A criticism of PG&E following the San Bruno failure was their inability to promptly close mainline valves to isolate the gas flow feeding the fire. One of the factors contributing to the delay was the fact that the valves were manually operated. That wasn’t the whole story because the manual valves could have been closed quite quickly if the emergency response had been better organised. Nevertheless, in response California recently passed legislation “requiring utilities to install automatic shut-off valves on gas lines”. Exactly which valves, and what type of “automatic shut-off” is not clear.
Mainline valves on Australian pipelines are almost always provided with remote-controlled actuators so that the valves can be closed in emergency to limit the release of gas from a leak or rupture or to allow more rapid depressurising of a damaged section of pipe. However they are not always (not often?) automatic line-break valves but must be closed by a control room operator, who in an emergency would need to respond to observations of the pipeline pressures and flows. Actuating MLVs seems to have been standard practice in Australia for at least 25 years, probably a lot longer. There are exceptions, mostly on older pipelines.
One exception for which I was responsible (about 20 years ago) was 300 km of DN 150 pipeline to a mine in a very remote part of the outback. None of it passed within a kilometre or so of any building (except within the last few hundred metres near the mine) and there were not more than a handful of road crossings. During the design we found it hard to imagine anything that could cause a serious failure, and even if it did fail the consequences would be only commercial. There would certainly be no safety impacts that could be mitigated by prompt closure of a mainline valve. On that basis we decided to provide only basic manual valves and no telemetry.
Actuating a valve would have added perhaps $250 000 to the cost of each site by the time we included all the SCADA, telemetry and power supply infrastructure necessary to make it work. Against that, the value of gas that might be saved by prompt closure of valves was less than $100 000, and of course a loss of containment was highly unlikely anyway. That logic made the decision to omit actuation pretty easy.
Recently I was asked to help a client review the justification for retro-fitting actuators to mainline valves on an old pipeline in a more populated area. It turned out to be a really interesting exercise with a surprising outcome – justification on safety grounds was difficult. That was particularly surprising in the light of the Californian legislation.
The difficulty is that even in the event of a full bore rupture MLVs will not be closed instantly. It will take at least a few minutes for control room operators to positively confirm that there has been a loss of containment. Operators are reluctant to shut valves without compelling reason because of the serious disruption to supply and the flow-on effects of that (eg. purging and relighting pilots on possibly hundreds of thousands of domestic appliances …). In the recent study the consensus was that it might take 15 min before the control room operators sent the signal to close the valves.
However if there has indeed been a full bore rupture, and the release has ignited, we thought that the great majority of the harm would already have been done by the time the valves start to close. People who are close to a pipeline fire and cannot flee will suffer hospitalising or fatal burns within a minute or so of exposure. 15 min also seems quite long enough to ignite any buildings that are vulnerable to fire.
The usefulness of valves is even less compelling when the failure is a leak (even a large one) rather than a rupture. The pipeline section between valves will contain linepack that will continue to flow out through the leak (and possibly burn) for a long time after the valves have closed, perhaps for several hours depending on how long it takes to mobilise crews to start depressurising the pipeline via blowdown vents. Reducing that duration by an hour or so through the addition of actuated valves is not an impressive benefit.
Mainline valves may be more effective emergency protection if they were equipped with sensitive automatic line-break controls that would close them more quickly. But such controls are not 100% reliable, and no operator wants to be exposed to the risk of spurious trips that may cause both serious community disruption and large commercial losses. Given the low frequency of major pipeline failures in Australia, adoption of sensitive automatic line-break valves would probably result in a few spurious trips each year, with associated chaos, in order to protect against failure events that might only occur every hundred or thousand years (these frequencies are just informed guesses for illustration, not serious estimates). Even then automation would only provide some protection against rupture events, not leaks large or small.
This limited effectiveness of actuated valves is a rather unsettling conclusion. Discussion would be welcome.
Pipelines OZ 
Reading through Canadian reports (www.tsb.gc.ca) it would seem that there is some value in being able to turn down the fire promptly, as the gas fed into the conflagration can severely hamper fire fighting efforts on surrounding infrastructure.
SCADA control design always seems to be caught up in an age-old argument. Do you let the SCADA operator re-open the valve sight-unseen or require an operator to visit the site, verify whether it is a real event or spurious trip and then locally open the valve if a spurious trip? This topic gets discussed each time the subject comes up.
