This PDF is available at http://nap.nationalacademies.

org/27521

Ensuring Timely Pipeline Shutdowns in

Emergencies: When to Install Rupture
Mitigation Valves (2024)

DETAILS
145 pages | 6 x 9 | PAPERBACK
ISBN 978-0-309-71641-3 | DOI 10.17226/27521

CONTRIBUTORS
Committee for a Study on Criteria for Installing Automatic and Remote-Control
Shutoff Valves on Existing Gas and Hazardous Liquid Transmission Pipelines;
BUY THIS BOOK Policy Studies; Transportation Research Board; National Academies of Sciences,
Engineering, and Medicine

FIND RELATED TITLES SUGGESTED CITATION

National Academies of Sciences, Engineering, and Medicine. 2024. Ensuring
Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation
Valves. Washington, DC: The National Academies Press.
https://doi.org/10.17226/27521.

Visit the National Academies Press at nap.edu and login or register to get:
– Access to free PDF downloads of thousands of publications
– 10% off the price of print publications
– Email or social media notifications of new titles related to your interests
– Special offers and discounts

All downloadable National Academies titles are free to be used for personal and/or non-commercial
academic use. Users may also freely post links to our titles on this website; non-commercial academic
users are encouraged to link to the version on this website rather than distribute a downloaded PDF
to ensure that all users are accessing the latest authoritative version of the work. All other uses require
written permission. (Request Permission)

This PDF is protected by copyright and owned by the National Academy of Sciences; unless otherwise
indicated, the National Academy of Sciences retains copyright to all materials in this PDF with all rights
reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

PREPUBLICATION COPY—Uncorrected Proofs

Copyright National Academy of Sciences. All rights reserved.

Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Ensuring Timely Pipeline

Shutdowns in Emergencies
When to Install Rupture Mitigation Valves

Committee for a Study on Criteria

for Installing Automatic and
Remote-Control Shutoff Valves on
Existing Gas and Hazardous Liquid
Transmission Pipelines

Transportation Research Board

Consensus Study Report

PREPUBLICATION COPY—Uncorrected
Copyright National Academy of Sciences. All rights reserved. Proofs
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Transportation Research Board Special Report 349

Subscriber Categories: Pipelines; policy; safety and human factors; and energy

Transportation Research Board publications are available by ordering individual publications

directly from the TRB Business Office, through the Internet at www.TRB.org or
nationalacademies.org/trb, or by annual subscription through organizational or individual
affiliation with TRB. Affiliates and library subscribers are eligible for substantial discounts. For
further information, contact the Transportation Research Board Business Office, 500 Fifth
Street, NW, Washington, DC 20001 (telephone 202-334-3213; fax 202-334-2519; or e-mail
[email protected]).

Copyright 2024 by the National Academy of Sciences. National Academies of Sciences,

Engineering, and Medicine and National Academies Press and the graphical logos for each are
all trademarks of the National Academy of Sciences. All rights reserved.

Printed in the United States of America.

This publication was reviewed by a group other than the authors according to the procedures
approved by a Report Review Committee consisting of members of the National Academy of
Sciences, the National Academy of Engineering, and the National Academy of Medicine.

This study was sponsored by the Pipeline and Hazardous Materials Administration of the U.S.
Department of Transportation.

International Standard Book Number-13: 978-0-309-XXXXX-X

International Standard Book Number-10: 0-309-XXXXX-X
Digital Object Identifier: http://doi.org/10.17226/XXXXX
Library of Congress Control Number: XXXXXXXXXX

PREPUBLICATION COPY—Uncorrected Proofs

Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

The National Academy of Sciences was established in 1863 by an Act of Congress, signed by
President Lincoln, as a private, nongovernmental institution to advise the nation on issues
related to science and technology. Members are elected by their peers for outstanding
contributions to research. Dr. Marcia McNutt is president.

The National Academy of Engineering was established in 1964 under the charter of the
National Academy of Sciences to bring the practices of engineering to advising the nation.
Members are elected by their peers for extraordinary contributions to engineering. Dr. John L.
Anderson is president.

The National Academy of Medicine (formerly the Institute of Medicine) was established in
1970 under the charter of the National Academy of Sciences to advise the nation on medical and
health issues. Members are elected by their peers for distinguished contributions to medicine
and health. Dr. Victor J. Dzau is president.

The three Academies work together as the National Academies of Sciences, Engineering,
and Medicine to provide independent, objective analysis and advice to the nation and conduct
other activities to solve complex problems and inform public policy decisions. The National
Academies also encourage education and research, recognize outstanding contributions to
knowledge, and increase public understanding in matters of science, engineering, and medicine.

Learn more about the National Academies of Sciences, Engineering, and Medicine at
www.nationalacademies.org.

The Transportation Research Board is one of seven major program divisions of the
National Academies of Sciences, Engineering, and Medicine. The mission of the Transportation
Research Board is to mobilize expertise, experience, and knowledge to anticipate and solve
complex transportation-related challenges. The Board’s varied activities annually engage about
8,500 engineers, scientists, and other transportation researchers and practitioners from the
public and private sectors and academia, all of whom contribute their expertise in the public
interest. The program is supported by state departments of transportation, federal agencies
including the component administrations of the U.S. Department of Transportation, and other
organizations and individuals interested in the development of transportation.

Learn more about the Transportation Research Board at www.TRB.org.

PREPUBLICATION COPY—Uncorrected Proofs

Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Consensus Study Reports published by the National Academies of Sciences, Engineering,

and Medicine document the evidence-based consensus on the study’s statement of task by an
authoring committee of experts. Reports typically include findings, conclusions, and
recommendations based on information gathered by the committee and the committee’s
deliberations. Each report has been subjected to a rigorous and independent peer-review
process and it represents the position of the National Academies on the statement of task.

Proceedings published by the National Academies of Sciences, Engineering, and

Medicine chronicle the presentations and discussions at a workshop, symposium, or
other event convened by the National Academies. The statements and opinions contained in
proceedings are those of the participants and are not endorsed by other participants, the
planning committee, or the National Academies.

Rapid Expert Consultations published by the National Academies of Sciences, Engineering,

and Medicine are authored by subject-matter experts on narrowly focused topics that can be
supported by a body of evidence. The discussions contained in rapid expert consultations are
considered those of the authors and do not contain policy recommendations. Rapid expert
consultations are reviewed by the institution before release.

For information about other products and activities of the National Academies, please
visit www.nationalacademies.org/about/whatwedo.

PREPUBLICATION COPY—Uncorrected Proofs

Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

COMMITTEE FOR A STUDY ON CRITERIA FOR INSTALLING AUTOMATIC AND

REMOTE-CONTROL SHUTOFF VALVES ON EXISTING GAS AND HAZARDOUS
LIQUID TRANSMISSION PIPELINES

IAN P. SAVAGE (Chair), Northwestern University

LORI S. BENNEAR, Duke University
ROBERT B. GILBERT (NAE), The University of Texas at Austin
SARA R. GOSMAN, University of Arkansas School of Law
ORVILLE D. HARRIS, O.B. Harris, LLC
GARY D. KENNEY, Sine Rivali, LLC
SCOTT A. MARSHALL, Virginia State Corporation Commission
EDWARD M. MARSZAL, Kenexis
ALISON E. MILLERICK, Independent Consultant
CASSANDRA K. MOODY, Time For Change, LLC

Transportation Research Board Staff

MICAH D. HIMMEL, Study Director (August 2021–October 2023)
THOMAS R. MENZIES, JR., Director, Consensus and Advisory Studies Division
BRITTANY BISHOP, Program Officer
TIMOTHY B. MARFLAK, Program Coordinator

PREPUBLICATION COPY—Uncorrected Proofs

v
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Copyright National Academy of Sciences. All rights reserved.

Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Reviewers

This Consensus Study Report was reviewed in draft form by individuals chosen for their diverse
perspectives and technical expertise. The purpose of this independent review is to provide candid
and critical comments that will assist the National Academies of Sciences, Engineering, and
Medicine in making each published report as sound as possible and to ensure that it meets the
institutional standards for quality, objectivity, evidence, and responsiveness to the study charge.
The review comments and draft manuscript remain confidential to protect the integrity of the
deliberative process.
We thank the following individuals for their review of this report:

SAMUEL T. ARIARATNAM, Arizona State University

KENNETH B. ARNOLD (NAE), K. Arnold Consulting, Inc.
CHRISTOPHER M. CARRIGAN, The George Washington University
THOMAS B. MARLOW, Pipeline Research Council International
RISTO M. NIEMINEN (NAS), Aalto University
MANUEL TERRANOVA, Peaxy, Inc.
MARK D. WEESNER, SMW Principle Solutions, Inc.
JEFFREY D. WIESE, Independent Consultant
MATTHEW YOUNG, ExxonMobil Pipeline Company

Although the reviewers listed above provided many constructive comments and
suggestions, they were not asked to endorse the conclusions or recommendations of this report,
nor did they see the final draft before its release. The review of this report was overseen by
CHRIS T. HENRICKSON (NAE), Carnegie Mellon University, and CRAIG E. PHILIP
(NAE), Vanderbilt University. They were responsible for making certain that an independent
examination of this report was carried out in accordance with the standards of the National
Academies and that all review comments were carefully considered. Responsibility for the final
content rests entirely with the authoring committee and the National Academies.

PREPUBLICATION COPY—Uncorrected Proofs

vii
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Copyright National Academy of Sciences. All rights reserved.

Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Acknowledgments

The committee thanks the numerous individuals who contributed to its work. The Pipeline and
Hazardous Materials Safety Administration (PHMSA) liaison for the study was Joshua Johnson,
who provided contract oversight and handled information requests from study staff. The
committee was briefed by or received information from pipeline safety regulators, accident
investigators, pipeline operator personnel, industry association representatives, subject matter
experts in risk assessment and pipeline release impact modeling, experts in benefit-cost analysis,
and pipeline safety advocates. The committee expresses its gratitude to the following individuals.
From federal, state, and foreign pipeline safety regulatory agencies: John Gale, Blaine
Keener, Alan Mayberry, Mary McDaniel, Steve Nanney, and Ronald Raunikar, PHMSA; Iain
Colquhoun and Joe Paviglianiti, Canada Energy Regulator; Jim Hosler, CAL FIRE; Thomas
James and Fred Williams, Health and Safety Executive, United Kingdom; and Philip Oakes,
National Association of State Fire Marshals.
From the National Transportation Safety Board: Alexandria Colletti and Sara Lyons.
From the U.S. Environmental Protection Agency: Tricia Edwards, Jeffrey Kimble, and Karen
Peaceman.
From pipeline operators: Dirk Ayala, Pacific Gas and Electric Company; Eddie Boone,
Duke Energy; Suzanne King and Michael O’Shea, Xcel Energy; Timothy Lajiness, DTE Energy;
and Matthew Young, ExxonMobil. From NuStar Energy, which hosted the committee for a site
visit in San Antonio, Texas: Jerry Barnard, Shay Bluntzer, Joseph Burnell, Alan Frucht, Henry
Gonzalez, Joe Lerma, Bill Mamalakis, Tricia Dietrich Petty, Shawnna Poor, Colton Shannon,
Sandeep Sharma, Larry Thompson, and Mark Trexler. From pipeline industry research and trade
association representatives: Paul Amato and Ben Kochman, Interstate Natural Gas Association of
America; Andrew Lu, American Gas Association; Thomas Marlow, Pipeline Research Council
International; Mark Piazza, American Petroleum Institute; and John Stoody, Association of Oil
Pipe Lines. From a pipeline valve supplier: Mike Manning, Emerson Automation Solutions.
Experts in risk assessment and impact modeling: Baruch Fischhoff, Carnegie Mellon
University; Jeremy Fontenault and Deborah French-McCay, RPS Group; Mike LaMont, TRC
Companies, Inc.; W. Kent Muhlbauer, WKM Consultancy, LLC; Curtis Parker, Dynamic Risk;
Shane Siebenaler, Southwest Research Institute; and Mark Stephens, MJ Stephens Consulting.
Pipeline safety analysis and advocacy: Lois Epstein, LNE Engineering and Policy, and Richard
Kuprewicz, Accufacts Inc. In the field of decision science: Lisa Robinson, Harvard University.
The committee also extends its thanks to James Eager, Pipeline Safety Trust, for the
geospatial analysis he conducted to examine demographic characteristics at transmission pipeline
incident sites (Chapter 4).
Micah D. Himmel directed the study from its beginning to October 2023. He assisted the
study committee in the preparation of this report with the assistance of Brittany Bishop. Thomas
R. Menzies, Jr., provided study guidance and oversight and managed the final stages of report
development. Timothy B. Marflak provided administrative and logistical support. Karen Febey,
Senior Report Review Officer, managed the report review process.

PREPUBLICATION COPY—Uncorrected Proofs

ix
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Copyright National Academy of Sciences. All rights reserved.

Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Contents

PREFACE xiii

ACRONYMS AND ABBREVIATIONS xv

SUMMARY 1

1 INTRODUCTION 7
Study Origin and Charge, 14
Study Approach, 15
Report Organization, 16

2 BACKGROUND ON TRANSMISSION PIPELINES AND SHUTOFF VALVES 17

U.S. Pipeline System Scope and Use Characteristics, 17
Pipelines in High Consequence Areas, 21
Pipeline Shutoff Valves, 27
Prevalence of Rupture Mitigation Valves in High Consequence Areas, 31
Summary Points, 36

3 PIPELINE SAFETY REGULATORY FRAMEWORK 38

Federal and State Regulation, 38
Integrity Management Program Requirements, 40
Guidance and Training on Integrity Management Enforcement and Compliance, 42
Valve Installation and Rupture Detection Rule, 43
Summary Points, 46

4 SAFETY REVIEW 47
Potential Consequences of a Gas or Hazardous Liquid Pipeline Release, 48
Incident History Overview, 50
Summary Points, 70
Addendum: A Lens on Equity in Decision Making, 73

5 RUPTURE MITIGATION VALVE COST AND DECISION CRITERIA FOR

EXISTING PIPELINES 79
Cost Factors and Cost Ranges for Rupture Mitigation Valve Installations, 79
Rupture Mitigation Valve Assessments in Integrity Management Requirements, 83
Summary Points, 95

6 SUMMARY, CONCLUSIONS, AND RECOMMENDATIONS 97

Synopsis of Study Approach, 99
Summary of Key Points from Chapters, 99
Conclusions, 103
Recommendations, 104
Concluding Observations, 106

PREPUBLICATION COPY—Uncorrected Proofs

xi
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

APPENDIXES
A DISSENTING VIEW OF GARY D. KENNEY 109
B TIMELINE OF RELEVANT STANDARDS AND REGULATIONS 118
C INDUSTRY SURVEY 120
D STUDY COMMITTEE BIOGRAPHICAL INFORMATION 123

PREPUBLICATION COPY—Uncorrected Proofs

xii
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Preface

Section 119 of the Protecting Our Infrastructure of Pipelines and Enhancing Safety (PIPES) Act
of 2020 directs the Secretary of Transportation to enter into an arrangement with the National
Academies of Sciences, Engineering, and Medicine (the National Academies) to do the
following:

…conduct a study of potential methodologies or standards for the installation of

automatic or remote-controlled shut-off valves on an existing pipeline in—
(1) a high consequence area (as defined in section 192.903 of title 49, Code of Federal
Regulations (or a successor regulation)) for a gas transmission pipeline facility; or
(2) for a hazardous liquid pipeline facility—
(A) a commercially navigable waterway (as defined in section 195.450 of that
title (or a successor regulation)); or
(B) an unusually sensitive area (as defined in section 195.6 of that title (or a
successor regulation)).

The statute further states that the study should take the following into consideration:

(1) methodologies that conform to the recommendations submitted by the National

Transportation Safety Board to the Pipeline and Hazardous Materials Safety
Administration and Congress regarding automatic and remote-controlled shut-off valves;
(2) to the extent practicable, compatibility with existing regulations of the
Administration, including any regulations promulgated pursuant to docket number
PHMSA–2013–0255, relating to the installation of automatic and remote-controlled
shutoff valves;
(3) methodologies that maximize safety and environmental benefits; and
(4) the economic, technical, and operational feasibility of installing automatic or remote-
controlled shut-off valves on existing pipelines by employing such methodologies or
standards.

Pipeline and Hazardous Materials Safety Administration (PHMSA) docket number 2013-
1
0255, as cited in the statute, contains rulemaking proceedings that were active when the PIPES
Act was enacted. The rulemaking proposed requirements for the installation of automatic and
remote-control shutoff valves on newly constructed and entirely replaced segments of pipelines
in accordance with a mandate by Congress in 2011 legislation. In April 2022 the rulemaking
culminated in a final rule establishing the requirement.
PHMSA and the National Academies negotiated a task statement for the study consistent
with the language in the act. It is provided in Chapter 1 of this report. While an award for the
study was executed in August 2021, work was delayed while waiting for the final rule to be
issued as needed to inform the study and allow PHMSA officials to comment in briefings.

1
Pipeline Safety: Amendments to Title 49 Code of Federal Regulations Parts 192 and 195 to Require Valve
Installation and Minimum Rupture Detection Standards.

PREPUBLICATION COPY—Uncorrected Proofs

xiii
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

To conduct the study, the National Academies appointed a committee of 10 members

with expertise in pipeline design and operations, risk analysis and management, accident
investigation, economics, public policy, and regulatory design and enforcement. This report
represents the efforts of these 10 individuals, who served uncompensated in the public interest, to
produce a consensus report. Their biographical information is provided in Appendix D.
The committee members convened multiple times during 2022 and 2023 to gather
information and deliberate over and prepare this report. Its public information-gathering sessions
included meetings with PHMSA officials to discuss the study charge, its origins and background,
and the key elements of the new rule applicable to newly constructed and entirely replaced
segments of hazardous liquid and gas transmission pipelines. The committee also met with
representatives of pipeline industry research and trade associations and individual pipeline
companies, experts in risk analysis, pipeline safety analysts and advocates, state pipeline safety
regulators and regulators from abroad, and officials from the National Transportation Safety
Board and the U.S. Environmental Protection Agency.
The study committee visited San Antonio, Texas, to meet with researchers from the
Southwest Research Institute, which has studied automatic and remote-control valves, and with a
hazardous liquid pipeline company to learn more about its processes for deciding when to install
these valves and for a tour of its control room and terminal facilities. The committee was also
briefed by experts in pipeline valve design and operations, decision science and benefit-cost
analysis, and pipeline release impacts and dispersal modeling.
The study committee wishes to thank the many individuals who participated in these
information-gathering sessions and who are identified in the Acknowledgments section of this
report.

PREPUBLICATION COPY—Uncorrected Proofs

xiv
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Acronyms and Abbreviations

ACS American Community Survey

AGA American Gas Association
ASME American Society of Mechanical Engineers

Cal-PUC California Public Utilities Commission

CFR Code of Federal Regulations
CNW commercially navigable waterway

DOJ/ENRD U.S. Department of Justice Environment and Natural Resources Division

DW drinking water resource

EFRD emergency flow restricting device

FSA Formal Safety Assessment

GAO Government Accountability Office

GIS geographic information system
GT gas transmission

HCA high consequence area

HL hazardous liquid
HPA high population area
HVL highly volatile liquid

IM integrity management

NPMS National Pipeline Mapping System

NTSB National Transportation Safety Board

OPA other populated area

OPID operator identification number
ORNL Oak Ridge National Laboratory

PG&E Pacific Gas and Electric

PHMSA Pipeline and Hazardous Materials Safety Administration
PIPES Act Protecting Our Infrastructure of Pipelines and Enhancing Safety Act
PIR potential impact radius
PSEP Pipeline Safety Enhancement Plan
PST Pipeline Safety Trust

RIA regulatory impact analysis

RMV rupture mitigation valve

PREPUBLICATION COPY—Uncorrected Proofs

xv
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

SCADA supervisory control and data acquisition

SDG&E San Diego Gas & Electric
SoCalGas Southern California Gas

TQ Training and Qualification Division

UKOOA United Kingdom Offshore Operators Association

U.S. DOT U.S. Department of Transportation

PREPUBLICATION COPY—Uncorrected Proofs

xvi
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Summary

For more than 50 years the National Transportation Safety Board (NTSB) has been
recommending that the U.S. Department of Transportation require the more widespread
installation of automatic and remote-control shutoff valves on hazardous liquid and gas
transmission pipelines. In investigating several major pipeline ruptures, NTSB concluded that the
time required for personnel to access and close manual shutoff valves had delayed isolation of
the ruptured pipe segment to prolong the release of hazardous material and cause more severe
consequences and added risks to emergency responders. As directed by Congress, the Pipeline
and Hazardous Materials Safety Administration (PHMSA) issued a new rule in April 2022
mandating the installation of these safety devices, now referred to in regulation as rupture
mitigation valves (RMVs), on newly constructed and entirely replaced segments of hazardous
liquid and gas transmission pipelines. For these pipelines, RMVs must be installed at specified
spacings unless an operator can demonstrate that an alternative technology, including a manual
valve, can meet a 30-minute rupture isolation performance standard and that an RMV installation
would be cost-prohibitive or operationally or technically infeasible.
In commenting on the new rule as it was being proposed, NTSB raised concerns that the
required installation of RMVs, or the demonstrated ability to meet a performance standard for
timely rupture isolation, would not apply to existing pipelines, especially when segments pass
through and near populated and environmentally sensitive areas, defined in regulation as “high
consequence areas” (HCAs). While RMVs are not required for pipelines installed prior to the
issuance of the new rule, PHMSA obligates pipeline operators to evaluate the need for them as
part of their integrity management (IM) programs required for pipelines that are located in or that
could affect HCAs. Operators are required to implement IM programs that include risk analyses
and evaluations of safety measures that can reduce the likelihood of ruptures and other failures
and limit the severity of their consequences when they occur. The design of the IM regulations is
intended to ensure that operators account for the risks specific to their pipelines and make
deliberate and documented decisions about their risk management choices. The risk assessments
should include evaluations of whether RMVs should be installed for added safety when
considering a series of factors listed in the regulations, including the timeliness of a pipeline’s
emergency shutdown capabilities. PHMSA and state inspectors are charged with reviewing each
operator’s IM program documents to verify the completeness and quality of the risk analyses and
the RMV evaluations.
In passing the Protecting Our Infrastructure of Pipelines and Enhancing Safety (PIPES)
Act of 2020, Congress directed PHMSA to commission this study to assess regulatory standards
and criteria for deciding when automatic and remote-control shutoff valves (i.e., RMVs) should
be installed on existing hazardous liquid and gas transmission pipelines in HCAs. 2 To fulfill its
charge, the study committee reviewed the recent history of pipeline incidents involving HCAs,
including findings and recommendations by NTSB and PHMSA following investigations of
major pipeline ruptures. The committee consulted and surveyed pipeline operators to estimate the
prevalence of RMVs, obtain information on RMV installation costs, and understand how
operators make choices about when to install RMVs in HCAs and other populated locations. The
2
While the study request in the PIPES Act does not refer to RMVs, the report uses this term when referring to
automatic and remote-control shutoff valves. Such valves may serve functions in addition to rupture mitigation,
including routine operational purposes.

PREPUBLICATION COPY—Uncorrected Proofs

1
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

committee reviewed the regulatory rationale for IM programs and the direction and guidance
provided to operators on their implementation, including efforts by PHMSA to strengthen
implementation guidance in response to NTSB recommendations and the agency’s own findings
of shortcomings in the quality and execution of some IM programs. The committee also
reviewed the design of PHMSA’s new rule mandating the installation of RMVs on newly
constructed and entirely replaced segments of pipelines. PHMSA has not taken a position on the
installation of RMVs on existing pipelines. Existing statutory language, however, can be
interpreted as precluding the establishment of new regulatory standards for their installation
when applied to existing pipelines. 3
Based on this review, the committee was asked to make recommendations, as
appropriate, on regulatory or statutory changes that should be considered concerning decisions
about when to install RMVs on existing hazardous liquid and gas transmission pipelines in
HCAs and other populated areas. Key study conclusions and recommendations follow.

CONCLUSIONS

• The long-standing and widespread use of rupture mitigation valves (RMVs) by

pipeline operators who have judged them to be beneficial for operations and safety
demonstrates that their use is technically and operationally feasible under many
circumstances and across a wide range of conditions. While RMVs can be installed
on pipelines mainly by changing the actuators of existing manual valves, the varied
conditions and circumstances that exist across pipeline systems mean that retroactive
RMV installations can differ greatly in feasibility, complexity, and cost, as well as in
the benefits they can confer.
• There is a strong rationale for the integrity management (IM) process and its
obligations on operators for active risk management to make rupture mitigation valve
installation choices because of the wide variability among pipelines in terms of where
they are sited and their conditions and circumstances. However, the efficacy of the
approach depends on operators being capable and diligent in their implementation of
required IM processes with sufficient direction, guidance, and oversight from
regulators.
• As currently written for both hazardous liquid and gas transmission pipelines, the
integrity management regulations governing operator risk assessments are short on
direction and guidance on how the need for a rupture mitigation valve should be
evaluated and decided by operators, despite requiring operators to undertake such
evaluations.
• The integrity management process depends on operators using sound risk modeling
and analysis methods for informing their prevention and mitigation strategies in high
consequence areas. These methods must account for the location-specific
probabilities of different types of failures occurring, potential consequences ensuing,
and alternative measures being effective in failure prevention and consequence
mitigation. By using quantitative models that represent risk and uncertainty in a
probabilistic manner, the operator will be in a better position to assess the risk
reduction potentials of alternative safety measures at any given site. However, risk
3
This report notes that Title 49 USC § 60104(b) states, “[A] design, installation, construction, initial inspection,
or initial testing standard does not apply to a pipeline facility existing when the standard is adopted.”

PREPUBLICATION COPY—Uncorrected Proofs

2
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

modeling capabilities vary among operators, who are not required to use quantitative
models that can provide such probability-based output for assessing the risk reduction
potential of RMVs and other safety measures.
• In deciding on the use of alternative safety measures with differing potentials for risk
reduction, including rupture mitigation valves (RMVs) at specific locations, operators
need to be able to determine the array of benefits and costs of each measure,
including benefits to the public. However, standardized practices for estimating
benefits and costs for pipeline risk management do not exist, raising questions about
how operators are establishing the need for RMVs and, more generally, how they are
prioritizing and making choices about all candidate safety measures with the public
interest in mind.
• Because of the rigor, expertise, and data quality required, risk assessments using
quantitative modeling and economic analyses of the benefits and costs of alternative
safety measures can be challenging for operators to implement and for inspectors to
assess for quality. Operators and inspectors lack guidance and support on the
application of requisite analytic methods, including opportunities for training.

While all 10 committee members agreed with the conclusions above, 9 of the 10
members also agreed on the following conclusion. The reasoning of the one committee member
who disagreed with the conclusion is provided in Appendix A.

• A broadly applicable requirement for the installation of rupture mitigation valves

(RMVs), such as in the rule for newly constructed and entirely replaced segments of
pipelines, would not be advisable for existing hazardous liquid and gas transmission
pipelines in high consequence areas. While newly constructed and entirely replaced
segments of pipelines can be designed for RMVs, a similar broad-based requirement
that is retroactively applied to existing pipelines would not be advisable because the
available evidence on costs and benefits attributed to the installation of RMVs varies
widely as a function of factors such as site-specific pipeline characteristics, land use
patterns, the built environment, ecological sensitivity, topography, and commodity.

RECOMMENDATIONS

In the view of the 9 of 10 committee members who continue to believe that operator decisions
about when to install RMVs on existing pipelines in HCAs should be made in IM programs, the
following steps are warranted to strengthen the quality and execution of operator IM processes
and their verification by safety inspectors.

Recommendation 1: To make obligations for rupture mitigation valve (RMV) evaluations

well understood, the Pipeline and Hazardous Materials Safety Administration (PHMSA)
should revise and supplement the integrity management regulations and accompanying
guidance to ensure that the requirements for RMV analyses are clear to operators and
inspectors. For this purpose, PHMSA should do the following:
• Make the language in the regulations less equivocal about whether and under
what conditions an operator should evaluate an RMV as an added safety
measure.

PREPUBLICATION COPY—Uncorrected Proofs

3
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

• Where the regulations call for operators to install RMVs when they are
“needed” and an “efficient means” of protection on the basis on the evaluations,
define these terms or replace them to leave less room for varied interpretation.
• In regulations and guidance documents, establish criteria, metrics, and methods
for operators to consult and use when assessing the set of factors that they are
obligated to consider when evaluating RMVs, such as pipeline shutdown speed.
• Ensure that regulatory direction and guidance are clear in emphasizing the
importance of operators documenting the evaluation methods and criteria used
in their RMV evaluations, especially when the results do not favor or do not lead
to the installation of an RMV.

Regarding this recommendation for PHMSA to establish evaluation criteria, metrics, and
methods for operators to use when evaluating factors such as a pipeline’s shutdown speed, some
committee members believe that PHMSA should require operators to evaluate on the basis of a
prescribed metric, such as the 30-minute isolation time that must now be satisfied by newly
constructed and entirely replaced segments of pipelines. The results from the operator’s
evaluation using the prescribed metric would need to be documented and thus could be readily
noted by federal and state inspectors when reviewing an operator’s IM program and the results
from the RMV evaluations. While statutory restrictions may preclude PHMSA from compelling
RMV installations on existing pipelines when the evaluation metric is not satisfied, the agency
could compile the information gleaned from these inspector-reviewed RMV evaluations for
insight into how much of the pipeline system could be at risk for slow or delayed rupture
isolation. Some other committee members, however, do not favor such a prescribed evaluation
metric out of concern that a single value would not be applicable to many circumstances and
could be used by operators to justify decisions not to install RMVs when public interests may
warrant their use.

Recommendation 2: To motivate more diligence, rigor, and transparency in the conduct of

rupture mitigation valve (RMV) evaluations and more focused and critical inspector
reviews of them, the Pipeline and Hazardous Materials Safety Administration should do
the following:
• Update enforcement guidance to establish criteria, methods, and benchmarks
for federal and state inspectors to use during integrity management document
reviews to enable more critical reviews of RMV evaluations and operator
reasons for not installing an RMV.
• Require operators to provide inspectors with documentation describing their
RMV evaluation methods and criteria well in advance of inspections to allow for
more careful and thorough reviews.
• Subject a selection of operators to post-inspection audits of their RMV
evaluation methods and their execution to monitor and assess the quality of the
analyses, understand inspector performance in conducting thorough reviews,
and judge the effectiveness of regulatory direction and enforcement guidance.
• Choose operators who do not install RMVs as priority candidates for such
audits.

PREPUBLICATION COPY—Uncorrected Proofs

4
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Recommendation 3: To further the pipeline industry’s use of quantitative models for

integrity management (IM) risk analysis as well as sound and consistent methods for
establishing the benefits of safety measures, the Pipeline and Hazardous Materials Safety
Administration should do the following:
• Require the use of quantitative risk modeling by all pipeline operators for their
IM programs, except when an operator can make a compelling justification for
the use of another risk assessment method.
• Provide the pipeline industry with practitioner-oriented technical guidance for
conducting state-of-the-art pipeline risk analyses using quantitative models and
for estimating the benefits of alternative risk reduction measures, including
public safety benefits and interests.
• Encourage recognized standard-setting organizations, such as the American
Society of Mechanical Engineers and American Petroleum Institute, to enhance
their standards for hazardous liquid and gas transmission pipelines by including
more technical guidance for using quantitative risk models and for obtaining the
data needed to develop them.
• Coordinate with standard-setting organizations and subject matter experts to
develop a training curriculum and offer coursework for practitioners to apply
the technical guidance for risk modeling and benefits estimation, while also
including elements in training and qualification programs for state and federal
inspectors.

Regarding Recommendations 2 and 3, some committee members believe that PHMSA

should advise operators on the specific methods they should use in making choices among
alternative risk reduction measures. These committee members favor the use of benefit-cost
analysis to establish the net benefits of alternatives coupled with requirements that operators
document their analytic methods and results for inspectors to review. They believe operators are
now making such net-benefit calculations, formally or informally, but that some may be
construing safety and risk reduction benefits on a limited basis that does not fully account for the
societal interests as one would expect from a sound and compliant IM program. Although all
committee members share a concern that operators may not be considering societal benefits and
interests fully when deciding on the use of RMVs and other risk reduction measures, some
members do not endorse making a net-benefit calculus an explicit standard for decision making.
Those members want to be sure that operators are not dissuaded from making decisions that
favor RMVs when all potential benefits cannot be enumerated, such as when the choice advances
equity or promises other public benefits sufficient to justify an installation.
In the committee’s view, it is fair and reasonable to expect all pipeline operators to use
quantitative risk modeling for their IM programs. A large share of HCA mileage is managed by a
relatively small number of major operators likely to have the resources and technical capacity to
employ such methods, and smaller operators can seek outside assistance. The recommended
technical guidance and training should help all operators, including smaller companies whose
obligations to meet the requirement could be phased in.

PREPUBLICATION COPY—Uncorrected Proofs

5
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

CONCLUDING OBSERVATIONS

Nine of the committee’s 10 members believe the advice offered above, if followed, has the
potential to strengthen operator IM decisions about when to install RMVs and PHMSA’s ability
to ensure sound decisions. Not similarly confident that improvements to IM processes will be
made and result in operators making decisions about RMVs that align more closely with the
public interest, one committee member proposes alternative approaches based on reasoning
offered in Appendix A. All other committee members agree, however, that if PHMSA is not
successful in furthering the recommended actions or if operators do not implement them
effectively, then alternative approaches may be warranted, including the introduction of
regulatory standards stipulating when RMVs should be installed.

PREPUBLICATION COPY—Uncorrected Proofs

6
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

1
Introduction

In the United States, large-diameter transmission pipelines transport gas and liquid commodities
in large volumes over long distances. The country’s network of transmission pipelines consists of
about 300,000 miles of gas pipeline and 230,000 miles of hazardous liquid pipeline. Gas
transmission pipelines primarily transport natural gas but also carry other flammable, toxic, and
corrosive gases; hazardous liquid pipelines transport a variety of liquid products, including crude
oil, liquid carbon dioxide, refined petroleum products, and highly volatile liquids that include
anhydrous ammonia and the hydrocarbons propane, butane, and natural gas liquids.
Transmission pipelines are one of the safest and most efficient modes of bulk freight
transportation. However, when their integrity is compromised, the consequences can be
catastrophic because of the hazardous nature and high volumes of the commodities being
transported under pressure and the frequency with which pipelines traverse populated and
environmentally sensitive areas. When a pipeline rupture occurs, it can lead to an explosion, fire,
asphyxiation hazard, or discharge of toxic material into the environment. The National
Transportation Safety Board (NTSB) has been investigating major pipeline ruptures and their
causes for more than 50 years, including factors contributing to the severity of outcomes.
Following some its earliest investigations, NTSB concluded that faster actions to isolate the
ruptured pipeline segment would have reduced the consequences by limiting the release of
hazardous material. These findings led NTSB in 1971 to recommend that the U.S. Department of
Transportation (U.S. DOT) conduct studies for the purpose of developing standards for the
timely isolation and shutdown of ruptured gas and hazardous liquid pipelines. 4
In the years prior to NTSB’s recommendation, U.S. DOT had issued regulations
establishing location requirements for shutoff valves on new hazardous liquid and gas
transmission pipelines. In the case of gas transmission pipelines, the regulations stipulated that
the valves be spaced at intervals depending on the density of the population where the pipeline
was located. 5 The regulations designated “class” locations from 1 to 4, with 1 representing rural
locations and 4 representing densely populated areas and based on the number of buildings and
dwellings in the area. 6 The maximum valve spacing was set at 10 miles, 7.5 miles, 4 miles, and
2.5 miles, respectively for Classes 1, 2, 3, and 4. In the case of hazardous liquid pipelines, the
regulations were less prescriptive with regard to valve locations, requiring their installation on
each side of water crossings but giving the operator discretion to install them in other locations
that would minimize damage from releases. For both types of pipelines, the regulations did not
define the specific type of shutoff valve that must be installed or its method of activation during
an abnormal or emergency event, whether by manual, automatic, or remote operation.
During the 1980s and 1990s, NTSB continued to make recommendations for U.S. DOT
to establish standards for the timely shutdown of pipeline segments in emergencies, including
recommendations for the installation of automatic and remote-control shutoff valves to
4
NTSB. 1971. Special Study of the Effects of Delay in Shutting Down Failed Pipeline Systems and Methods
for Providing Rapid Shutdown. Report NTSB-PSS-71-1. Washington, DC.
5
In August 1970, U.S. DOT issued standards for gas transmission pipelines that established new definitions for
class locations (35 Fed. Reg., 13248–13276, August 19, 1970).
6
These designations were previously included in the American Society of Mechanical Engineers International
standard “Gas Transmission and Distribution Piping Systems” (ASME B31.8).

