Morten Kristiansen
Energy Solutions International
Houston
| Based on presentation to Pipeline Simulation Interest Group Annual Meeting, Santa Fe, NM, May 15-18, 2012 |
Pipeline operators must analyze how different leak-detection systems affect the total cost of a leak. Whether the additional money spent on a more sophisticated system is a worthwhile investment depends on each pipeline's circumstances.
Understanding API RP 1130 and generating a prioritized list of leak-detection system selection criteria is critical to this analysis. The list should be specific for each pipeline and depend on operational as well as environmental conditions. Trade-offs and sacrifices will have to be made; no system on the market satisfies all criteria listed in API RP 1130.
This article puts some of the leak-detection metrics and selection criteria into perspective and illustrates the importance of various factors under different conditions. This is accomplished by using some hypothetical, yet realistic, examples of various leak incidents.
Background
The American Petroleum Institute's recommended practice API RP 1130 provides an overview of most of the leak-detection methods available for liquid pipelines, many of which apply to gas pipelines as well. API RP 1130 also defines the performance metrics and other selection criteria that should be considered during selection of a leak-detection system.
Poorly considered or prioritized selection criteria can lead to a poorly written request for quotation to various system vendors, sometimes even asking vendors to specify their system's exact performance at the time of bid submission, even though many details about the pipeline and the associated instrumentation are still unknown. Bids are often also submitted with a format that originally was part of API 1155, now an appendix to API RP 1130.
API 1155's format was designed for use when comparing different systems based on a well-defined pipeline and well-defined scenario. Using the specific information, one could easily analyze and document how many false alarms each system would generate, what the smallest detectable leak size was, how long it took to detect, and so on. It enabled pipeline companies to compare different systems and select the one best meeting their specific criteria, without necessarily meeting all the criteria.
API 1155's format, however, is now often being used as a template for leak-detection vendors to fill out even when missing required underlying information and data. Examples include:
• Number of false alarms. Without a specific data set, it is impossible to answer this question. An educated guess is possible, but many vendors simply state zero.
• Loss of functionality due to loss of pressure instruments. This event category depends on which pressure instruments are being discussed; some are more critical than others. Specific data sets are required for this category to have any meaning.
Performance metrics
Leak-detection performance can be described as the ability to recognize leak conditions rapidly and without failure, so as to minimize fluid loss, property damage, and risk of personal injury. This definition is too broad to be useful in evaluating a given pipeline system, with more specific performance criteria defined and grouped into the four categories in API RP 1130 that follow.
• Reliability. Reliability measures the ability of a leak-detection system to render accurate decisions about the possible existence of a leak in the pipeline under defined conditions: how many false alarms the system will generate and how many real leaks it will detect. For most systems, there is a tradeoff between sensitivity and false alarms; the higher the sensitivity, the more false alarms. Reliability does not take into account failures from other systems, like supervisory control and data acquisition (SCADA) systems.
• Sensitivity. Sensitivity is a measure of the size of leak that the leak-detection system is capable of detecting and the time required to do so. For many systems, detection time is tied to the leak size: the larger the leak, the shorter the detection time.
• Accuracy. Accuracy is a measure of how accurate the parameters calculated by the system are. Typical parameters include leak flow rate, total volume lost, type of fluid lost, and leak location.
• Robustness. Robustness measures the leak-detection system's ability to continue to function and provide useful information, particularly under changing conditions of pipeline operation or situations where data is lost or suspect. Will the system remain active during large operational changes (transients) and what happens if certain instruments are lost?
Prioritization
For some pipeline operators, reliability is more important than robustness. For others accuracy is critical. Each pipeline operator should prepare a prioritized list of desired performance metrics so that the selection process is well defined. Such metrics will often also include cost parameters. Having a clear set of priorities early in the selection process is critical. Selecting the wrong technology can result in a system that is too difficult to work with and might be ignored or abandoned, prompting a new search for a new system.
It is also important to look ahead when selecting technology. If today's sensitivity requirement is 2% and you expect future regulations to require 1% sensitivity, it makes sense to select a system that meets the 2% requirement today, but eventually can be set up to achieve stricter requirements.
Technology examples
Examples of three different leak-detection systems (LDS), each with their strengths and weaknesses, help illustrate the four basic performance metrics.
• System 1 (LDS-1). The user has reasonable confidence in the system. It can detect small leaks while yielding few false alarms. Leak location accuracy is typically within 10 miles, depending on leak size.
–Reliability: High.
–Sensitivity: High.
–Accuracy: Medium.
–Robustness: High.
–Cost: Medium.
