of the surrounding built and natural environment into which the materials are released.

Evidence of Valve Types and Closure Times from Incident Reports

Significant incidents reported to PHMSA by pipeline operators from 2010 to 2022 were examined. These incident reports suggest that RMVs can be an effective means of reducing the time elapsed between identifying the occurrence of a rupture and closing valves upstream and downstream from the rupture to isolate the failed segment. Twenty-four incident reports contain information on the elapsed time from identifying a release to closing upstream and downstream valves. In 17 cases, the two valves used to isolate the pipeline were manual, while in 4 cases one manual valve was listed while the other was not reported. For these 21 cases, the average time taken to close the valves was 4 hours and 43 minutes. In two incidents, the valves were RMVs, with reported elapsed times from identification to closure of 17 and 50 minutes, respectively. In the other case, the upstream and downstream valves included a manual valve and a remote-control shutoff valve, and the operator reported a closure time of 130 minutes for the remote-control valve and just more than 4 hours for the manual valve.

Twenty-six hazardous liquid pipeline incident reports contained information on the elapsed time to valve closure. In eight incidents, the upstream and downstream valves closed were manual, with an average elapsed time from identification to closure of 97 minutes. For the other 18 incidents, in 15 cases the valves were controlled remotely, and the average time from identification to closure was 30 minutes. In the remaining three incidents, automatic shutoff valves were activated, with an average closure time of 34 minutes.

Rupture Mitigation Valve Cost and Decision Criteria for Existing Pipelines (Chapter 5)

Operators Can Have Multiple Reasons for Installing Rupture Mitigation Valves

The incident and survey data indicate that gas transmission and hazardous liquid pipeline operators have made decisions to install RMVs under varied circumstances for operational and safety reasons. Some pipeline operators have established programs specifically to determine where RMVs are warranted, while others evaluate the applicability of the devices within the context of the overall planning and implementation of their IM programs and operational needs.

Operators Report Wide Variability in Rupture Mitigation Valve Installation Costs

The retrofitting, upgrading, and installation costs of RMVs can vary widely and be highly site-specific, from about $30,000 to more than $1 million per site. If the only requirement is the addition of an automatic or remote-control actuator to an existing valve, the installation cost is more likely to be on the lower end of the cost range but still be affected by factors such as pipe diameter and access to power and communications. Alternatively, if an operator needs to retrofit an older pipeline and place a valve in a location that did not previously have one, this installation could entail significant capital expenditures for construction; new power and communication systems; state and local permitting; and site access, improvement, and restoration.

Integrity Management Rules Require Risk Modeling, But Methods Vary

Recognizing the importance of high-quality risk modeling for assessing risk, PHMSA has increased its guidance on modeling risk and has emphasized the importance of using quantitative models that can provide probability-based output rather than qualitative methods. However, the extent to which operators employ such methods remains unclear, as does the adequacy of the methodology guidance provided to operators and inspectors.

Integrity Management Rules Require Rupture Mitigation Valve Evaluations But Give Limited Direction

The IM rules obligate operators to develop and implement risk management strategies that are informed by risk assessments. A credible risk assessment would identify all risks, including those that are so large that they are intolerable and should be eliminated even at great cost. For most risks that are not at such intolerably high levels, mitigation through different interventions will require the use of risk models to predict each intervention’s expected risk reduction benefits. While such assessments would be expected to consider RMVs as an intervention option, PHMSA regulations also stipulate that an operator should specifically evaluate RMVs after the initial risk assessment is performed. The regulatory direction for conducting this supplemental RMV evaluation, however, is limited to specifying the factors an operator should consider during the evaluation. The regulations do not provide guidance or direction on the criteria to be used for assessing the factors, such as for assessing whether the pipeline’s shutdown capabilities are sufficiently swift.