PREPUBLICATION COPY—Uncorrected Proofs

7
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

supplement or replace manually operated valves. Whereas manual valves must be closed by a
person at the site of the valve by turning a wheel, toggling a switch, or pushing a lever, valves
operated remotely can be closed by personnel from a control center following notification of a
rupture or indications of a release from sensors monitoring pressure levels and flow rates.
Automatic shutoff valves deploy on their own when designated pressure or flow-rate thresholds
are sensed. 7
Following its investigation of a ruptured pipeline that released gasoline in Mounds View,
Minnesota, in July 1986, NTSB called on U.S. DOT to require the installation of remote-control
valves on hazardous liquid pipelines. 8 In this incident, which led to two fatalities after the
gasoline ignited in a residential area, the control room personnel who identified the rupture had
to dispatch technicians to close the valve manually, a process that took 1 hour and 40 minutes.
NTSB maintained that if the control room personnel had been able to close the valve remotely,
the amount of product released into the residential area would have been substantially reduced.
Less than a decade later, in March 1994, NTSB investigated a gas transmission pipeline
explosion in Edison, New Jersey. 9 In this case, the operator took 2.5 hours to close a manual
valve while eight apartment buildings burned and 1,500 people were evacuated. In its report,
NTSB again called on U.S. DOT to establish requirements for automatic or remote-control
shutoff valves in populated and environmentally sensitive areas.
In early 2000, U.S. DOT issued a rulemaking notice proposing a new set of regulations
for hazardous liquid pipelines intended to address a number of safety and environmental
concerns, including those raised by NTSB pertaining to the timely isolation of ruptures and the
use of automatic and remote-control shutoff valves. 10 The notice proposed the establishment of
regulations obligating operators to assess, repair, and validate through comprehensive analyses
the integrity of pipelines that could affect populated locations, areas unusually sensitive to
environmental damage, and commercially navigable waterways, which were defined to be high
consequence areas (HCAs). Finalized in December 2000, 11 the integrity management (IM) rule
required hazardous liquid pipeline operators to identify all pipeline segments located in or that
could affect an HCA, evaluate the entire range of threats to their integrity, assess the associated
risks, and implement other preventive and mitigative measures as appropriate based on the
analyses and in addition to measures already required by regulation.
The hazardous liquid pipeline IM rule contains examples of preventive and mitigative
measures that should be candidates for consideration by operators, including automatic and
remote-control shutoff valves, which are referred to as emergency flow restricting devices
(EFRDs). The rule lists factors that an operator should consider when making such decisions,
including the swiftness of leak detection and pipeline shutdown capabilities, but it does not
stipulate the use of specific and measurable criteria for these evaluations to inform operators’
decisions, such as by specifying a maximum shutdown time or expected product release value.
The reference to EFRDs as a candidate mitigative measure, rather than a requirement, is
consistent with the IM rule’s overall approach that allows operators to make choices about the

7
Another type of valve that activates automatically is a check valve, which will block the reverse flow of
product when forward flow rates or pressures are reduced below thresholds (e.g., in the event of a rupture).
8
NTSB. 1986. Pipeline Accident Report: Williams Pipe Line Company Liquid Pipeline Rupture and Fire,
Mounds View, Minnesota, July 8, 1986. Report PB87-916502. Washington, DC.
9
NTSB. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New
Jersey, March 23, 1994. Pipeline Accident Report PB-95-916501. Washington, DC.
10
65 Fed. Register, 21695–21710. April 24, 2000.
11
65 Fed. Register, 75378–75411, December 1, 2000.

PREPUBLICATION COPY—Uncorrected Proofs

8
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

implementation of risk management measures that exceed regulatory minimums based on their
own risk assessment and decision-making processes and pipeline-specific conditions.
In commenting on the IM rule when it was first proposed, NTSB raised concerns about
the capability of operators to apply risk management principles to determine the need for
additional protective measures and recommended that the rule include more minimum criteria for
decision making. 12 Other commenters, including the U.S. Environmental Protection Agency,
maintained that if the rule requires an operator to conduct a risk assessment to determine whether
an EFRD or other protective measure is needed, then it should prescribe a specific risk
assessment protocol. In issuing the final rule, U.S. DOT did not establish minimum criteria or
assessment protocols for deciding when to install an EFRD but noted that the adequacy of an
operator’s analysis and the appropriateness of an operator’s risk reduction decisions would be
subject to review during inspections. 13
In 2003, U.S. DOT issued a similar IM rule for gas transmission pipelines located in
HCAs. 14 Since the greatest risks from ruptures by these pipelines are fires and explosions, the
HCAs were defined as highly populated areas and sites where people regularly gather or live. In
the same manner as the hazardous liquid IM rule, the gas IM rule obligated an operator, informed
by threat assessments and risk analyses, to take additional measures beyond those already
required in regulation to prevent and mitigate the consequences of a pipeline failure in an HCA.
However, unlike the rule for hazardous liquid pipelines, the gas rule required operators to make a
specific determination of whether automatic shutoff valves or remote-control valves would be an
“efficient means” of adding protection to an HCA. While the rule did not define or provide
criteria on how this evaluation of efficiency should be performed or its outcome assessed, it
stipulated that the results should be documented for review by inspectors.
When commenting on the proposed gas pipeline IM rule, this time NTSB stated that it
generally supported the rule’s key elements, including the obligations for operators to conduct
threat and risk assessments to inform risk management strategies. Furthermore, NTSB revisited
its recommendation (P-95-1) following the Edison, New Jersey, pipeline rupture that called on
U.S. DOT to require operators to install automatic or remote-control shutoff valves on gas main
lines in urban and environmentally sensitive areas. In presuming that the gas rule’s requirement
for operators to determine whether these safety devices would be an efficient means of adding
protection would increase their use, NTSB classified the 1995 Edison recommendation as being
“Closed—Acceptable Action.”
NTSB revisited this conclusion a few years later when on September 9, 2010, a 30-inch-
diameter segment of a gas transmission pipeline ruptured in a residential area in San Bruno,
California. The escaping natural gas ignited, resulting in a fire that destroyed 38 homes and
damaged 70 others. Eight people were killed, many others were injured, and residents were
evacuated from the area. In investigating the incident, NTSB determined that it took the operator
95 minutes to stop the flow of gas and isolate the pipe segment, as dispatchers and qualified
technicians were delayed in locating the rupture site and accessing and closing the manual
valves. 15 Investigators concluded that the delay in isolating the rupture and stopping the flow of
gas had contributed to the extent and severity of property damage and increased risks to residents

12
65 Fed. Register, 75393, December 1, 2000.
13
Ibid.
14
68 Fed. Register, 69778–69837, December 15, 2003.
15
NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San
Bruno, California, September 9, 2010. Report PB2011-916501. Washington, DC.

PREPUBLICATION COPY—Uncorrected Proofs

9
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

and emergency responders. As a result, NTSB recommended that U.S. DOT’s Pipeline and
Hazardous Materials Safety Administration (PHMSA) (which assumed responsibility for the
federal pipeline safety program in 2004) amend its IM regulations to require the use of automatic
or remote-control shutoff valves on gas transmission pipelines in HCAs and in Class 3 and 4
locations. 16 In doing so, NTSB tempered its earlier confidence in the IM rule, expressing concern
about a lack of regulatory criteria and guidance on how operators should determine the need for
the valves when considering the evaluation factors cited in the rule, including criteria for
assessing the swiftness of pipeline shutdown capabilities.
In passing the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, a
year after the San Bruno pipeline rupture, Congress mandated the use of automatic or remote-
control shutoff valves, or equivalent technologies, on newly constructed or entirely replaced
segments of hazardous liquid and gas transmission pipeline segments when economically,
technically, and operationally feasible. 17 In compliance, PHMSA issued a final rule in April
2022 requiring operators of gas transmission and hazardous liquid pipelines to install such
valves—collectively defined as rupture mitigation valves (RMVs)—on all newly constructed or
entirely replaced segments of pipelines with diameters of 6 inches or more. 18 In doing so, the
rule established a minimum performance standard for an RMV to enable isolation of a rupture in
30 minutes or less (when measured from an operator’s identification of a rupture after
notification of a potential rupture). The rule affords operators the ability to propose the use of
manual valves as an alternative equivalent technology but only if it can meet the 30-minute
standard and the operator can demonstrate that an RMV is technically, operationally, or
economically infeasible. The rationale for the 30-minute standard, which was developed after
consultations with pipeline advisory committees, is provided in the final rule along with
examples of circumstances that could affect feasibility.
In commenting on the final rule, NTSB maintained that the rule’s scope of coverage does
not satisfy the 2011 San Bruno recommendation because it applies only to newly constructed or
entirely replaced segments of transmission pipelines and would not apply retroactively to
existing pipelines. 19 At the same time, NTSB noted that in a January 22, 2020, response to
another NTSB safety recommendation, 20 PHMSA had maintained that it could only issue
advisory bulletins for existing pipeline facilities due to a “nonapplication” clause in Title 49 USC
§ 60104(b) that states the following: “[A] design, installation, construction, initial inspection, or
initial testing standard does not apply to a pipeline facility existing when the standard is
adopted.” While stating that it believed PHMSA does have the authority to require the
installation of RMVs on existing pipelines, NTSB requested that Congress make this authority
explicit by exempting RMV installations from the nonapplication clause.
To be consistent with the terminology of the new rule, “RMV” is used in the remainder
of this report when referring collectively to automatic shutoff valves, remote-control shutoff
valves, and EFRDs.

16
NTSB Recommendation P-11-11.
17
Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, section 4, 2012.
https://www.gpo.gov/fdsys/pkg/PLAW-112publ90/pdf/PLAW-112publ90.pdf.
18
68 Fed. Register, 620940–620992, April 8, 2022.
19
NTSB. 2022. Evaluation of the US Department of Transportation 2021 Report to Congress on the Regulatory
Status of the Safety Issue Areas on the National Transportation Safety Board’s Most Wanted List.
https://www.ntsb.gov/news/Documents/NTSB%20Evaluation%20of%20DOT%202021-22%20MWL%20Final.pdf.
20
Official correspondence from Howard R. Elliott, PHMSA Administrator, to NTSB regarding NTSB
Recommendation P-19-014, January 22, 2020.

PREPUBLICATION COPY—Uncorrected Proofs

10
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Box 1-1 provides a timeline summary of the pipeline incidents and NTSB
recommendations cited above. It also contains a selection of relevant studies, U.S. DOT
rulemakings, and congressional directives on RMVs since the 1960s. Appendix B provides a
more detailed timeline.

BOX 1-1
Federal Activities and Actions Related to Pipeline Shutoff Valves, 1968–2022

The following is a timeline of notable federal government activities and actions related to the
installation of automatic and remote-control shutoff valves on hazardous liquid and gas
transmission pipelines from 1968 to 2022.

1968–1972: U.S. DOT issues regulations and minimum federal safety standards for the
design, installation, operation, and maintenance of hazardous liquid and gas transmission
pipelines. These include American Society of Mechanical Engineers (ASME) standards B31.4
and B31.8, which require the installation of location-specific valves (e.g., both sides of a major
river crossing) on hazardous liquid pipelines and mainline sectionalizing valves with specific
spacings (e.g., shorter spacing between valves in high population areas) on gas transmission
pipelines.a

1971: After a series of gas and hazardous liquid pipeline failures in the late 1960s, NTSB
recommends that U.S. DOT conduct a study to develop standards for the rapid shutdown of
failed pipelines. The NTSB report notes that much of the equipment (i.e., automatic and
remote-control valves) available on the market at the time appears feasible for this purpose.
The report also notes that the cost to install these valves varies greatly; however, the study
concludes that the cost of the safety measures may be justified when they offer a greater
degree of security for those living near pipelines and the potential to save lives.b

1987: In its report following an investigation of the 1986 rupture in Mounds View, Minnesota,
NTSB recommends that U.S. DOT require the installation of remotely operated valves on
hazardous liquid pipelines.c

1988: Congress directs U.S. DOT to undertake a study of the safety, cost, feasibility, and
effectiveness of requiring the installation of automatic and remote-control valves on existing
and future pipeline systems in varying circumstances and locations.d

1991: U.S. DOT releases a report on the effectiveness of EFRDs, which notes that it can be
feasible to convert manually operated valves in rural and urban areas to remote operation.
The report also notes that the cost-effectiveness of conversions cannot be determined
because a compilation of valve locations on existing pipelines is not available.e

1992: Congress directs U.S. DOT to survey and assess the effectiveness of EFRDs on
hazardous liquid pipelines to minimize product release volumes. Within 2 years of completing
the survey and assessment, U.S. DOT is required to issue regulations defining the
circumstances under which operators must use EFRDs.f

1994: After the failure and subsequent explosion of a gas transmission pipeline in Edison,
New Jersey, NTSB recommends that U.S. DOT expedite requirements for automatic and
remote-control shutoff valves to be installed on high-pressure pipelines in urban and
environmentally sensitive areas.g

PREPUBLICATION COPY—Uncorrected Proofs

11
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

1999: U.S. DOT issues a report on the installation of remote-control shutoff valves on gas
transmission pipelines. The report concludes that it is feasible to convert manual valves to
remote-control valves, as the equipment necessary exists and has been used successfully for
years. The report also notes that remote-control shutoff valves are effective and have not
experienced issues with valve closure, citing no documented cases in which valves had
malfunctioned to cause them to close unexpectedly or fail to close on command. However,
the report concludes that “the quantifiable costs far outweigh the quantifiable benefits from
installing RCVs [remote-control valves].”h

2001: U.S. DOT issues a final rule titled “Pipeline Integrity Management in High Consequence
Areas (Hazardous Liquid Operators with 500 or More Miles of Pipeline).” The rule sets
requirements for pipeline operators to develop IM programs for pipeline segments located
within or that could affect HCAs. Operators are required to evaluate whether the installation of
EFRDs is needed to reduce the consequences of a release in an HCA. In locations where the
operator deems that an EFRD is needed, the operator is required to install the device.i

2004: U.S. DOT issues a final rule titled “Pipeline Integrity Management in High Consequence
Areas (Gas Transmission Pipelines),” which has a similar set of rules for gas transmission
pipeline IM programs as those applicable to hazardous liquid pipelines. The rule requires
operators to evaluate automatic and remote-control shutoff valves to determine whether they
provide an efficient means of protection but does not establish specific evaluation criteria to
be followed by operators in making the assessment.j

2010: After the failure and explosion of a natural gas transmission pipeline in San Bruno,
California, NTSB recommends that U.S. DOT’s PHMSA require the installation of automatic
or remote-control shutoff valves on high-pressure pipelines in HCAs.k

2011: After significant incidents in San Bruno and in Marshall, Michigan, Congress directs
PHMSA to enact regulations requiring the installation of automatic and remote-control valves
(or equivalent technology) on newly constructed and entirely replaced segments of pipelines
in HCAs.l

2012: PHMSA holds a 2-day workshop to understand the application of automatic and
remote-control valves on newly constructed and entirely replaced segments of pipelines.
Industry representatives raise feasibility issues, including concerns about the availability of
space required to install actuators; systems to power the actuators; and requisite monitoring,
communication, and control systems. Representatives of valve and actuator manufacturers
note that advances in technology, especially in the areas of power requirements and
communication, can address many of these concerns. Various industry representatives also
note high costs for valve installation and questioned whether the costs would be justified by
the benefits conferred.m

2012: Oak Ridge National Laboratory issues a report to PHMSA that includes evaluations of
the technical, operational, and economic feasibility of retrofitting or installing automatic and
remote-control valves on pipelines. The primary concern regarding technical and operational
feasibility is related to the space required to retrofit a valve, including the space required for
the actuator, the power supply, and related monitoring and communications equipment. The
report also concludes that studies based on risk analyses for worst-case release scenarios
demonstrate that it is economically feasible, with a positive benefit-cost ratio, to install the
valves on newly constructed and entirely replaced segments of pipelines. However, the report

PREPUBLICATION COPY—Uncorrected Proofs

12
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

also cautions that operators must consider site-specific variables when determining whether a
specific valve has a positive net benefit.n

2013: The U.S. Government Accountability Office issues a report recommending augmented
guidance to operators on the installation of automatic shutoff valves, adoption of a
performance-based approach to reducing incident response times, and improved consistency
in setting risk-based intervals for pipeline integrity re-assessments.o

2015: NTSB conducts a study of the implementation of IM programs by gas transmission

pipeline operators. The study finds no evidence to show that the overall occurrence of gas
transmission pipeline incidents has declined since the enactment of the IM rule.p

2019: In a testimony to Congress, NTSB reiterates its recommendation after the San Bruno
investigation for PHMSA to require the use of automatic and remote-control valves on existing
pipelines in HCAs.q

2022: PHMSA issues a final rule that establishes a new set of requirements for newly
constructed and entirely replaced segments of pipelines, including the installation and
spacing requirements of automatic and remote-control valves (or alternative equivalent
technology), referred to as RMVs. The rule sets a minimum performance standard for an
RMV that it should enable isolation of a rupture in 30 minutes or less after the operator has
confirmed that a rupture has occurred.r
a
PHMSA. Archived Pipeline Rulemakings: 1968–1972.
https://www.phmsa.dot.gov/rulemakings/archived-rulemakings/archived-pipeline-rulemakings-1968-
1972.
b
NTSB. 1971. Special Study of Effects of Delay in Shutting Down Failed Pipeline Systems and
Methods of Providing Rapid Shutdown. https://www.ntsb.gov/safety/safety-
studies/Documents/PSS7101.pdf.
c
NTSB. 1987. Pipeline Accident Report: Williams Pipe Line Company Liquid Pipeline Rupture and
Fire–Mounds View, Minnesota.
https://www.ntsb.gov/investigations/AccidentReports/Reports/PAR8702.pdf.
d
Public Law 100-561, Sections 305 and 306, 1988, https://www.govinfo.gov/link/statute/102/2817.
e
Research and Special Programs Administration. 1991. Emergency Flow Restricting Devices
Study. https://www.regulations.gov/document/PHMSA-2015-0082-0004.
f
Public Law 102-508, Section 212, 1992, https://www.govinfo.gov/content/pkg/STATUTE-
106/pdf/STATUTE-106-Pg3289.pdf.
g
NTSB. 1994. Pipeline Accident Report: Texas Eastern Transmission Corporation Natural Gas
Pipeline Explosion and Fire—Edison, New Jersey.
https://www.ntsb.gov/investigations/AccidentReports/Reports/PAR9501.pdf.
h
Research and Special Programs Administration. 1999. Remotely Controlled Valves on Interstate
Natural Gas Pipelines. https://rosap.ntl.bts.gov/view/dot/16918.
i
Research and Special Programs Administration. 2001. Pipeline Safety: Pipeline Integrity
Management in High Consequence Areas (Hazardous Liquid Operators with 500 or More Miles of
Pipeline). https://www.federalregister.gov/documents/2000/12/01/00-29570/pipeline-safety-pipeline-
integrity-management-in-high-consequence-areas-hazardous-liquid-operators.
j
Research and Special Programs Administration. 2004. Pipeline Safety: Pipeline Integrity
Management in High Consequence Areas (Gas Transmission Pipelines).
https://www.federalregister.gov/documents/2003/12/15/03-30280/pipeline-safety-pipeline-integrity-
management-in-high-consequence-areas-gas-transmission-pipelines.
k
NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and
Fire—San Bruno, California. https://www.ntsb.gov/investigations/accidentreports/reports/par1101.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

13
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

l
Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, Section 4, 2012.
https://www.gpo.gov/fdsys/pkg/PLAW-112publ90/pdf/PLAW-112publ90.pdf.
m
PHMSA. 2012. Improving Pipeline Leak Detection System Effectiveness and Understanding the
Application of Automatic/Remote Control Valves.
https://primis.phmsa.dot.gov/meetings/MtgHome.mtg?mtg=75.
n
Oak Ridge National Laboratory. 2012. Studies for the Requirements of Automatic and Remotely
Controlled Shutoff Valves on Hazardous Liquids and Natural Gas Pipelines with Respect to Public and
Environmental Safety. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/technical-
resources/pipeline/16701/finalvalvestudy.pdf.
o
U.S. Government Accountability Office. 2013. Pipeline Safety: Better Data and Guidance Could
Improve Operators’ Responses to Incidents. https://www.gao.gov/assets/gao-13-284t.pdf.
p
NTSB. 2015. Integrity Management of Gas Transmission Pipelines in High Consequence Areas.
https://www.ntsb.gov/safety/safety-studies/documents/ss1501.pdf.
q
NTSB. 2019. Testimony of the Honorable Jennifer Homendy Before the Subcommittee on
Railroads, Pipelines, and Hazardous Materials—United States House of Representatives.
https://www.congress.gov/116/meeting/house/109198/witnesses/HHRG-116-PW14-Wstate-HomendyJ-
20190402.pdf.
r
PHMSA. 2022. Pipeline Safety: Safety of Gas Transmission Pipelines: Repair Criteria, Integrity
Management Improvements, Cathodic Protection, Management of Change, and Other Related
Amendments. https://www.federalregister.gov/documents/2022/08/24/2022-17031/pipeline-safety-
safety-of-gas-transmission-pipelines-repair-criteria-integrity-management.

STUDY ORIGIN AND CHARGE

In 2020, Congress passed the Protecting Our Infrastructure of Pipelines and Enhancing Safety
Act of 2020, also known as the PIPES Act of 2020. Section 119 directs U.S. DOT to commission
a study by the National Academies of Sciences, Engineering, and Medicine (the National
Academies) to examine the regulatory standards that govern decisions about the installation of
automatic and remote-control shutoff valves on existing gas transmission and hazardous liquid
pipelines located in HCAs.
To conduct the study, which is the subject of this report, the National Academies
convened (following procedures explained in the Preface) an independent committee of experts
in pipeline design and operations, risk analysis and management, accident investigation,
economics, public policy, and regulatory design and enforcement. The study committee’s charge
(or Statement of Task) was drawn from a legislative directive and is provided in Box 1-2. It calls
for the committee to review existing methodologies, standards, and regulatory criteria for
deciding when and where an automatic or remote-control shutoff valve, or equivalent EFRD,
should be installed on an existing transmission pipeline in an HCA. In doing so, the committee is
asked to consider how such criteria and methodologies treat public safety and environmental
risks and the economic, technical, and operational feasibility of an RMV installation. The
committee is also asked to consider relevant NTSB recommendations and consider issues and
problems that can arise when relying on manual shutoff valves in emergencies, including human
factors issues and timely access to the valve for closure.
At the time the study was commissioned, PHMSA was nearing completion of its
rulemaking on the installation of RMVs on newly constructed and entirely replaced segments of
transmission pipelines. In April 2022, the rule was finalized, allowing the committee to consult
PHMSA’s rulemaking notice for insight into the agency’s rationale for establishing the
conditions and criteria for RMV installation, albeit restricted to applications for newly
constructed and entirely replaced segments of pipelines. Informed by its review of the new rule
and the other topics in its charge, the committee is asked to make recommendations, as

PREPUBLICATION COPY—Uncorrected Proofs

14
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

appropriate, regarding regulatory or statutory changes that might be considered at the federal and
state levels concerning RMV requirements on existing hazardous liquid and gas transmission
pipelines.

BOX 1-2
Statement of Task

The committee will study current and potential methodologies and standards, including
regulatory criteria, for deciding when an automatic shutoff valve (ASV), remote-controlled
valve (RCV), or other equivalent emergency flow restricting device (EFRD) should be installed
on existing gas transmission pipelines and on existing hazardous liquid pipelines in high-
consequence areas, as defined in federal regulation.
The study will examine current federal regulatory requirements governing decisions
about where and when to install these devices on existing pipelines, including regulatory
criteria on factors to be considered and methodologies to be used for making such decisions.
Consideration will be given to the treatment of public safety and environmental risks by these
methodologies and the treatment of economic, technical, and operational feasibility. The
study will identify and assess other potential methodologies for making such installation
decisions on existing pipelines. In doing so, the committee will consider ASV, RCV, and
EFRD technological capabilities; statutory and procedural limits on federal regulatory
authority to require their use; relevant recommendations by the National Transportation
Safety Board; and current and proposed regulatory criteria for the installation of ASVs, RCVs,
and EFRDs on newly constructed and fully replaced pipelines. The study will take into
account issues associated with reliance on manual control valves, including human factors
and accessibility concerns. As appropriate, recommendations will be made regarding
regulatory or statutory changes that might be considered at the federal and state levels.

STUDY APPROACH

To inform its work, the committee invited briefings from subject matter experts from
transportation safety and regulatory agencies (including PHMSA and NTSB), the natural gas and
hazardous liquid pipeline industries, valve suppliers, research institutions, consulting
organizations, and academia. The briefings yielded information on a range of relevant topics,
including federal and state regulatory requirements, pipeline operations and monitoring systems,
risk analysis methods, IM planning and implementation, pipeline safety performance, and
rupture and dispersion modeling. The committee also visited pipeline facilities and met with their
engineers, technicians, analysts, and operations and planning personnel. The many consulted
experts and their affiliations are listed in the Acknowledgments.
To obtain additional information, the committee consulted data published by PHMSA
that provide annually updated statistics on the country’s existing hazardous liquid and gas
transmission pipeline networks, including total pipeline mileage, mileage by decade of
installation, mileage in HCAs and Class 3 and 4 locations, and mileage by pipe diameter.
Because the PHMSA pipeline database lacks information on valve installations, including their
types, spacing, and placement, the committee sought help in obtaining relevant data from
industry trade associations representing the gas and hazardous liquid pipeline industries. The
industry associations transmitted to their members a committee-developed survey asking for

PREPUBLICATION COPY—Uncorrected Proofs

15
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

information about the number and types of valves used and average valve spacing distances for
pipelines in HCAs and Class 3 and 4 locations. These data proved helpful for understanding
many issues pertinent to the study, including current operator practices for using and placing
different types of valves on their systems and some of the challenges associated with adding
RMVs and replacing or converting manual valves to RMVs.
The committee analyzed PHMSA’s database of pipeline incident reports and reviewed
NTSB pipeline accident investigations, PHMSA rulemaking notices, and studies conducted on
issues related to RMVs and IM over the past 50-plus years, as summarized above and in Box 1-
1. In deliberating over the information obtained from these data sources and consultations with
outside experts, the committee sought to fulfill its charge with a consensus set of findings,
conclusions, and recommendations on federal policy regarding the installation of RMVs on
existing transmission pipelines. Although successful in reaching a consensus on several key
issues, committee members differed in their views about the appropriate treatment of RMVs in
PHMSA’s regulatory direction and guidance. Accordingly, some of the report’s
recommendations reflect this consensus and others were accepted by a large majority of
members but with some material differences. One member dissented from a majority
recommendation and provided the reasoning in an appended statement (see Appendix A).

REPORT ORGANIZATION

The remainder of the report consists of five chapters. Chapter 2 provides background on the
country’s transmission pipeline networks, the share of pipeline mileage in HCAs, and the types
of shutoff valves that are used on pipelines, including the use of RMVs. Chapter 3 describes the
current pipeline safety assurance framework, focusing on IM processes and requirements. The
chapter describes how federal and state safety regulators evaluate IM programs to verify
regulatory compliance. The chapter also discusses in more detail the requirements in the new
federal rule mandating RMVs on newly constructed and entirely replaced segments of pipelines.
Chapter 4 contains a review of pipeline incident data and reports of incident
investigations. The recent history of pipeline incidents in HCAs and Class 3 and 4 locations is
examined to identify trends and patterns in incidents, including reported consequences. The
chapter also provides a short synopsis of NTSB and PHMSA findings from investigations of
several major pipeline incidents, noting how and when shutoff valves were activated. In an
addendum to the chapter, the results of an analysis of the socio-demographic characteristics of
communities proximate to pipeline incidents are provided in anticipation that equity impacts of
pipeline safety risks and their abatement will receive increasing public policy attention.
Chapter 5 describes the prevalence of RMVs on existing pipelines in HCAs and presents
operator-provided estimates of costs associated with installing RMVs and converting manual
valves to RMVs. The discussion then turns to how operators make choices about whether to
install RMVs on existing pipelines, first by discussing the programs several operators have
instituted to prioritize their deployment and then by reviewing operator requirements to consider
RMVs specifically and within the broader context of their IM obligations. The discussion in this
chapter surfaces several shortcomings in the direction and guidance provided to operators for
conducting and documenting their decision criteria for the installation of RMVs. A report
summary and the committee’s conclusions and recommendations are provided in Chapter 6.

PREPUBLICATION COPY—Uncorrected Proofs

16
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

2
Background on Transmission Pipelines and Shutoff Valves

This chapter provides background on the network of transmission pipelines in the United States.
It begins by discussing the shared and distinct characteristics of the two main types of
transmission pipelines, gas and hazardous liquid, including statistics on the use, scope, and age
of their networks. Because the report’s focus is on pipelines in populated and environmentally
sensitive areas, statistics are then provided on transmission pipeline mileage in high consequence
areas (HCAs) and Class 3 and 4 locations.
Additional background is then provided on the valves used for controlling and shutting
down pipeline flows during emergencies. The background includes information on the types of
valves that are used for these purposes and their actuation methods, including automatic and
remote-control shutoff valves (referred to collectively as rupture mitigation valves [RMVs]).
This discussion is accompanied by an overview of the methods used by pipeline operators to
monitor and control the operations of their pipelines and valve actuations, focusing particularly
on the role of supervisory control and data acquisition (SCADA) systems. The chapter concludes
with estimates of the prevalence of RMVs on pipelines in HCAs.

U.S. PIPELINE SYSTEM SCOPE AND USE CHARACTERISTICS

Vast networks of pipelines move most of the natural gas and hazardous liquids shipped long
distances across the United States. These networks are composed of three major categories of
pipeline: gathering, transmission, and distribution. In general, gathering pipelines transport raw
materials (e.g., crude oil, unprocessed natural gas) from the wellhead or production area to
storage tanks and processing facilities. Depending on the commodity, larger-diameter
transmission pipelines are then used to transport shipments from these upstream facilities to
midstream and downstream storage depots, refineries, export terminals, distribution centers, and
large end-point users such as electric utilities and chemical and manufacturing plants. In the case
of petroleum products, transmission pipelines are also used to move product from refineries to
downstream intermediaries and users. Distribution pipelines are used for gas systems and
typically connect a natural gas distribution center to residential and commercial end-point users.
In keeping with the Statement of Task and legislative charge, this report focuses on the
large-diameter (6 or more inches) onshore transmission pipelines that are used mainly for
transporting gas and liquid commodities in high volume over long distances, as opposed to
pipelines used for end-use distribution and field gathering (some of the latter can also have large
diameters). Because they transport hazardous materials in large volumes under high pressure,
transmission pipelines are subject to different safety regimes and regulations than pipelines in
distribution and gathering systems, which have their own risks for consequential failures and
imperatives for safety vigilance.
Both hazardous liquid and gas transmission pipelines are usually made from mild carbon
steel and buried 2 or more feet underground. However, the two systems are configured and
operate differently and are therefore distinguished and treated separately under federal safety
regulations, as will be discussed more in Chapter 3. Gas transmission pipelines ae mainly used to

PREPUBLICATION COPY—Uncorrected Proofs

17
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

transport natural gas in a gaseous state under high pressure (400 psi to 1,400 psi). 21 The gas is
typically transported from processing plants to storage depots, export facilities, and points of
distribution known as “city gates,” where the product is delivered to homes, businesses, and
industrial plants. Because of the ubiquity of natural gas demand, the 300,000-mile gas
transmission pipeline network is dispersed across the country but with higher density in the gas-
producing states along the Gulf Coast (see Figure 2-1, which also includes offshore mileage).
Total U.S. mileage of the onshore hazardous liquid and gas transmission pipeline networks is
shown in Table 2-1.

FIGURE 2-1 Map of U.S. gas transmission pipelines, June 2023.

SOURCE: Pipeline and Hazardous Materials Safety Administration. National Pipeline Mapping
System, https://www.npms.phmsa.dot.gov.

Hazardous liquid pipelines are used mainly to transport crude oil, refined petroleum
products, and highly volatile liquids (HVLs). 22 The latter includes ethane, propane, butane,
pentane, liquid carbon dioxide, and anhydrous ammonia, which have high vapor pressures and
are highly compressed in pipelines. The majority of the 220,000 miles of hazardous liquid
pipeline crosses the interior of the United States to connect storage depots with one another and
refineries (see Figure 2-2, which also shows offshore mileage). 23 In the case of crude oil

21
About 1,500 miles of gas pipelines are used to transport hydrogen.
22
About 5,000 miles of hazardous liquid pipeline are used to transport carbon dioxide.
23
By virtue of geography, the Southern and Central Plains regions have long been convergence points for crude
oil pipelines.

PREPUBLICATION COPY—Uncorrected Proofs

18
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

pipelines, their starting points are usually inlet stations in oil-producing regions and large storage
centers, while their end points are usually other storage facilities, refineries, and export
terminals. Some crude oil pipelines move product from import terminals to storage depots and
refineries. Conversely, the transmission pipelines used to transport refined products such as
gasoline, diesel, and jet fuel usually begin at refineries and terminate at storage farms, export
terminals, and end-use distribution centers. HVL pipelines move their liquid shipments between
processing facilities, refineries, and petrochemical plants.

FIGURE 2-2 Map of U.S. hazardous liquid pipelines, June 2023.

SOURCE: Pipeline and Hazardous Materials Safety Administration. National Pipeline Mapping
System, https://www.npms.phmsa.dot.gov.

Transmission pipelines vary in design, fabrication, materials, configuration, and

components depending on many factors including age, markets served, terrain crossed, and
whether additional shipping services are provided, such as storage and transloading. Pipeline
characteristics will be influenced by location, as pipelines span urban, suburban, and rural
settings as well as a wide range of terrains and environments that expose them to different soil
chemistries, moisture levels, temperature extremes, and risks of external damage from human
activity (e.g., excavation) and natural hazards (e.g., floods, earthquakes, landslides). Their design
and construction features will also reflect installation practices and technologies available when
they were fabricated and installed, resulting in variations in pipe materials, external coatings,
welding techniques, and valve types and placements. Figure 2-3 shows the age variation in the
hazardous liquid and gas transmission pipeline systems. Note that more than 50% of gas

PREPUBLICATION COPY—Uncorrected Proofs

19
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

transmission pipeline mileage was installed before 1970. While the hazardous liquid network
contains more newly constructed pipelines, the share of mileage installed more than 50 years ago
still approaches 50%.

TABLE 2-1 Mileage and Diameters, U.S. Network of Onshore Hazardous Liquid and Gas
Transmission Pipelines, 2021
Approximate Diameter Range
Type of Transmission Pipeline Mileagea (inches)
Gas 300,000 4–48
Hazardous Liquid 220,000b 4–48
Crude oil 70,000 4–48
Petroleum products 74,000 4–40
HVL 76,000 4–30
a
This value excludes transmission pipelines used to transport products other than crude oil, petroleum products,
and HVLs.
b
This report focuses on onshore pipelines having diameters of 6 inches or more.
SOURCE: Pipeline and Hazardous Materials Safety Administration, Gas Transmission and
Hazardous Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-
statistics/pipeline/gas-distribution-gas-gathering-gas-transmission-hazardous-liquids.

Figure 2-3 also shows the diameters of hazardous liquid and gas transmission pipelines in
the U.S. networks. Note that gas transmission pipelines tend to have larger diameters than
hazardous liquid pipelines, due in part to the added volume required for moving low-density
gaseous products. More than half of HVL pipelines have diameters of 10 inches or less. Most
hazardous liquid pipelines, both HVL and non-HVL (i.e., crude oil, refined products), have
diameters of 16 inches or less, whereas nearly half of gas transmission pipelines exceed 16
inches in diameter.
Rarely shutting down, natural gas transmission pipelines operate continuously to ensure
service to end users. 24 They are usually configured with compressor stations placed every 20 to
80 miles depending on factors such as topography, line configuration, and pipe size. Operators
monitor volumes of gas being moved through the pipelines as well as volumes of gas being
delivered, often directing the flow from various product sources to different delivery points.
Consumer and utility demand (e.g., for home heating and electricity generation) plays a large
role in determining the volumes of gas moved during any given time of day and season. By
comparison, most hazardous liquid pipelines operate by moving batches of different grades of
crude oil (i.e., light and heavy grades) and batches of different petroleum products (gasoline,
diesel fuel, and jet fuel) and HVLs. Pumps are spaced every 20 to 80 miles depending on many
factors, including terrain profile. Pipeline operators prefer to start and stop their systems as
infrequently as possible to maintain a continuous flow; however, a pipeline may start and stop at
various time intervals to allow for in-line inspection and maintenance. Repetitive starts and stops
are also avoided because they can create cyclic fatigue issues and the potential for crack
propagation.

24
Intermediate compressors may be started or stopped to accommodate demand fluctuations.

PREPUBLICATION COPY—Uncorrected Proofs

20
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 2-3 U.S. onshore hazardous liquid and gas transmission pipeline systems, decade
of installation and pipeline diameter, 2021.
SOURCE: Pipeline and Hazardous Materials Safety Administration, Gas Transmission and
Hazardous Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-
statistics/pipeline/gas-distribution-gas-gathering-gas-transmission-hazardous-liquids.