• System 2 (LDS-2). The user has some reservations about the system. It can detect small leaks but often generates false alarms during transient conditions. Leak location accuracy has been proved to typically be within a few hundred feet.
–Reliability: Medium.
–Sensitivity: High.
–Accuracy: High.
–Robustness: Medium.
–Cost: High.
• System 3 (LDS-3). The user has some reservations about the system. It is not very sensitive and it takes a long time to detect small leaks. Robustness is low, as the system automatically disables itself during transient conditions. It is, however, considered reliable because the number of false alarms is low. The system does not offer any leak location information.
–Reliability: High.
–Sensitivity: Low.
–Accuracy: Low.
–Robustness: Low.
–Cost: Low.
Leak scenarios
Applying these technologies to four different scenarios typical for liquid pipelines will further illustrate the importance of developing a rigourous selection process.
• Scenario 1: Small corrosion leak. Corrosion causes a 1%-of-throughput leak on a 500-mile, 10-in. OD refined products pipeline through rural areas. The leak occurs at relatively steady operating conditions, far from the nearest town, in a hard-to-reach wooded area.
• Scenario 2: Medium leak due to third-party excavation. Third-party excavation causes a 10%-of-throughput leak on a 500-mile, 16-in. OD crude oil pipeline in a densely populated area. The leak occurs at relatively steady operating conditions near a residential area.
• Scenario 3: Pipeline rupture. A landslide causes complete rupture of a 500-mile, 12-in. OD refined products pipeline in a hard-to-reach mountainous area at relatively steady operating conditions.
• Scenario 4: Product theft. An illegal tap is installed in a rural area of a 500-mile, 10-in. OD products pipeline removed from public view. Thieves steal diesel fuel at a rate of 0.5% by opening the illegal tap very slowly for a short period of time, 4 times daily, using pipeline pressure to transfer diesel fuel to a tanker truck. The leak rate is small and intermittent
Operator response
Operator response depends on many factors, including its own policy. Technology available in the control room can play a major role as well, particularly the leak-detection system available to the pipeline controller and the level of confidence the controller has in the leak-detection system. The following discusses how different performance metrics of a particular LDS affect how a controller might react to a leak.
• Reliability. Reliability affects the time from when a leak alarm is issued to when the pipeline is shutdown and field personnel notified. An unreliable LDS will typically force the controller to perform additional analysis before the pipeline is shutdown. A reliable LDS might eliminate the additional analysis performed by the controller.
• Sensitivity. Sensitivity affects the number of leaks detected by the system. Low LDS sensitivity can result in small leaks going undetected for a long time, which can cause a large amount of product loss and addendant consequences. High sensitivity ensures even small leaks are detected.
• Accuracy. Accuracy affects the quality of information the controller can provide to the field personnel after the leak has been detected. High accuracy can result in emergency response teams arriving at the incident location more quickly, potentially reducing the consequences of a leak. Low accuracy might force the pipeline operator to mobilize additional detection methods such as a company line flyer or ground-based response teams to find the leak.
• Robustness. Robustness can have a major effect on the consequences of a leak. If a leak happens during transient conditions, or during a period with data outages, a non-robust system can prolong the detection time or even result in the leak not being detected.
Consequences
This section will analyze the overall cost of the leak scenarios outlined earlier by assuming installation of the three different leak-detection systems: LDS-1, LDS-2, and LDS-3. Overall cost considered for leak incidents includes direct costs related to loss of product and general cleanup. This analysis excludes fines, damage to the company image, imprisonment, and other consequences more difficult to quantify.
General assumptions
Analysis of historical incident data reported by US pipeline operators allows calculation of the financial consequences of leak scenarios. US Pipeline & Hazardous Materials Safety Administration (PHMSA) data and statistics for distribution and transmission pipelines show 730 hazardous liquid pipeline accidents between Jan. 1, 2010, and Feb. 29, 2012 (Table 1, Figs. 1-3), with 241 involving at least 10 bbl. Average cost/accident was $1,343,041. Average cost/bbl released was $4,263. Costs include:
• Product loss.
• Property damage and repair.
• Emergency response.
• Environmental damage.
• Other costs related to the accident (leak testing, equipment, food, security, sanitation, divers, administration, etc.).
Accident costs vary greatly, even when calculated on a per barrel basis. The detailed reporting method is also probably not completely standardized, since data are based on reports from many pipeline companies. PHMSA provides a standard form for accident reporting, but based on the data analyzed, it seems pipeline operators use this form differently. For example, some accidents only include a total cost, while most accidents have the cost split into the cost categories defined by PHMSA.