The matter of autolinebreak controls is far from simple, and as you state valid only for rupture type events – not leaks.
The standard rate-of-pressure-drop control is simple in concept, but the set point needs to be designed to suit the application. The further away the valve is from failure point, the lower the kPa/minute set point. With the penchance in Oz for extended distances between MLV’s these setpoints get down to “spurious trip” levels.
ALB controls on branch pipelines of different diameter and lengths start getting complex very quickly. In the most simplistic example, an ALB fitted to a DN100 pipeline offtake feeding into a DN1000 mainline would never see any significant rate of pressure drop from a DN100 rupture, due it’s being fed by the huge DN1000 “bottle”. The trusty old check valve at the tee is probably the most effective and simple device in this circumstance. The other means of control is some form of flow measurement and limit. This does not have to be custody transfer standard – an insertion type annubar is quite sufficiently accurate for this purpose. This can work in a number of ways including the reverse flow, and hence replace the check valve.
Hi Peter
I’m not sure the statement “Mainline valves on Australian pipelines are almost always provided with remote-controlled actuators” is accurate. This may be the case for modern recently designed gas transmission pipelines but does not apply to older high pressure liquid petroleum piplines. I am aware of a number of older piplines where the valves are not linked to the SCADA system and must be manually operated.
The key issue for both new and existing piplines is the safety management study (initial and 5 year review) consideration of the level of risk to the community or environment and the cost of installing (including retrofitting) of such a capability.
The San Bruno event might be a good ALARP case study in detemining if retrofitting remote control and or authomatic line break values is appropriate.
Adrian
I’d like to point out that automatic line break actuators should not be viewed as an answer. I refer you to GRI Report #GRI-95/0101 Remote and Automatic Mainnline Valve Technology Assessment. While the detection capability may have improved since 1995, the hydraulics remain the same. The conclusion of that analysis is “Both field experience and simulation studies show that the major source of unreliability in automatic and remote control valves lies in the ninability of existing line break detection systems to identify a rupture event and locate its position in the pipeline. ….However the detection systems and control logic used to trigger their closure have difficulty in distinguishing a line break from other transient conditions. ….When operating transients are comparable in magnitude to those resulting from a line break, detector sensitivity must be adjustedto avoid false closures due to normal operating transients, and the detectors become insensitive to line breaks as well”.
The report makes good reading for those considering remote or automatic valve actuation of line valves as a safety measure.
Simple transient hydraulic analysis of a typical pipeline section with pipeline breaks near either end, and in the middle shows the pressure gradients and flows resulting from failure and these can be compared with the pressure gradients in pipeline operating, including events like changes in control settings, demand, and compressor start and stop.
To add to the initial comment, a decision to remotely actuate an isolation valve results in a disproportionate cost increase (compared with the actuator cost), because it usually requires installation of a power supply, UPS, communications system, control hut, air conditioning and so on….
Nevertheless the important take-home messsage from this discussion is that if you plan to install a lilnebreak facility on a MLV, be sure to do sufficient transient hydraulic analyses of the events you are trying to use to trigger closure, at all locations along the pipe section proposed to be protected and make sure that the detection system can reliably discriminate between the break (at any position in the section) and the most severe operating transient.
Otherwise a simpler and more reliable control is to close the actuator from minimum pipelilne pressure.
I have a copy of this report – but it is paper and a couple of hundered pages long. If it is needed and unavailable I would be prepared to scan it in due course.
Phil Venton
One big difference between the older pipelines like the MAP and modern pipelines is the Code they were designed to. The MAP was designed to North American standards (there were no Australian standards in the 1960’s) which required (and still does require*) valve spacings of not more than 32km in R1 locations. To actuate all these valves would be very expensive and pointless and on the MAP only every third valve is actuated where they coincide with a compressor station.
AS2885.1 nowadays leaves the determination of valve spacing in R1 areas to the designer, and these valves are usually 100+ km apart as there is little justification, either from safety or commercial product loss criteria, in having them closer. When the pipeline enters populated areas the standard does specify maximum spacings, but once again the justification for doing so seems to be a perception of safety rather than any real advantage. As Peter points out, the damage will have been done before even an automatic valve closure can occur – all that closing the valves will achieve is reducing the duration of the gas burn-off, not its intensity over the first few minutes which is when the maximum damage is likely to occur.
*or did in 2003 which was the edition of B31.8 I referred to.