PIPELINES IN HIGH CONSEQUENCE AREAS

As Chapter 1 explains, during the 1990s the U.S. Department of Transportation (U.S. DOT)
began to question the adequacy of a regulatory approach that depended heavily on a common
minimum set of standards for all pipelines that did not account for the wide variability in pipeline
designs, materials, fabrication methods, operations, age, products transported, and locations.
National Transportation Safety Board (NTSB) investigations of a number of catastrophic
pipeline failures had revealed inadequacies in the minimum standards, particularly for pipelines
that traversed populated and environmentally sensitive areas that warranted additional
PREPUBLICATION COPY—Uncorrected Proofs

21
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

protections. 25 Many existing pipelines, for instance, had been installed decades earlier in what
were once rural locations but that had since become more developed and heavily populated.
Meanwhile, the public was demanding increased vigilance in protecting people and the
environment from pipeline releases.
Congress responded to this interest by passing legislation (49 USC 60109(a)) during the
1990s requiring federal standards for identifying gas transmission pipelines located in populated
areas and hazardous liquid pipelines that crossed navigable waters, population centers, and areas
unusually sensitive to environmental damage. In the identified locations, now referred to as
HCAs, the legislation called on U.S. DOT to establish supplemental requirements for operators
to reduce risks, including requirements for enhanced inspection and standards for leak detection
and notification, for when a pipeline operator must install an emergency flow restricting device
(EFRD), and for procedures and systems (49 USC 60102(f)(2) and 49 USC 60102(j)).
These legislative requirements, along with NTSB recommendations, were factors in
prompting U.S. DOT to promulgate the integrity management (IM) rules for hazardous liquid
pipelines and gas transmission pipelines starting in 2000, as discussed in Chapter 1. The IM rules
applied to pipelines in locations designated as HCAs and in locations where a release could
affect an HCA (applicable to hazardous liquid pipelines because releases can spread long
distances). It was understood that the amount of pipeline mileage in HCAs would change over
any given time as pipelines were constructed and retired from service but also due to changes in
the land uses where existing pipelines are located.

High Consequence Area Definitions

In the case of HCAs for hazardous liquid pipelines, their designations originated from an existing
industry consensus standard developed by the American Society of Mechanical Engineers
(ASME): B31.4, “Liquid Petroleum Transportation Piping Systems,” subsection 434.15.2,
“Mainline Valves.” It established standards for installing mainline valves on both sides of major
river crossings and at other locations along the length of a pipeline in accordance with the terrain
traversed. U.S. DOT used the ASME standard to define HCAs for hazardous liquid pipelines as
follows:

• A commercially navigable waterway,

• A high population area (an urbanized area that contains 50,000 or more people and
has a population density of at least 1,000 people per square mile),
• Another populated area (a place that contains a concentrated population or
commercial activity), and
• An unusually sensitive area (drinking water or ecological resource area).

U.S. DOT also used an ASME standard for designating HCAs for gas transmission
pipelines. ASME’s class location concept, as discussed in Chapter 1, was incorporated into
federal regulations during the early 1970s. ASME had established the concept to set different
requirements for the design of gas transmission pipelines depending upon the population
densities of the areas through which the pipeline traversed (as part of ASME B31.8, “Gas
Transmission and Distribution Piping Systems”). Four class locations were established, Class 1
to 4. Class 1 locations are very sparsely populated areas, such as farmland or rural areas, with no
25
Bellingham, Washington; Simpsonville, South Carolina; Reston, Virginia; and Edison, New Jersey.

PREPUBLICATION COPY—Uncorrected Proofs

22
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

or few individuals potentially located adjacent to a pipeline right-of-way. On the other end of the
spectrum, Class 4 locations are areas of high population density, such as urban or city areas, with
many individuals potentially located adjacent to the pipeline right-of-way. In addition to
requiring IM programs for gas transmission pipelines in Class 3 and 4 (i.e., populated) locations,
the regulations required them for other identified sites defined as HCAs because they contain
buildings that house people who have limited mobility and are in the vicinity of where people
congregate. These designations stemmed from concern that releases from gas transmission
pipelines can lead to explosions and fires that will harm people and property.
To illustrate how pipeline miles can be distributed across a metropolitan region and
traverse HCAs and Class 3 and 4 locations, Figure 2-4 contains a map derived from the Pipeline
and Hazardous Materials Safety Administration’s (PHMSA’s) National Pipeline Mapping
System for Harris County, Texas. In the heart of the country’s oil and gas producing region,
Harris County’s pipeline densities are likely to be higher than in many other regions of the
country, but the map serves the purpose of illustrating how pipeline systems and HCAs can
overlap.

FIGURE 2-4 Hazardous liquid and gas transmission pipelines, Harris County, Texas,
October 2023.
SOURCE: PHMSA. National Pipeline Mapping System.
https://pvnpms.phmsa.dot.gov/PublicViewer.

Pipeline Mileage in High Consequence Areas

The amount of hazardous liquid and gas transmission pipeline mileage in HCAs and Class 3 and
4 locations in 2021 is summarized in Table 2-2. That year, about 19% of gas transmission

PREPUBLICATION COPY—Uncorrected Proofs

23
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

pipeline mileage was located in an HCA or Class 3 and 4 locations. The hazardous liquid
network is separated into non-HVL (i.e., crude oil, refined products) and HVL mileage. About
40% of non-HVL mileage was located in an HCA in 2021, and about 40% of HVL mileage was
located in an HCA. Table 2-2 shows mileage by type of HCA; however, because different types
of hazardous liquid HCAs overlap, their totals are not additive.
Table 2-2 also shows how mileage in HCAs and Class 3 and 4 locations has changed over
time by comparing 2010 to 2021 mileage. Gas transmission pipeline mileage in HCAs changed
very little during this period, while non-HVL mileage in HCAs grew by nearly 7%. It is notable
that the amount of HVL mileage in HCAs grew by 41%, as the total HVL pipeline network grew
in mileage by 31%.

TABLE 2-2 Hazardous Liquid and Gas Transmission Pipeline Mileage in HCAs and Class 3 and 4
Locations, 2010 and 2021
Percent
2010 Mileage 2021 Mileage Change
Gas Transmission
U.S. Network Total 299,481 298,748 –0.2
HCAs and Class 3 and 4a
HCA 20,022 21,108 +5.4
Class 3 33,884 33,688 –0.6
Class 4 1,365 871 –36

Hazardous Liquid (Non-HVL)

U.S. Network Total 123,948 153,364 +24
b
HCA Total 57,230 61,000 +6.6
High Population Areas 18,968 21,030 +10.9
Other Population Areas 27,624 31,597 +14.4
Drinking Water Resources 25,711 26,233 +2
Ecological Resources 21,641 23,228 +7.3
Commercially Navigable Waterways 8,116 7,173 –11.6

Hazardous Liquid (HVL)

U.S. Network Total 57,887 75,601 +31
b
HCA Total 20,786 29,356 +41
High Population Areas 5,514 8,398 +52.3
Other Population Areas 8,829 15,453 +75
Drinking Water Resources 6,641 7,800 +17.5
Ecological Resources 7,658 9,910 +29.4
Commercially Navigable Waterways 2,169 2,311 +6.5

PREPUBLICATION COPY—Uncorrected Proofs

24
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

a
PHMSA does not calculate total HCA and Class 3 and 4 mileage for gas transmission pipelines, which cannot
be determined by adding the reported mileage in each location due to overlaps among HCAs and Class 3 and 4
locations.
b
Hazardous liquid mileage by type of HCA is not additive because HCA types can overlap geographically.
SOURCE: Pipeline and Hazardous Materials Safety Administration, Gas Transmission and
Hazardous Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-
statistics/pipeline/gas-distribution-gas-gathering-gas-transmission-hazardous-liquids.

Operator Profiles

A review of pipeline operator reports of system mileage reveals that large shares of the mileage
in HCAs and Class 3 and 4 locations are managed by a relatively small number of operators.
PHMSA’s annual report data for 2021 indicate that there were 563 operator identification
numbers (OPIDs) for gas transmission pipelines and 516 OPIDs for hazardous liquid (HVL and
non-HVL) pipelines located in HCAs and Class 3 and 4 locations. By consolidating instances
where a single operator has multiple OPIDs, the total number of operators falls by more than
half. After this consolidation is made, Table 2-3 shows that in 2021 just 12 operators managed
more than 60% of gas transmission pipeline mileage in HCAs and Class 3 and 4 locations, while
18 operators managed more than 75% of the hazardous liquid pipeline mileage in HCAs. Table
2-4 shows pipeline mileage in HCAs and Class 3 and 4 locations by the largest gas transmission
and hazardous liquid pipeline operators in terms of system mileage.

TABLE 2-3 Mileage and Number of Operators of Hazardous Liquid and Gas Transmission
Pipelines in HCAs and Class 3 and 4 Locations, 2021
Operators Mileage Total
within an HCA or Mileage of Average
Class 3 and 4 Number of All Miles per Percent of All
Location Operatorsa Operators Operator Mileage
Gas Transmissionb
Less Than 1 Mile 50 18 0.4 0.1
1–15 Miles 115 622 5.4 2.0
15–50 Miles 35 957 27.3 3.1
50–100 Miles 24 1,779 74.1 5.8
100–500 Miles 35 8,171 233.5 26.8
500–1,000 Miles 4 3,096 774.1 10.2
>1,000 Miles 8 15,859 1,982.4 52.0
Total 271 30,502 112.6 100

Hazardous Liquid (HVL and non-HVL)

Less Than 1 Mile 10 5 0.5 0.01
1–15 Miles 72 467 6.5 0.5
15–50 Miles 49 1,509 30.8 1.7

PREPUBLICATION COPY—Uncorrected Proofs

25
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

50–100 Miles 13 870 66.9 1.0

100–500 Miles 36 8,648 240.2 9.6
500–1,000 Miles 11 7,675 697.8 8.5
>1,000 Miles 18 71,182 3,954.6 78.8
Total 209 90,356 432.3 100
a
The email domains in each OPID reporting record were used to consolidate operators in cases where a single
company operates multiple pipelines and uses multiple OPIDs.
b
The gas pipeline data do not include mileage that falls under 49 CFR Part 192.710, which is any transmission
pipeline segment with a maximum allowable operating pressure of ≥30% of the specified minimum yield strength
that is located in a Class 3 and 4 location or a moderate consequence area, if the pipeline segment can be inspected
with an instrumented inline tool and the location is not classified as an HCA. While this mileage does include some
Class 3 and 4 data, one cannot determine the mileage of each class based on the information provided in the Annual
Report.
SOURCE: Pipeline and Hazardous Materials Safety Administration, Gas Transmission and
Hazardous Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-
statistics/pipeline/gas-distribution-gas-gathering-gas-transmission-hazardous-liquids.

TABLE 2-4 Hazardous Liquid and Gas Transmission Pipeline Operators with the Most Pipeline
Mileage in HCAs and Class 3 and 4 Locations, 2021
Operator’s Pipeline Percentage of Total Pipeline
Miles in HCAs and Class Miles in HCAs and Class 3
Operator Name 3 and 4 Locations and 4 Locations
Gas Transmission
Kinder Morgan 2,867 9.4
PG&E 2,335 7.6
Energy Transfer 2,112 6.9
TC Energy 1,973 6.5
Duke Energy 1,958 6.4
Williams 1,657 5.4
Enbridge 1,606 5.3
SoCalGas 1,351 4.4
TOTAL 15,859 51.9

Hazardous Liquid (HVL and Non-HVL)

Energy Transfer 8,926 9.9
Enterprise Products 8,393 9.3
Oneok 6,335 7.0
Kinder Morgan 5,511 6.1
Marathon Pipe Line 5,114 5.7

PREPUBLICATION COPY—Uncorrected Proofs

26
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Colonial Pipeline 4,397 4.9

Phillips 66 4,284 4.7
Buckeye Partners 4,219 4.7
Enbridge 4,203 4.7
TOTAL 51,382 57
SOURCE: Pipeline and Hazardous Materials Safety Administration, Gas Transmission and
Hazardous Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-
statistics/pipeline/gas-distribution-gas-gathering-gas-transmission-hazardous-liquids.

PIPELINE SHUTOFF VALVES

The placement of sectionalizing valves on pipelines serves operating purposes to manage the
flow of product and safety purposes to mitigate the consequences of a rupture or leak by
allowing for the flow to be shut off from a failed segment. These valves can also serve other
purposes, such as closing a pipe segment for maintenance, construction, pressure relief, and
changing products. The following sections describe common valve types and actuation methods
used for shutting down pipeline flows to isolate pipeline segments.

Common Types of Shutoff Valves

Valves are usually named based on the type of device that plugs or blocks the pipe to stop or
regulate product flow. The two most common types of valves installed on gas and hazardous
liquid transmission pipelines are gate and ball valves. A gate valve is designed with a solid
rectangular or circular plate of steel (i.e., a gate-type disc) that is attached to a threaded stem that
is turned to raise or lower the gate. When the gate is raised, product can flow freely past the
valve; when the gate is lowered, the flow is stopped. Gate valves are typically designed to
operate in either the fully open or fully closed position.
In a ball valve, the steel plate of the gate valve is replaced by a sphere (i.e., a ball-type
disc) that is fabricated with a hole bored to the same diameter as the interior diameter of the
pipeline. When the bore is aligned in the same direction as the pipe, the fluids can flow freely
through the valve and into the pipeline. When the ball is rotated 90 degrees, the bore turns
toward the body of the valve and the flow is stopped. Ball valves can also be designed for
operation in a partially open position to throttle the flow, which can make them more versatile
than gate valves.
Some valves are self-activating, such as a check valve. These flap-like valves are
designed to prevent a reversal of flow direction. The check valve will remain open as long as
there is free flow in the intended direction, as the fluid pressure lifts the flap upward toward the
top of the valve body. If the flow stops, the pressure decreases, or the flow starts to reverse, the
change in fluid direction and pressure will force the flap down into a closed position, stopping
any back flow. The check valve, therefore, can be used to prevent downstream product that has
passed a rupture site, but is no longer under pumping pressure, from reversing flow and escaping
through the rupture site.

PREPUBLICATION COPY—Uncorrected Proofs

27
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Valve Actuation Methods

Valves can be fitted with various systems for moving the disc that opens and closes the valve
(e.g., turning the ball, lifting the gate), and as a means for initiating and controlling the
movement. In a manual valve, both the opening and closing of the disc are handled by the person
(or people) operating the handwheel or lever. Other means of moving the disc may include
electric motors, pneumatic or hydraulic systems using a pressurized gas or fluid, and
electromagnetic force via a solenoid. In many cases manual valves can be retrofitted with one of
these other mechanized systems for opening and closing.
All means of actuation can be configured to be initiated by a person at the valve site,
whether by physical action (e.g., turning a handwheel) or by toggling a switch that triggers a
solenoid or turns on a motor, pump, or compressor. Non-manual valves can be activated
remotely from a control room or automatically in response to a sensor reading (i.e., reaching a
designated set point for pressure, flow rate, or temperature). The choice and practicality of
different methods of activation depend on many factors, as will be discussed later.
Valve designs that combine mechanized valve actuation with monitoring and control
systems afford pipeline systems with an ability to operate instrumented valves through
automation and remotely from a control room. Application of these technologies on transmission
pipelines is found in automatic and remote-control shutoff valves, collectively referred to as
RMVs.
Operating without human intervention, an automatic shutoff valve is designed to monitor
conditions and automatically close in response to a rapid change in pipeline pressure, flow rate,
or temperature. Upon reaching a designated set point, generally operating pressure or flow rate,
the actuator will automatically activate to close the valve. The actuator may be powered by
electricity or gas in the case of natural gas pipelines. This functionality allows for fast isolation
times for major leaks and ruptures.
Operating with human intervention, remote-control valves are designed and instrumented
to be opened or closed in response to commands from a control room at a remote location.
Control room personnel monitor pipeline conditions with the assistance of SCADA systems
(discussed in Box 2-1) for a range of parameters, including flow rate and pressure. An alarm may
sound or another alert may be provided when condition thresholds are met. Control room
personnel will review and evaluate the data to determine whether a problem exists. They may
also receive direct notice of a problem from the public, emergency responders, or operator
personnel at or near the site. If the control room determines there is an emergency condition
based on available information, and possibly field confirmation, the decision may be made to
close a valve or series of valves by executing commands to remote-control valves.
Automatic and remote-control shutoff valves provide common benefits, notably the
mitigation of consequences from hazards by reducing the duration or volume of a release from a
failed pipeline segment. The time differentials between isolating a pipe segment fitted with
remote-control or manual shutoff valves will depend on a number of factors, including the
amount of time before the controller determines that an abnormal and emergency condition
exists, the time it takes for the controller either to initiate the remote valve closure or to alert
local operating personnel to close a valve manually, and the location of the valve relative to
available operating personnel. In the case of automatic shutoff valves, these timing issues are not
factors.

PREPUBLICATION COPY—Uncorrected Proofs

28
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

For gas transmission pipelines, both automatic and remote-control shutoff valves can
shorten the time to closure, thus limiting the volume of natural gas—methane, a flammable and
potent greenhouse gas—released at the incident site and into the atmosphere. Shortening the time
to closure would reduce the spread or intensity of a fire if a natural gas rupture ignites. Rapid
isolation of a rupture allows emergency response teams to begin rescue efforts sooner, which
offers a chance to curb injuries, loss of life, and destruction of property and the environment.
For hazardous liquid pipelines, automatic or remote-control shutoff valves can likewise
shorten the time to closure, reducing the volume spilled into the surrounding environment.
Installing more valves onto a single pipeline also reduces the length of pipeline segments (i.e.,
the valve spacing), allowing operators to isolate smaller sections and thus smaller volumes of a
commodity. Consequently, smaller pipeline segments decrease the drain-down volume of a
pipeline leak or rupture, especially where the leak or rupture is located at a low point within the
pipeline, and product volume will flow from high ground to low ground and release from the
leak or rupture site. In addition to segment length, the topography of the land where the pipeline
is located is crucial in determining the drain-down volume at a specific location. For example, if
a pipeline ruptures at the bottom of a hill, the liquid will flow down from the top of the hill and
drain out of the rupture location below. The strategic placement of valves on a pipeline that
considers the topography of the land, often through modeling of the pipeline system, can further
reduce the volume of commodity released during an incident.
The use of both types of RMVs—automatic and remote-control—presents operators with
potential challenges. Failures of both types of valves can be caused by random hardware and
software failures. A particular challenge in designing and programing an automatic shutoff valve
is keeping it from activating inadvertently by sensed conditions such as pressure fluctuations due
to changes in operations or weather conditions as opposed to a change in pressure due to a
rupture. While rapid actuation can be advantageous in an emergency, a potential consequence of
rapid isolation includes hydraulic shock, also known as water hammer. Water hammer is a
pressure surge or wave caused when a fluid, generally a liquid, is forced to stop or change
direction abruptly such as when a valve suddenly closes. This phenomenon can be especially
hazardous for high-pressure systems that carry hazardous liquids—which are not compressible—
because it could cause mechanical stress or damage to components upstream on the pipeline such
as at a bend or pump station. The risk of water hammer thus constitutes an important factor when
determining whether to install an automatic shutoff valve on a hazardous liquid pipeline. While
water hammer could lead to the damage of a pipeline system, countermeasures can also be put
into place to mitigate the threat, such as surge tanks and chambers to suppress the pressure wave
and thereby minimize the mechanical stress to the piping. In addition, the installation of pressure
relief systems can provide a mechanism to release excess pressure if a safe location for
ventilation and disposal is available.
The operation of a remote-control shutoff valve, unlike an automatic shutoff valve and
like a manual valve, requires human decision making and intervention. Adding this human
element to activation can prevent unnecessary, costly shutdowns but also slow the response
process and introduce the possibility of human error, including failure to activate the valves
when warranted. Poor decisions about when to activate remote-control valves and their
sequencing can cause damage and failures, including incidents of hydraulic shock. The potential
exists for such human errors to arise from fatigue, although operators provide training and
resources for control room personnel to prevent or mitigate such occurrences.

PREPUBLICATION COPY—Uncorrected Proofs

29
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

While actuation of remote-control valves through SCADA systems is a common and

effective approach for mitigation of rupture consequences, the use of these systems can also
introduce new hazards that must be considered and controlled. While pipeline failures can be
caused by a malicious attack performed locally at a pipeline equipment site (e.g., by crossing
wires at a local control panel at a valve station), SCADA infrastructure can be subjected to a
remote cyberattack. As a result, both physical and cyber security are necessary to limit
opportunities for threat actors.
Whether the result of the actuation of automatic, remotely controlled, or manual valves,
errant shutdowns of pipelines systems can have harmful effects on the integrity of the pipeline
and on customers due to disruptions in the delivery of fuel and other commodities. The issues
and concerns identified in this chapter are discussed with regard to the current state of
technology and practice. Advances in control systems that reduce the uncertainties that slow the
confirmation of ruptures, and thus slow the deployment of valves, can be expected in the future.
Similarly, technological advances are likely to reduce the probability of errant and uncoordinated
activations of automatic shutoff valves. While this report does not examine such possibilities, or
the state of research and technology, they will undoubtedly be factors in the development of
standards and methods for RMVs in the future.

BOX 2-1
SCADA Systems for Pipeline and Valve Control

Pipeline monitoring and control systems are comprised of sensors that measure process
conditions at inlets, outlets, valves, and pump and compressor stations; actuators that act on
the fluids (e.g., valves, compressors, and pumps); signal connectors (e.g., copper wire, fiber
optic cables, and wireless networking); and logic solvers (e.g., computers and programmable
logic controllers). While there is no regulatory requirement to use a SCADA system, most
pipeline operators who deploy such SCADA systems collect, analyze, and display real-time
operation information about pipeline systems at central control rooms. The systems allow
control room personnel to monitor the network during normal and abnormal operations and
during emergencies and to send commands back to the pipeline system’s local controllers
installed at pump, compressor, and valve stations.
Using computational pipeline monitoring methods, which monitor and interpret internal
operating parameters, SCADA systems can detect conditions indicative of an emergency or
significant leak. In addition, these systems may receive input from technologies installed for
the specific purpose of detecting leaks, such as acoustic, temperature, and mechanical
sensors installed outside the pipeline and that are commonly referred to as external leak
detection systems.
SCADA systems and control rooms, therefore, serve multiple purposes, including
scheduling, dispatching, controlling, and reporting. Valves and other equipment (e.g., pumps
and compressors), if appropriately instrumented and equipped, can be remotely activated and
controlled from SCADA centers. Importantly, the centers offer the advantage of added
situational awareness and quick response to an emergency while maintaining human control
of the activation process. Remote activation also allows for more sophisticated computer
control of activation parameters through a programmable logic controller built into the valve
itself, which in the past was achieved through ramping the closure of valves over time to
reduce the potential impacts of hydraulic shock in liquid pipelines (i.e., water hammer).

PREPUBLICATION COPY—Uncorrected Proofs

30
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Operators can also deploy software programs that automatically activate instrumented valves
without direct operator involvement when the SCADA system detects a deviation.

PREVALENCE OF RUPTURE MITIGATION VALVES IN HIGH CONSEQUENCE

AREAS

While PHMSA’s annual statistical reports provide operator-reported data on the mileage and
certain other characteristics of the pipelines in HCAs and Class 3 and 4 locations, operators are
not required to report on the installation of shutoff valves on the pipeline segments located
within or that could affect an HCA. 26 However, a PHMSA database that can offer some insight
into valve use and type is the Pipeline Incident Flagged Files. 27 Between 2010 and 2022, 427
incidents were reported for gas transmission and hazardous liquid pipelines in HCAs and Class 3
and 4 locations in which valves were closed and their types identified in the incident record (see
Figure 2-5). 28 According to a review of these records, manual valves were used exclusively to
shut down the pipeline in 48% of incidents. By comparison, remote-control valves were used to
shut down the pipeline in one-third of the incidents, and automatic shutoff valves were used in
another 5%. In addition, there were seven incidents in which a combination of automatic and
remote-control shutoff was used, bringing the total for RMVs to 39%. In 12% of the incidents,
manual valves were used in combination with RMVs.
Extrapolating from these data, almost 55% of valves on all transmission pipelines located
in HCAs are manually operated (48% plus half of 12%), and the remaining 45% are RMVs (39%
plus half of 12%). These percentages, however, differ for gas and hazardous liquid pipelines. The
prevalence of incidents in which shutdowns were performed exclusively using manual valves
was much higher for incidents involving gas transmission pipelines (84%) than for incidents
involving non-HVL hazardous liquid and HVL pipelines (40% and 54%, respectively).
It is also notable that in approximately 87% of the 427 pipeline incidents, a SCADA
system was in place and functioning at the time (see Figure 2-6). This finding is notable because
it suggests that most hazardous liquid and gas transmission pipeline miles are under the kind of
centralized supervision and control that would be required for the operation of remote-control
valves.

26
See https://www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-mileage-and-facilities.
27
PHMSA. Pipeline Incident Flagged Files.
https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/data_statistics/pipeline/PHMSA_Pipeline_Safety_Flagged_Inc
idents.zip.
28
As in Chapter 4, the incidents examined do not include those involving pipeline system components whose
valves, manual or otherwise, are not normally intended for emergency shutdowns, such as valves at compressor
stations and drain lines. Furthermore, the incident reports examined included only those involving pipelines having
diameters of 6 inches or more.

PREPUBLICATION COPY—Uncorrected Proofs

31
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 2-5 Types of valves used to shut down hazardous liquid and gas transmission
pipelines in reported incidents in HCAs and Class 3 and 4 locations, 2010 to 2022.
NOTES: The reports are for both insignificant and significant incidents, pipelines with diameters
of at least 6 inches, and when valve types were reported. “Mixed” refers to when the upstream
and downstream valves used to isolate the incident were of different types.
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “gtggungs2010toPresent,”
https://www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-incident-flagged-files.

FIGURE 2-6 Share of reported hazardous liquid and gas transmission pipeline incidents in
HCAs and Class 3 and 4 locations where SCADA systems were installed, 2010 to 2022.
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “gtggungs2010toPresent,”
https://www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-incident-flagged-files.

PREPUBLICATION COPY—Uncorrected Proofs

32
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

While these incident records offer some insight into the prevalence of RMVs, the study
committee wanted to obtain additional sources of information on the use and spacing of these
devices in HCAs and Class 3 and 4 locations. The committee therefore asked the main industry
associations for natural gas and hazardous liquid pipeline operators—the American Gas
Association, Interstate Natural Gas Association of America, and American Petroleum Institute—
to forward questionnaires to their members (see Appendix C) asking for information on their
pipeline mileage and valves in HCAs and Class 3 and 4 locations. Specifically, operators were
asked to report anonymously their pipeline mileage by diameter, decade of installation, and
commodity transported. Furthermore, they were asked to report on the number of shutoff valves
on the pipelines; the average spacing between valves; and whether the valves are operated
manually, automatically, or remotely. In the case of hazardous liquid pipelines, the operators
were also asked to report by type of HCA—that is, high population area, other population area,
commercially navigable waterway, drinking water, and ecologically sensitive area. In addition,
operators were asked to report on their total onshore pipeline system mileage by main
commodity type (to include mileage outside HCAs and Class 3 and 4 locations) but without
providing the same level of detail about pipeline characteristics (age, diameter).
A total of 21 gas transmission and 7 hazardous liquid pipeline operators completed the
questionnaire, including 4 of the latter who reported data for pipelines carrying HVLs. For the 21
gas transmission pipeline operators, their individual system-wide total mileage ranged from 20
miles to more than 51,000 miles. For the seven hazardous liquid pipeline operators, their system-
wide total mileage ranged from 120 miles to more than 13,500 miles. The gas transmission
pipeline operators reported mileage ranging from 0.5 miles to more than 3,700 miles in HCAs or
Class 3 and 4 locations. The hazardous liquid pipeline operators reported mileage ranging from 5
miles to more than 3,800 miles of pipeline in HCAs.
To check the representativeness of the 28 respondents, the mileage reported was
compared to mileage reported to PHMSA by all operators in fulfillment of annual reporting
requirements. As shown in Table 2-5, the respondents accounted for 25% and 22% of total
(national) gas transmission and hazardous liquid pipeline mileage, respectively. The responding
gas pipeline operators accounted for a comparable share (more than 25%) of all gas transmission
pipeline mileage in HCAs and Class 3 and 4 locations. The responding hazardous liquid pipeline
operators accounted for a comparable share (more than 20%) of all hazardous liquid pipeline
mileage in HCAs. Comparing PHMSA statistics 29 and the questionnaire-generated data about
HCA pipeline mileage by diameter and year of installation, similar consistencies emerged to
suggest that the respondents provide a reasonably good indication of the prevalence of shutoff
valves of different types on hazardous liquid and gas transmission pipelines and their average
spacing. 30,31

29
See https://www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-mileage-and-facilities.
30
For gas transmission pipelines, PHMSA’s 2022 Annual Report reports 6–12-inch pipelines corresponding to
29% of the total pipeline system, 14–22-inch pipelines at 20%, 24–36-inch pipelines at 39%, and greater than 38-
inch pipelines at 4%. The survey responses reported 26%, 26%, 42%, and 1.5%, respectively. The Annual Report
also corresponds to 31% of pipelines installed pre-1960s, 22% in the 1960s, 10% in the 1970s, 8% in the 1980s,
10% in the 1990s, 9% in the 2000s, 8% in the 2010s, and 2% in the 2020s. The survey responses reported 27%,
24%, 10%, 11%, 9%, 9%, 8%, and 1%, respectively.
31
For hazardous liquid pipelines, PHMSA’s 2021 Annual Report reports 6–12-inch pipelines corresponding to
60% of the total pipeline system, 14–22-inch pipelines at 24%, 24–36-inch pipelines at 13%, and greater than 38-
inch pipelines at 1%. The survey responses reported 54%, 31%, 10%, and 3%, respectively. The Annual Report also
corresponds to 24% of pipelines installed pre-1960s, 15% in the 1960s, 13% in the 1970s, 8% in the 1980s, 8% in

PREPUBLICATION COPY—Uncorrected Proofs

33
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE 2-5 Mileage Operated by Hazardous Liquid and Gas Transmission Pipeline Operators
Responding to Study Survey, Spring 2023
Mileage Reported by Survey Respondents
Pipeline Type System Class 3 Class 4 HCA
Gas Transmission (21 74,999 8,873 258 5,574
operators)
Share of All Miles in National 25% 26% 35% 26%
Systema
High Other Drinking Ecological Navigable
System Population Population Water Resource Waterway
Hazardous Liquid (7 operators) 48,433 5,967 10,407 9,165 8,841 2,194
Share of All Miles in National 22% 20% 24% 28% 28% 26%
Systemb
a
The percentages calculated use 2022 data for gas transmission pipelines from PHMSA’s annual report. For gas
transmission pipelines, PHMSA reported 298,325 miles of onshore pipeline, including 33,543 miles in Class 3
locations, 744 miles in Class 4 locations, and 21,369 miles in HCAs.
b
The percentages calculated use 2021 data for hazardous liquid pipelines from PHMSA’s annual report. For
hazardous liquid pipelines (HVL and non-HVL), PHMSA reported 224,695 miles of onshore pipeline, including
29,427 miles in high population HCAs, 47,050 miles in other population HCAs, 34,033 miles in drinking water
HCAs, 33,137 miles in ecological resource HCAs, and 9,484 miles in commercially navigable waterway HCAs.
SOURCE: TRB survey of pipeline operators, Spring 2023.

As will be discussed more in Chapter 3, PHMSA regulations set maximum spacing

intervals for shutoff valves on gas transmission pipelines in Class 3 and 4 locations. 32 The
maximum spacing for a gas transmission pipeline is 5 miles for a Class 4 location and 8 miles for
a Class 3 location. Valves on pipelines in Class 1 and 2 locations must be spaced no more than
20 miles apart. There are no maximum valve spacing requirements for existing hazardous liquid
pipelines specific to HCAs; however, the April 2022 rule requiring RMVs on newly constructed
and entirely replaced pipelines 33 establishes a maximum valve spacing of 7.5 miles for HVL
pipelines and 15 miles for all other hazardous liquid pipelines in HCAs.
Although not all respondents to the questionnaire reported their average valve spacings,
20 did. As shown in Figure 2-7, all 15 responding gas pipeline operators reported an average
valve spacing within the 5- and 8-mile maximums established in regulation. Five of the seven
responding hazardous liquid pipeline operators would have high compliance if they were subject
to the valve spacing maximums that apply to newly constructed pipelines. This concordance is
not surprising in light of the ASME B31.8 block valve spacing requirement that has been in
place since the 1950s and was incorporated into the federal gas transmission standards in the
1970s.
The data from the questionnaires and the PHMSA incident reports suggest that manually
operated sectionalizing valves are already installed along the lengths of gas transmission and

the 1990s, 7% in the 2000s, 20% in the 2010s, and 3% in the 2020s. The survey responses reported 28%, 17%, 13%,
10%, 9%, 7%, 11%, and 4%, respectively.
32
49 CFR Part 192.179.
33
49 CFR Part 195; Amendment to Require Valve Installation and Minimum Rupture Detection Standards.

PREPUBLICATION COPY—Uncorrected Proofs

34
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

hazardous liquid pipelines at intervals in general accordance with the April 2022 rule for newly
constructed and entirely replaced segments of pipelines.

FIGURE 2-7 Average shutoff valve spacing for pipelines reported by gas (left) and
hazardous liquid (right) pipeline operators responding to the study survey, Spring 2023.
NOTE: The box and whisker charts show the mean (x), median (horizontal line within the box),
upper and lower quartiles (top and bottom of the box), minimum and maximum values excluding
outliers (whisker), and outliers (o).
SOURCE: TRB survey of pipeline operators, Spring 2023.

In addition to reporting average valve spacings, operators reported the total number of
valves on pipelines in each HCA and Class 3 and 4 location, as shown in Table 2-6. Based on the
responses, manually operated valves are predominant, accounting for more than three-quarters of
valves installed on gas transmission pipelines, more than half of valves on hazardous liquid
pipelines, and about two-thirds of valves on HVL pipelines. The RMVs on gas transmission
pipelines are primarily automatic and remote-control shutoff valves. By contrast, the RMVs on
hazardous liquid and HVL pipeline systems are almost entirely remote-control valves and other
types (i.e., check valves) of EFRDs. The near absence of automatic shutoff valves on hazardous
liquid pipelines may be explained by concern that activation of an automatic shutoff valve
without other system adjustments could cause mechanical damage to the pipeline by hydraulic
shock (i.e., water hammer).

PREPUBLICATION COPY—Uncorrected Proofs

35
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE 2-6 Number and Types of Valves Installed on Hazardous Liquid and Gas
Transmission Pipelines in HCAs and Class 3 and 4 Locations, as Reported by Operators
Responding to the Study Survey, Spring 2023
Valve Type
Type of Pipeline Manual Automatic Remote Other EFRD
Gas Transmission

Number of Valves 4,205 545 702 86

Percent of Valves 76 10 13 <2

Hazardous Liquid (non-HVL)
Number of Valves 3,491 1 1,713 1,081
Percent of Valves 56 ~0 27 17
HVL
Number of Valves 579 0 341 20
Percent of Valves 62 0 36 2

SOURCE: TRB survey of pipeline operators, Spring 2023.

Thus, when comparing the data on valve types from incident reports and the
questionnaire responses, there is a fair amount of consistency. To recap, the incident data suggest
that about 55% of valves on all transmission pipelines located in HCAs are manually operated
and the remaining 45% are RMVs. The survey data suggest that the ratio of manual valves to
RMVs is somewhat higher, on the order of 65% to 35%. The incident reports also suggest that
manual valves are most common on gas transmission pipelines, accounting for about 85%, while
the questionnaire data suggest that manual valves account for about 75%. The prevalence of
manual valves is lower for hazardous liquid (including HVL) pipelines according to both the
incident (~55%) and questionnaire data (~60%).
Chapters 3 and 5 of this report go into greater depth on operator-reported cost ranges for
installing RMVs; how operators make determinations about when and where to install these
devices; and current regulatory requirements, direction, and guidance on their use.

SUMMARY POINTS

Most Pipeline Miles in High Consequence Areas Are Part of Large Systems

As reported by operators, at year-end 2021 about 40% of hazardous liquid pipeline mileage was
located in HCAs, while 19% of gas transmission pipeline mileage was located in HCAs and
Class 3 and 4 locations. Large shares of the HCA mileage were managed by a relatively small
number of operators with large systems. In the case of gas transmission pipelines, 12 operators
managed more than 60% of the mileage in HCAs and Class 3 and 4 locations. In the case of
hazardous liquid pipelines, 18 operators managed more than 75% of the HCA mileage.

PREPUBLICATION COPY—Uncorrected Proofs

36
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Rupture Mitigation Valves Are Being Used on Existing Transmission Pipelines in High
Consequence Areas

A combination of operator survey results and data from incident reports suggests that the most
prevalent valves on hazardous liquid and gas transmission pipelines in HCAs are manual valves;
however, RMVs are common, accounting for about 35% to 40% of valves. Although RMVs are
more common in hazardous liquid pipelines than gas transmission pipelines, operators of both
types of pipelines have significant operational experience using RMVs. The data suggest that for
both types of pipelines, valves are currently spaced at intervals that either comply or are in
general accordance with the spacing requirements for RMVs for newly constructed and entirely
replaced segments of pipelines. Furthermore, the data suggest that SCADA systems are almost
universal on existing hazardous liquid and gas transmission pipelines, meaning that much of the
connectivity and telemetry required for RMVs may already be in place. Existing valve spacings
and the prevalence of SCADA systems suggest that it may be possible to add RMVs to many
existing pipelines through manual valve retrofits and replacements rather than investments in
new valve locations and centralized control mechanisms.