The leak scenarios analyzed in this article use an average cost of $4,000/bbl. The theft scenario uses an average cost of $500/bbl, assuming no property or environmental damage. This cost includes product loss and repair only.
Analysis
LDS-1 is a sensitive and reliable leak-detection system with a reasonable accuracy. LDS-2 is a sensitive and more accurate system, but reliability is worse than LDS-1. LDS-3 is reliable, but not very accurate, and sensitivity is not very good.
Analysis assumes only one system is in place for each leak, compared with a pipeline having all three systems installed simultaneously.
Scenario 1
LDS-2 might detect the leak first and alarm within a few minutes. The controller would have to perform further analysis before shutting down the pipeline, however, due to its low reliability. The small leak rate could cause this to take a substantial amount of time.
LDS-1 detects the leak after 45 min. The high reliability allows the controller to immediately initiate a pipeline shutdown.
LDS-3 would take 4 hr to generate the alarm, with the controller initiating a shutdown at that time.
LDS-2's high accuracy would allow easy identification of the leak site, resulting in repair and cleanup crews reaching the accident site roughly 3 hr after the start of the leak.
LDS-1's medium accuracy level would extend determination of the exact leak site. The pipeline operator would likely deploy ground personnel to search for the leak. It might take 3 hr from when the pipeline is shut down to identify the exact site, but since field crews were deployed, they would reach the site shortly thereafter.
LDS-3 would take more than 12 hr to identify the exact leak location. Closing intermediate block valves and monitoring temperature and pressure would allow the controller to identify the leaking segment within 2 hr of the leak alarm, but it would take several more hours to identify the precise leak site, possibly by using the company's line flyer. Field crews would arrive a few hours after the site was identified.
It might take crews an additional 6 hr to stop the leak, regardless of how it was detected. Table 2 shows a summary of each system's performance.
Scenario 2
LDS-2 might detect the leak first and alarm within a few minutes. Its low reliability would require the controller to perform further analysis before shutting down the pipeline. The large leak rate, however, would cut analysis time down to a few minutes.
LDS-1 might detect the leak after 5 min, with its high reliability allowing the controller to initiate an immediate pipeline shutdown. Pipeline shutdown and field personnel notification for LDS-1 and LDS-2 would be almost identical.
LDS-3 would take 15 min to generate the alarm, and the controller would initiate a shutdown at that time. LDS-3 would cause a slight delay on notifying the field personnel compared to LDS-1 and LDS-2.
Since the leak was caused by a third party, the accident would already have been reported by the time LDS-3 had issued an alarm and its location well known regardless of LDS used. It would take field crews 1 hr to reach the leak. It would take crews 3 hr to stop the leak upon arrival, regardless of LDS system.
Even without any LDS, overall cost would match that of LDS-3, with the difference in total cost between either LDS-1 or LDS-2 and no LDS at all 10%. Table 3 shows a summary of each system's performance.
Scenario 3
LDS-1 and LDS-2 would detect the leak simultaneously within a few minutes. The very large leak rate would allow the controller to shut down the pipeline immediately.
LDS-3 would take a few extra minutes to generate the alarm, and its low accuracy would require additional time to determine the leak's exact location.
After field crews arrive, it would take them an additional 2 hr to stop the leak, regardless of LDS system (Table 4).
Scenario 4
Leaks caused by theft affect pipeline hydraulic conditions differently than leaks caused by failure. Their flow is often intermittent, where flow from a real leak is continuous. Flow rate is also often small, making detection more difficult. Thieves often open the illegal trap slowly in an attempt to avoid creating pressure waves that might be detected in the system. This specific scenario might eliminate certain leak-detection techniques. For example, techniques detecting the physical presence of hydrocarbons outside the pipeline, analysis of acoustic emissions, or pressure waves might not be suited. Systems designed to detect variations in a certain flow rate may also not be sensitive enough to trigger an alarm in the instance of theft.
A system performing a volume-balance calculation might be a better choice. Such systems might not detect the theft immediately, but over time, the volume imbalance will grow and will eventually trigger an alarm.
Neither LDS-2 nor LDS-3 would likely detect the theft. LDS-1 is equipped with a volume balance, allowing it to detect the leak after several rounds of illegal product extractions.
Undetected theft will have a recurring daily cost, and only LDS-1 would eliminate this. Thieves might, however, install another illegal tap after the first one is removed; so the cost savings can be hard to quantify. The main cost savings would likely stem from the repair crew finding the illegal tap in a shorter amount of time with LDS-1 installed (Table 5).
Acknowledgments
The author thanks Tom Miesner of Pipeline Knowledge & Development for his insights regarding the response, cleanup, repair, and other operating aspects of liquid pipeline releases.