CONCLUSIONS

• The long-standing and widespread use of rupture mitigation valves (RMVs) by pipeline operators who have judged them to be beneficial for operations and safety demonstrates that their use is technically and operationally feasible under many circumstances and across a wide range of conditions. While RMVs can be installed on pipelines mainly by changing the actuators of existing manual valves, the varied conditions and circumstances that exist across pipeline systems mean that retroactive RMV installations can differ greatly in feasibility, complexity, and cost, as well as in the benefits they can confer.
• There is a strong rationale for the integrity management (IM) process and its obligations on operators for active risk management to make rupture mitigation valve installation choices because of the wide variability among pipelines in terms of where they are sited and their conditions and circumstances. However, the efficacy of the approach depends on operators being capable and diligent in their implementation of required IM processes with sufficient direction, guidance, and oversight from regulators.
• As currently written for both hazardous liquid and gas transmission pipelines, the integrity management regulations governing operator risk assessments are short on direction and guidance on how the need for a rupture mitigation valve should be evaluated

and decided by operators, despite requiring operators to undertake such evaluations.

• The integrity management process depends on operators using sound risk modeling and analysis methods for informing their prevention and mitigation strategies in high consequence areas. These methods must account for the location-specific probabilities of different types of failures occurring, potential consequences ensuing, and alternative measures being effective in failure prevention and consequence mitigation. By using quantitative models that represent risk and uncertainty in a probabilistic manner, the operator will be in a better position to assess the risk reduction potentials of alternative safety measures at any given site. However, risk modeling capabilities vary among operators, who are not required to use quantitative models that can provide probability-based output for assessing the risk reduction potential for RMVs and other safety measures.
• In deciding on the use of alternative safety measures with differing potentials for risk reduction, including RMVs at specific sites, operators need to be able to determine the array of benefits and costs of each measure, including benefits to the public. However, standardized practices for estimating benefits and costs for pipeline risk management do not exist, raising questions about how operators are establishing the need for RMVs and, more generally, how they are prioritizing and making choices about all candidate safety measures in the public interest.
• Because of the rigor, expertise, and data quality required, risk assessments using quantitative modeling and economic analyses of the benefits and costs of alternative safety measures can be challenging for operators to implement and for inspectors to assess for quality. Operators and inspectors lack guidance and support on the application of requisite analytic methods, including opportunities for training.

While all 10 committee members agreed with the conclusions above, 9 of the 10 members also agreed on the following conclusion. The reasoning of the one committee member who disagreed with the conclusion is provided in Appendix A.

• A broadly applicable requirement for the installation of RMVs, such as in the rule for newly constructed and entirely replaced segments of pipelines, would not be advisable for existing hazardous liquid and gas transmission pipelines in high consequence areas. While newly constructed and entirely replaced segments of

pipelines can be designed for RMVs, a similar broad-based requirement that is retroactively applied to existing pipelines would not be advisable because the available evidence on costs and benefits attributed to the installation of RMVs varies widely as a function of factors such as site-specific pipeline characteristics, land use patterns, the built environment, and ecological sensitivity.

PHMSA has not taken a position on the installation of RMVs on existing pipelines. Existing statutory language, however, can be interpreted as precluding the establishment of new regulatory standards for their installation when applied to existing pipelines.⁵

RECOMMENDATIONS

In the view of the 9 of 10 committee members who continue to believe that operator decisions about when to install RMVs on existing pipelines should be made in IM programs, the following steps are warranted to strengthen the quality and execution of operator IM processes and their verification by safety inspectors.

___________________

⁵ This report notes that Title 49 USC § 60104(b) states, “[A] design, installation, construction, initial inspection, or initial testing standard does not apply to a pipeline facility existing when the standard is adopted.”

evaluation methods and criteria used in their RMV evaluations, especially when the results do not favor or do not lead to the installation of an RMV.

Regarding this recommendation for PHMSA to establish evaluation criteria, metrics, and methods for operators to use when evaluating factors such as a pipeline’s shutdown speed, some committee members believe that PHMSA should require operators to evaluate on the basis of a prescribed metric, such as the 30-minute isolation time that must now be satisfied by newly constructed and entirely replaced segments of pipelines. The results from the operator’s RMV evaluation using the prescribed metric would need to be documented and thus could be readily noted by federal and state inspectors when reviewing an operator’s IM program documents and results from the RMV evaluations. While statutory restrictions may preclude PHMSA from compelling RMV installations on existing pipelines when the evaluation metric is not satisfied, the agency could compile the information from these inspector-reviewed RMV evaluations for insight into how much of the pipeline system could be at risk for slow or delayed rupture isolation. Some other committee members, however, do not favor such a prescribed evaluation metric out of concern that a single value would not be applicable to many circumstances and could be used by operators to justify decisions not to install RMVs when public interests may warrant their use.