PREPUBLICATION COPY—Uncorrected Proofs

37
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

3
Pipeline Safety Regulatory Framework

This chapter provides a high-level overview of the federal and state regulatory framework that
governs the safety of hazardous liquid and gas transmission pipelines, discusses the key required
elements of an integrity management (IM) program applicable to pipelines in high consequence
areas (HCAs), and describes how federal and state inspectors verify and enforce compliance with
IM program requirements. While IM requirements specific to the use of shutoff valves on
existing pipelines are discussed in Chapter 5, a synopsis of the provisions in the April 2022 rule
requiring rupture mitigation valves (RMVs) on newly constructed and entirely replaced segments
of pipelines is provided at the end of this chapter. This new rule applies to all pipelines that are
newly constructed, regardless of whether they are located in an HCA. A key point is that the new
rule differs fundamentally from the management-based IM approach because it establishes a
performance metric (i.e., a 30-minute rupture isolation capability) and mandates the use of a
specific mitigation measure (an RMV) if that performance cannot be achieved. The rule does not
give the operator the discretion to decide whether an RMV should be installed on the basis of its
pipeline- and site-specific IM risk analyses.

FEDERAL AND STATE REGULATION

In 1968, Congress passed the Natural Gas Pipeline Safety Act, which created the Office of
Pipeline Safety within the U.S. Department of Transportation (U.S. DOT) to implement and
oversee natural gas pipeline safety regulations. A decade later, Congress passed the Hazardous
Liquid Pipeline Safety Act of 1979, giving U.S. DOT the authority to prescribe minimum federal
safety standards for these pipelines. When the federal safety regulations to implement the acts
were issued during the 1970s and 1980s, they were derived primarily from long-standing
industry consensus standards that had been in effect at the time. Industry trade associations and
professional societies, such as the American Petroleum Institute, American Gas Association,
American Society of Mechanical Engineers (ASME), and National Association of Corrosion
Engineers, had established standards for pipeline design, construction, fabrication, maintenance,
and operations. Many of these consensus standards were incorporated directly or referenced in
the new federal regulations. Indeed, the first federal regulations governing gas transmission
pipelines were based in large part on an existing consensus standard developed by ASME:
B31.8, “Gas Transmission and Distribution Piping Systems.”
As discussed in Chapter 2, an example of a current regulation that originated in a
consensus standard is the class location concept, derived from Subsection 846.1 of B31.8,
“Required Spacing of Valves,” had established spacing standards for the installation of
sectionalizing valves along the length of a gas main. The spacing standards, as originally
established, were as follows:

• Class 1 location—each point on the pipeline must be within 20 miles of a valve.

• Class 2 location—each point on the pipeline must be within 15 miles of a valve.
• Class 3 location—each point on the pipeline must be within 8 miles of a valve.
• Class 4 location—each point on the pipeline must be within 4 miles of a valve.

PREPUBLICATION COPY—Uncorrected Proofs

38
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Consequently, many gas transmission pipelines in operation today were designed with
these original spacing standards established by ASME. Likewise, subsection 434.15.2 of
ASME’s B31.4 standard, “Liquid Petroleum Transportation Piping Systems,” established
standards for installing valves on both sides of major river crossings and at other locations
appropriate for the terrain. This consensus standard was in effect when many of today’s
hazardous liquid pipelines were constructed.
Today, the federal regulations that apply to gas transmission pipelines are in Title 49 Part
192 of the Code of Federal Regulations (49 CFR 192), while the regulations that apply to
hazardous liquid pipelines are in Title 49 Part 195 (49 CFR 195). Each of the two major sets of
regulations cover areas such as pipeline design, construction, corrosion control, pressure testing,
operations, and maintenance. Often these regulations, like the consensus standards on which they
are based, prescribe the use of specific designs, materials, equipment, or procedures. For
example, they may specify minimum pipe wall thickness or the minimum frequency of operator
inspections. They may also establish testing and performance criteria for aspects of pipeline
design and materials, usually by referencing criteria specified in consensus standards.
Since 2004, the Pipeline and Hazardous Materials Safety Administration (PHMSA) has
administered and updated these federal regulations. The agency sets the minimum federal safety
standards for all pipelines, interstate and intrastate, but depends on states for oversight and
enforcement of regulatory compliance for much of the pipeline system and for intrastate
pipelines in particular. In its role as federal regulator, PHMSA administers an inspection and
enforcement program, provides technical assistance to state pipeline safety programs, provides
training to federal and state inspectors, sponsors safety-related research, investigates incidents,
and collects and analyzes reports on pipeline releases. States are encouraged to regulate their
intrastate pipelines, but their programs must be certified by PHMSA. To be certified, states must
adopt, at a minimum, all current minimum pipeline safety standards by law and develop
processes and procedures for carrying out their programs in compliance with PHMSA
guidelines. Almost all states have chosen to regulate their intrastate gas pipelines, enforcing them
through regular inspections. However, only about one-third of states have similar programs for
their intrastate hazardous liquid pipelines; hence, responsibility for enforcing compliance with
the federal regulations that apply to interstate and intrastate hazardous liquid pipelines in the
remaining states lies with PHMSA.
States may elect to promulgate pipeline safety rules that are more stringent but are not
inconsistent with applicable federal statutes and regulations. Examples of state-specific
requirements are Maine’s demand that operators use a geographic information system to record
all valves by location, New Hampshire’s regulations that define acceptable emergency response
times (30–45 minutes), and Washington State’s requirement for emergency responses within 15
minutes for certain leak detection thresholds. 34 An especially notable state requirement is in
California’s code (Section 51013.1(b)(1)) that requires pipelines in “environmentally and
ecologically sensitive areas in the coastal zone” to be retrofitted using the “best available
technology,” 35 including leak detection systems, RMVs, or equivalent technologies. A risk
34
National Association of Pipeline Safety Representatives. 2022. Compendium of State Pipeline Safety
Requirements and Initiatives Providing Increased Public Safety Levels Compared to Code of Federal Regulations.
http://www.napsr.org/compendium.html.
35
Title 19 Part 2100 of the California Code of Regulations defines best available technology “as the technology
that provides the greatest degree of protection by limiting the quantity of release in the event of a spill, taking into
consideration whether the processes are currently in use and could be purchased anywhere in the world.”

PREPUBLICATION COPY—Uncorrected Proofs

39
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

analysis conducted by the operator is used to determine what technologies should be

implemented to reduce the volume of liquid released. The California regulation considers only
the effectiveness of the technology, not its cost.
PHMSA leverages the capabilities of state pipeline safety offices for enforcement of
pipeline safety regulations. To supplement its own force of about 200 inspectors, PHMSA has
authorized more than 400 state personnel to inspect both interstate and intrastate pipeline
systems for compliance with federal and state regulations. 36 Indeed, these state inspectors
conduct oversight for a large majority of the pipeline infrastructure under PHMSA’s authority. 37
PHMSA reimburses states for up to 80% of their total pipeline safety program expenditures.
Both PHMSA and its state partners are required to establish intervals for conducting
inspections to verify regulatory compliance. Because of the scope of the regulations, federal and
state inspectors subject operators to multiple types of inspections for procedures, programs,
processes, and record keeping. A comprehensive pipeline safety inspection will consist of pre-
inspection activities to understand how a pipeline operator devises and implements required
programs and procedures. Regulators also conduct field inspections of pipeline facilities to verify
designs, tests, operations, and maintenance practices. The federal and state inspectors’ roles in
verifying compliance with IM requirements are discussed below.

INTEGRITY MANAGEMENT PROGRAM REQUIREMENTS

In requiring hazardous liquid and gas transmission pipeline operators to develop and implement
IM programs in HCAs, PHMSA has emphasized that the programs are intended to supplement,
or overlay, the actions taken by operators to comply with all other prescribed minimum
requirements applicable to pipelines generally. The rationale for instituting the IM regulations is
that because individual pipeline systems are diverse in their design, condition, configuration,
operation, and environmental and topographical settings, an exclusive reliance on generally
applicable, prescriptive regulations could not account for the context- and site-specific sources of
risk to safe operations in the industry. Another stated purpose of the IM requirements is to
compel operators to take direct responsibility for identifying and managing their risks, under the
assumption that operators are likely to be more cognizant than the regulator of the specific
threats and risk factors associated with their pipelines. 38 Accordingly, the IM process differs
from traditional prescriptive regulation by requiring operators to put in place management
processes that obligate them to identify threats and their risks and to take additional risk-reducing
actions beyond those required for pipelines generally as appropriate to each pipeline’s
circumstances.
The hazardous liquid and gas transmission pipeline IM rules differ in certain respects. As
a general matter, however, to be compliant with the rules an operator must do the following:

• Conduct a baseline assessment of all pipelines that could affect an HCA and repeat
the assessment on a regular basis. The integrity of the pipelines must be assessed by
internal inspections, pressure tests, or equivalent alternative technologies.

36
See https://www.phmsa.dot.gov/pipeline/effort-allocation/federal-effort.
37
PHMSA. State Programs Overview. https://www.phmsa.dot.gov/working-phmsa/state-programs/state-
programs-overview.
38
65 Fed. Register, 75378, December 1, 2000.

PREPUBLICATION COPY—Uncorrected Proofs

40
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

• Integrate all data about the pipeline from diverse sources to analyze the entire range
of threats and assess risks to a pipeline’s integrity.
• Take prompt action to evaluate any identified anomalies and remediate conditions
that pose a threat to the integrity of the pipeline.
• Take measures to prevent and mitigate the consequences of a failure based on threat
identification and risk assessment.
• Measure and assess the effectiveness of the program and improve it, informed by
these assessments.

For IM planning generally, the PHMSA rules refer operators to ASME B31.4 (for
hazardous liquid pipelines) and B31.8 (for gas transmission pipelines) as industry guidance that
specifically addresses pipeline system integrity. Pipeline operators are expected to follow the
consensus standards but can deviate from certain prescriptions in them as long as they have a
mature program that satisfies the IM rule’s intent. A key element of an IM program is the
requirement that pipeline operators conduct systematic analyses of the risks to the integrity of
their pipelines and assessments of the measures that should be taken to reduce risk. The types of
risk models used by operators to conduct the risk assessments are discussed in more detail in
Chapter 5; they range from simple qualitative methods that express risk in relative terms (i.e.,
high, medium, low) but not numerically to more sophisticated quantitative system-level models
that use algorithms that model physical and local relationships of risk factors and estimate
quantitative outputs for likelihood and consequences in terms such as frequency, probability, and
expected losses.
As noted in Chapter 1, the quality of operator IM assessments, including risk analyses,
has been the subject of criticism over the past two decades. Significant program deficiencies
have been found in multiple National Transportation Safety Board (NTSB) investigations of
major pipeline failures, including the 2010 gas transmission pipeline explosion in San Bruno,
California. 39 NTSB has raised concerns that the development and execution of IM programs
requires operators to have or obtain expertise in multiple technical disciplines, including
engineering, materials science, geographic information systems, data management, statistics, and
risk management. 40 Questioning whether operators have acquired such expertise, NTSB has
urged PHMSA to increase its guidance on how to develop and implement IM programs, pointing
in particular to the need for operator guidance on the types of risk assessment approaches
allowed by regulation. One of the actions taken by PHMSA to respond to NTSB’s
recommendation was the creation of a Risk Modeling Work Group. Chapter 5 takes a closer look
at issues surrounding risk modeling and the 2020 report 41 of this PHMSA work group.

39
Chapter 1 cites the relevant NTSB reports.
40
NTSB. 2015. Safety Study: Integrity Management of Gas Transmission Pipelines in High Consequence
Areas. SS-15/01. Washington, DC.
41
PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation.
https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-
Document-02-01-2020-Final.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

41
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

GUIDANCE AND TRAINING ON INTEGRITY MANAGEMENT ENFORCEMENT

AND COMPLIANCE

Operators do not require advance approval from regulators before instituting an IM program, but
federal and state inspectors are responsible for reviewing the program’s content and execution
once in place. During these reviews, inspectors verify that a program meets regulatory minimum
requirements and contains program elements that are functionally correct in the design and use
set forth in an operator’s overall IM program. They also examine operator decisions,
conclusions, and actions taken, including choices about preventive and mitigative measures, in
response to the IM-required assessments of pipeline condition, threats, and risks. The aim is to
understand whether individual IM program elements, as planned and documented, meet
regulatory obligations and to verify that the program elements are being implemented
appropriately.
Because risk assessments are an integral part of IM planning, inspectors must be capable
of understanding an operator’s risk analyses methods and tools, including the types of risk
models used (e.g., quantitative or qualitative). To support IM inspections, PHMSA requires
inspectors from partner states and its program to attend qualification courses provided by its
Training and Qualification Division (TQ). 42 Base-level inspectors must pass these courses to be
qualified by PHMSA to inspect IM programs, and each IM inspection must have an IM-qualified
lead inspector. To qualify its own inspectors and the hundreds of state inspectors, TQ administers
a specialized training center, located in Oklahoma City, where it provides hands-on training in
laboratories and field sites, while also providing training modules and seminars online and in
individual states. TQ also provides guidance and technical assistance materials for distribution to
inspectors.
PHMSA also provides inspectors with enforcement guidance through documents that
provide regulatory interpretations and describe practices and techniques that should be used in
undertaking compliance verification and inspection activities. An aim is to facilitate consistency
of practice. The guidance documents include guidance for enforcing the IM rules for hazardous
liquid and gas transmission pipelines. 43 In the documents, the guidance cites precedent
interpretations of regulations, contains links to advisory bulletins and reference materials, gives
examples of probable violations, and provides answers to frequently asked questions. The
guidance in these documents that pertains to the enforcement of IM requirements for operators to
conduct RMV assessments is discussed in more detail in Chapter 5.
PHMSA’s enforcement guidance can be consulted by pipeline operators to obtain a better
understanding of the agency’s expectations for regulatory compliance and documentation. Since
the advent of IM rules more than 20 years ago, the pipeline industry has also benefitted from a
burgeoning subindustry of consultants and subject matter experts who assist operators with the
design and development of their IM programs and with the implementation of certain program
elements such as risk analysis and modeling. Standards organizations are often the source of the
core guidance for IM program frameworks; for instance, the American Petroleum Institute has
developed Recommended Practice 1160, “Managing System Integrity for Hazardous Liquid

42
See https://www.phmsa.dot.gov/training/pipeline/inspector-training-and-qualifications-overview.
43
See https://www.phmsa.dot.gov/pipeline/enforcement/gas-integrity-management-enforcement-guidance.

PREPUBLICATION COPY—Uncorrected Proofs

42
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Pipelines,” 44 and ASME offers a selection of online and in-person courses and publications that
cover compliance with standards as referenced in federal pipeline regulations, including
standards related to IM. 45 Given the array of resources available for facilitating regulatory
compliance, even small pipeline operators that lack in-house technical expertise and tools to
identify threats and model risks, as required by IM, can obtain such services from third parties.

VALVE INSTALLATION AND RUPTURE DETECTION RULE

The IM regulations provide operators latitude in choosing specific risk prevention and mitigation
measures depending on pipeline- and site-specific factors and, when justified, based on an
appropriate risk assessment and evaluation of risk management options. As noted earlier,
following its investigation of the San Bruno gas pipeline rupture, NTSB raised concerns about
whether operators were consistently performing assessments in accordance with the requirements
of the regulations and recommended that PHMSA directly require RMVs on pipelines in HCAs
and populated areas. 46 In response to NTSB’s recommendation (P-11-11), Congress passed the
Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, which mandated the use of
automatic and remote-control valves, or equivalent technologies, on newly constructed or
entirely replaced segments of pipelines when economically, technically, and operationally
feasible. 47
The valve installation and rupture detection rule, which was issued in April 2022 and
became effective as of October 2022, introduced minimum rupture detection standards and valve
installation requirements for newly constructed and entirely replaced segments of pipelines,
including pipelines that are not in HCAs. 48 The rule revised several sections of regulations
within Parts 192 and 195 of Title 49 of the Code of Federal Regulations. Specifically, the rule
sets standards for the installation, operation, and spacing of automatic shutoff valves, remote-
control shutoff valves, or alternative equivalent technologies on newly constructed or entirely
replaced segments of gas transmission, Type A gas gathering, 49 and hazardous liquid pipelines
with diameters of 6 inches or more. 50 In addition, the regulations define these valves as RMVs,
deployed to minimize the volume of gas, hazardous liquid, or carbon dioxide released from the
pipeline to mitigate the consequences of a rupture. 51 Relevant regulatory changes from the April
2022 rule are listed in Table 3-1.
Regarding newly constructed or entirely replaced segments of pipelines, the rule requires
operators to install RMVs, or equivalent technologies, at designated valve spacing intervals.

44
See https://www.techstreet.com/api/standards/api-rp-1160?product_id=1863868.
45
See https://www.asme.org/publications-submissions/books/find-book/pipeline-integrity-management-
systems-practical-approach/print-book.
46
NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San
Bruno, California, September 9, 2010. Report PB2011-916501. Washington, DC.
47
Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, section 4, 2012.
https://www.gpo.gov/fdsys/pkg/PLAW-112publ90/pdf/PLAW-112publ90.pdf.
48
68 Fed. Register, 20940–20992, April 8, 2022.
49
While Type A gas gathering lines are included in the list of applicable pipelines due to their higher operating
pressures and proximity to high population areas, Type A gathering lines are required to follow most of 49 CFR 192
regulations that apply to gas transmission pipelines. See https://www.phmsa.dot.gov/technical-
resources/pipeline/gas-gathering/gas-gathering-regulatory-overview; https://www.ecfr.gov/current/title-49/subtitle-
B/chapter-I/subchapter-D/part-192/subpart-A/section-192.8.
50
68 Fed. Register, 20940–20992, April 8, 2022.
51
49 CFR Part 192.3 Definitions and 49 CFR Part 195.2 Definitions.

PREPUBLICATION COPY—Uncorrected Proofs

43
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Equivalent technologies, including the use of manual valves, are acceptable if they can be closed
within 30 minutes under the worst-case conditions following rupture identification. In addition,
operators can use a manual valve as an alternative equivalent technology if they can demonstrate
to PHMSA that an RMV is technically, operationally, or economically infeasible. Examples of
technical, operational, or economic infeasibility include unavailable labor or equipment, lack of
access to communications or power, the inability to secure required land access rights and
permits, terrain restrictions, prohibitive cost, and lack of access to operator personnel for
installation and maintenance. 52
PHMSA also clarified its requirements for RMVs in the new rule, including a
performance-based standard for their function that applies to both hazardous liquid and gas
transmission pipelines. 53 The regulation specifies that an “operator must, as soon as practicable
but within 30 minutes of rupture identification … fully close any RMVs or alternative equivalent
technologies necessary … to mitigate the consequences of a rupture.” 54 All newly installed
RMVs must be able to meet the 30-minute performance standard, which was selected for its
practicality for measurement informed by PHMSA consultations with its gas and hazardous
liquid pipeline advisory committees. 55

TABLE 3-1 Added or Modified Regulations in 49 CFR Parts 192 and 195 per Valve Installation
and Spacing Rule
49 CFR 192: Transportation of Natural and Other Gas by Pipeline: Minimum Federal Safety Standards
Regulations Purpose
§ 192.179 (e)–(f) Transmission line valves; § 192.634 (a) Operators must install RMVs or equivalent
Transmission lines: Onshore valve shut-off for rupture mitigation technologies onto newly constructed or entirely
replaced segments of gas transmission pipelines
greater than or equal to 6 inches in accordance with
the appropriate valve spacing requirements
§ 192.179 (g) Transmission line valves; § 192.634 (b)–(c) Outlines standards for the use of equivalent
Transmission lines: Onshore valve shut-off for rupture technologies to RMVs, including the use of manual
mitigation; § 192.636 Transmission lines: Response to a rupture, valves and the requirement to close installed RMVs
capabilities of rupture-mitigation valves (RMVs) or alternative within 30 minutes following rupture detection
equivalent technologies; § 192.745 (d) Valve maintenance:
Transmission lines
§ 192.179 (h) Transmission line valves; § 192.634 (b) Specifies valve spacing requirements, with
Transmission lines: Onshore valve shut-off for rupture mitigation exceptions, for all class locations on newly
constructed or entirely replaced segments of gas
transmission pipelines

52
68 Fed. Register, 20940–20992, April 8, 2022
53
49 CFR Part 192.636 and 49 CFR Part 195.419.
54
“As such, in this final rule, PHMSA has retained those same requirements while simplifying the language to
state that an RMV installed in accordance with Part 192.935 and Part 195.452 must comply with all of the other
RMV requirements in the respective parts of the regulations.” The accompanying footnote for this excerpt lists the
relevant sections in the Code of Federal Regulations including Part 192.636 for gas transmission and Part 195.419
for hazardous liquid pipelines, which specify the performance-based standard for RMVs and alternative equivalent
technologies.
55
68 Fed. Register, 20940–20992, April 8, 2022.

PREPUBLICATION COPY—Uncorrected Proofs

44
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

§ 192.935 (c) What additional preventive and mitigative measures Mandates that operators install RMVs or equivalent
must an operator take? Risk analysis for gas releases and technologies if a risk analysis determines that the
protection against ruptures installation would be an efficient means to add
protection to an HCA
49 CFR 195: Transportation of Hazardous Liquids by Pipeline
Regulations Purpose
§ 195.258 (c)–(d) Valves: General; § 195.418 (a) Valves: Onshore Operators must install RMVs or equivalent
valve shut-off for rupture mitigation technologies onto newly constructed or entirely
replaced segments of hazardous liquid pipelines
greater than or equal to 6 inches in accordance with
the appropriate valve spacing requirements
§ 195.258 (e) Valves: General; § 195.419 Valve capabilities; Outlines standards for the use of equivalent
§ 195.420 (e) Valve maintenance technologies to RMVs, including the use of manual
valves and the requirement to close valves within
30 minutes following rupture detection
§ 195.260 (c), (e), (g) Valves: Location; § 195.418 (b) Valves: Specifies valve spacing requirements on newly
Onshore valve shut-off for rupture mitigation constructed or entirely replaced segments of
hazardous liquid and highly volatile liquid pipelines
in HCAs and non-HCAs
§ 195.452 (i)(4) Pipeline integrity management in high Mandates that operators install emergency flow
consequence areas restricting devices if a risk analysis determines that
the installation is needed on a pipeline segment
located in or that could affect an HCA

The April 2022 rule created new spacing requirements for the installation of RMVs on
newly constructed and entirely replaced segments of hazardous liquid pipelines, while leaving in
place the spacing requirements for gas transmission pipelines. Table 3-2 shows the spacing
requirements. The regulations for gas transmission pipelines apply to all pipeline segments
except those located in Class 1 or 2 locations with a potential impact radius of 150 feet or
less. 56,57

TABLE 3-2 RMV Spacing Requirements for Newly Constructed and Entirely Replaced
Segments of Hazardous Liquid and Gas Transmission Pipelines with Diameters Greater Than or
Equal to 6 Inches
RMV Spacing per HCA and Class (miles)
Non-HCA or Class 1
Type of Pipeline or 2 Location HCA Class 3 Class 4
Gas Transmission 20 — 15 8
Hazardous Liquid 20 15 — —
Highly Volatile Liquid 7.5 7.5 — —

56
49 CFR Part 192.179 Transmission line valves.
57
49 CFR Part 192.634 (a) Transmission lines: Onshore valve shut-off for rupture mitigation.

PREPUBLICATION COPY—Uncorrected Proofs

45
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

SOURCES: 49 CFR Part 192.179 Transmission line valves (e)–(h); 49 CFR Part 192.634
Transmission lines: Onshore valve shut-off for rupture mitigation; 49 CFR Part 195.260 Valves:
Location; 49 CFR Part 195.418 Valves: Onshore valve shut-off for rupture mitigation.

SUMMARY POINTS

Pipeline Safety Regulation Is a Federal and State Responsibility

Pipeline safety regulation is a federal and state responsibility. Most inspections to verify
compliance with the federal regulations are performed by state inspectors under PHMSA-
delegated authorities.

Pipeline Operators Face Challenges Implementing Integrity Management Risk

Management Processes and Inspectors Face Challenges Verifying Compliance

A major element of PHMSA’s safety regulations for gas transmission and hazardous liquid
pipelines in populated and environmentally sensitive areas is the requirement for operators to
develop and implement IM programs. The IM regulations provide operators the discretion to
implement risk reduction strategies suited to their specific pipelines and site-specific
circumstances based on risk assessments and by employing other risk management processes.
The regulations, by and large, do not prescribe the use of specific risk reduction measures,
beyond those already required by regulation, but obligate operators to institute programs for risk
management involving risk identification, assessment, and prevention and mitigation.
In the 20 years since the IM requirements were introduced for pipelines in HCAs, NTSB
and others have raised concerns about whether pipeline operators have the capacity to employ
rigorous risk assessment methods and tools and whether they are consistently using them for IM
planning and decision making, including to inform choices about when to use RMVs. PHMSA,
standards organizations, and industry have introduced guidance, training, and other support for
industry and pipeline safety inspectors. Federal and state inspectors nevertheless face challenges
in verifying compliance with IM obligations because of the need to assess whether operators are
following all required processes, using appropriate methods and tools to assess risk and decide
on appropriate risk reduction actions, and implementing such actions in the field.

Mandates for Rupture Mitigation Valve Installations Diverge from the Integrity
Management Approach

The current policy approach to RMV installation on existing pipelines is to incorporate the
decision into the IM program, which gives pipeline operators leeway to make choices about their
use of risk reduction measures that exceed the federal minimums. The new rule requiring the
installation of RMVs on newly constructed and entirely replaced segments of pipelines mandates
a specific protective measure unless it is infeasible; in this respect, it is similar to the many other
requirements in federal pipeline safety regulations that apply generally.

PREPUBLICATION COPY—Uncorrected Proofs

46
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

4
Safety Review

As with extraction, refining, and processing activities, the long-distance transportation of

hazardous liquids and gases by transmission pipeline is a high-hazard activity but one that can
be—and usually is—carried out safely on a daily basis. The primary safety aim of the pipeline
industry and federal and state regulators is to prevent failures that can lead to unintentional
pipeline releases, while also preparing for them through post-release mitigation and response
capabilities. The previous chapter explained how prevention and mitigation are furthered through
industry activities and federal and state regulation. In this chapter, the safety performance of the
hazardous liquid and gas transmission pipeline industries are reviewed, giving particular
attention to incident consequences and their mitigation.
The chapter begins with an overview of the general types of scenarios where the release
of product from a gas or hazardous liquid pipeline can yield consequences harmful to people and
the environment. The recent history of pipeline incidents is then reviewed, first for natural gas
transmission pipelines and then for hazardous liquid pipelines, with a focus on incidents in high
consequence areas (HCAs) and Class 3 and 4 locations. Trends and patterns discerned from
incidents reported to the Pipeline and Hazardous Materials Safety Administration (PHMSA) are
presented, including reported consequences.
Statistical analyses of incident reports can be helpful for identifying emerging or
recurring problems that deserve more scrutiny and possible interventions; however, like many
high-hazard industries, the pipeline sector can experience incidents having severe consequences
but with frequencies that are too low to observe as trends or patterns in incident reporting. Such
high-consequence incidents, such as the 2010 rupture of a gas transmission pipeline in San
Bruno, California, have factored into the National Transportation Safety Board’s (NTSB’s)
decisions to recommend that PHMSA mandate the use of rupture mitigation valves (RMVs) on
hazardous liquid and gas transmission pipelines. Rupture prevention is not fail-safe; hence,
RMVs are seen as a way to reduce consequences by isolating the rupture site quickly to
minimize released product. This chapter therefore provides a short synopsis of NTSB and
PHMSA findings from investigations of this major pipeline incident as well as five others, noting
how and when shutoff valves were deployed.
Following a summary assessment of the findings from the chapter’s review of incident
reporting statistics and these major accident investigations, an addendum presents the results of
an analysis of the socio-demographic characteristics of communities proximate to incidents that
have been reported for hazardous liquid and gas transmission pipelines. In recent years, long-
distance transmission pipelines have been attracting increased public attention due to concerns
ranging from safety assurance to emissions of greenhouse gases. The nature of this public
interest has taken on new dimensions as awareness about the potential equity impacts of pipeline
facilities has grown, including sensitivity to whether precautions are being taken in an equitable
manner to protect the safety, health, and environments of the communities through which long-
distance pipelines pass. If not already part of the decision-making calculus, equity impacts are
likely to receive more explicit attention in the future as pipeline risks and consequences are being
modeled and as regulatory requirements are being debated and revised. The analysis in the

PREPUBLICATION COPY—Uncorrected Proofs

47
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

addendum represents a preliminary attempt to consider equity in a way that may prompt more
sophisticated follow-on analyses by PHMSA and others.

POTENTIAL CONSEQUENCES OF A GAS OR HAZARDOUS LIQUID PIPELINE

RELEASE

Hazardous liquids are defined in Title 49 Code of Federal Regulations (CFR) Part 195.2
“Definitions” as follows: “Hazardous liquid means petroleum, petroleum products, anhydrous
ammonia, and ethanol or other non-petroleum fuel, including biofuel, which is flammable, toxic,
or would be harmful to the environment if released in significant quantities.” Similarly, gases are
defined in Title 49 CFR 192.3 “Definitions” as follows: “Gas means natural gas, flammable gas,
or gas which is toxic or corrosive.”
As these definitions imply, the release of these products into the environment because of
a pipeline failure could result in the formation and spread of a toxic and/or flammable pool of
liquid or cloud of gas. Many transported liquid and gaseous products, such as the petroleum-
related products of butadiene and propane, can be flammable, toxic, or both.
The consequences of a hazardous liquid or gas transmission pipeline release can be
categorized into the following general scenarios:

• Flammable liquids or gases

o Ignition upon or soon after release—a fire (typically referred to as a pool fire
[liquids] or a flash/jet fire [gases]), with the subsequent continuing and possible
spread of fires dependent on the ability and time to shut off and isolate the flow of
flammable liquids or gases.
o Delayed ignition—for liquids, formation of a pool of liquid, which then ignites
and burns until the flammable material is consumed or can be extinguished; for
gases or liquids that rapidly vaporize on release, the formation of a flammable
cloud of material, which when ignites and could explode and continue burning
until the flammable gases are consumed.
o No ignition—formation and spread of a toxic/corrosive pool of liquid or cloud of
gas that could contaminate and harm people and various forms of wildlife and
vegetation.
• Non-flammable liquids or gases
o As above with no ignition—the formation and spread of a toxic/corrosive pool of
liquid or cloud of gas that could asphyxiate, contaminate, or otherwise harm
people and various forms of wildlife and vegetation.

Two factors associated with the pipeline’s design and installation that dominate the
potential volume of product that can be released from a failure are the diameter of the pipe and
the distance between the sectionalizing valves that can be closed to shut off the flow of fluids to
the release point. Table 4-1 presents information on the volume of liquid or gas contained within
a 1-mile length of pipeline having a diameter from 6 to 48 inches.

PREPUBLICATION COPY—Uncorrected Proofs

48
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE 4-1 Volume of Liquid or Gas Contained Within a 1-Mile Length of Pipeline by Pipe
Diameter
Nominal Vol. Gas at 500 Vol. Gas at 1,000 Vol. Gas at 1,500
Diameter Vol. Liquid psi psi psi
(in.) (gal.) (scf) (scf) (scf)
6 7,121 35,904 76,032 120,912
12 27,765 141,768 299,957 476,955
24 99,765 507,197 1,073,002 1,706,443
36 262,818 1,333,939 2,822,002 4,487,789
48 473,930 2,406,254 5,090,554 8,095,507
NOTES: The liquid and gas volumes for each pipeline diameter were calculated using the
volumetric equation for a cylinder [Volume = π(radius)2 × length] using a length of 1 mile. The
volume was then converted to gallons for liquid and standard cubic feet (scf) for gas at the
specified pressure. For gas, this is calculated assuming room temperature and using Z2P1V1 =
Z1P2V2, where Z2 is the compressibility factor of natural gas at standard pressure, P1 is the
designated pressure, V1 is the volume of the cylinder with the given radius, Z1 is the
compressibility factor of natural gas at the designated pressure, P2 is standard pressure (14.7 psi),
and V2 is the calculated volume of the gas at standard pressure.

Factors that influence the rate at which materials are released include the properties of the
fluid (e.g., viscosity of the liquid material), the size and shape of the hole or point of failure in
the pipeline, and the pressure at which the pipeline was operating. In general, the larger the
diameter of the hole and higher the pressure in the pipeline, the faster the release of fluids from
the pipeline.
The sequence of events following a catastrophic failure of a pipeline, such as a rupture, is
typically categorized into three phases as follows:

• Phase 1—Detection or Identification. The detection phase begins immediately after

the pipeline ruptures and continues until the release of materials is detected and
recognized or confirmed by the pipeline operator. During this period product
continues to flow through the pipeline as pumps or compressors continue to operate
and valves remain open. The rate of product released during this phase tends to be at
its highest.
• Phase 2—Shutdown and Block Valve Closure. This period begins after the failure is
detected and the pipeline operator initiates actions to shut down any pumps or
compressors on the failed segment and close block valves upstream and downstream
of the release site to isolate the failed segment. Depending on the commodity, the
initial pressure in the pipeline, and other factors such as temperature, the rate of
product release during this phase will start to decrease.
• Phase 3—Blowdown or Drain Down. The blowdown (gases) or drain down (liquids)
phase begins after complete closure of the block valves located upstream and
downstream of the release site. For gases, this phase ends when the pressure of the
product in the pipeline reaches the same pressure as at the site of the release (i.e.,
typically 1 atmosphere). For liquids, drain down may continue for some time, such as

PREPUBLICATION COPY—Uncorrected Proofs

49
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

when the site of the release is at a low point in the pipeline allowing product to
continue to flow to and drain from the pipeline, albeit at an ever-decreasing rate of
release.

INCIDENT HISTORY OVERVIEW

Operators of hazardous liquid and gas transmission pipelines are required to submit a report to
PHMSA of an incident 58 (e.g., leak, rupture, mechanical puncture) that has occurred to one of
their pipelines as soon as practicable but not more than 30 days after detection of the
incident. 59,60 PHMSA collects, collates, and makes available on its website a spreadsheet version
of the various data the operators provide in their reports. 61 Most of the data and information
presented next were extracted from the sets of incident files PHMSA makes available on its
website.
Several times, PHMSA has revised the reporting forms and the information operators are
required to report. For example, it was not until 2010 that PHMSA first required operators of gas
transmission pipelines to provide an estimate of the volume of gas released due to a failure in
their equipment. In contrast, operators of hazardous liquid pipelines have been reporting an
estimate of the volume of hazardous liquid released since 2002. As a result, in the analyses that
follow, it was not always possible to include information on reported incidents prior to 2010.

Incident History: Gas Transmission Pipelines

During the 30-year period from 1993 to 2022, gas transmission pipeline operators reported 324
incidents occurring within Class 3 and 4 locations or HCAs. For this report, the only incidents
included in the analyses are those involving system parts directly relevant to gas transmission
pipelines and their valves. 62 Incidents involving system parts separate from the main
transmission line or relating to equipment located at pipeline facilities, such as compressors or
drain lines, were not included, as they do not pertain to the emergency shutoff valves relevant to
this study.
In 2010, PHMSA started to require gas transmission pipeline operators to report the
volume of gas released. Table 4-2 provides a summary of the consequences of gas transmission
pipeline incidents that occurred within Class 3 and 4 locations and HCAs from 2010 to 2022, as

58
This report opts for the term incident as a catch-all for a hazardous liquid and gas transmission pipeline
failure event.
59
49 CFR Part 191.15(a)(1) Transmission systems, gathering systems, liquefied natural gas facilities and
underground storage systems: Incident report. 49 CFR 191.3 “Definitions” defines incident to mean a release of gas
involving any of the following: (a) a death or personal injury necessitating in-patient hospitalization, (b) estimated
property damage of $122,000 or more, (c) unintentional estimated gas loss of 3 million cubic feet or more, or (d) an
event that is significant in the judgment of the operator.
60
49 CFR Part 195.50 Reporting Accidents. 195.50 requires hazardous liquid pipeline operators to report all
incidents that result in (a) an explosion or fire not intentionally set by the operator, (b) a release of 5 gallons or more
of hazardous liquid or carbon dioxide, (c) death of any person, (d) personal injury necessitating hospitalization, or
(e) property damage in excess of $50,000.
61
PHMSA. Data and Statistics Overview. https://www.phmsa.dot.gov/data-and-statistics/pipeline/data-and-
statistics-overview.
62
Examples include pipes/pipelines, valves, flange assemblies, repair sleeves or clamps, and welds/fusions.
Items labeled as “other” were included, as most of these were related to the transmission pipeline itself and those
related to pipeline facilities were negligible and did not impact the overall findings.

PREPUBLICATION COPY—Uncorrected Proofs

50
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

reported by operators. Figure 4-1 provides further details on the number of gas transmission
pipeline incidents reported from 1993 to 2022, along with the miles of gas transmission pipeline
located within Class 3 and 4 locations. 63

TABLE 4-2 Gas Transmission Pipeline Incidents in HCAs and Class 3 and 4 Locations with
Measures of Consequences, 2010 to 2022
Cost of
Property Cost
Damage Total Volume of Gas
No. of No. of No. of (Million, (Million, Released
Category Incidents Fatalities Injuries 2023) 2023) (Million scf)

Totala 174 10 70 $53.9 $1,019 881

Average/year 13.4 0.8 5.4 $4.1 $78.4 67.8
The consequences of the 2010 San Bruno, California, natural gas release, explosion, and fire dominate the
a

numbers.
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “gtggungs2010toPresent.”

