“Beware of little expenses. A small leak will sink a great ship.” — Benjamin Franklin
The most common hazard we encounter during a HazOp is a leaking pipe. Not the most severe and not the highest risk. Just the most common. But we always encounter it.
Why? Because pipes leak. All pipes, whether or not they contain a high-hazard chemical. They leak because piping fails and they leak because components in the piping system, like gaskets or valve packing, fail.
When the loss of containment is of cooling water or instrument air, the loss of containment is an inconvenience, but it is not a process hazard.
When the loss of containment is of a hazardous material — a flammable substance, a toxic substance, or even a simple asphyxiant — it becomes a process hazard. It’s a rare process that needs a HazOp that doesn’t have piping containing at least one hazardous material. So, pipe leaks are the most common process safety hazard.
How much risk is associated with this hazard?
Risk
Risk is a function of likelihood and consequence severity. To understand the risk associated with pipe leaks, we first need to understand the likelihood of leaks from piping systems. Consider those leaks in terms of piping leaks and in terms of leaks from piping system components — flanges, valve seals, etc.
The likelihood of leaks from piping is listed in the CCPS Guidelines for Initiating Events and Independent Layers in Layers of Protection Analysis. We can expect a leak from piping that is 150 mm (6 inches) in diameter or less to occur at a frequency of 0.00001 per meter of piping per year. A 10 m (33 feet) pipe section, then, has a likelihood of leaking of once per 10,000 years. According to the Guidelines, we can expect bigger piping to be ten times less likely to leak. These frequencies all assume an appropriate level of inspection and testing.
While the Guidelines include gasket leaks as one of the mechanisms for piping leaks, most organizations use a more conservative estimate for the likelihood of gasket, o-ring, packing, hose, and seal leaks. Typically, it is a frequency of once per 10 years, which is consistent with other frequencies listed in the Guidelines. This means that while the pipe itself is unlikely to leak, the other components and fittings in the piping system are much more likely to leak.
Consequence Severity
While likelihood is the side of risk we have the most control over, consequence severity is the side of risk that gets everyone’s attention. The consequence severity of leak is dependent on the material that is leaking and the surroundings into which it is leaking. An instrument air leak into the surrounding air is going to result in higher operating expenses because of wasted air, but little more. A cooling water leak onto the ground is going to create a mess that someone has to clean up and may create a slip hazard, but no process hazard. Leaks from chiller systems will have similar consequences to cooling water leaks if the chiller uses propylene glycol but will result in environmental impacts if the chiller uses ethylene glycol.
Other types of materials have more severe consequences when they leak. While low pressure steam leaks will typically only waste steam, high pressure steam leaks can result in thermal exposure and burns to personnel. Flammable materials ignite and can result in increasingly more severe consequences: pool fires, jet fires, vapor cloud fires, and vapor cloud explosions. Leaks of toxic materials can result in personnel exposure, injury, or death, as well as environmental harm. Even leaks of non-toxic materials can result in injury or death when they are simple asphyxiants, like nitrogen or argon.
The consequence severity of a leak will also depend on the surroundings into which it is leaking. Secondary containment, such as diked or curbed areas, can reduce the environmental impact of a liquid leak. A diked or curbed area, especially when equipped with automatic fire suppression, can reduce the impact of a pool fire when a flammable liquid leaks.
For leaking gases and vapors, the consequence severity depends largely on the degree of ventilation in the area of the leak. Outdoor leaks will have the lowest consequence severity. Leaks into small, poorly ventilated rooms, on the other hand, will have the highest consequence severity. A leak of nitrogen, which is inert and non-toxic, into a small, unventilated room can quickly render that room a death-trap. Nitrogen, although inert and non-toxic, is not air and just two breaths is enough to lead to death.
Reducing the Risk of Leaking Piping System
The first step in reducing the risk of leaking piping is to make sure that it is correctly specified and is part of an appropriate inspection, testing, and preventative maintenance program. That done, leaking piping can still occur. In many cases, the risk is low enough to tolerate as is. We must simply understand that piping sometimes leaks.
In many other cases, we will find that a piping leak is both frequent enough or the consequences severe enough to put the risk in the “As Low As Reasonably Practicable” – the ALARP – zone. This is the risk zone where cost-benefit decisions must be made. If the piping is correctly specified and is part of an appropriate inspection, testing, and preventative maintenance program, it will probably be reasonable to conclude that the benefit of additional risk reduction measures does not warrant the cost.
When the risk of leaking piping is too high to be tolerated, however, something must be done. Some guidance can be taken from NFPA 497, Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas. This guidance applies specifically to flammable materials but can be applied to other releases as long as we keep in mind that flammable and asphyxiation hazards occur at per cent levels, while toxic hazards often occur at ppm levels.
In NFPA 497, §5.5 talks about unclassified locations, locations that do not require special equipment to avoid igniting flammable material. For piping, which is intended to keep flammable material entirely contained, these include locations with adequate ventilation, meaning locations that are outdoors, or indoor locations with ventilation equivalent to outdoor ventilation. Indoors, locations with piping systems but without adequate ventilation can also be unclassified, “where piping systems are without valves, fittings, flanges, and other accessories.” In other words, all welded piping. For a run of 50 mm (2”) pipe for 10 m (33 feet), it’s the difference in likelihood of 0.1/year and 0.0001/year. As for “adequate ventilation”, NFPA 497 defines that as either “six air changes per hour, 1 cfm per square foot of floor area, or other similar criterion.”
Where there is a potential for a leak of a simple asphyxiant into an enclosed space, a local oxygen monitor and alarm is a valuable safeguard. Where there is a potential for a leak of a toxic vapor, calculations to show that ventilation is “adequate” are important, since it will necessarily be higher than what is adequate for flammable gases and simple asphyxiants. Additionally, monitoring and alarms for the specific toxic vapor is a valuable safeguard.
Death and Taxes
Like death and taxes, piping leaks are inevitable. They are hazards associated with every chemical process and must be addressed. In most cases, addressing them will consist of acknowledging them and tolerating them, like death and taxes. When the risks are intolerable, however, there is a range of safeguards that are available. Use them. Unlike death and taxes, intolerable risks do not need to be accepted.