Regarding Recommendations 2 and 3, some committee members believe that PHMSA should advise operators on the specific methods they should use in making choices among alternative risk reduction measures. These committee members favor the use of benefit-cost analysis to establish the net benefits of alternatives coupled with requirements that operators document their analytic methods and results for inspectors to review. They believe operators are now making such net-benefit calculations, formally or informally, but potentially construing safety benefits on a limited basis that does not fully account for societal interests as one would expect from a sound and compliant IM program. Although all committee members share a concern that operators may not be considering societal benefits and interests fully when deciding on the use of RMVs and other risk reduction measures, some members do not endorse making a net-benefit calculus an explicit standard for decision making. Those members want to be sure that operators are not dissuaded from making decisions that favor RMVs when all

potential benefits cannot be enumerated, such as when the choice advances equity or promises other public benefits sufficient to justify an installation.

In the committee’s view, it is fair and reasonable to expect all pipeline operators to use quantitative risk modeling for their IM programs, especially because a large share of HCA mileage is managed by a relatively small number of major operators likely to have the resources and technical capacity to employ such methods. The recommended technical guidance and training should help all operators, including smaller companies whose obligations to meet the requirement could be phased in.

CONCLUDING OBSERVATIONS

Even when RMVs are technically and operationally feasible to install on an existing pipeline, there can be valid reasons for not installing them. The cost of installing new valves capable of remote or automatic operation or installing actuators to permit the remote or automatic operation of existing valves may be prohibitive. The probability and potential consequences of a rupture at a given site can also vary widely depending on factors such as the product in the pipeline, the characteristics and setting of the pipeline (e.g., diameter, design, age, and topography), and the features of the surrounding area (population density, activity levels, and environmental sensitivities).

RMVs are intended to reduce the magnitude of the consequences of a rupture by isolating the failed pipeline faster. The expected benefits of RMV installation are the reduction in the consequences of a rupture multiplied by the probability that a rupture will occur during the lifetime of the valve. While ruptures occur, the probability that they will occur at any specific location is small. In some locations where the consequences of a rupture could be high, the costs of retrofitting with an RMV will still exceed the expected quantifiable benefits because of the low probability of a rupture, the high cost of the RMV installation, or both.

There will be locations where the expected quantifiable benefits of an RMV installation exceed the costs. However, even in locations where the quantifiable benefits of RMVs exceed the costs, it is possible that RMVs are not the most cost-beneficial option. Other options could be less expensive to implement while yielding similar benefits, making them more cost-effective.

Likewise, other actions could be even more expensive to implement but offer more quantifiable benefits than an RMV, such as by reducing the probability of a rupture or doing more to mitigate adverse consequences.

The IM process is supposed to hold operators accountable for their risk management strategies by giving them latitude to make context-specific choices about risk reduction measures, including when to install an RMV. This differs from traditional regulatory designs that prescribe the use of a specific treatment or feature or define specific performance criteria that

must be met, as is the case for most federal and state regulations that apply to pipelines generally. A rationale for the IM regulatory design is that pipeline operators are more likely than regulators to know the site- and context-specific risks associated with their pipelines and their operations. Such management-based regulations can also infuse a stronger sense of safety, responsibility, and accountability (i.e., safety culture) in the regulated industry if steadfast compliance is supported, monitored, and enforced.⁶

Nine of the committee’s 10 members believe the advice offered above, if followed, has the potential to strengthen operator IM decisions about when to install RMVs and PHMSA’s ability to ensure sound decisions. Not similarly confident that improvements to IM processes will be made and result in operators making decisions about RMVs that align more closely with the public interest, one committee member proposes alternative approaches based on reasoning offered in Appendix A. All other committee members agree, however, that if PHMSA is not successful in furthering the recommended actions or if operators do not implement them effectively, then alternative approaches may be warranted, including the introduction of regulatory standards stipulating when RMVs should be installed.

___________________

⁶ National Academies of Sciences, Engineering, and Medicine. 2018. Designing Safety Regulations for High-Hazard Industries. Washington, DC: The National Academies Press. https://doi.org/10.17226/24907.

This page intentionally left blank.