The focus is on Class 3 and 4 locations because the 30-year span includes years prior to the establishment of
63

HCAs.

PREPUBLICATION COPY—Uncorrected Proofs

51
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-1 Gas transmission pipeline incidents (1993 to 2022) and miles of gas
transmission pipeline in Class 3 and 4 locations (2001 to 2022).
SOURCE: PHMSA. Pipeline Incident Flagged Files: file titles “gtgg1986to2001,”
“gtgg2002to2009,” and “gtggungs2010toPresent.” PMHSA. Gas Transmission and Hazardous
Liquids Annual Report Data, https://www.phmsa.dot.gov/data-and-statistics/pipeline/gas-
distribution-gas-gathering-gas-transmission-hazardous-liquids.

As discussed in Chapter 3, PHMSA’s integrity management rule for gas transmission

pipelines was issued in December 2003 and came into force in 2004. The preamble to the rule
notes that it “comprehensively addresses statutory mandates, safety recommendations, and
conclusions from accident analyses, all of which indicate that coordinated risk control measures
are needed to improve pipeline safety.” 64
As Figure 4-1 depicts, there had been an upward trend in reported incidents starting in
1993 through 2004, with an average of approximately seven occurring per year over that time
period. From 2004 to 2022 (i.e., after the introduction of the IM regulations), the number of
incidents in Class 3 and 4 locations averaged approximately 13 per year. After 2004, no
discernible pattern in the annual change in the number of incidents can be observed, although
since 2018 the number of incidents has decreased.
From 2001 to 2004, approximately 4,000 miles of pipeline were added to the gas
transmission network in Class 3 and 4 locations (i.e., an overall increase of approximately 13%).
From 2004 through 2022, the reported overall miles of gas transmission pipelines in Class 3 and
4 locations have remained relatively constant at approximately 34,500 miles.
Figure 4-2 presents the reported costs (updated for inflation to 2023 dollars) of gas
transmission pipeline incidents in Class 3 and 4 locations for 1993 to 2022. The figure includes
64
68 Fed. Register, 69778, December 15, 2003.

PREPUBLICATION COPY—Uncorrected Proofs

52
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

the volumes released starting in 2010, which is the first year all operators were required to
provide that information.

FIGURE 4-2 Reported costs (1993 to 2022) and volume of product released from gas
transmission pipeline incidents in Class 3 and 4 locations (2010 to 2022).
SOURCE: PHMSA. Pipeline Incident Flagged Files: file titles “gtgg1986to2001,”
“gtgg2002to2009,” “gtggungs2010toPresent,” and “annual_gas_transmission_gathering” reports
2001–2022.

Because Class 3 and 4 locations and HCAs for gas transmission pipelines are designated
based on the nature of the built environment along the pipeline right-of-way, the factors
dominating the costs of gas transmission pipeline incidents are impacts on human life and
damage to surrounding property from an explosion or fire. Two incidents—one in Edison, New
Jersey, in 1994 (total cost of $55 million [2023 dollars]) and the 2010 rupture in San Bruno,
California (total cost of $899 million [2023 dollars])—dominate the physical and subsequent
economic consequences of the pipeline failures (e.g., fatalities, injuries, and property damage)
and the costs of those consequences. Summaries of both incidents are provided later in this
section.
Since 2010, PHMSA has asked operators who are reporting an incident to indicate the
type of valves used upstream and downstream from the point of release to isolate the failed
segment. The forms also prompt the operator to report the length of the segment of pipeline that
was isolated. Over the period of 2010 to 2022, gas transmission pipeline operators submitted 124
reports of incidents within Class 3 or 4 locations or HCAs that identified the type of valve used

PREPUBLICATION COPY—Uncorrected Proofs

53
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

to isolate the failed segment. The reports also provided information on the length of the segment
that was isolated once the valves were closed.
Figure 4-3 shows the percent of reported gas transmission pipeline incidents in an HCA
or Class 3 or 4 location during the 2010–2022 period in which a valve was reported on the
segment. The chart is categorized by the decade in which the pipeline segment was installed and
includes a comparison with the overall percent of gas transmission pipeline miles installed within
that decade.
After removing pipelines of an unknown decade of installation, approximately 59% of
these reported incidents within Class 3 and 4 locations (or that could affect an HCA) occurred on
pipeline segments installed prior to 1970, which is when minimum federal safety standards were
introduced. While the majority share of incidents occurring on pre-1970 pipelines is notable, the
59% value aligns with the fact that approximately 54% of the gas transmission pipeline miles in
active service were installed prior to 1970. Conversely and because they are relatively new, it
might be of interest that approximately 20% of the incidents occurring from 2010 to 2022 were
on pipelines that were installed between 1990 and 2022; however, approximately 30% of the
overall network of gas transmission pipelines was installed in that same period. These
differences may arise from the fact that many of the pipelines installed from 1990 to 2022 were
not in place for the full period of 2010 to 2022.

FIGURE 4-3 Number of gas transmission pipeline incidents and reported product released
in Class 3 and 4 locations per valve type and decade of pipeline installation, 2010 to 2022.

PREPUBLICATION COPY—Uncorrected Proofs

54
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

NOTES: MCF = one thousand cubic feet. “Mixed” indicates when the upstream and downstream
valves used to isolate the incident were of different types. In five of the incident reports where a
manual valve was used, the operator listed only the upstream or downstream valve and therefore
it is possible that an automatic or remote control valve was also used.
SOURCES: PHMSA. Pipeline Incident Flagged Files, file title “gtggungs2010toPresent”; and
PHMSA. Annual Gas Transmission Gas Gathering 2010–Present, file title “annual_gas
_transmission_gathering _2022.”

As shown in Figure 4-3, in approximately 83% of the reported incidents within a Class 3
or 4 location, manual valves—located upstream and downstream of the release site—were used
to isolate the failed pipeline. 65 In addition, about 10% of the reported incidents (12 incidents)
used a different valve upstream and downstream from the release site. While four of these cases
were a combination of an automatic and remote-control shutoff valve, the remaining eight
incidents were a combination of a manual valve and an automatic and remote-control shutoff
valve or check valve. Notably, the unintentional volume of gas released where a manual valve
was used to isolate the segment was approximately 15 times the volume released in the cases
where automatic shutoff valves were installed and 113 times the volume in cases where remote-
control shutoff valves were installed. However, those figures may be distorted because during
the 2010 to 2022 period, only five incidents were reported with installed automatic shutoff
valves and four with remote-control shutoff valves.
In 114 reported gas transmission pipeline incidents that occurred from 2010 to 2022
within a Class 3 location, the operator provided information on the length of the segment that
was isolated. Figure 4-4 provides a summary of the reported lengths of the segments that were
isolated following a failure in a pipeline and a release of gas.

65
Five incidents only listed “manual” as the upstream or downstream valve, while leaving the other blank.

PREPUBLICATION COPY—Uncorrected Proofs

55
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

REPORTED LENGTH OF ISOLATED SEGMENTS

IN CLASS 3 LOCATIONS

> 16 miles
1%

8 - 16 miles
12%

≤ 8 miles
87%

FIGURE 4-4 Summary of the lengths of gas transmission pipeline segments isolated in a
Class 3 location because of a pipeline incident, 2010 to 2022.
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “gtggungs2010toPresent.”

49 CFR 192.179 stipulates that no point on a gas transmission pipeline within a Class 3
location should be more than 4 miles from a valve (i.e., the distance between valves within Class
3 locations should not exceed 8 miles). In approximately 87% of the 114 incidents in which the
length of the isolated segment is reported, the overall length isolated was noted to be 8 miles or
less. In 12% of the cases, the distance of the isolated segment exceeded 8 miles. Of the 114
incidents, there was only one instance in which the length of the isolated segment was reported
to be 20.4 miles (i.e., more than twice the distance stipulated in the federal regulations). The
reasons for the variation from the regulatory requirements cannot be ascertained from the
incident reports.
In the reports of seven incidents that occurred in a Class 4 location, the operators
provided information on the length of the isolated segment. In six instances, the lengths were
below the 4-mile requirement stipulated in 49 CFR 192.179. In one case, the length of the
isolated segment was reported to be 7.6 miles (i.e., approximately twice the distance stipulated in
the federal regulations). Again, the reasons for this discrepancy are not clear.
PHMSA recently started collecting information on the time(s) (in hours and minutes) at
which a gas transmission failure or release was first identified and confirmed by the pipeline
operator and the time(s) at which valves upstream and downstream of the release site were
closed. In 24 incidents within Class 3 and 4 locations during 2018 to 2022, operators reported
these times. In 17 instances, the valves upstream and downstream of the release site were both
manual valves, while in 4 instances a manual valve was listed as either an upstream or
downstream valve (with the other left blank). The reported average time between when the
rupture was identified and when the valves were closed was 4 hours and 43 minutes. In two
instances, the upstream and downstream valves were controlled remotely, and the reported times

PREPUBLICATION COPY—Uncorrected Proofs

56
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

to close the valves were 17 and 50 minutes, respectively. In the other case, the upstream and
downstream valves included a manual valve and a remote-control valve, and the operator
reported a closure time of 130 minutes for the remote-control shutoff valve and just more than 4
hours for the manual valve.

Notable Gas Transmission Pipeline Ruptures

The first two incidents summarized below were investigated by NTSB and PHMSA. They
involved the rupture of a natural gas transmission pipeline that had catastrophic consequences
because of the gas being released to the atmosphere. In both cases, valves were not shut down for
more than an hour after the pipeline had ruptured. The third, more recent incident summarized
below was investigated by PHMSA. It did not have similarly catastrophic consequences to
human life and property but did result in significant product losses due again to shutdown taking
more than an hour to close valves and isolate the failed segment.

1994—Edison, New Jersey 66 On March 23, 1994, at approximately 11:55 p.m., a 36-inch-
diameter natural gas transmission pipeline that was constructed and installed in 1961 ruptured
catastrophically in Edison Township, New Jersey. The force of the rupture propelled fragments
from the pipeline, rocks, and other debris more than 800 feet from the site of the rupture. The
initial force of the rupture created a crater about 140 feet long, 65 feet wide, and 14 feet deep.
Within 1 to 2 minutes of the rupture the escaping gas ignited, sending flames 400 to 500 feet in
the air. Emergency response personnel evacuated 23 individuals to a local hospital, and another
70 individuals made their own way to hospitals. In addition, 1,500 occupants in a complex of
two- and three-story apartments had to escape on foot from the residences. Cars within the area
could not be used as the heat from the fires made the metal too hot to touch.
The 400- to 500-foot flames were fed for about 2.5 hours before crews from the pipeline
operator could access and manually close valves located approximately 3 to 3.5 miles upstream
and downstream of the release.
One of several findings of the NTSB investigation into this incident was that the
operator’s “lack of automatic or remote operated valves on Line 20 prevented the company from
promptly stopping the flow of gas to the failed pipeline segment, which exacerbated damage to
nearby property.”
As a result of this finding, one of NTSB’s recommendations to the U.S. Department of
Transportation (U.S. DOT) was to “expedite requirements for installing automatic or remote
operated mainline valves on high-pressure pipelines in urban and environmentally sensitive areas
to provide for rapid shutdown of failed pipeline segments (Class II, Priority Action) (P-94-1).”

2010—San Bruno, California 67 On September 9, 2010, at about 6:11 p.m., a 30-inch-diameter

segment of a natural gas transmission pipeline that was installed in 1956 ruptured
catastrophically in a suburban area of San Bruno, California. The section of pipe that ruptured
was about 28 feet long and weighed about 3,000 pounds. That section was ejected from its
original position and found 100 feet from the site of the rupture. The rupture resulted in a crater

66
NTSB. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New
Jersey, March 23, 1994. Pipeline Accident Report NTSB/PAR-95/01. Washington, DC.
67
NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San
Bruno, California, September 9, 2010. NTSB/PAR-11/01. Washington, DC.

PREPUBLICATION COPY—Uncorrected Proofs

57
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

about 72 feet long and 26 feet wide. The released natural gas ignited almost immediately
following the rupture. Eight individuals were fatally injured, another 10 were seriously injured,
and 48 other individuals were treated for minor injuries. Blast injury was not identified as the
cause of death for any of the eight fatalities. For three of the fatalities, the medical examiner
indicated that the cause was undetermined. For the five others, the cause of death was listed as
fire, specifically “generalized conflagration effects.” One person survived for 18 days before
succumbing to their injuries. The pipeline operator estimated that approximately 47.6 million
standard cubic feet (scf) of gas were released.
Eight homes were destroyed and another 70 buildings were damaged. For about 50 hours
following the initial rupture of the pipeline, 600 firefighting (including medical service)
personnel and 325 law enforcement personnel responded. In total about 300 homes were
evacuated. Figure 4-5, taken from NTSB’s report, shows the site of the incident after the fires
were finally extinguished.

FIGURE 4-5 Site of the San Bruno gas transmission pipeline rupture.
SOURCE: NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline
Rupture and Fire, San Bruno, California, September 9, 2010. NTSB/PAR-11/01. Washington,
DC.

The cost of this incident as recorded in PHMSA’s incident database

(“gtggungs2010toPresent” denotes all costs in 1984 dollars) is $305.9 million, or approximately
$899.4 million in 2023 dollars. This cost figure does not include the $1.4 billion fine levied by
the operator by the California Public Utilities Commission.
According to NTSB’s investigations, it took about 95 minutes from the time the pipeline
first ruptured for qualified personnel to access and close manual valves located approximately
1.5 miles apart upstream and downstream of the rupture site. Provisions in 49 CFR Part
192.935(c) stipulate that operators are to conduct a risk analysis of their pipelines in Class 3 and
4 locations. Furthermore, the regulations require that when the operator determines that the
installation of an RMV (remote control valve) is an efficient means to mitigate the consequence,

PREPUBLICATION COPY—Uncorrected Proofs

58
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

they must install the RMV. As part of its investigations, NTSB found a 2006 memo that was
prepared by Pacific Gas and Electric (PG&E) in respect to these provisions. 68 The memo cited
industry references that as most of the damage from a pipeline rupture occurs within 30 seconds
of a release and ignition of the gas cloud, the use of an automatic or remote-control shutoff valve
as a mitigation measure in an HCA would have “little or no effect on increasing human safety or
protecting properties.” At one of NTSB’s investigative hearings, a PG&E manager
acknowledged that the use of remote-control valves could have reduced the time taken to isolate
the rupture by about 1 hour. As a result, NTSB concluded that the 95 minutes it took the operator
to stop the flow of gas to the rupture site was excessive, contributed to the severity and extent of
property damage, as well as presented an increased risk of injury to residents and emergency
responders. The report went on to note that had the two isolation valves—located approximately
1.5 miles apart upstream and downstream of the rupture site—been outfitted with remote closure
capability, prompt closure of the valves would have allowed emergency responders to enter the
affected area sooner.
As a result of these findings, NTSB recommended (P-11-11) that PHMSA “amend Title
49 Code of Federal Regulations 192.935(c) to directly require that automatic shutoff valves or
remote-control valves in high consequence areas and in Class 3 and 4 locations be installed and
spaced at intervals that consider the factors listed in that regulation.”

2020—West Palm Beach, Florida 69 On September 24, 2020, at approximately 9:48 a.m., an 18-
inch-diameter gas transmission pipeline that was installed in 1959 ruptured at the intersection of
Lake Worth Avenue and Interstate-95 in the general area of West Palm Beach. The segment of
the pipeline in which the rupture occurred follows the general path of Interstate-95 through this
urbanized area. The released gas did not ignite, and there were no fatalities or injuries. Manual
valves located approximately 15 miles apart were closed and the pipeline segment isolated at
approximately 10:53 a.m. (i.e., approximately 65 minutes after the rupture occurred). The
operator estimated the volume of natural gas released at 12 million scf. The operator estimated
the total cost of the incident at approximately $1.7 million. Figure 4-6 shows the general
environment surrounding the site of the release. 70

68
NTSB public docket for NTSB/PAR-11/01.
69
PHMSA. Pipeline Incident Flagged Files: file title “gtggungs2010toPresent.”
70
NTSB. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New
Jersey, March 23, 1994. Pipeline Accident Report NTSB/PAR-95/01. Washington, DC.

PREPUBLICATION COPY—Uncorrected Proofs

59
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-6 Site of the 2020 18-inch-diameter natural gas transmission pipeline release in
the West Palm Beach area of Florida.
SOURCE: PHMSA. National Pipeline Mapping System, https://www.npms.phmsa.dot.gov.

Incident History: Hazardous Liquid Pipelines

While PHMSA’s Pipeline Incident Flagged Files contain records of hazardous liquid pipeline
incidents starting in 1986, it was not until 2002 that the forms contained fields for
operators to indicate whether a release could affect an HCA. For this report, the only incidents
included in the analysis are those involving system parts directly relevant to hazardous liquid
pipelines and their valves. 71 Incidents involving system parts separate from the main pipeline or
relating to equipment located at pipeline facilities, such as pumps or drain lines, were not
included, as they do not pertain to the emergency shutoff valves relevant to this study. Figure 4-7
provides the number of hazardous liquid pipeline releases each year from 2002 through 2022.
The figure also shows the total installed miles of hazardous liquid pipeline segments that were
reported as “could affect” an HCA in the event of a release starting in 2004, which was the first
year that PHMSA required operators to report such data for the annual reports.

71
Examples include pipes, valves, flange assemblies, repair sleeves or clamps, and welds/fusions. Items labeled
as “other” were included, as most of these were related to the transmission pipeline itself and those related to
pipeline facilities were negligible and did not impact the overall findings.

PREPUBLICATION COPY—Uncorrected Proofs

60
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-7 Hazardous liquid pipeline incidents (2002 to 2022) and miles of pipeline in
HCAs (2004 to 2022).
SOURCES: PHMSA. Pipeline Incident Flagged Files: file titles “hl2002to2009” and
“hl2010toPresent”; and PHMSA. Annual Hazardous Liquid 2010 to Present files: file titles
“annual_hazardous_liquid_2004_2009” and “annual-hazardous-liquid-2010-present.”

Over the period of 2004 to 2007, the reported miles of hazardous liquid pipelines in an
HCA (or that could affect an HCA) in the event of a release averaged approximately 72,000
miles, and the number of reported incidents averaged approximately 32 per year. Starting in the
2007–2008 timeframe, the miles of pipeline segments involving an HCA increased by about one-
third to approximately 95,500 miles in 2020. During this same period, the number of reported
incidents also increased but at a larger rate, averaging approximately 47 per year (i.e., about a
45% increase). Since 2017–2018, incidents reported per year have decreased, averaging about 38
per year over the period of 2017 to 2022 (i.e., a few incidents more than the 2004 to 2007 period
but with about 20,000 additional pipeline miles). During 2020–2022, the reported miles of
pipeline in an HCA decreased by about 5% (i.e., from a reported approximately 95,500 to 90,000
miles). Figure 4-8 provides the total volume of hazardous liquid released from pipeline segments
in an HCA each year along with the total costs of those incidents in 2023 dollars.

PREPUBLICATION COPY—Uncorrected Proofs

61
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-8 Volume of hazardous liquid released per year and reported costs, 2002 to
2022.
SOURCE: PHMSA. Pipeline Incident Flagged Files: file titles “hl2002to2009” and
“hl2010toPresent.”

The 2010 Marshall, Michigan, rupture of a 30-inch pipeline that released 840,000 gallons
(approximately 20,000 barrels) of heavy crude oil into a wetland area and the Kalamazoo River
dominates the reported incidents. A summary of the Marshall incident is provided below. In
addition to this major incident, significant releases occurred in 2011, 2013, and 2015 that
affected HCAs and resulted in cumulative costs exceeding $250,000,000 in each of those 3
years.
There are five categories of HCAs that could be affected by a release of hazardous
liquids: populated areas, including (1) high population areas (HPAs) or (2) other populated areas
(OPAs); unusually sensitive areas, including (3) an ecological or environmental resource or
sensitive area or (4) a drinking water resource (DW); and (5) commercially navigable waterways
(CNWs).
In many of the reported incidents, the release was noted as potentially affecting multiple
HCA types. As an example, reports have indicated that a single release could have affected an
HPA, OPA, DW, and perhaps a CNW. A review of the incidents found that a primary factor
impacting the overall costs associated with a hazardous liquid release was cleanup of the spill.
Depending on the type of HCA into which the commodity was released, reported costs ranged
from a low of $200 to more than $150,000 per barrel. This variation in cost is due in part to the
type of commodity, and the locations where the releases occurred and their associated cleanup
complexities. In 2020, for instance, a total of 72,000 barrels of hazardous liquid released resulted
in reported costs of around $192 million (i.e., an average cost of $2,666/barrel). Conversely, in

PREPUBLICATION COPY—Uncorrected Proofs

62
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

2015, a total of 9,700 barrels of released product resulted in reported costs around $295 million
(i.e., an average cost of $30,400/barrel).
Since 2010, the form for reporting incidents of product released from hazardous liquid
pipelines includes information on the type of valve used to isolate the failed segment and the
length of the segment. Figure 4-9 presents the share of incidents reported from 2010 to 2022 that
could affect an HCA for non-highly volatile liquids (non-HVLs) (e.g., crude oil and refined
petroleum products) and HVLs where a valve was reported on the pipeline segment. The chart is
categorized by the decade in which the pipeline was installed and includes a comparison with the
overall percent of hazardous liquid (non-HVL) and HVL pipeline miles installed within that
decade.

PREPUBLICATION COPY—Uncorrected Proofs

63
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-9 Number of hazardous liquid pipeline incidents and reported product released in HCAs per valve type and
decade of pipeline installation, 2010 to 2022.
NOTE: “Mixed” indicates when the upstream and downstream valves were of different types.
SOURCES: PHMSA. Pipeline Incident Flagged Files, file title “hl2010toPresent”; and PHMSA. Annual Hazardous Liquid 2010 to
Present, file title “annual_hazardous_liquid_2010_present.”

PREPUBLICATION COPY—Uncorrected Proofs

64
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

As depicted in Figure 4-9, the percent of releases occurring on segments of non-HVL

hazardous liquid pipelines that were installed pre-1950 through 1979 (i.e., pipelines of an age of
40 or more years) is greater than the percent of miles of pipelines installed. Pre-1970 pipelines
were installed prior to the introduction of the minimum federal safety standards for hazardous
liquid pipelines. Some of the observed differences in the occurrence of incidents may arise from
the fact that some of the pipelines installed from 1990 to 2022 were not in place for the full
period of 2010 to 2022.
In contrast to gas transmission pipelines, remote-control shutoff valves were reported to
have been used in approximately 34% and 21% of the incidents involving non-HVL hazardous
liquid and HVL pipelines, respectively. A manual valve was reported to have been used in about
43% of the incidents involving a release of a non-HVL hazardous liquid and in 51% of the
incidents involving releases of an HVL. In addition, automatic shutoff valves were used in about
7% of non-HVL hazardous liquid incidents, while 16% of incidents involved the use of a mix of
valves, where the upstream and downstream valves installed were of different types. For HVL
pipeline incidents, automatic shutoff valves were used in about 7% of incidents, while 22%
involved the use of multiple valve types. More than 90% of both the non-HVL hazardous liquid
and HVL pipeline incidents with different types of upstream and downstream valves used a
combination of a manual valve and an RMV (i.e., automatic and remote-control shutoff valve or
check valve). Another contrast to what is observed for gas transmission pipelines, as shown in
Figure 4-3, is that the volumes of commodity released during hazardous liquid pipeline incidents
were 1.5 to 3 times higher for incidents involving the use of remote-control valves than incidents
involving manual valves.
As noted in Chapter 3, PHMSA’s recent regulation for newly constructed and entirely
replaced segments of pipelines established a requirement to install an RMV at a spacing not to
exceed 15 miles for pipelines transmitting non-HVL hazardous liquids and 7.5 miles for those
carrying HVLs. Table 4-3 provides a summary of the lengths of pipeline segment that were
isolated due to a reported release in an HCA for the period 2010 to 2022.
In approximately 77% of the reported incidents involving the release of a non-HVL
hazardous liquid, the length of the isolated pipeline segment was reported to be less than 15
miles, with an average length of 4.8 miles. In the other 23% of the incidents, the isolated pipeline
segment was reported to be longer than 15 miles, with an average length of 33.8 miles (i.e., more
than twice the distance required in the RMV regulations for newly constructed pipelines). For
incidents involving a release of HVLs, in about 61% of the cases the length of the pipeline
segment isolated was reported to be less than 7.5 miles, with an average spacing of 3.3 miles. For
the other 39% of the cases involving a release of HVLs, the reported length exceeded 7.5 miles,
with an average length of 19.8 miles (or approximately three times the distance specified in the
new RMV regulations). Here again, the reason for these variances from the required spacing
interval could not be determined from the incident reports.

PREPUBLICATION COPY—Uncorrected Proofs

65
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE 4-3 Reported Number and Average Lengths of Hazardous Liquid Pipeline Segments
Isolated from Releases, Incidents from 2010 to 2022
No. of No. of
Reports, Avg. Reports, Avg.
Segment Segment Segment Segment
Length Length Length Length
<15 mi <15 mi >15 mi >15 mi
Crude Oil 326 4.8 99 33.8
No. of No. of
Reports, Avg. Reports, Avg.
Segment Segment Segment Segment
Length Length Length Length
<7.5 mi <7.5 mi >7.5 mi >7.5 mi
HVLs 72 3.3 46 19.8
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “hl2010toPresent.”

Over the period of 2020 to 2021, operators submitted 30 reports of releases from pipeline
segments in an HCA that included the time the release was first identified and the time the
upstream valves were closed. Table 4-4 provides a summary of the reported times by the type of
upstream valve closed.

TABLE 4-4 Overview of the Elapsed Times from First Identifying a Hazardous Liquid Release
to Closing the Upstream Valve, Incidents from 2010 to 2022
Upstream No. of Avg. Time to Range of Time
Incidents Upstream Valve to Valve
Valve Type
Closure (min.) Closure (min.)
Manual 12 171 0–1,130
Remote-Control 15 30 1–125
Automatic 3 257 0–757
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “hl2010toPresent.”

Based on what operators reported for the incidents in which remote-control valves were
installed, the period of time from identification to closure of upstream and downstream valves
was approximately one-fifth of the average elapsed time taken when compared with incidents
where the upstream valve was manual. While automatic valves have a longer average time to
valve closure, two instances were below 15 minutes while the third instance took more than 12
hours to close. Therefore, the average time to closure for automatic valves is likely skewed due
to the low number of incident reports.

Notable Hazardous Liquid Pipeline Ruptures

The following three incidents investigated by NTSB and PHMSA involved the rupture of a
hazardous liquid pipeline that had catastrophic consequences due to the commodity being
released. In all three cases, valves upstream and downstream of the release site remained open
for upward of 1 hour.
PREPUBLICATION COPY—Uncorrected Proofs

66
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

1999—Bellingham, Washington 72 On June 10, 1999, at about 3:18 p.m., a 16-inch-diameter

pipeline that was installed in 1966 ruptured and released about 237,000 gallons of gasoline into a
creek that flowed through a park in Bellingham, Washington. Due to a variety of factors
involving the pipeline’s supervisory control and data acquisition (SCADA) system, a command
to shut down remotely controlled valves upstream and downstream of the rupture site was not
initiated until approximately 4:32 p.m. (i.e., about 74 minutes after pipeline rupture). At
approximately 4:34 p.m. the SCADA system recorded the upstream and downstream valves to be
closed.
About 1.5 hours after the rupture the gasoline ignited and burned approximately 1.5
miles along the creek. Two children and an adult were fatally injured by the fires. Eight
additional injuries were recorded, and a single-family residence and the City of Bellingham’s
water treatment plant were severely damaged. Other consequences of the release included 24
acres of land burned along the banks of Whatcom and Hannah Creeks. Figure 4-10 is an aerial
view of the burned section of one of the creeks taken post-incident.

72
NTSB. 2002. Pipeline Rupture and Subsequent Fire in Bellingham, Washington, June 10, 1999. NTSB/PAR-
02/02. Washington, DC.

PREPUBLICATION COPY—Uncorrected Proofs

67
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-10 Aerial view of a burned section of a creek within Whatcom Falls Park after
June 1999 rupture of hazardous liquid pipeline in Bellingham, Washington.
SOURCE: NTSB. 2012. Pipeline Rupture and Subsequent Fire in Bellingham, Washington, June
10, 1999. NTSB/PAR-02/02 PB2002-916502. Washington, DC.

As part of the remediation efforts, water upstream of the release was diverted from
Whatcom and Hannah Creeks to allow for more than 1,200 feet of creek bed and banks to be
removed where gasoline had saturated 5 feet into the creek face. More than 9,500 cubic yards of
gasoline-contaminated soils were removed from the creeks. In 2002, the operator estimated the
damage to property at approximately $45 million ($76.4 million in 2023 dollars).
The two recommendations NTSB made to U.S. DOT were focused on providing
guidance about the testing of new equipment prior to being put into use and that off-line
workstations should be used when modifying and updating SCADA system software.

2010—Marshall, Michigan 73 On July 25, 2010, at 5:58 p.m., a segment of a 30-inch-diameter

pipeline that was installed in 1969 ruptured. The pipeline was transporting a viscous crude oil.
The pipeline was fitted with various instruments that monitored the pressure and flow through
the pipeline as well as remote-control valves located upstream and downstream of the rupture
site, all of which were tied into the operator’s SCADA system. Following the rupture, the system
sounded alarms indicative of a leak or rupture; however, because there had been a planned
shutdown and restart of the pipeline, control room operators interpreted the alarms to be an
artifact of the planned shutdown and restart of the pipeline. Consequently, even though the
pipeline was shut down when the SCADA system alarmed, it was restarted twice; this accounted
for approximately 80% of the estimated 20,000 barrels of crude oil that were released into the
surrounding wetlands. Approximately 17 hours after the rupture and in response to receiving
numerous calls about oil odors, the control center in Edmonton, Canada, began closing remotely
controlled valves to isolate a nearly 3-mile section of the pipeline that contained the ruptured
pipe. The remote-control shutoff valves were closed within a period of about 5 minutes once
control room staff confirmed the alarms were the result of a rupture and not due to abnormal
operating conditions.
The released crude oil saturated the wetlands area near the rupture and flowed into
Talmadge Creek and then to the Kalamazoo River. Local residents self-evacuated, and about 320
individuals reported symptoms consistent with crude oil exposure. No fatalities were reported.
NTSB noted in its report that one factor contributing to the severity of the environmental
consequences was “the failure of Enbridge’s control center staff to recognize abnormal
conditions related to ruptures.”
The cost of this incident as reported in PHMSA’s “hl2010toPresent” file is approximately
$1,350 million in 2023 dollars (PHMSA reports in 1984 dollars or $460 million). That equates to
a cost of about $67,000 per barrel or $1,610 per gallon of crude released (2023 dollars). Figure 4-
11 provides an aerial view of some of the efforts undertaken to contain the release of product and
to protect the surrounding wetlands.

73
NTSB. 2012. Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release, Marshall, Michigan,
July 25, 2010. NTSB/PAR–12/01. Washington, DC.

PREPUBLICATION COPY—Uncorrected Proofs

68
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE 4-11 Efforts undertaken to contain and collect the release of heavy crude oil from
the July 25, 2010, rupture of a hazardous liquid pipeline in Marshall, Michigan. Picture of
site was taken on July 30, 2010.
SOURCE: NTSB. 2012. Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release,
Marshall, Michigan, July 25, 2010. NTSB/PAR-12/01 PB2012-916501. Washington, DC.

2011—Yellowstone River, Laurel Montana 74 On July 1, 2011, at approximately 10:40 p.m., a

failure occurred on a 12-inch-diameter pipeline that was installed in 1991. The failed segment of
pipeline was reported to have released approximately 1,510 barrels of crude oil into the
Yellowstone River, near Laurel, Montana. There were no reported fatalities or injuries related to
the failure. Controllers shut down the pumps and valves at the beginning of the pipeline within
10 minutes of receiving alarms. However, a remote-control valve located just upstream of the
Yellowstone River was not closed for an additional 46 minutes (i.e., a total of approximately 56
minutes) after the failure was first identified. PHMSA’s report notes that the 46 minutes taken by
the control room supervisor and control room staff to analyze the various SCADA data and
alarms that were received before closing the upstream valve allowed crude oil to drain from the
failed section of the pipeline into the Yellowstone River, increasing the consequences of the
failure.
The operator estimated the total combined cost of the release at $135 million (in 2011
dollars, or approximately $183.1 million in 2023 dollars). That equates to a cost of about
$121,258 per barrel or $2,900 per gallon of crude oil released (2023 dollars).

74
U.S. DOT, PHMSA, Office of Pipeline Safety, Western Region. 2012. ExxonMobil Silvertip Pipeline Crude
Oil Release into the Yellowstone River in Laurel, Montana, on July 1, 2011. October 30, 2012. See
https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/ExxonMobil_HL_MT_10-2012.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

69
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

SUMMARY POINTS

Key Factors Affecting Release Volumes and Consequence Severity Following a Rupture

• After rupture, the two factors associated with the pipeline design and installation that
determine the volume of gas or hazardous liquid released from a pipeline are
o the elapsed time from identifying and confirming the failure and the release of
material to closing valves or using other means to shut in and isolate the failed
segment; and
o the diameter and spacing or length between valves or whatever means is used to
isolate a failed segment and, for gases, the pressure at which the pipeline was
being operated.
• Factors that impact the magnitude of the consequences include
o the physical and chemical properties of the product released including its
flammable and toxic properties; and
o the nature of the surrounding built and natural environment into which the
materials are released.

Evidence of Valve Types and Closure Times from Incident Reports: Gas Transmission
Pipelines

• There is no apparent downward trend in the number of reported incidents within

Class 3 and 4 locations or HCAs after the introduction of IM rules in 2004. The lack
of an observable trend may be attributable, in part, to the overall scatter in the number
of incidents reported each year.
• Approximately 59% of reported incidents have occurred on segments within Class 3
and 4 locations that are on pipelines installed before 1970 (i.e., pipelines 50 or more
years old), which aligns reasonably well with the fact that 54% of the overall network
of gas transmission pipelines was installed before 1970.
• For incident reports in which operators indicated the types of valves used to isolate a
failed pipeline segment, more than 80% of the cases used a manually operated valve.
Furthermore, in about 87% of the cases the length of the pipeline segment isolated
was less than the distance stipulated in federal regulations.
• Twenty-four incident reports contain information on the elapsed time from
identifying a release to closing upstream and downstream valves. In 17 cases, the two
valves used to isolate the pipeline were manual, while in 4 cases one manual valve
was listed while the other was not reported. For these 21 cases, the average time taken
to close the valves was 4 hours and 43 minutes. In two incidents, the valves were
RMVs, with reported elapsed times from identification to closure of 17 and 50
minutes, respectively. In the other case, the upstream and downstream valves
included a manual valve and a remote-control shutoff valve, and the operator reported
a closure time of 130 minutes for the remote-control valve and just more than 4 hours
for the manual valve.

PREPUBLICATION COPY—Uncorrected Proofs

70
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Evidence of Valve Types and Closure Times from Incident Reports: Hazardous Liquid
Pipelines

• There is no definitive trend of a reduction in the number of reported incidents that

could affect an HCA after the introduction of IM rules in 2001. The lack of an
observable trend may be attributable, in part, to the overall scatter in the number of
incidents reported each year.
• For pipelines transporting non-HVL hazardous liquids, approximately 70% of the
reported incidents in HCAs or that could affect an HCA were on pipelines installed
before 1970. In contrast, less than 60% of the overall pipeline network was installed
prior to 1970.
• For pipelines transporting HVLs, approximately 59% of the reported releases
occurred on pipelines installed before 1970, which aligns well with the fact that 58%
of the overall network of pipelines transporting HVLs was installed before 1970.
• For incident reports in which operators indicated the types of valves used to isolate a
failed pipeline segment, in approximately 34% of the cases the valve used was
controlled remotely. Furthermore, in about 77% of the incidents that could affect an
HCA, the length of the pipeline segment isolated was less than 15 miles, with an
average length of about 5 miles.
• Thirty incident reports contain information on the elapsed time from identifying a
release of hazardous liquid to closing upstream and downstream valves. In 12
incidents, the two valves closed to isolate the pipeline were manual, with an average
elapsed time from identification to closure of 171 minutes. In 15 incidents, the valves
were controlled remotely, and the average time from identification to closure was 30
minutes. In the other three incident reports, automatic shutoff valves activated and the
closure times averaged 257 minutes, although two incidents were closed in less than
15 minutes while the third took more than 12 hours. Therefore, the average time to
closure for automatic shutoff valves is likely skewed due to the low number of
reports.

Evidence of Valve Types and Closure Times from Incident Reports: General

A review of the incident reports submitted by operators to PHMSA supports the view that RMVs
can be an effective means of reducing the time between identifying the occurrence of a rupture
and closing valves upstream and downstream from the rupture site to isolate the failed segment.

• For existing gas transmission pipelines, an extrapolation of incident data on the

lengths of pipeline segments isolated after failure suggests that about 87% of the
overall network of gas transmission pipelines in Class 3 and 4 locations is already
fitted with isolation valves placed distances in accordance with the RMV requirement
for newly constructed pipelines. Albeit based on the information submitted, more
than 80% of these valves are now manually operated.
• For existing hazardous liquid pipelines, extrapolating from data provided on incident
reports revealed the following:

PREPUBLICATION COPY—Uncorrected Proofs

71
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

o The proportion of the installation of automatic and remote-control shutoff valves

to manual valves is higher, with approximately 40–50% of the valves being of an
automatic or remote-control type and the remaining being operated manually.
o The spacing or distance between valves also appears to be, in general, in
accordance with the provisions in the recently introduced rule for newly
constructed pipelines (i.e., at a distance of 15 miles or less for non-HVL pipelines
and 7.5 miles for HVL pipelines). Albeit due to the variety of HCAs defined in
the regulations, the actual situation for hazardous liquid pipelines is more difficult
to assess from incident records than that for gas transmission pipelines.

PREPUBLICATION COPY—Uncorrected Proofs

72
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

ADDENDUM: A LENS ON EQUITY IN DECISION MAKING

The study committee was charged with examining factors that should be considered when
establishing regulatory requirements for the installation of rupture mitigation valves (RMVs) on
existing hazardous liquid and gas transmission pipelines. In addressing its charge, the study
committee was cognizant of the broader government and societal interest in ensuring that the
equity impacts are considered when making public policy choices. Indeed, since 1994, federal
agencies have been required by executive order to make “achieving environmental justice part of
[their] mission by identifying and addressing, as appropriate, disproportionately high and adverse
human health or environmental effects of [their] programs, policies, and activities on minority
populations and low-income populations.” 75 Inasmuch as pipelines pose public safety, health,
and environmental risks, the obligation to consider equity impacts can extend to PHMSA’s
pipeline regulatory program.
While a growing body of research has focused on the safety, health, and environmental
burdens on communities that are created by highways, airports, railroads, and other similarly
conspicuous modes of transportation, long-distance pipelines have only recently begun to attract
the attention of researchers. For instance, the study committee could not find many peer-
reviewed studies that involve demographic analyses of people living and working in locations
proximate to hazardous liquid and gas transmission pipelines. A recent study by Emanuel et al.
(2021) 76 found that gas transmission and gathering pipeline densities are positively correlated
with higher levels of social vulnerability at the county level. Conversely, a recent study by
Strube et al. (2021) 77 found that gas transmission pipelines are less likely to be proposed and
planned in census tracts with high proportions of Black and Hispanic residents and high poverty
rates. The safe performance of pipelines in relation to the demographic characteristics of
communities has likewise received limited attention in the peer-reviewed literature. Luna and
Nicholas (2022) 78 found that people of color and the poor in communities in Massachusetts are
more likely to live in areas with a higher density of gas leaks; however, the study focused on
leaks from gas distribution pipelines.
A possible reason for the paucity of equity-related studies of pipeline exposures is that
detailed pipeline location data are considered security-sensitive, and thus made available on a
restricted basis only. 79 Moreover, PHMSA does not collect and publish data on the boundaries of
Class 3 and 4 locations and some HCA types, such as drinking water HCAs; boundaries that, if
known, could be mapped in relation to area populations and their socio-demographic patterns.
In not having a solid base of research to draw from, but interested in ensuring that equity
is not neglected in the calculus of pipeline safety decision making, the committee asked the
Pipeline Safety Trust (PST), a non-profit organization devoted to pipeline safety issues, to design

75
Executive Order 12898. 1994. Federal Actions to Address Environmental Justice in Minority Populations and
Low-Income Populations.
76
Emanuel, R.E., M.A. Caretta, L. Rivers III, and P. Vasudevan. 2021. Natural gas gathering and transmission
pipelines and social vulnerability in the United States. GeoHealth 5:e2021GH000442.
77
Strube, J., B.C. Thiede, and W. Ech. 2021. Proposed pipelines and environmental justice: Exploring the
association between race, socioeconomic status, and pipeline proposals in the United States. Rural Sociology
86:647–672.
78
Luna, M., and D. Nicholas. 2022. An environmental justice analysis of distribution-level natural gas leaks in
Massachusetts, USA. Energy Policy 162.
79
PHMSA. About the Pipeline Information Management Mapping Application.
https://www.npms.phmsa.dot.gov/ApplyForPIMMAAccess.aspx.

PREPUBLICATION COPY—Uncorrected Proofs

73
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

and conduct a geospatial analysis of hazardous liquid and gas transmission pipeline incidents
involving HCAs and Class 3 and 4 locations. In the absence of data on pipeline network
locations, these incident reports, which contain location coordinates, can provide an indication of
where pipelines are known to be present (because an incident occurred there) to create some
degree of risk exposure to people living and working in the vicinity. Data on the socio-
demographics of the people living in the identified locations could then be compared with data
on the socio-demographics of people in living in other locations where there were no incidents
(and thus where pipelines may or may not be present).
PST was asked to perform the analysis by using geographic information system (GIS)
tools to create a buffer, or potential impact area, around each reported incident location. Areas
encompassed within the buffer could then be matched with community-level (block group) data
on the population’s socio-demographic characteristics as collected by the U.S. Census Bureau.
The socio-demographics of these communities could them be compared with the socio-
demographics of populations in non-buffer areas. For more granularity, a similar analysis was
requested for only the states of California and Texas. The data and methods used by PST for
these geospatial analyses are summarized next.
It is important to emphasize that the committee’s purpose in requesting PST’s work was
to bring attention to equity as a factor deserving consideration when designing, implementing,
and assessing pipeline regulatory policy. The geospatial analysis is therefore described as an
“illustrative and preliminary” exercise, not suitable for drawing conclusions about whether
pipeline exposures and risks are distributed equitably or inequitably. Instead, the purpose of the
exercise is to prompt more sophisticated and data-intensive follow-on work that can be helpful
for policy making that considers equity. The addendum therefore ends by noting several of the
limitations of the analysis that would need to be addressed to further this purpose.

Geospatial Analysis of Pipeline Incidents and Community Socio-Demographics: An

Illustrative and Preliminary Exercise

Pipeline Incident Data

Data on hazardous liquid and gas transmission pipeline incidents from calendar years 2010
through March 31, 2023, were acquired from PHMSA’s online Flagged Incident Files, a publicly
available source of information on reported pipeline incidents. 80 The incident data were filtered
for only onshore incidents involving pipelines at least 6 inches in diameter and an additional
filter was applied to focus on incidents reported to have occurred in HCAs and Class 3 and 4
locations. Hazardous liquid pipeline incidents were further divided to distinguish among

80
The regulatory definition of a gas transmission incident is “[a]n event that involves a release of gas from a
pipeline … and that results in … [a] death, or personal injury necessitating in-patient hospitalization, [e]stimated
property damage of $122,000 or more … [or] an unintentional estimated gas loss of three million cubic feet or
more” (49 CFR Part 191.3). The definition has not changed since 2010, except that the reporting threshold for
property damage increased from $50,000 to $122,000 in 2021 and was tied to inflation. The definition of a
hazardous liquid incident during the period relevant to the study is “a release of the hazardous liquid … transported
resulting in … [e]xplosion or fire not intentionally set by the operator[;] [r]elease of 5 gallons (19 liters) or more of
hazardous liquid [with an exception for pipeline maintenance activities] … ; [d]eath of any person; [p]ersonal injury
necessitating hospitalization; [or] [e]stimated property damage … exceeding $50,000” (49 CFR Part 195.50).

PREPUBLICATION COPY—Uncorrected Proofs

74
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

incidents involving highly volatile liquid (HVL) and non-HVL pipelines. The filtered incident
counts at the national level are shown in Table 4A-1.

TABLE 4A-1 National Summary of Gas, Hazardous Liquid, and HVL Transmission Pipeline
Incidents in HCAs and Class 3 and 4 Locations, January 2010–March 2023
Type of System Incidents
Gas Transmission 76
Hazardous Liquid (non-HVL) 357
HVL 58
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “hl2010toPresent.”

For a more granular view, the incident data were filtered further to include only incidents
in the nation’s two most populous states, California and Texas. 81 These state-level results are
displayed in Table 4A-2. Because of the small number of incidents, HVL pipeline incidents were
not separated from hazardous liquid pipelines.

TABLE 4A-2 State-Level: California and Texas Hazardous Liquid and Gas Transmission
Pipeline Incidents in HCAs and Class 3 and 4 Locations, January 2010–March 2023
Type of System California Incidents Texas Incidents
Gas Transmission 13 13
Hazardous Liquid 38 95
(including HVLs)
SOURCE: PHMSA. Pipeline Incident Flagged Files: file title “hl2010toPresent.”

Community Socio-Demographic Data

To identify communities affected by pipeline incidents (and thus known to be near pipelines), a
GIS buffer was built around the coordinates of each incident. The buffer diameter, developed by
consulting referenced studies was set at 1,320 feet for gas pipeline incidents and 1,085 feet for
hazardous liquid pipeline incidents. 82 Socio-demographic data on economic status (household
income and unemployment rate) and race and ethnicity were acquired from the U.S. Census
Bureau’s American Community Survey for 2021 (ACS 5-year estimates) using block group
data. 83 A census block group, typically having populations of 600 to 3,000 people, is the smallest
geographical unit containing household socio-demographic sampling data.

81
Texas also has the most hazardous liquid and gas transmission pipeline mileage of all the states.
82
For reference to hazardous liquid and gas releases, PST consulted a 2012 report by Oak Ridge National
Laboratory (ORNL), Studies for the Requirements of Automatic and Remotely Controlled Shutoff Valves on
Hazardous Liquids and Natural Gas Pipelines with Respect to Public and Environmental Safety, and accident
reports published by NTSB and cited in Chapters 1 and 4.
83
Raw census data and incident data were aggregated by each desired geography using the R statistical software
package “tidyverse,” version 2.0.0. For “tidyverse” documentation, see https://cran.r-
project.org/web/packages/tidyverse/tidyverse.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

75
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

The census block groups that intersected with the buffers were defined as the affected
block groups, or “affect communities.” Household socio-demographic characteristics of these
affected communities were then compared against all other block groups in the relevant larger
jurisdiction (i.e., United States, Texas, and California).

Results and Limitations

The outcomes of the comparisons are shown in Tables 4A-3 (national level), 4A-4 (Texas), and
4A-5 (California). Because the analyses were undertaken for only illustrative purposes, the
results in the tables are not assessed and should not be used to form conclusions. There are many
limitations to the analytic methods employed that would need to be improved through the
marshaling of more data, testing of assumptions, and the use of more sophisticated statistical
methods. For instance, if pipeline incidents must be used to identify known pipeline locations (in
the absence of network location coordinates), it will be necessary to ensure that the socio-
demographic data used are aligned with the time period of the recorded incidents to account for
the social, economic, and demographic changes that will occur in communities over time.
Likewise, the diameters used to create buffers would need to be established in a more systematic
manner to have confidence that they do overestimate or underestimate the populations exposed
to the risk of a pipeline incident. Ideally the analyses could be performed in a more
comprehensive manner by using pipeline system location data rather than the incident data,
because there are certain to be many communities located near pipelines that have not
experienced an incident but are nevertheless exposed to risk.
It is important to reiterate that the analyses in this addendum were not undertaken to
reach conclusions about pipeline risk exposure and equity, but rather to call attention to the
importance of informing public policy choices through equity-oriented analyses and by exploring
the methods for doing so.

TABLE 4A-3 Comparison of Socio-Demographics of Communities Affected by a Transmission

Pipeline Incident and All Other Communities in the United States
Hazardous Liquid
Gas Pipeline Pipeline HVL Pipeline
Incidents Incidents Incidents
Socio-
Demographic All
Indicator Other Affected Difference Affected Difference Affected Difference
Percent of annual 13.5 13.8 +0.3 11.4 –2.1 10.7 –2.8
household income
<$20,000
Percent of annual 17.1 20.1 +3.0 18.1 +1.0 16.9 –0.2
household income
>$150,000
Unemployment 5.5 6.2 +0.7 5.2 –0.3 6.0 +0.5
rate
Percent White 68.0 64.4 –3.6 68.1 +0.1 77.3 +9.3
Percent Black 12.5 11.3 –1.2 11.5 –1.0 11.0 –1.5

PREPUBLICATION COPY—Uncorrected Proofs

76
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Percent Asian 5.6 6.9 +1.3 5.1 –0.5 1.4 –4.2

Percent Hispanic 19.2 24.7 +5.5 23.0 +3.8 16.8 –2.4
or Latino

Percent American
0.8 1.0 +0.2 1.0 +0.2 0.7 –0.1
Indian or Alaska
Native

TABLE 4A-4 Comparison of the Socio-Demographics of Communities Affected by a

Transmission Pipeline Incident and All Other Communities in the State of Texas
Gas Pipeline Incidents Hazardous Liquid Pipeline Incidents
Socio-
Demographic
Indicator All Other Affected Difference Affected Difference
Percent of annual 13.1 18.5 +5.4 11.3 –1.8
household income
<$20,000
Percent of annual 16.4 9.9 –6.5 19.8 +3.4
household income
>$150,000
Unemployment 5.3 5.4 –0.1 6.3 +1.0
rate
Percent White 64.3 72.4 +8.1 71.9 +7.6
Percent Black 12.1 4.6 –7.5 10.6 –1.5

Percent Asian 5.0 0.6 –4.4 2.6 –2.4

Percent Hispanic 39.8 56.3 +16.5 33.1 –6.7
or Latino

Percent American
0.5 0.6 +0.1 0.2 –0.3
Indian or Alaska
Native

PREPUBLICATION COPY—Uncorrected Proofs

77
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE 4A-5 Comparison of the Socio-Demographics of Communities Affected by a

Transmission Pipeline Incident and All Other Communities in the State of California
Hazardous Liquid Pipeline
Gas Pipeline Incidents Incidents
Socio-
Demographic
Indicator All Other Affected Difference Affected Difference
Percent of annual 11.2 11.1 –0.1 9.2 –2.0
household income
<$20,000
Percent of annual 25.1 26.6 +1.5 23.3 –1.8
household income
>$150,000
Unemployment rate 6.5 7.5 +1.0 6.4 –0.1

Percent White 52.1 54.3 +2.2 49.1 –3.0

Percent Black 5.7 4.1 –1.6 8.0 +2.3

Percent Asian 14.9 18.5 +3.6 13.5 –1.4
Percent Hispanic or 39.5 29.3 –10.2 48.7 +9.2
Latino

Percent American
0.9 0.8 –0.1 0.9 0
Indian or Alaska
Native

PREPUBLICATION COPY—Uncorrected Proofs

78
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

5
Rupture Mitigation Valve Cost and Decision Criteria for
Existing Pipelines

This chapter presents operator-provided estimates of costs for rupture mitigation valves (RMVs)
on existing pipelines in high consequence areas (HCAs) and populated (Class 3 and 4) locations.
The discussion then turns to how operators make choices about installing RMVs on existing
pipelines, first by discussing the programs several operators have instituted to prioritize RMV
deployments and then by reviewing federal requirements for operators to consider RMVs
specifically as a mitigation measure and within the broader context of their obligations for risk
assessment and risk reduction for integrity management (IM).
The first part of the chapter suggests that pipeline operators are choosing to install
automatic and remote-control shutoff valves on some existing pipelines for operational and/or
safety reasons, despite evidence and claims of costliness for some site-specific circumstances.
The second part of the chapter considers the adequacy of the direction and guidance provided by
the Pipeline and Hazardous Materials Safety Administration (PHMSA) to operators when
making such risk management choices in the public interest for their pipelines in HCAs. The
discussion surfaces shortcomings in this direction and guidance, particularly for conducting IM-
required risk analyses and for examining benefits and costs to inform risk reduction choices.

COST FACTORS AND COST RANGES FOR RUPTURE MITIGATION VALVE

INSTALLATIONS

During information-gathering sessions, the committee queried representatives of pipeline

operators and their trade associations about the costs associated with (a) retrofitting a manual
valve with an actuator to facilitate automatic or remote operation, (b) replacing an existing valve
with an RMV, and (c) adding a new valve location with an RMV. In addition, the committee
consulted PHMSA’s regulatory impact analysis (RIA) conducted for the April 2022 rule
requiring RMVs for newly constructed and entirely replaced segments of pipelines. 84 The
rulemaking’s regulatory impact documents contain information on RMV installation costs, albeit
for newly constructed and entirely replaced segments of pipelines.
The information gleaned from these sources indicates that RMV installation costs are
likely to vary widely and be highly site-specific. Estimates provided to the study committee and
to PHMSA by the American Gas Association (AGA), Association of Oil Pipe Lines, and a
number of individual pipeline operators suggest that the cost of installing an RMV at a given site
can vary widely, from as low as $30,000 to more than $10 million (see Table 5-1). For example,
if the only requirement is the addition of an automatic or remote-control actuator to an existing
valve, the installation cost is more likely to be on the lower end of the cost range but still be
affected by the availability of power and communications. Alternatively, if an operator needs to
retrofit an older pipeline and place a valve in a location that did not previously have a valve and
space is constricted, this could entail significant capital expenditures for construction, new power

PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and 195 to Require Valve Installation
84

and Minimum Rupture Detection Standards Proposed Rule. https://downloads.regulations.gov/PHMSA-2013-0255-

0046/attachment_1.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

79
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

and communication systems, and site access and preparation. The outlay required to install a new
valve can also vary depending on the diameter and operating pressure of the pipeline, as larger-
diameter and higher-pressure pipelines can be more expensive to retrofit with a new valve. If the
valve must be located in an environmentally sensitive area, such as a wetlands, the costs can
escalate further. Cost-driving factors that would need to be considered for all types of installation
(i.e., whether retrofit, valve replacement, or valve addition) include prevailing wages for
installers and technicians; costs for procuring materials and equipment (e.g., valve, actuators, and
controls); costs associated with accessing power and communications; and costs arising from
acquiring land rights, obtaining environmental permits, and making site improvements, including
site restoration. According to AGA, the cost of installing power and communication systems and
managing permitting, land, and environmental factors could add up to outlays on the order of
$250,000. 85
As a check on these figures, installation cost data summarized by PHMSA for its RIA for
the 2022 rule requiring RMVs on newly constructed pipelines were consulted. 86 Although the
cost estimates in the RIA did not account for the complexities associated with adding an RMV to
an existing pipeline, many of the same cost factors were identified, leading to similarly wide cost
ranges.

TABLE 5-1 Pipeline Industry Cost Estimate Ranges for RMV Installations
Company or
Industry
Organizationa Type of Installation Cost Range
Gas Transmission Pipelines
American Gas Manual valve upgrade or $100,000 to $1,500,000
Associationb replacement
Installation of entirely new valve $200,000 to $2,000,000
DTE Energyc Low complexity installation (e.g., $30,000 to $50,000
actuator upgrade)
Medium complexity installation $50,000 to $75,000
(e.g., requires additional power or
pressure transmitters)
High complexity installation (e.g., $75,000 to $200,000
requires many upgrades or site
improvement)
Granite State Remote-control valve installation, $40,000 to $50,000
including communications
equipment and modifications to leak
detection systems
Kinder Morgan Automatic valve installation on $48,000 to $100,000
existing manual valve

85
Presented by Andrew Lu from the American Gas Association, April 26, 2022.
86
PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and 195 to Require Valve Installation
and Minimum Rupture Detection Standards Proposed Rule, pp. 26–27, Table 5-3.
https://downloads.regulations.gov/PHMSA-2013-0255-0046/attachment_1.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

80
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Northwest Automatic valve installation $37,000 to $240,000

Pipeline GP

Xcel Energyd Upgrade of existing isolation valves, $200,000 to $300,000

including right-of-way and site
access
Upgrade of entire site (with multiple $500,000 to $1,000,000
valves)
Williams Gas Automatic valve installation $75,000 to $500,000
Pipeline-Transco
Hazardous Liquid Pipelines
Association of New valve site installation, $1,000,000 to $10,000,000
Oil Pipe Linese including materials, construction,
communication systems, and other
site upgrades
Belle Fourche Remote-control valve installation, $100,000 to $500,000
including communications
equipment and right-of-way access
as needed
Buckeye Partners Remote-control valve installation or $35,000 to $325,000
upgrade, including right-of-way
access as needed
ExxonMobilf New valve site installation, $1,000,000 to $10,000,000
including materials, construction,
communication, and other upgrades
Phillips 55 Automatic valve installation, $250,000 to $500,000
including communications, power,
right-of-way access, and local
construction costs
Gas Transmission and Hazardous Liquid Pipelines
Enterprise New valve installation, including $250,000 to $500,000
Products communications infrastructure
Unless otherwise noted, as in footnotes b–f, all source information came from PHMSA’s March 2022
a

Regulatory Impact Analysis.

b
Andrew Lu, American Gas Association, April 26, 2022.
c
Timothy Lajiness and Tyler Shanteau, DTE Energy, April 26, 2022.
d
Sue King and Mike O’Shea, Xcel Energy, October 27, 2022.
e
John Stoody, Association of Oil Pipe Lines, April 26, 2022.
f
Matthew Young, ExxonMobil, October 27, 2022.
SOURCES: American Gas Association; DTE Energy; Xcel Energy; Association of Oil Pipe
Lines; ExxonMobil; PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and
195 to Require Valve Installation and Minimum Rupture Detection Standards Proposed Rule, pp.
26–27. https://downloads.regulations.gov/PHMSA-2013-0255-0046/attachment_1.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

81
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Operator-Reported Reasons for Installing Rupture Mitigation Valves

The results of the study committee’s pipeline operator survey, reviewed in Chapter 2, suggest
that more than one-third of valves on existing hazardous liquid and gas transmission pipelines
are RMVs. 87 Some operators have made determinations that favor the use of these valves for
operational and/or safety purposes. The committee, therefore, asked the pipeline operators who
have installed RMVs to explain their reasons for doing so. Indeed, many reported that they have
instituted programs for the identification of candidate sites for RMV installations and their
prioritization.
In the case of gas transmission pipelines, a commonality of these operator installation
programs is the prioritization of high-population locations. Pacific Gas and Electric (PG&E), for
instance, reported that its program, which was instituted in response to mandates stemming from
the 2010 San Bruno rupture, prioritizes pipelines with diameters greater than 12.75 inches
located in Class 3 and 4 locations with a target post-rupture gas evacuation time of 30 minutes or
less. 88 PG&E reported that between 2015 and 2022, it installed about 200 RMVs, bringing the
total number of RMVs to about 400 across the company’s entire transmission pipeline system. 89
Like PG&E, Xcel Energy prioritizes Class 3 and 4 locations. The priorities are informed by a
ranking system that accounts for pipeline diameter and volume, specific risks associated with the
setting, results from IM assessments, the potential for third-party damage, and the time required
for personnel to access the valve location. From January 2011 to October 2022, Xcel Energy
installed 373 RMVs across about 150 sites. The installations included a mix of manual valve
retrofits (by adding actuators and controls) and full valve replacements. 90
The gas transmission pipeline operator DTE Energy reported that its risk assessments
resulted in the identification of nearly 200 candidate sites for RMVs. 91 The original plan was to
upgrade 15 to 20 valves per year over a 10-year period through 2020; however, following the
satisfactory results from the closing of an RMV during an incident in 2016, the company
accelerated the installation process to complete the planned installations about 2 years early. The
2016 incident involved a motor vehicle that crashed through a fence and struck an aboveground
valve station. While the control center lost communication with the damaged station and its
remote-control valves, controllers received low-pressure alarms from nearby stations, including
one located approximately 20 miles upstream from the crash site. By closing the remote-control
valve at this upstream location, control room personnel were able to slow the gas flow to the
incident site within 5 minutes of initial indications of a failure, minimizing the consequences.
It merits noting, however, that some of the consulted pipeline operators maintained that
RMV installation decisions are best made within the broader context of their IM risk assessment
and management planning, which includes consideration of all risk reduction options. The
hazardous liquid pipeline operator ExxonMobil, for instance, explained that it had previously
instituted a program focused on prioritizing RMV installations but has since reoriented these

87
When remote-control valves are installed for operational purposes mainly, one might question whether they
should be referred to as RMVs. Such distinctions are not made here as the term RMV is used generally in reference
to automatic and remote-control valves under the assumption that such valves may be used during normal,
abnormal, and emergency conditions.
88
In these scenarios, the gas evacuation time is the duration from valve closure to the time when pipeline
pressure has reached equilibrium.
89
Presented by Dirk Ayala from PG&E, April 26, 2022.
90
Presented by Sue King and Mike O’Shea from Xcel Energy, October 27, 2022.
91
Presented by Timothy Lajiness and Tyler Shanteau, DTE Energy, April 26, 2022.

PREPUBLICATION COPY—Uncorrected Proofs

82
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

efforts to consider the wider array of risk management options available, from enhanced
surveillance, inspection, and maintenance to pipeline replacement, in addition to installing
RMVs in some locations.

RUPTURE MITIGATION VALVE ASSESSMENTS IN INTEGRITY MANAGEMENT

REQUIREMENTS

Operator programs and protocols for assessing RMVs warrant consideration within the context
of PHMSA’s IM regulatory requirements. In the sections that follow, consideration is given first
to provisions in IM requirements that call specifically for assessments of RMVs. 92 In the IM
regulations that apply to hazardous liquid and gas transmission pipelines in HCAs, the
installation of RMVs (specifically remote-control valves and emergency flow restricting devices
[EFRDs]) is called out as a risk reduction measure that should be considered by an operator (see
Box 5-1). The installations are not directly required, which comports with each IM rule’s
emphasis on giving operators latitude to make risk-based and situation-specific choices about the
use of preventive and mitigative measures that exceed the minimum federal requirements.
Accordingly, the discussion concludes with a review of the requirements and guidance in the IM
rules for risk assessments that are supposed to inform choices about when and where to install
RMVs.
It merits noting that the aperture for risk assessment is much wider for PHMSA when it
makes determinations about the desirability of a broad-based regulatory intervention, as it did
when requiring RMVs for all newly constructed and entirely replaced segments of pipelines.
PHMSA, like most federal agencies, is required by law and executive orders to conduct RIAs
during rulemaking, and as part of these assessments the agency must make benefit-cost
calculations about the desirability of a requirement that considers the net benefits of the
regulatory intervention when applied generally. There are reasons that a safety regulator may
decide that a general (e.g., industrywide) intervention is preferable to allowing individual
operators to make choices even when the intervention is not cost-beneficial across all specific
sites. These reasons can include the ease of enforcing a requirement that applies to all operators
and a finding that the intervention would be cost-beneficial a large majority of the time.

Integrity Management Obligations Specific to Rupture Mitigation Valves

The IM rules for hazardous liquid pipelines in HCAs 93 reference RMVs (or specifically EFRDs
that include automatic and remote-control shutoff valves and check valves) among a number of
preventive and mitigative measures that an operator should consider for risk reduction, such as
enhanced monitoring of cathodic protection, shorter inspection intervals, and additional training
of personnel. 94 Box 5-1 presents the regulatory direction that is given to a hazardous liquid
pipeline operator for evaluating an RMV installation. The regulation states that when an operator
evaluates RMVs (i.e., EFRDs) and determines that these devices are “needed,” the operator must
install them. To make this determination, the regulation states that the operator must at least
consider the following factors: the swiftness of leak detection and pipeline shutdown capabilities,

92
49 CFR 192.935(a) (Gas Transmission Pipelines) and 49 CFR 195.452(i)(1) (Hazardous Liquid Pipelines).
93
49 CFR Part 195.452(i).
94
The requirement to identify and implement additional preventive and mitigative measures for HCAs does not
stipulate that an operator must consider RMVs.

PREPUBLICATION COPY—Uncorrected Proofs

83
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

the type of commodity carried, the rate of potential leakage, the volume that can be released,
topography or pipeline profile, the potential for ignition, proximity to power sources, location of
nearest response personnel, specific terrain between the pipeline segment and the HCA, and
benefits expected by reducing the spill size. The regulatory direction and accompanying
guidance, however, do not stipulate the evaluation criteria that an operator must use to establish
“need.” The direction and guidance, for instance, do not establish what constitutes an
insufficiently “swift” pipeline shutdown capability.
The IM regulatory text that applies to gas transmission pipeline operators and their
evaluations of remote-control valves (i.e., RMVs) is also provided in Box 5-1. It states that an
operator must consider these devices when conducting required risk analyses. The requirements
stipulate that if an operator determines, based on a risk analysis, that an RMV (or alternative
equivalent technology) would be “an efficient means” of adding protection to an HCA, then the
operator must install the device. Here again, what constitutes an “efficient means” is not defined,
although the operator is expected to consider many of the same factors listed for hazardous liquid
pipeline operators, including the timing of pipeline shutdown capabilities.
The lack of specific regulatory direction and guidance on how an operator should
establish whether an RMV installation is a “needed” or “efficient” means of adding protection
may stem from PHMSA’s adherence to the “nonapplication clause” in the U.S. Code. As
discussed in Chapter 1, that clause states that a “design, installation, construction, initial
inspection, or initial testing standard does not apply to a pipeline facility existing when the
standard is adopted.” 95 PHMSA has maintained, as recently as 2020, that it can only issue
advisory bulletins and not new standards that are retroactive to existing pipeline facilities
because of this statutory language. 96 As reported in Chapter 1, the National Transportation
Safety Board (NTSB) believes PHMSA does indeed have the authority to require the use of
RMVs on existing pipelines; however, NTSB nevertheless requested that Congress make this
authority explicit by exempting RMV installations from the nonapplication clause.

BOX 5-1
Regulations for RMV Analysis

The following paragraphs present the regulatory text from the pipeline safety regulations for
hazardous liquid (Part 195) and gas transmission (Part 192) pipelines that require a
determination whether to install an RMV on an existing pipeline within an HCA as part of a
broader preventive and mitigative measures analysis.

Hazardous Liquid Pipelines

49 CFR 195.452(i)(1)—What preventive and mitigative measures must an operator take

to protect the high consequence area? General requirements. An operator must take
measures to prevent and mitigate the consequences of a pipeline failure that could affect a
high consequence area. These measures include conducting a risk analysis of the pipeline
segment to identify additional actions to enhance public safety or environmental protection.
Such actions may include, but are not limited to, implementing damage prevention best
practices, better monitoring of cathodic protection where corrosion is a concern, establishing
95
Title 49 USC § 60104(b).
96
Official correspondence from Howard R. Elliott, PHMSA Administrator, to the National Transportation
Safety Board (NTSB) regarding NTSB Recommendation P-19-014, January 22, 2020.

PREPUBLICATION COPY—Uncorrected Proofs

84
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the systems
that monitor pressure and detect leaks, providing additional training to personnel on response
procedures, conducting drills with local emergency responders and adopting other
management controls.

49 CFR 195.452(i)(4)—Emergency Flow Restricting Devices (EFRD). If an operator

determines that an EFRD is needed on a pipeline segment that is located in, or which could
affect, a high-consequence area (HCA) in the event of a hazardous liquid pipeline release, an
operator must install the EFRD. In making this determination, an operator must, at least,
evaluate the following factors—the swiftness of leak detection and pipeline shutdown
capabilities, the type of commodity carried, the rate of potential leakage, the volume that can
be released, topography or pipeline profile, the potential for ignition, proximity to power
sources, location of nearest response personnel, specific terrain within the HCA or between
the pipeline segment and the HCA it could affect, and benefits expected by reducing the spill
size. An RMV installed under this paragraph (i)(4) must meet all of the other applicable
requirements in this part, provided that the requirement of this sentence does not apply to
gathering lines.

Gas Transmission Pipelines

49 CFR 192.935(a)(1)—General requirements. An operator must take additional measures

beyond those already required by this part to prevent a pipeline failure and to mitigate the
consequences of a pipeline failure in a high consequence area. Such additional measures
must be based on the risk analyses required by § 192.917. Measures that operators must
consider in the analysis, if necessary, to prevent or mitigate the consequences of a pipeline
failure include but are not limited to: (iv) Installing automatic shut-off valves or remote-control
valves.

49 CFR 192.935(c)—Risk analysis for gas releases and protection against ruptures. If
an operator determines, based on a risk analysis, that a rupture-mitigation valve (RMV) or
alternative equivalent technology would be an efficient means of adding protection to a high-
consequence area (HCA) in the event of a gas release, an operator must install the RMV or
alternative equivalent technology. In making that determination, an operator must, at least,
evaluate the following factors—timing of leak detection and pipe shutdown capabilities, the
type of gas being transported, operating pressure, the rate of potential release, pipeline
profile, the potential for ignition, and location of nearest response personnel. An RMV or
alternative equivalent technology installed under this paragraph must meet all the other
applicable requirements in this part.

PHMSA enforcement guidance for inspections of hazardous liquid pipeline IM programs

emphasizes that operators must conduct RMV evaluations, albeit without direction on how
factors such as the swiftness of the pipeline’s shutdown capability should be judged. The
guidance stipulates the following:

If an operator performs no evaluation of the need for additional EFRDs, or the

evaluation has some inadequacies or deficiencies, § 195.452(i)(4) should be cited.
If an operator’s EFRD evaluation does not include the required factors, §

PREPUBLICATION COPY—Uncorrected Proofs

85
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

195.452(i)(4) should be cited. If an operator determines that EFRDs are not

needed, documentation justifying this decision must be provided. 97

In accordance with this guidance, inspectors are instructed to review an operator’s IM

documents to see whether an operator has conducted the requisite RMV (EFRD) evaluation; if
not, the inspector should cite the operator for being out of compliance with the requirements of
49 CFR Part 195.452(i)(4). A review of PHMSA enforcement cases opened during 2018–2022
reveals 1,108 cases that involved the IM programs of hazardous liquid and gas transmission
pipeline operators (see Table 5-2). 98 Of these cases, 66 involved reviews of operator risk
analyses and HCA identifications. Because PHMSA does not publish data on the total number of
IM program inspections conducted per year, it was not possible to calculate IM compliance
violation rates based on these 1,108 cases. 99 A review of the documentation from these cases,
however, revealed that 66 cases involved issues arising from reviews of operator risk analyses
and/or HCA identifications.

TABLE 5-2 PHMSA IM Enforcement Cases for Hazardous Liquid and Gas Transmission
Pipelines, 2018–2022
Total Number of Enforcements for
Enforcements HCAs and Risk Analysis
Year (All Types) Compliance Type of Enforcement
Notice of
Probable
Violation
and
Hazardous Gas Proposed
Liquid Transmission Warning Notice of Compliance Assessed
Pipeline Pipeline Letter Amendment Order Penalties
2018 199 9 3 4 4 4 $101,600
2019 223 7 4 2 4 5 $46,600
2020 195 8 5 1 5 7 $64,600
2021 264 10 4 2 4 8 $26,200
2022 227 13 3 4 4 8 $272,956
Total 1,108 47 19 13 21 32 $511,956
NOTES: The enforcement actions identified are only those related to provisions the operator
must take for identifying a pipeline segment in an HCA (or that could affect an HCA) and the
evaluations an operator must perform on additional measures to prevent and mitigate the
consequences of a failure, including an evaluation of the need to install an RMV (i.e., EFRDs,
remote-control valves).

97
PHMSA. 2015. Hazardous Liquid Integrity Management Enforcement Guidance Sections 195.450 and 452.
https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/Hazardous_Liquid_IM_Enforcement_Guidance_12_7_2
015.pdf. For enforcement guidance regarding 49 CFR 195.452(i)(4), see p. 123.
98
See
https://primis.phmsa.dot.gov/comm/reports/enforce/CasesOpen_opid_0.html?nocache=2365#_TP_1_tab_2.
99
In a personal communication with PHMSA program staff (April 20, 2023), project staff were notified that
information on IM inspection totals could be sought through a Freedom of Information Act request.

PREPUBLICATION COPY—Uncorrected Proofs

86
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

SOURCE: PHMSA. Pipeline Safety Enforcement Program, Summary of Enforcement Activity-

Nationwide.
https://primis.phmsa.dot.gov/comm/reports/enforce/Enforcement.html?nocache=6308.

A closer review of these 66 cases reveals that 14 involved a failure of the operator to
conduct an RMV (EFRD) analysis or to install an RMV in accordance with the results of an
analysis. The inadequacies cited in the 14 cases and their disposition are summarized below. Of
the 14 cases, 9 involved operators not performing the required EFRD analysis or not updating the
analysis as warranted. In three cases, the operators did not have EFRD analysis documents
available for inspection. In two cases, the inspectors cited the operator for having an inadequate
EFRD analysis. Summaries of the 14 cases are as follows:

1. Inadequate process for performing a risk analysis to identify preventive and

mitigative measures, and the EFRD evaluation does not consider all required factors.
The operator amended the IM program procedures to address the findings (CPF 5-
2018-6002).
2. EFRD evaluation had not been completed. PHMSA determined that the operator’s
revisions addressed inadequacies and that no further action was necessary (CPF 3-
2019-5018).
3. Failure to provide records that show that an evaluation for the need or lack of need for
additional EFRDs had been carried out. The operator later located and provided the
required evaluation documents (CPF 4-2019-5016).
4. Failure to conduct an EFRD evaluation in accordance with the operator’s IM program
manual. PHMSA assessed a penalty of $46,600 and required the operator to complete
the evaluation per its IM program manual and submit it (CPF 4-2019-5024).
5. Failure to conduct a periodic evaluation of pipeline segments to identify the need for
additional prevention and mitigation measures. PHMSA had required the operator to
install an EFRD as identified in the operator’s EFRD analysis report conducted the
year before (CPF 4-2020-5001).
6. Failure to provide documents to support the analyses, determinations, and decisions
used for an evaluation of EFRDs. The required documents were later provided (CPF
5-2020-5001W).
7. Failure to identify preventive and mitigative measures to determine if EFRDs were
needed. Following a hearing, PHMSA required the operator to carry out an EFRD
evaluation and to submit the results (CPF 4-2020-5006).
8. Failure to reevaluate EFRD analysis for 13 years while operating conditions on the
pipeline system changed. PHMSA required the operator to revise procedures and
conduct a new EFRD evaluation (CPF 4-2020-5017).
9. Failure to determine the need for additional preventive and mitigative measures.
Operator provided an action plan to revise the procedures and complete the EFRD
evaluation (CPF 4-2021-016 NOPV).
10. Failure to establish a process for documenting the determination of whether EFRDs
should be installed. Operator responded that it would amend its IM program to
address the finding (CPF 4-2021-028 NOA).
11. Inadequate procedures for determining preventive and mitigative measures. The
operator simply referred to a 1995 study by a research institute that states it is

PREPUBLICATION COPY—Uncorrected Proofs

87
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

statistically unlikely that an EFRD will mitigate the consequences of a pipeline

failure. The operator was required to perform an EFRD evaluation, which PHMSA
later determined addressed the inadequacies (CPF 4-2021-020 NOA).
12. EFRD evaluation documentation was missing. Operators responded that an EFRD
study had been conducted but records could not be located. The records were found
and submitted to PHMSA, which determined that no additional enforcement actions
were needed (CPF 3-2022-005-WL).
13. Failure to conduct an EFRD evaluation. PHMSA required the operator to conduct the
evaluation (CPF-4-2022-062-NOPV).
14. Failure to perform an evaluation to determine whether EFRDs are needed. PHMSA
required the EFRD evaluation to be submitted within 90 days (CPF 4-2022-041-
NOPV).

It merits noting that one of the cited hazardous liquid pipeline operators (see CPF 4-2020-
5006) petitioned PHMSA to withdraw the finding that it had not conducted an EFRD evaluation.
The operator maintained that the regulations do not clearly stipulate that such an analysis is
always required. The operator pointed to language in 49 CFR 195.452(i)(1), which states that an
operator “must take measures to prevent and mitigate the consequences of a pipeline failure that
could affect a high consequence area. These measures include conducting a risk analysis of the
pipeline segment to identify additional actions to enhance public safety or environmental
protection. Such actions may include [italic added], but are not limited to … installing EFRDs on
the pipeline segment.” The operator claimed that because its general risk analysis did not identify
a need for additional safety measures it was not obligated to perform a subsequent EFRD
analysis. PHMSA’s Office of Pipeline Safety denied the petition on the grounds that the
requirement for an EFRD evaluation is not contingent on the results of the general risk
analysis. 100
The 14 cases indicate that inspectors are indeed examining operator IM program
documents for evidence of EFRD evaluations. However, the cases do not provide insight into
whether inspectors are routinely examining the quality of the EFRD evaluations, as only two
cases were brought for inadequate evaluations. While a review of the initial findings in safety
inspector reports, as opposed to later-stage PHMSA enforcement actions, could potentially
provide insight into whether the evaluations are being thoroughly reviewed by inspectors, such
detailed records were not available to the study committee.

The Rupture Mitigation Valve Isolation-Time Performance Standard Applicable to New

Pipelines

As discussed in Chapter 3, PHMSA’s April 2022 valve installation and rupture detection rule,
which applies to newly constructed and entirely replaced segments of pipelines only, requires the
installation of RMVs (or alternative equivalent technology). The rule establishes a requirement
that as soon as practicable, but within 30 minutes of rupture identification, an operator must fully
close any RMVs or alternative equivalent technologies to minimize the volume of product
released and mitigate the consequences of a rupture. If an operator wants to use a manual valve,
it must demonstrate that the manual closure of the valve can meet this 30-minute rupture

In the matter of Enlink Midstream, LLC, CPF No. 4-2020-5006, Decision on Petition for Reconsideration,
100

January 4, 2021.

PREPUBLICATION COPY—Uncorrected Proofs

88
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

isolation time and that installing an RMV is economically, technically, or operationally

infeasible. PHMSA references “prohibitive” costs as an example of economic infeasibility. The
rulemaking notice also provides examples of installations that could be technically or
operationally infeasible, such as when power or communications cannot be brought to a remote
site. In all cases, the operator would need to obtain PHMSA’s preapproval of an infeasibility
determination. In its notice, PHMSA points to the unanimous endorsement of this 30-minute
performance standard by the Gas Pipeline and Liquid Pipeline Advisory Committees, which
found that this time limit would be “technically feasible, cost-effective, and practicable” in most
cases. 101

Risk Models to Inform Decisions on Rupture Mitigation Valves and Other Risk Reduction
Strategies

Although the regulatory requirements for RMV evaluations that apply to existing pipelines do
not contain an evaluation metric similar to the 30-minute standard for new pipelines, the IM rules
obligate operators to conduct risk assessments that evaluate a suite of preventive and mitigative
measures, as discussed in Chapter 3. When such IM risk assessments are conducted in a
deliberate and systematic manner, it is reasonable to expect that RMVs will be among the suite
of measures examined, irrespective of the follow-on requirement to evaluate RMVs. For
example, along with examining other risk reduction options, an IM risk assessment might model
optimal valve locations to reduce the potential release volume or impacts, test the impacts of
upgrading an existing manual valve to an RMV, and assess how that might mitigate or reduce the
severity of consequences of a pipeline rupture.
The regulations provide guidance for the implementation of an IM program that describes
how to assess risk, including references to American Society of Mechanical Engineers (ASME)
guidance. 102 The guidance is clear that an operator’s risk assessment process should identify the
site-specific events and conditions (i.e., threats) that could lead to a pipeline failure, provide an
understanding of the likelihood and consequences of an event, and provide the nature and
location of the most significant risks to the pipeline. In performing these assessments, operators
are expected to use risk models as a central part of their risk assessments. Indeed, PHMSA
inspections of IM programs are supposed to include reviews of operator risk assessment
processes and the risk models that are used.
The referenced guidance for implementing pipeline IM programs points to the following
four basic approaches for risk modeling in increasing order of sophistication and capacity to
inform decision making: qualitative, relative assessment/index, quantitative system, and
probabilistic (see Box 5-2). The model that is selected can depend on the operator’s capabilities,
data requirements, and pipeline characteristics and circumstances. For instance, the guidance
suggests that an operator of a pipeline with little inherent risk because the facility is new and
located in a sparsely populated area and with no geologic threats may elect to use a qualitative or
indexing model (see Box 5-2). In contrast, a pipeline in a higher population area and installed
with legacy construction practices may require a more sophisticated quantitative model to inform
risk reduction choices.

101
87 Fed. Register, 20955, April 8, 2022.
102
Appendix C to Part 195 and incorporation by reference to the ASME standard B31.8S.

PREPUBLICATION COPY—Uncorrected Proofs

89
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

BOX 5-2
Types of Risk Models

Qualitative models rank risk factors by severity (i.e., unitless or dimensionless quantity) using
the judgment of subject matter experts. These models are often represented in descriptive,
qualitative terms—such as high, medium, or low risk—and are typically expressed through a
mapping of the results—such as a matrix. Relative assessment or index models develop a
unitless, though quantitative, index score to sum individual and weighted factors for probability
and consequence. By contrast, quantitative system models yield outputs with units such as
probability of failure and expected loss. The capacity of quantitative system models to generate
results in risk assessment units is founded on simulations of physical and logical relationships of
a pipeline system’s risk factors.
Probabilistic models are a type of quantitative model that uses probability distributions
and laws of probability to produce model outputs, such as event probability, severity of
consequences, and expected loss. Probabilistic models also account for and express the
uncertainty of model inputs and outputs. These models rely heavily on modeling of the
probability of ruptures and the consequences should a rupture occur. Typically, but not always,
the model measures the consequences in terms of physical outcomes such as fatalities, serious
injuries, or area polluted.
By its very nature, a quantitative risk assessment is specific to a particular location and
depends on an assessment of the physical characteristics of the pipe (product carried, diameter,
pressure, age, joints, etc.), the threats to pipeline integrity (seismic activity, weather and
environment factors, potential damage from nearby construction), and the factors that affect the
magnitude of the consequences of ruptures (habitation and land use, topography, different
types of HCAs). Quantitative risk analyses identify a range of scenarios leading to product
releases of various magnitudes and severities. These adverse consequences vary in severity
from relatively common minor leaks to relatively rare ruptures involving extensive environmental
damage and possible fatality and injury risk.

SOURCE: PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved
Implementation. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-
Modeling-Technical-Information-Document-02-01-2020-Final.pdf.

Key parts of a risk model involve an assessment of the likelihood of an unwanted event
occurring coupled with an assessment of the consequences of the event if it does occur. The
former requires the identification of threats, including interactive threats, and assessments of
their likelihood. The latter involves evaluations of the severity and losses associated with an
unwanted event by considering factors such as the commodity’s hazard characteristics, potential
release rate and volume, likely dispersion, and likely receptors (e.g., populations, the
environment, or buildings). Quantitative risk assessments will identify a range of scenarios
leading to product releases of various magnitudes and severities. The scenarios can range from
minor leaks to rare ruptures that involve extensive environmental damage, property loss, and
injuries and fatalities. A credible risk assessment will identify risks that are so large that they are
intolerable and should be eliminated even at great cost. For most risks that are not at such
intolerably high levels, mitigation through different interventions will require the use of risk
models to predict each intervention’s expected risk reduction benefits.

PREPUBLICATION COPY—Uncorrected Proofs

90
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Risk modeling requires a range of analytic tools and methods to support the full
consideration of the potential consequences of a pipeline failure. For example, computational
models are available and used by operators of hazardous liquid pipelines to predict the volume of
product that could be released into an environmentally sensitive area and its potential spill paths.
For natural gas transmission pipelines, similar models are available that predict vapor dispersion
and the impact zones of thermal radiation from a jet fire. As another example, operators may use
a geographic information system to map a pipeline in relation to the topographies, populations,
structures, and environmentally sensitive areas that it traverses to present different risk factors.
In modeling the likelihood and potential consequences of failure scenarios, operators
should then be able to use the models to evaluate a range of preventive and mitigative strategies,
including the use of RMVs. However, after its investigations of major pipeline incidents,
including the 2010 San Bruno gas transmission pipeline rupture, NTSB has raised concerns
about operators not having sufficient guidance for selecting and implementing risk modeling
tools and methods that can adequately inform prevention and mitigation choices. PHMSA too
has expressed concern that findings from its investigations and inspections have revealed risk
assessment approaches that lack sophistication and are too reliant on qualitative methods that
produce only relative risk judgments (i.e., high, medium, low). 103
In response to these concerns, PHMSA formed a Risk Modeling Working Group
composed of risk analysts from national laboratories and representatives of pipeline regulatory
agencies, operators, and industry organizations. 104 The group gathered information on state-of-
the-art risk modeling methods and tools and their potential application in IM programs. In its
2020 report, the group concluded that quantitative and probabilistic risk models provide greater
capabilities to inform risk reduction decisions than qualitative methods. 105 The report
emphasized that the selected model must allow for the estimation of potential risk reductions
from implementing different measures by comparing baseline risks (without the measure) with
risks after alternative measures are introduced. The report stressed that for a risk model to
support such analyses adequately, its evaluation of consequences should be capable of reflecting
changes to scenarios produced by different actions such as in pipeline operations, dispersion
pathways, and the type and location of receptors. Furthermore, it was noted that the model
should be able to produce consistent output for making comparisons, such as by producing
standard risk units and uniformly denominated measures of consequences (probability of failure,
expected loss, etc.).
In its report, the Risk Modeling Working Group acknowledged the challenges that can
arise in obtaining the data needed for developing values for input variables in quantitative risk
models, including data from pipeline system records (i.e., from routine operating, maintenance,
surveillance, and inspection activities). The report notes that improving the scope and quality of
input data can be an ongoing, long-term process. The report concludes, however, that an
operator’s choice of a risk modeling method should not depend primarily on the quality and

103
PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation, p.
19. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-
Document-02-01-2020-Final.pdf.
104
PHMSA. Risk Modeling Work Group Mission Statement. https://www.phmsa.dot.gov/pipeline/risk-
modeling-work-group/risk-modeling-work-group-mission-statement-word-doc.
105
PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation.
https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-
Document-02-01-2020-Final.pdf.

PREPUBLICATION COPY—Uncorrected Proofs

91
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

completeness of available data because steps can be taken to add and improve the quality of data
over time. 106

Establishing the Benefits and Costs of Risk Reduction Measures

The Risk Modeling Working Group also pointed out that another advantage of quantitative risk
models is that their standardized output can be used to identify the benefits and costs of
alternative risk reduction measures. The large costs that can ensue from a pipeline rupture with a
prolonged release of hazardous material and the wide range of RMV installation cost estimates
provided by pipeline operators (as summarized in Table 5-1) suggest that commonly accepted
methods for establishing the benefits (e.g., harms avoided) and costs of risk reduction measures
could be helpful to operators in making decisions about whether and where to install RMVs,
especially when doing so requires significant capital outlays. However, PHMSA has offered little
guidance for such decision making. 107 In its report, the Risk Modeling Working Group noted
issues that can arise in the absence of such guidance—for instance, by observing that operators
may be reluctant to express harms avoided, such as lives saved, in monetary terms, potentially
leading to an understatement of the prospective benefits of some risk reduction measures.
As discussed above, because pipeline operators have elected to install RMVs voluntarily
for both safety and operational reasons, they have concluded that the expected benefits justify the
installation costs in these cases. Operators can be expected to make such choices when they
compare the investment required against the avoidance of expected financial losses caused by
damage to their facilities and the need to compensate shippers for lost product and third parties
for damages. The investment may also yield benefits by avoiding cleanup costs and the loss of
profits from the pipeline being out of service. In these cases, the installation costs can be
ascertained with a high degree of accuracy, while the reduction in losses is an expectation. This
is because ruptures occur with a probability in any given year at a given location, and RMVs
may not be fully effective in reducing the magnitude of the damages caused by the rupture
depending on the circumstances. Of course, in making the decision to install an RMV, the
operator may also factor in the operational benefits of the device, which can be estimated more
readily than the expected future safety benefits.
It is important to recognize that an operator’s determination of where and when to install
RMVs may result in fewer RMVs on pipelines than is socially desirable for at least four reasons:

1. While releases impose private costs on operators (e.g., damage to equipment, repairs,
loss of operating revenues), many of the consequences are externalities imposed on
third parties such as landowners and those living close to the rupture site. Operators

106
PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation, p.
74. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-
Document-02-01-2020-Final.pdf.
107
The following 2020 report sponsored by PHMSA offers a methodology for pipeline operators to use in
conducting benefit-cost analyses for external leak detection systems: PHMSA. 2020. Cost-benefit Analysis of
Deploying or Retrofitting External-based Leak Detection Sensors (dot.gov).
https://primis.phmsa.dot.gov/matrix/FilGet.rdm?fil=14719. As a general resource for benefit-cost analysis, see the
following: U.S. Department of Transportation. Benefit-Cost Analysis Guidance for Discretionary Grant Programs.
https://www.transportation.gov/mission/office-secretary/office-policy/transportation-policy/benefit-cost-analysis-
guidance.

PREPUBLICATION COPY—Uncorrected Proofs

92
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

may be required to compensate these parties under tort law or by statute; 108 however,
several hurdles make it unlikely that operators will bear all the external costs. Only
some injured victims will sue or file an administrative claim. Victims may not be
aware of their legal rights, may not be able to obtain legal representation, or may not
know how to file a claim on their own. Laws often limit liability to certain types of
conduct and injuries. Finally, victims may win civil suits but still be insufficiently
compensated for the losses and inconvenience they have suffered.
2. With some limited exceptions, operators are not held responsible for the full
environmental cost of releases. The traditional common law mechanism for
compensation—tort law—is anthropocentric. The law recognizes harm to the
environment if it negatively affects the legal interests of individuals, organizations, or
government entities. Natural resources themselves do not have standing to sue, nor
can concerned individuals or organizations sue on their behalf. A few environmental
statutes impose strict liability on operators for environmental harm, but these statutes
only apply to certain spills. 109 Thus, in the absence of statutory liability, there are
externalities borne by the environment.
3. Even if all the costs of a release could be internalized, society may take the view that
the harm is unacceptable because the risk of harm could have been reduced through
an RMV. That is, the public considers after-the-fact compensation to be an inadequate
substitute for a precautionary measure that reduces risk. Society may also take the
view that the public should not be exposed to more than a certain level of risk from
pipeline operations. Beyond this level, the risk of an incident may be regarded as
intolerable, even if there are legal remedies available.
4. Operators may take insufficient precautions to mitigate the consequences of ruptures
because they are myopic in comparing the certain costs of investing in valves today
with uncertain changes in the magnitude of ruptures that occur in a probabilistic
fashion at random points in the future. Installing an RMV at a particular location now
might mitigate a rupture that occurs next year, maybe in 12 years’ time, or maybe not
until the next century. Some operators may be inexperienced in determining future
financial risks and may additionally underplay future consequences (and regret it
when faced with financial claims following an incident). Others may be aware of
these future losses but downplay them because they have more short-term financial
goals such as surviving a business downturn. Operators who, knowingly or
unknowingly, downplay the future private benefits of RMVs underinvest in them.

For these reasons, the benefits and costs of preventive and mitigative measures need to be
calculated in a rigorous, consistent, and transparent manner for the public’s interest to be served.
This means that the costs incurred by and the benefit conferred on all parties should be
considered, including those that are not normally measured in purely monetary terms such as
mortality and injury risks and environmental damage. There is an extensive body of economic

108
Under the federal Oil Pollution Act, the operator of a pipeline is responsible for certain damages to property,
economic losses, and loss of subsistence natural resource use from a release of oil or oil products if there is a
discharge into navigable waters or the adjoining shorelines or there is a substantial threat of such discharge (33 USC
§ 2702). There are also state laws that impose liability for oil spills, such as the California Lempert-Keene-Seastrand
Oil Spill Prevention and Response Act. See California Government Code § 8670.56.5.
109
These are the Oil Pollution Act and the Comprehensive Environmental Response, Compensation, and
Liability Act (popularly known as the Superfund Law).

PREPUBLICATION COPY—Uncorrected Proofs

93
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

literature on valuing environmental costs and the value that should be placed on averting a
statistical death, non-fatal physical injuries, and adverse health consequences that go beyond
purely financial considerations such as lost wages and medical and funeral expenses. Past
ruptures can be used as a guide to a portion of the likely environmental costs per unit of product
released. Information is available on cleanup costs and settlement of lawsuits with affected
residents and landowners.
Careful calculations of benefits and costs should also take timing into account. Most of
the costs of RMV installation are borne in the present, with a smaller proportion represented by
recurrent maintenance and testing, whereas the benefits of rupture mitigation at any location
occur with a probability and at uncertain times in the future. Estimating the expected benefits in
a given year from a risk mitigation measure, such as an RMV, may require multiplying the
magnitude of the benefit from the measure if a rupture occurs by the probability that a rupture
occurs in a given year at a particular location. The present value of the streams of expected
benefits and costs over time can be calculated using discount rates.
Examples of benefits and costs for RMVs are shown in Table 5-3. Note that the
calculation is of marginal benefits and costs. RMVs mitigate the magnitude of ruptures and not
their probability. The appropriate benefit to consider is the reduction in the magnitude of
consequences of a rupture if an RMV is present. The appropriate costs to consider are the
additional costs incurred in installing and maintaining RMVs.
It is the study committee’s understanding that pipeline operators do not generally
document the methods they use to assess the benefits and costs of alternative risk reduction
measures, and that such methods are not subject to an inspector’s review. Thus, even as operators
are required to document their risk modeling methods and results, they are not obligated to
explain how these results are translated into decisions that have cost and benefit implications.

TABLE 5-3 Examples of Marginal Benefits and Marginal Costs of RMVs

Marginal Benefits Marginal Costs
Less loss of product Installation costs
Potentially less damage to the pipeline Costs for monitoring operations and initiating
valve closure
Less downtime in restoring service
Routine maintenance costs
Fatalities averted
Routine testing
Injuries averted
Direct costs of inspection, enforcement, and
Property damage averted
administration of penalties for compliance with
Cleanup costs averted RMV rulesa
Environmental damages averted
Other expenses averted such as emergency
services, road traffic closures, etc.
Fines for non-compliance are typically regarded as neither a cost nor a benefit as they are monetary transfers
a

from operators to the government. Administrative expenses associated with the penalties are, however, a cost.

PREPUBLICATION COPY—Uncorrected Proofs

94
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

SUMMARY POINTS

Operators Can Have Multiple Reasons for Installing Rupture Mitigation Valves

The incident and survey data indicate that gas transmission and hazardous liquid pipeline
operators have made decisions to install RMVs under varied circumstances for operational and
safety reasons. Some pipeline operators have established programs specifically to determine
where RMVs are warranted, while others evaluate the applicability of the devices within the
context of the overall planning and implementation of their IM programs and operational needs.

Operators Report Wide Variability in Rupture Mitigation Valve Installation Costs

The installation costs of RMVs can vary widely and be highly site-specific, from about $30,000
to more than $1 million per site. If the only requirement is the addition of an automatic or
remote-control actuator to an existing valve, the installation cost is more likely to be on the lower
end of the cost range but still be affected by factors such as pipe diameter and access to power
and communications. Alternatively, if an operator needs to retrofit an older pipeline and place a
valve in a location that did not previously have one, this installation could entail significant
capital expenditures for construction; new power and communication systems; state and local
permitting; and site access, improvement, and restoration.

Integrity Management Rules Require Risk Modeling, But Methods Vary

The IM rules obligate operators to develop and implement risk management strategies that are
informed by risk assessments. A credible risk assessment will identify all risks, including those
that are so large that they are intolerable and should be eliminated even at great cost. For most
risks that are not at such intolerably high levels, mitigation through different interventions will
require the use of models to predict each intervention’s expected risk reduction effects.
Recognizing the importance of high-quality risk modeling by pipeline operators, PHMSA has
increased its guidance on modeling risk and has emphasized the importance of using quantitative
rather than qualitative methods. However, the extent to which operators employ such quantitative
methods remains unclear, as does the adequacy of the guidance provided to operators and
inspectors pertaining to risk modeling.
While rigorous, high-quality risk modeling is essential for predicting the risk reduction
benefits of different preventive and mitigative measures, risk modeling alone cannot provide a
standard for deciding when to implement a measure that will have costs to the operator. The IM
regulations direct operators to consider risk reduction factors but do not specify how (or if)
operators should consider the costs of each measure in relation to the benefits. The absence of
consistent regulatory direction and guidance on how to make and justify decisions about the use
of different preventive and mitigative measures raises questions about how operators are now
establishing the need for RMVs and, more generally, about how they are prioritizing and making
choices about all potential risk reduction measures they could employ.

PREPUBLICATION COPY—Uncorrected Proofs

95
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Integrity Management Rules Require RMV Evaluations But Give Limited Direction

While such assessments would be expected to consider RMVs as an intervention option,

PHMSA regulations also stipulate that an operator should specifically evaluate RMVs after the
initial risk assessment is performed. The regulatory direction for conducting this supplemental
RMV evaluation, however, is limited to specifying the factors an operator should consider during
the evaluation. The regulations do not provide guidance or direction on the criteria to be used for
assessing the factors, such as for assessing whether the pipeline’s shutdown capabilities are
sufficiently swift.

PREPUBLICATION COPY—Uncorrected Proofs

96
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

6
Summary, Conclusions, and Recommendations

Gas transmission and hazardous liquid pipelines are among the safest and most efficient modes
of long-distance bulk freight transportation. However, when the integrity of a pipeline is
compromised, the consequences can be catastrophic because of the hazardous nature and high
volumes of the commodities being transported under pressure and the frequency with which
pipelines traverse populated and environmentally sensitive areas. When a pipeline rupture
occurs, it can lead to an explosion, fire, asphyxiation hazard, or discharge of toxic material into
the environment. The National Transportation Safety Board (NTSB) has been investigating
major pipeline ruptures and their causes for more than 50 years, including factors contributing to
the severity of outcomes. Following investigations of catastrophic pipeline ruptures in which the
consequences were made worse by prolonged releases of the hazardous material, NTSB has
made repeated recommendations for more stringent federal standards governing the timely
isolation and shutdown of failed pipeline segments, including requirements for the use of
automatic and remote-control shutoff valves.
In response to NTSB’s recommendations and concerns raised by Congress and others,
during the early 2000s, the U.S. Department of Transportation (U.S. DOT) issued a series of
rulemakings requiring operators of pipelines in populated and environmentally sensitive areas,
designated as high consequence areas (HCAs), to establish integrity management (IM) programs.
The IM regulations do not prescribe the use of specific risk reduction measures, such as
automatic and remote-control shutoff valves, but obligate operators to institute and demonstrate
that they have established a deliberate program for risk management involving risk identification
and assessment to make choices about where and when to take additional preventive and
mitigative actions beyond those already required by regulation.
NTSB was initially satisfied with U.S. DOT’s IM rules as a response to its earlier
recommendations for the expanded use of rupture mitigation valves (RMVs). However,
following an investigation of a 2010 gas transmission pipeline rupture in San Bruno, California,
in which eight people died, many more were injured, and more than 100 homes burned, NTSB
determined that the pipeline operator had not been diligent in developing and implementing a
high-quality IM program. Furthermore, the pipeline operator’s lengthy delay in isolating the
ruptured pipe segment by having to dispatch qualified personnel to close valves manually had
contributed to the incident’s severity, including added exposure to emergency response
personnel. 110 Thus, NTSB repeated its recommendation that U.S. DOT’s Pipeline and Hazardous
Materials Safety Administration (PHMSA) require the installation of automatic and remote-
control shutoff valves on transmission pipelines in HCAs and populated locations (Class 3 and 4
locations). These devices, which are now referred to by PHMSA as RMVs, 111 can isolate a failed
pipe segment either through automatic activation or remotely from commands by personnel in a
control center once the rupture is detected and confirmed. NTSB raised concerns that PHMSA’s
regulations did not establish a maximum expected response time to isolate a rupture or mandate

110
NTSB. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San
Bruno, California, September 9, 2010. Pipeline Accident Report NTSB/PAR-11/01. Washington, DC.
111
For the remainder of this chapter, automatic and remote-control shutoff valves and other emergency flow
restricting devices are referred to as RMVs.

PREPUBLICATION COPY—Uncorrected Proofs

97
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

the installation of RMVs for faster valve closures (i.e., operators were allowed to make their own
determinations about whether to install the devices). NTSB noted that a decade before the San
Bruno rupture, following a gas transmission pipeline explosion in Edison, New Jersey, it had
recommended expedited requirements for RMVs on high-pressure pipelines in urban and
environmentally sensitive areas. 112
Following NTSB’s recommendations, Congress passed legislation in 2011 that directed
PHMSA to issue requirements for the installation of RMVs or equivalent technologies on newly
constructed or entirely replaced segments of pipelines in HCAs when economically, technically,
and operationally feasible. When PHMSA proposed a rule to comply with this statutory
requirement for affected new pipelines, NTSB and pipeline safety advocates expressed concern
that RMVs were not being required on existing transmission pipelines, especially in populated
and environmentally sensitive areas. NTSB noted that in a January 2020 response to another
NTSB safety recommendation, 113 PHMSA had maintained that it could only issue advisory
bulletins for existing pipeline facilities due to a “nonapplication” clause in Title 49 USC §
60104(b) that states that a “design, installation, construction, initial inspection, or initial testing
standard does not apply to a pipeline facility existing when the standard is adopted.” NTSB
countered that PHMSA does have the authority to require the installation of RMVs on existing
pipelines but nevertheless requested that Congress make this authority explicit by exempting
RMV installations from the nonapplication clause.
In 2020, Congress passed the Protecting Our Infrastructure of Pipelines and Enhancing
Safety Act, which directed PHMSA to commission this study by an independent committee to
examine methodologies, standards, and regulatory criteria for deciding when RMVs should be
installed on existing transmission pipelines in HCAs and populated locations. The committee
was also asked to consider how these criteria and methodologies treat public safety and
environmental risks as well as the economic, technical, and operational feasibility of RMVs.
Based on this review, the study committee was asked to make recommendations on regulatory or
statutory changes that should be considered at the federal and state levels about shutoff valve
requirements in HCAs and populated locations.
On April 10, 2022, during this study, PHMSA finalized its rule requiring RMVs on most
newly constructed and entirely replaced segments of hazardous liquid and gas transmission
pipelines. The new rule established a minimum performance standard for an RMV to enable
isolation of a rupture in 30 minutes or less when measured from an operator’s identification of a
rupture after notification of a potential rupture. The rule affords operators the ability to propose
the use of manual valves as an alternative equivalent technology, but only if the operator
demonstrates that it can meet the 30-minute performance standard and if an RMV’s technical,
operational, or economic infeasibility can be established to PHMSA’s satisfaction. The reasoning
behind the rule and the information developed to support it proved helpful to the committee in
conducting this related study focused on existing pipelines.
A synopsis of the study approach is provided next, followed by a recap of findings from a
pipeline incident data review and information on the prevalence of RMVs, operator-reported
reasons for installing them and their cost ranges, and the direction and guidance provided by
PHMSA on the methods and criteria to be used by operators in making RMV installation

NTSB. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison,
112

New Jersey, March 23, 1994. Pipeline Accident Report NTSB/PAR-95/01. Washington, DC.
113
Official correspondence from Howard R. Elliott, PHMSA Administrator, to NTSB regarding NTSB
Recommendation P-19-014, January 22, 2020.

PREPUBLICATION COPY—Uncorrected Proofs

98
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

decisions. The chapter concludes with observations about the current regulatory direction and
guidance that is provided to pipeline operators for deciding when to install RMVs on existing
pipelines and for inspectors to verify that all obligations for deliberate and informed decisions
are being met. Conclusions based on this assessment are presented along with recommendations
for strengthening the direction and guidance provided and the verification methods used for
ensuring sound decisions.

SYNOPSIS OF STUDY APPROACH

To fulfill its charge, the study committee reviewed the use, scope, and age profile of the U.S.
hazardous liquid and gas transmission pipeline networks; the means by which pipeline operators
monitor the status and control the operations of their systems; and the types and prevalence of
valves that are used to isolate and shut down pipelines in an emergency. The committee reviewed
the current pipeline safety assurance framework, including regulations obligating pipeline
operators to plan and implement IM programs for pipelines in HCAs and Class 3 and 4 locations.
The committee considered how pipeline operators conduct their IM-required risk analyses and
how federal and state safety regulators support, monitor, evaluate, and enforce operator
compliance with IM requirements. The committee examined the IM requirements pertaining to
operator evaluations of RMVs and PHMSA enforcement records for information on inspector
verifications of the evaluations.
The study committee reviewed the recent history of pipeline incidents in HCAs and
populated areas to identify any discernible trends and patterns, including incidents where the
timeliness of valve closures could have affected outcome severity. The committee consulted
NTSB and PHMSA investigations of several major pipeline ruptures, noting how and when
shutoff valves were deployed, as reported by investigators. By consulting and surveying pipeline
operators, the committee gained a better understanding of the prevalence of RMVs on existing
pipelines in HCAs and populated (Class 3 and 4) locations, the magnitude and types of costs
incurred by operators when installing RMVs, and how operators make choices about when to
install RMVs on existing pipelines. This information proved helpful when reviewing existing
regulatory requirements for operators to evaluate the need for RMVs as part of their IM
obligations for conducting risk assessments and implementing protective and mitigative
measures beyond those already required by federal regulation.

SUMMARY OF KEY POINTS FROM CHAPTERS

Pipeline Miles in High Concentration Areas and Current Use of Rupture Mitigation Valves
(Chapter 2)

Most Pipeline Miles in High Concentration Areas Are Part of Large Systems

As reported by operators, at year-end 2021 about 40% of hazardous liquid pipeline mileage was
located in HCAs, while 19% of gas transmission pipeline mileage was located in HCAs and
Class 3 or 4 locations. Large shares of this HCA mileage were found to be managed by a
relatively small number of operators with large pipeline systems. In the case of gas transmission
pipelines, 12 operators managed more than 60% of the mileage in HCAs and Class 3 and 4

PREPUBLICATION COPY—Uncorrected Proofs

99
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

locations. In the case of hazardous liquid pipelines, 18 operators managed more than 75% of the
HCA mileage.

Rupture Mitigation Valves Are Being Used on Existing Transmission Pipelines in High
Concentration Areas

A combination of operator survey results and data from incident reports suggests that about 60%
of mainline or sectionalizing valves currently installed on gas and hazardous liquid pipelines in
HCAs are manual valves; however, RMVs are common, accounting for about 35% to 40% of
valves. Although RMVs are more common in hazardous liquid pipelines than gas transmission
pipelines, operators of both types of pipelines have significant operational experience using
RMVs. The data suggest that for both types of pipelines, valves are currently spaced at intervals
that, in general, accord with the spacing requirements for RMVs on newly constructed and
entirely replaced segments of pipelines. Furthermore, the data suggest that supervisory control
and data acquisition (SCADA) systems are almost universal on existing hazardous liquid and gas
transmission pipelines, meaning that much of the connectivity and telemetry required for RMVs
may already be in place. Existing valve spacings and the prevalence of SCADA systems suggest
that it may be possible to add RMVs to many existing pipelines through manual valve retrofits
and replacements rather than investments in new valve locations and centralized control
mechanisms.

Pipeline Safety Regulatory Framework (Chapter 3)

Pipeline Safety Regulation Is a Federal and State Responsibility

The federal government and states are responsible for regulating pipeline safety. Most
inspections to verify compliance with the federal regulations are performed by state inspectors
under PHMSA-delegated authorities.

Pipeline Operators Face Challenges Implementing Integrity Management Risk Management

Processes and Inspectors Face Challenges Verifying Compliance

In the 20 years since the IM requirements were introduced for pipelines in HCAs, NTSB and
others have raised concerns about whether pipeline operators have the capacity to employ
rigorous risk assessment methods and tools and whether they are consistently using them for IM
planning and decision making, including to inform choices about when to use RMVs. PHMSA,
standards organizations, and industry have introduced guidance, training, and other support for
industry and pipeline safety inspectors. Federal and state inspectors nevertheless face challenges
in verifying compliance with IM obligations because of the need to assess whether operators are
following all required processes, using appropriate methods and tools to assess risk and decide
on appropriate risk reduction actions, and implementing such actions in the field.

PREPUBLICATION COPY—Uncorrected Proofs

100
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Mandates for Rupture Mitigation Valve Installations Diverge from the Integrity Management
Approach

The current policy approach to RMV installation on existing pipelines is to incorporate the
decision into the IM program, which gives pipeline operators leeway to make choices about their
use of risk reduction measures that exceed the federal minimums. The new rule requiring the
installation of RMVs on newly constructed and entirely replaced segments of pipelines mandates
a specific protective measure unless it is infeasible; in this respect, it is similar to the many other
requirements in federal pipeline safety regulations that apply generally.

Safety Data Review (Chapter 4)

Key Factors Affecting Release Volumes and Consequence Severity Following a Rupture

After a pipeline rupture, two important factors associated with the pipeline design and
installation that affect the volume of gas or hazardous liquid released are

1. the elapsed time from identifying and confirming the failure and the release of
material to closing valves or using other means to shut in and isolate the failed
segment; and
2. the pipeline diameter and spacing between valves to isolate a failed segment and, in
the case of gases, the pressure at which the pipeline was being operated.

Factors that affect the magnitude of the consequences include the physical and chemical
properties of the product released including its flammable and toxic properties, and the nature of
the surrounding built and natural environment into which the materials are released.

Evidence of Valve Types and Closure Times from Incident Reports

Significant incidents reported to PHMSA by pipeline operators from 2010 to 2022 were
examined. These incident reports suggest that RMVs can be an effective means of reducing the
time elapsed between identifying the occurrence of a rupture and closing valves upstream and
downstream from the rupture to isolate the failed segment. Seventeen gas transmission pipeline
incident reports contained information on the elapsed time from identifying a release to closing
the upstream and downstream valves. In 14 cases, the two valves used to isolate the failed
pipeline segment were manual, and the average time taken to close the valves was 99 minutes. In
one incident, the valves were remote-control shutoff valves, and the reported elapsed time from
identification to closure was 50 minutes. In the other two incidents, the two valves were
automatic shutoff valves, with a reported elapsed closure time of 0 minutes.
Twenty-six hazardous liquid pipeline incident reports contained information on the
elapsed time to valve closure. In eight incidents, the upstream and downstream valves closed
were manual, with an average elapsed time from identification to closure of 97 minutes. For the
other 18 incidents, in 15 cases the valves were controlled remotely, and the average time from
identification to closure was 30 minutes. In the remaining three incidents, automatic shutoff
valves were activated, with an average closure time of 34 minutes.

PREPUBLICATION COPY—Uncorrected Proofs

101
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Rupture Mitigation Valve Cost and Decision Criteria for Existing Pipelines (Chapter 5)

Operators Can Have Multiple Reasons for Installing Rupture Mitigation Valves

The incident and survey data indicate that gas transmission and hazardous liquid pipeline
operators have made decisions to install RMVs under varied circumstances for operational and
safety reasons. Some pipeline operators have established programs specifically to determine
where RMVs are warranted, while others evaluate the applicability of the devices within the
context of the overall planning and implementation of their IM programs and operational needs.

Operators Report Wide Variability in Rupture Mitigation Valve Installation Costs

The retrofitting, upgrading, and installation costs of RMVs can vary widely and be highly site-
specific, from about $30,000 to more than $1 million per site. If the only requirement is the
addition of an automatic or remote-control actuator to an existing valve, the installation cost is
more likely to be on the lower end of the cost range but still be affected by factors such as pipe
diameter and access to power and communications. Alternatively, if an operator needs to retrofit
an older pipeline and place a valve in a location that did not previously have one, this installation
could entail significant capital expenditures for construction; new power and communication
systems; state and local permitting; and site access, improvement, and restoration.

Integrity Management Rules Require Risk Modeling, But Methods Vary

Recognizing the importance of high-quality risk modeling for assessing risk, PHMSA has
increased its guidance on modeling risk and has emphasized the importance of using quantitative
models that can provide probability-based output rather than qualitative methods. However, the
extent to which operators employ such methods remains unclear, as does the adequacy of the
methodology guidance provided to operators and inspectors.

Integrity Management Rules Require Rupture Mitigation Valve Evaluations But Give Limited
Direction

The IM rules obligate operators to develop and implement risk management strategies that are
informed by risk assessments. A credible risk assessment would identify all risks, including
those that are so large that they are intolerable and should be eliminated even at great cost. For
most risks that are not at such intolerably high levels, mitigation through different interventions
will require the use of risk models to predict each intervention’s expected risk reduction benefits.
While such assessments would be expected to consider RMVs as an intervention option,
PHMSA regulations also stipulate that an operator should specifically evaluate RMVs after the
initial risk assessment is performed. The regulatory direction for conducting this supplemental
RMV evaluation, however, is limited to specifying the factors an operator should consider during
the evaluation. The regulations do not provide guidance or direction on the criteria to be used for
assessing the factors, such as for assessing whether the pipeline’s shutdown capabilities are
sufficiently swift.

PREPUBLICATION COPY—Uncorrected Proofs

102
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

CONCLUSIONS

• The long-standing and widespread use of rupture mitigation valves (RMVs) by

pipeline operators who have judged them to be beneficial for operations and safety
demonstrates that their use is technically and operationally feasible under many
circumstances and across a wide range of conditions. While RMVs can be installed
on pipelines mainly by changing the actuators of existing manual valves, the varied
conditions and circumstances that exist across pipeline systems mean that retroactive
RMV installations can differ greatly in feasibility, complexity, and cost, as well as in
the benefits they can confer.
• There is a strong rationale for the integrity management (IM) process and its
obligations on operators for active risk management to make rupture mitigation valve
installation choices because of the wide variability among pipelines in terms of where
they are sited and their conditions and circumstances. However, the efficacy of the
approach depends on operators being capable and diligent in their implementation of
required IM processes with sufficient direction, guidance, and oversight from
regulators.
• As currently written for both hazardous liquid and gas transmission pipelines, the
integrity management regulations governing operator risk assessments are short on
direction and guidance on how the need for a rupture mitigation valve should be
evaluated and decided by operators, despite requiring operators to undertake such
evaluations.
• The integrity management process depends on operators using sound risk modeling
and analysis methods for informing their prevention and mitigation strategies in high
consequence areas. These methods must account for the location-specific
probabilities of different types of failures occurring, potential consequences ensuing,
and alternative measures being effective in failure prevention and consequence
mitigation. By using quantitative models that represent risk and uncertainty in a
probabilistic manner, the operator will be in a better position to assess the risk
reduction potentials of alternative safety measures at any given site. However, risk
modeling capabilities vary among operators, who are not required to use quantitative
models that can provide probability-based output for assessing the risk reduction
potential for RMVs and other safety measures.
• In deciding on the use of alternative safety measures with differing potentials for risk
reduction, including rupture mitigation valves (RMVs) at specific sites, operators
need to be able to determine the array of benefits and costs of each measure,
including benefits to the public. However, standardized practices for estimating
benefits and costs for pipeline risk management do not exist, raising questions about
how operators are establishing the need for RMVs and, more generally, how they are
prioritizing and making choices about all candidate safety measures in the public
interest.
• Because of the rigor, expertise, and data quality required, risk assessments using
quantitative modeling and economic analyses of the benefits and costs of alternative
safety measures can be challenging for operators to implement and for inspectors to
assess for quality. Operators and inspectors lack guidance and support on the
application of requisite analytic methods, including opportunities for training.

PREPUBLICATION COPY—Uncorrected Proofs

103
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

While all 10 committee members agreed with the conclusions above, 9 of the 10
members also agreed on the following conclusion. The reasoning of the one committee member
who disagreed with the conclusion is provided in Appendix A.

• A broadly applicable requirement for the installation of rupture mitigation valves

(RMVs), such as in the rule for newly constructed and entirely replaced segments of
pipelines, would not be advisable for existing hazardous liquid and gas transmission
pipelines in high consequence areas. While newly constructed and entirely replaced
segments of pipelines can be designed for RMVs, a similar broad-based requirement
that is retroactively applied to existing pipelines would not be advisable because the
available evidence on costs and benefits attributed to the installation of RMVs varies
widely as a function of factors such as site-specific pipeline characteristics, land use
patterns, the built environment, and ecological sensitivity.

PHMSA has not taken a position on the installation of RMVs on existing pipelines.
Existing statutory language, however, can be interpreted as precluding the establishment of new
regulatory standards for their installation when applied to existing pipelines. 114

RECOMMENDATIONS

In the view of the 9 of 10 committee members who continue to believe that operator decisions
about when to install RMVs on existing pipelines should be made in IM programs, the following
steps are warranted to strengthen the quality and execution of operator IM processes and their
verification by safety inspectors.

Recommendation 1: To make obligations for rupture mitigation valve (RMV) evaluations

well understood, the Pipeline and Hazardous Materials Safety Administration (PHMSA)
should revise and supplement the integrity management regulations and accompanying
guidance to ensure that the requirements for RMV analyses are clear to operators and
inspectors. For this purpose, PHMSA should do the following:
• Make the language in the regulations less equivocal about whether and under
what conditions an operator should evaluate an RMV as an added safety
measure.
• Where the regulations call for operators to install RMVs when they are
“needed” and an “efficient means” of protection on the basis on the evaluations,
define these terms or replace them to leave less room for varied interpretation.
• In regulations and guidance documents, establish criteria, metrics, and methods
for operators to consult and use when assessing the set of factors that they are
obligated to consider when evaluating RMVs, such as pipeline shutdown speed.
• Ensure that regulatory direction and guidance are clear in emphasizing the
importance of operators documenting the evaluation methods and criteria used
in their RMV evaluations, especially when the results do not favor or do not lead
to the installation of an RMV.
114
This report notes that Title 49 USC § 60104(b) states, “[A] design, installation, construction, initial
inspection, or initial testing standard does not apply to a pipeline facility existing when the standard is adopted.”

PREPUBLICATION COPY—Uncorrected Proofs

104
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Regarding this recommendation for PHMSA to establish evaluation criteria, metrics, and
methods for operators to use when evaluating factors such as a pipeline’s shutdown speed, some
committee members believe that PHMSA should require operators to evaluate on the basis of a
prescribed metric, such as the 30-minute isolation time that must now be satisfied by newly
constructed and entirely replaced segments of pipelines. The results from the operator’s RMV
evaluation using the prescribed metric would need to be documented and thus could be readily
noted by federal and state inspectors when reviewing an operator’s IM program documents and
results from the RMV evaluations. While statutory restrictions may preclude PHMSA from
compelling RMV installations on existing pipelines when the evaluation metric is not satisfied,
the agency could compile the information from these inspector-reviewed RMV evaluations for
insight into how much of the pipeline system could be at risk for slow or delayed rupture
isolation. Some other committee members, however, do not favor such a prescribed evaluation
metric out of concern that a single value would not be applicable to many circumstances and
could be used by operators to justify decisions not to install RMVs when public interests may
warrant their use.

Recommendation 2: To motivate more diligence, rigor, and transparency in the conduct of

rupture mitigation valve (RMV) evaluations and more focused and critical inspector
reviews of them, the Pipeline and Hazardous Materials Safety Administration should do
the following:
• Update enforcement guidance to establish criteria, methods, and benchmarks
for federal and state inspectors to use during integrity management document
reviews to enable more critical reviews of RMV evaluations and operator
reasons for not installing an RMV.
• Require operators to provide inspectors with documentation describing their
RMV evaluation methods and criteria well in advance of inspections to allow for
more careful and thorough reviews.
• Subject a selection of operators to post-inspection audits of their RMV
evaluation methods and their execution to monitor and assess the quality of the
analyses, understand inspector performance in conducting thorough reviews,
and judge the effectiveness of regulatory direction and enforcement guidance.
• Choose operators who do not install RMVs as priority candidates for such
audits.

Recommendation 3: To further the pipeline industry’s use of quantitative models for

integrity management (IM) risk analysis as well as sound and consistent methods for
establishing the benefits of safety measures, the Pipeline and Hazardous Materials Safety
Administration should do the following:
• Require the use of quantitative risk modeling by all pipeline operators for their
IM programs, except when an operator can make a compelling justification for
the use of another risk assessment method.
• Provide the pipeline industry with practitioner-oriented technical guidance for
conducting state-of-the-art pipeline risk analyses using quantitative models and
for estimating the benefits of alternative risk reduction measures, including
public safety benefits and interests.

PREPUBLICATION COPY—Uncorrected Proofs

105
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

• Encourage recognized standard-setting organizations, such as the American

Society of Mechanical Engineers and American Petroleum Institute, to enhance
their standards for hazardous liquid and gas transmission pipelines by including
more technical guidance for using quantitative risk models and for obtaining the
data needed to develop them.
• Coordinate with standard-setting organizations and subject matter experts to
develop a training curriculum and offer coursework for practitioners to apply
the technical guidance for risk modeling and benefits estimation, while also
including elements in training and qualification programs for state and federal
inspectors.

Regarding Recommendations 2 and 3, some committee members believe that PHMSA

should advise operators on the specific methods they should use in making choices among
alternative risk reduction measures. These committee members favor the use of benefit-cost
analysis to establish the net benefits of alternatives coupled with requirements that operators
document their analytic methods and results for inspectors to review. They believe operators are
now making such net-benefit calculations, formally or informally, but potentially construing
safety benefits on a limited basis that does not fully account for societal interests as one would
expect from a sound and compliant IM program. Although all committee members share a
concern that operators may not be considering societal benefits and interests fully when deciding
on the use of RMVs and other risk reduction measures, some members do not endorse making a
net-benefit calculus an explicit standard for decision making. Those members want to be sure
that operators are not dissuaded from making decisions that favor RMVs when all potential
benefits cannot be enumerated, such when the choice advances equity or promises other public
benefits sufficient to justify an installation.
In the committee’s view, it is fair and reasonable to expect all pipeline operators to use
quantitative risk modeling for their IM programs, especially because a large share of HCA
mileage is managed by a relatively small number of major operators likely to have the resources
and technical capacity to employ such methods. The recommended technical guidance and
training should help all operators, including smaller companies whose obligations to meet the
requirement could be phased in.

CONCLUDING OBSERVATIONS

Even when RMVs are technically and operationally feasible to install on an existing pipeline,
there can be valid reasons for not installing them. The cost of installing new valves capable of
remote or automatic operation or installing actuators to permit the remote or automatic operation
of existing valves may be prohibitive. The probability and potential consequences of a rupture at
a given site can also vary widely depending on factors such as the product in the pipeline, the
characteristics and setting of the pipeline (e.g., diameter, design, age, and topography), and the
features of the surrounding area (population density, activity levels, and environmental
sensitivities).
RMVs are intended to reduce the magnitude of the consequences of a rupture by isolating
the failed pipeline faster. The expected benefits of RMV installation are the reduction in the
consequences of a rupture multiplied by the probability that a rupture will occur during the
lifetime of the valve. While ruptures occur, the probability that they will occur at any specific

PREPUBLICATION COPY—Uncorrected Proofs

106
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

location is small. In some locations where the consequences of a rupture could be high, the costs
of retrofitting with an RMV will still exceed the expected quantifiable benefits because of the
low probability of a rupture, the high cost of the RMV installation, or both.
There will be locations where the expected quantifiable benefits of an RMV installation
exceed the costs. However, even in locations where the quantifiable benefits of RMVs exceed
the costs, it is possible that RMVs are not the most cost-beneficial option. Other options could be
less expensive to implement while yielding similar benefits, making them more cost-effective.
Likewise, other actions could be even more expensive to implement but offer more quantifiable
benefits than an RMV, such as by reducing the probability of a rupture or doing more to mitigate
adverse consequences.
The IM process is supposed to hold operators accountable for their risk management
strategies by giving them latitude to make context-specific choices about risk reduction
measures, including when to install an RMV. This differs from traditional regulatory designs that
prescribe the use of a specific treatment or feature or define specific performance criteria that
must be met, as is the case for most federal and state regulations that apply to pipelines
generally. A rationale for the IM regulatory design is that pipeline operators are more likely than
regulators to know the site- and context-specific risks associated with their pipelines and their
operations. Such management-based regulations can also infuse a stronger sense of safety,
responsibility, and accountability (i.e., safety culture) in the regulated industry if steadfast
compliance is supported, monitored, and enforced. 115
Nine of the committee’s 10 members believe the advice offered above, if followed, has
the potential to strengthen operator IM decisions about when to install RMVs and PHMSA’s
ability to ensure sound decisions. Not similarly confident that improvements to IM processes will
be made and result in operators to making decisions about RMVs that align more closely with
the public interest, one committee member proposes alternative approaches based on reasoning
offered in Appendix A. All other committee members agree, however, that if PHMSA is not
successful in furthering the recommended actions or if operators do not implement them
effectively, then alternative approaches may be warranted, including the introduction of
regulatory standards stipulating when RMVs should be installed.

National Academies of Sciences, Engineering, and Medicine. 2018. Designing Safety Regulations for High-
115

Hazard Industries. Washington, DC: The National Academies Press. https://doi.org/10.17226/24907.

PREPUBLICATION COPY—Uncorrected Proofs

107
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Copyright National Academy of Sciences. All rights reserved.

Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Appendix A
Dissenting View of Gary D. Kenney

SUMMARY

I am in agreement with most of the conclusions drawn by the study committee. However, I
disagree with the conclusion that prescriptive measures or standards for the installation of
rupture mitigation valves (RMVs) on existing pipelines in high consequence areas (HCAs) is not
desirable. I am concerned that the committee’s rejection of prescriptive measures and reliance on
an improved integrity management (IM) process in evaluating the “need for” or whether the
installation of RMVs would be an “efficient means” to reduce the consequences of a rupture on
existing pipeline segments will likely:

• Achieve an incremental improvement, if any, in the actual installation of such devices

on existing pipeline segments within or that could affect an HCA, and
• Result in a wide degree of variability in their installation as reflected by the various
operators’ individual risk tolerance levels and variability in the administration and
enforcement of the regulations from the federal to state and the state-to-state level.

To address these concerns, I am of a view that any revisions to the current regulations
regarding the need to install RMVs on existing pipeline segments where a release could impact
an HCA must be supplemented with clear, measurable, and enforceable standards. In this respect
I am of an opinion that the Pipeline and Hazardous Materials Safety Administration (PHMSA)
should incorporate the 30-minute requirement to shut down and isolate a failed segment of an
existing hazardous liquid or gas transmission pipeline segment within or that could affect an
HCA and/or a Class 3 and 4 location as in PHMSA’s recently enacted RMV rule for newly
constructed and fully replaced pipeline segments.
Any changes to the regulations will require a period of time to enact. Therefore, as an
interim measure I am recommending PHMSA undertake and complete a series of focused onsite
audits and inspections evaluating operators’ compliance with current regulatory requirements and
their ability to shut down and isolate those existing segments of their pipeline segments within or
that could affect an HCA and/or a Class 3 and 4 location.

BACKGROUND

Table A-1 presents the increase in the miles of pipelines within each network, the age of this
infrastructure, and the increase in the U.S. population since 1971 when the National
Transportation Safety Board (NTSB) first recommended the U.S. Department of Transportation
study the need to install automatic and remote-control shutoff valves on hazardous liquid and gas
transmission pipeline.

PREPUBLICATION COPY—Uncorrected Proofs

109
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

TABLE A-1 Increases in the Hazardous Liquid and Gas Transmission Pipeline Networks and
U.S. Population, 1971 to 2022
Total Miles Class 3/4 HCA
Miles Miles
1971 2022 2022 2022
Gas Transmission 160,000 230,000 34,000 21,000
Hazardous Liquids 93,000 298,000 — 93,000
U.S. Population (millions)
Total Population 205 332 — —
Within Urban/Suburban Areas — 265 — —
SOURCES: PHMSA’s Gas Transmission and Hazardous Liquid Annual Reports and the U.S.
Census Bureau’s National Population Totals. 116,117

As seen in Table A-1, as of 2022 there are as many miles of hazardous liquid pipelines
(approximately 93,000) located within or that could affect an HCA as were in the total network
of pipelines when NTSB made its recommendation in 1971. As noted in Chapter 2,
approximately 50% of the current operating network of pipelines was installed pre-1970, before
enactment of the first federal minimum pipeline safety standards. Further, as seen in the table
there are approximately 60 million more people living within urban and suburban areas (i.e.,
high and other populated areas) of the United States than of the whole population in 1971.
Data are not readily available of the increase in unusually sensitive areas (e.g., ecological
resource areas) in this more than 50-year period. Over the period of 2011 to 2021 hazardous
liquid pipeline operators reported increases in the miles of pipelines within each of the various
defined HCAs (see Table A-2).

TABLE A-2 Increase in the Miles of Hazardous Liquid Pipelines by HCA Type, 2011 to 2021
HCA Type Miles Increase
%
High Population 23
Other Population 24
Ecological Resource 8
Drinking Water Resource 8
Commercially Navigable Waterway 35
SOURCE: PHMSA’s Hazardous Liquid Annual Reports 2011 and 2022.

If or when revising the current regulations for existing pipeline segments, these past, and
likely to continue into the future, trends need to be considered as they culminate in an increasing
potential of “unmitigated consequences of major ruptures” without an enforceable standard as
PHMSA stated in the regulatory impact analysis for the recently enacted RMV rule. 118

116
See www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-mileage-and-facilities; files: Gas Transmission
& Gathering Annual Data – 2010 to present and Hazardous Liquid Annual Data – 2020 to present.
117
See www.census.gov/programs-surveys/popest/data/datasets: National Population Totals.
118
Preliminary Regulatory Impact Analysis, Amendments to Parts 192 and 195 to Require Valve Installation
and Minimum Rupture Detection Standards Proposed Rule. PHMSA-USDOT. February 2020.

PREPUBLICATION COPY—Uncorrected Proofs

110
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

THE EFFECTIVENESS OF THE CURRENT REGULATORY REGIME

The annual report forms gas transmission and hazardous liquid pipeline operators file with
PHMSA did not at the time of this study include a requirement to report on the number or type of
valves operators have installed on their pipeline segments within an HCA and Class 3 and 4
locations. 119 As a result it is not possible to measure, quantitatively, the effectiveness of the
current provisions in the 2001 and 2004 IM rules for installing RMVs where an operator
determined they were “needed” or an “efficient means” in reducing the impact of a release on an
HCA or a Class 3 and 4 location. However, at the time of and since their enactment various
reviews and studies of the provisions of the IM regulations have raised questions regarding their
effectiveness. Including their effectiveness at reducing the consequences of pipeline ruptures on
segments within or that could affect an HCA or Class 3 and 4 locations. These include:

• In 2001, the U.S. Department of Justice’s Environmental Resources Division

(DOJ/ENRD), in comments made on the proposed IM rules for hazardous liquid
pipelines recommended “substantial revisions of the proposed rules to improve its
enforceability … and clearly stated and unambiguous requirements for specific
actions that achieve measurable results.” 120
• In 2011, NTSB, in its report of the San Bruno, California, gas transmission pipeline
rupture, explosion, and fires, found that there is “little incentive for an operator to
perform an objective risk analysis” as regards to evaluating and installing RMVs on
existing pipelines and recommended PHMSA amend its regulations and “directly
require that automatic shutoff or remote control valves in high consequence areas and
Class 3 and 4 locations be installed.” 121
• In 2013, the Government Accountability Office (GAO), in a study and report of
operator’s responses to pipeline incidents, concluded that while the regulations
require operators to respond to emergencies in a “prompt and effective manner” that
neither the regulations nor guidance describe ways to progress to that goal and
without performance measures and targets, PHMSA itself cannot quantitatively
determine whether operators are meeting that goal. 122
• In 2015, an NTSB report into concerns about deficiencies in gas transmission pipeline
operators’ IM programs and their oversight by PHMSA and state regulators contained
33 findings, among which were that inspectors lacked training to effectively verify
operators’ risk assessments and that there was a lack of data regarding risk
assessment approaches and insufficient data to successfully implement probabilistic
risk models. 123

119
Annual Report for Calendar Year 20__ Natural Gas and Other Gas Transmission and Gas Gathering Pipeline
Systems Form PHMSA F 7100.2-1 (rev 10-2014), and Annual Report for Calendar Year 20__ Hazardous Liquid
Pipeline Systems, Form PHMSA F 7000-1.1 (rev 6-2014).
120
65 Fed. Register, 75382, December 1, 2000.
121
Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire San Bruno,
California, September 9, 2010. NTSB/PAR -11/01. August 30, 2011.
122
Report to Congressional Committees; Pipeline Safety, Better Data and Guidance Needed to Improve Pipeline
Operator Incident Response, GASO-13-168. Government Accountability Office. January 2013.
123
Integrity Management of Gas Transmission Pipelines in High Consequence Areas, NTSB/SS – 15/01.
NTSB. January 27, 2015.

PREPUBLICATION COPY—Uncorrected Proofs

111
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

• In 2019, NTSB, in testimony to Congress, stated that its recommendation from the
San Bruno accident regarding the requirement to directly require the installation of
RMVs on existing pipeline segments remained on “NTSB’s Most Wanted List of
Transportation Safety Improvements and should be implemented by PHMSA
expeditiously.” 124
• In 2020, PHMSA, in its Regulatory Impact Analysis of the proposed rule requiring
the installation of RMVs on newly constructed and fully replaced pipeline segments,
noted a need for the regulations included that “although some individual operators
have installed ASVs [automatic shutoff valves] and RCVs [remote-control shutoff
valves] in response to high profile incidents … the potential for unmitigated
consequences of major ruptures still remains high without an enforceable standard.”
As a result, PHMSA stated in the preamble to its 2022 RMV regulations for newly
constructed and fully replaced pipelines that the new rule “codifies a suite of design
and performance standards.” 125,126

REVIEW OF COMPLIANCE WITH THE CURRENT REGULATION

As part of this study, the enforcement actions PHMSA initiated in 2007, and the 2011–2012 and
2018–2022 periods were reviewed. The data for 2018-22 were reported in Table 5-1 in Chapter 5
of the report. I have added data for 2007, 2011, and 2012 in Table A-3.

TABLE A-3 Number of Enforcement Actions Initiated Related to the Provisions in the IM Rules
to Identify HCAs and Evaluate the Need for Additional Preventive and Mitigative Measures
Total
Enforcements Number of Enforcements for
Year (All Types) HCAs and Risk Analysis Type of Enforcement
Notice of
Probable
Violation
and Total
Hazardous Gas Proposed Assessed
Liquid Transmission Warning Notice of Compliance Penalties
Pipelines Pipelines Letter Amendment Order $
2007 255 14 13 2 16 9 298,000
2011 207 6 3 2 6 1 —
2012 276 9 3 2 7 3 —
2018 199 9 3 4 4 4 101,600
2019 223 7 4 2 4 5 46,600
2020 195 8 5 1 5 7 64,600
2021 264 10 4 2 4 8 26,200
2022 227 13 3 4 4 8 272,956

124
Pipeline Safety: Reviewing the Unmet Mandates and Examining Additional Safety Needs. NTSB. April 2,
2019.
125
Op. Cit. (3).
126
87 FR 20934. Code of Federal Regulations. Vol. 87, No. 68. April 8, 2022.

PREPUBLICATION COPY—Uncorrected Proofs

112
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

NOTES: The enforcement actions identified are only those related to the provisions the operator
must take for identifying a pipeline segment in an HCA or that could affect an HCA and
evaluations operators must perform on additional measures to prevent and mitigate the
consequences of a failure including an evaluation of the need to install an RMV (i.e., emergency
flow restricting devices or self- or remote-controlled valves).
SOURCE: PHMSA Pipeline Safety Enforcement Program, Summary of Enforcement Activity-
Nationwide,
https://primis.phmsa.dot.gov/comm/reports/enforce/Enforcement.html?nocache=6308.

2007 is the first year after the enactment of the IM rules that the webpage provides
documents of the various enforcement actions PHMSA initiated in any one year. The
enforcement actions initiated in 2007 were reviewed to serve as a baseline of related enforcement
activity. The years 2011 and 2012 were selected as they were immediately after the 2010 San
Bruno, California, incident and the 2010 Marshall, Michigan, incident 127 and NTSB’s reports of
those incidents. Those 2 years were included to see whether following those incidents there was
an increased number of enforcement actions initiated related to the requirements to evaluate
additional preventive and mitigative measures for pipeline segments that could affect an HCA.
The enforcement actions initiated from 2018 through 2022 were also reviewed being the most
current to the date of this study.
As seen in the Table A-3, enforcement actions related to provisions within the IM
regulations involving identification of HCAs and evaluating the need for additional preventive
and mitigative measures account for between 5 and 10% of the total number of initiated
enforcement actions for the three periods reviewed. No discernible increase in the number of
enforcement actions were found in the 2 years following the 2010 San Bruno, California, and
Marshall, Michigan, incidents compared to the other periods. In addition to the number of
enforcement actions initiated, the reasons PHMSA cited for alleging a probable violation were
examined. Across all of the above years, the enforcement actions initiated were for alleged
deficiencies in:

• The procedures, processes, or methods used to undertake the required risk analyses
and evaluations;
• The process or method not considering or including all of the factors listed in the
regulations or ASME B31.8S; and
• Not properly documenting the studies were performed and/or documenting the results
of the studies.

In other words, the initiated enforcement actions were process based. In almost all cases,
PHMSA’s required corrective actions focused on revising procedures, processes, or an actual
evaluation or study. Other than where a corrective action was related to a significant incident, in
the various Warning Letters, Notice of Amendments, etc., reviewed, no instance was identified
where PHMSA required an operator to install additional preventive and mitigative measures
including an emergency flow restricting device (EFRD) or RMV to reduce the potential
consequence of a release on an HCA.

Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release Marshall, Michigan July 25, 2010.
127

National Transportation Safety Board. NTSB/PAR – 12/01. July 10, 2012.

PREPUBLICATION COPY—Uncorrected Proofs

113
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

While PHMSA provides access to the various enforcement actions it initiates,

information on the number of inspections and audits, the amount of time PHMSA and state
inspectors allocate evaluating compliance with the relevant provisions in 49 CFR 192.935(c) and
195.452(i)(4) and the number of miles of pipeline segments by HCA type addressed is not
provided on PHMSA’s website. PHMSA does make information regarding the number of
inspection days allocated to the construction of new pipelines publicly available on its
website. 128 However, when the committee asked for similar information relating to the relevant
provisions of the IM rules, PHMSA replied that a Freedom of Information Act request would be
required for it to provide that information. Such information would assist in providing a more
complete picture on current compliance with and effectiveness of the relevant requirements.

CALIFORNIA REGULATORY ACTION FOLLOWING THE SAN BRUNO INCIDENT

Following the San Bruno incident, in 2011 the California Public Utilities Commission (Cal-PUC)
enacted a rule adopting new safety and reliability regulations for intrastate natural gas
transmission and distribution pipelines within the state of California. 129 Cal-PUC’s rule required
the state’s three gas transmission pipeline operators to submit what became known as Pipeline
Safety Enhancement Plans (PSEPs) describing the various measures the operators were
undertaking to improve the safety and reliability of their network of pipelines. One part of those
plans included the evaluation of the need for, and plans to, install RMVs on gas transmission
pipeline segments within populated areas. In contrast to the evaluations the three operators
undertook in compliance with the provisions of 49 CFR 192.935(c) to determine if the
installation of RMVs would be an “efficient means” to reduce the consequences of a rupture in
Class 3 and 4 locations, Table A-4 summarizes the number of RMVs the operators determined
were to be installed on various pipeline segments to mitigate the consequence of a release in
populated areas to comply with Cal-PUC’s rules.

TABLE A-4 Number of Valves Installed on Gas Transmission Lines in Response to Cal-PUC’s
2011 Rule
Total Class 3 and
Network 4 Locations HCA No. Valves
Operator Miles Miles Miles Upgraded/Enhanced/Installed
Pacific Gas & Electric 5,744 1,655 1,040 217
Company
Southern California Gas 3,640 1,258 1,136 387
San Diego Gas & Electric 245 204 174 74
SOURCES: Data generated from Pacific Gas & Electric Company’s Natural Gas Transmission
Pipeline Replacement or Testing Implementation Plan. Pacific Gas & Electric Company. August
26, 2011; Pipeline Safety and Enhancement Plan (PSEP) Final Compliance Report. Pacific Gas
and Electric Company. March 6, 2019; and Pipeline Safety Enhancement Plan of Southern
California Gas Company (U 904-G) and San Diego Gas & Electric Company (U 902-M),
Southern California Gas Company and San Diego Gas & Electric Company. August 26, 2011.

See www.phmsa.dot.gov/pipeline/pipeline-construction.
128

Decision Determining Maximum Allowable Operating Pressure Methodology and Requiring Filing of
129

Natural Gas Transmission Pipeline Replacement or Testing Implementation Plans. Public Utilities Commission of
California. June 16, 2011.

PREPUBLICATION COPY—Uncorrected Proofs

114
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

DISCUSSION

In several meetings throughout the course of the study committee’s investigation, questions were
put to various invited operators, industry associations, and regulators concerning the number,
spacing, and types of valves operators have installed on pipeline segments within or that could
affect HCAs. The more or less standard answer received was that the information exists in the
files of the operators themselves. Even when the question was asked of regulators, the answer
was that the information was in the files of the operators. Without ready access to such
information it places state and PHMSA inspectors at a considerable disadvantage when
discharging their administrative and enforcement responsibilities. Furthermore, as noted
previously, quantitative data or information that would assist assessing that the current
regulations and their administration have been effective is not available, at least to the general
public, to ensure the public operators have installed RMVs where “needed” or an “efficient
means” to reduce the consequences of a pipeline rupture on an HCA or a Class 3 and 4 location.
While quantitative data are not available, the various studies, reports, and enforcement
actions cited in the previous section raise some serious questions concerning the effectiveness of
the current regulations’ reliance on the use of risk assessment processes for determining the need
to install RMVs on existing pipeline segments. In that respect, perhaps what is particularly
telling is in the promulgation of the RMV rules for newly constructed and fully replaced
pipelines. Rather than relying solely on the use of risk assessment methods for determining the
need to install RMVs, PHMSA itself determined the need to codify “a suite of design and
performance standards” for their installation. As detailed in Chapter 2, more than 90% of the
pipeline segments within or that could affect an HCA or a Class 3 and 4 location are existing
pipelines. Furthermore, of that, almost half of those miles are pipelines installed prior to the
enactment of the 1970 federal minimum safety standards. As a result, it seems only appropriate
as PHMSA determined for newly constructed and entirely replaced pipeline segments, that a
critical need exists to include clear performance standards for installing RMVs on existing lines.

RECOMMENDATIONS

In light of:

• Past increases and probable continuing trends in population, identified areas of eco-
system concerns, the miles of pipelines innervating such areas, and the age of the
infrastructure;
• Concerns regarding the effectiveness of the current regulations, their administration, and
enforcement;
• That PHMSA’s recently enacted RMV rules codified and incorporated design and
performance standards to improve its enforceability; and
• That any revisions PHMSA decides to make to the current regulations will, necessarily,
need to follow the requirements for rulemaking in the Administrative Procedure Act,

I offer the following recommendations:

PREPUBLICATION COPY—Uncorrected Proofs

115
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Recommendation A1, Revise the current regulations to include clear and enforceable
performance standards:

PHMSA should revise relevant sections of 49 CFR Parts 192 and 195 to require that an operator
must be able to demonstrate that, as soon as practicable, but within 30 minutes of rupture
identification, the operator can fully isolate failed segments of existing pipelines within HCAs to
minimize the volume of gas (or liquid product) released and mitigate the consequences of the
rupture. When evaluating the need for an RMV, EFRD, or alternative equivalent technology on
an existing pipeline segment located within or that could affect an HCA, the requirement to
isolate the pipeline segment within 30 minutes must be fully integrated into the evaluation.
Where an operator cannot demonstrate the ability to fully isolate an existing pipeline segment
within or that could affect an HCA in 30 minutes or less the operator must upgrade existing
manual valves to an RMV, EFRD, or alternative equivalent technology state. PHMSA may agree
to waive this requirement where the operator demonstrates it is operationally, technically, and
economically infeasible to install such equipment. Any such waiver must include a report, signed
by an officer of the operator that:

• Describes the methodology used and results of the studies supporting the operational,
technical, and economic infeasibility of installing the equipment,
• Includes the estimated consequences of a worst-case scenario failure on the impacted
HCA and that the operator has involved the local emergency services in developing
the estimate(s),
• The public within the impacted area and the immediate surroundings were informed
of and consulted with respect to the consequences and the request for waiver.

Any evaluations or assessments conducted under this requirement must be reviewed,

revised, and signed by an officer of the company and where necessary a new waiver raised:

• As part of the corrective actions following a major incident on the operator’s network
of pipelines,
• A major change in the operational status of the pipeline segment,
• A change in the built or natural environment through which the pipeline right-of-way
passes,
• A change in the organizational structure including changes in staffing levels that
would affect the ability to isolate the pipeline segment,
• On a periodic basis.

To be clear, in contrast to the regulations for newly constructed or and fully replaced
pipeline segments, I am not recommending that additional valves need to be installed on existing
pipelines if the segment does not meet contemporary valve spacing requirements. Rather, I am
recommending that existing manual valves upstream and downstream of an HCA, and any
intermediate manual valves within the HCA, be enhanced or upgraded to an RMV state. As noted
above, I suggest provisions be included that would allow an operator to request a waiver, on
meeting certain conditions.
As noted in Chapters 1 and 6, PHMSA has maintained it does not have the authority to
issue regulations for retroactive changes to existing pipelines due to the “nonapplication” clause

PREPUBLICATION COPY—Uncorrected Proofs

116
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

in Title 49 USC § 60104(b). In response, while NTSB has maintained that PHMSA has such
authority, it also recommends Congress explicitly exempt RMVs from the non-application
clause. For PHMSA to act on Recommendation 1 above, it is possible Congress may need to
address and clarify the issue of the non-application clause.

Recommendation A2, As an interim measure, PHMSA to complete a focused program of

inspections and audits of current compliance

PHMSA should develop and aim to complete promptly (such as within 12 months) a
comprehensive enforcement program consisting of a series of field-focused audits and
inspections of existing pipeline segments that could affect an HCA, including:

• An evaluation of the current plans, programs, procedures, and equipment operators

have in place to respond to pipeline failures on segments within the various types of
HCAs,
• Verification through onsite assessments that the current mitigative measures minimize
the consequences of a rupture, and
• A comparison of the site verification assessments to the risk analyses or evaluations
operators have undertaken of the need to take or install additional preventive and
mitigative measures.
• After completing this work, PHMSA should provide a report of its findings to the
Secretary, Congress, and potentially impacted and interested parties.

In the final sentence of the report the majority of the committee writes that “if PHMSA is
not successful in furthering the recommended actions, or operators do not implement them
effectively, then alternative approaches may be warranted, including the introduction of
regulatory standards stipulating when RMVs should be installed.” Because I have little
confidence that even a more rigorous and transparent IM process will deliver, the time for
supplementing the current regulations with some clear enforceable standards is now.

PREPUBLICATION COPY—Uncorrected Proofs

117
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Appendix B
Timeline of Relevant Standards and Regulations

TABLE B-1 Relevant Industry Consensus Standards and Regulations Related to the Installation
of Valves onto Pipelines
Responsible
Body or
Year Agency Title Comment
1958 ASMEa Gas Transmission and Sections 805 and 848 establish the
Distribution Piping concepts of class location and the
Systems–B31.8 spacing of sectionalizing block
valves.

1966 ASME Liquid Petroleum Section 434.15.2 establishes general

Transportation Piping requirements for the installation of
Systems–B31.4 sectionalizing block valves at major
river crossings and other locations
depending on terrain.

1969 U.S. DOTb Transportation of Incorporates the 1966 ASME

Hazardous Liquids by standards into regulations, including
Pipeline–Title 49 Part the block valve installation
195 requirements. (See above: ASME
B31.4, including Section 434.15.2.)

1970 U.S. DOT Transportation of Natural Incorporates the 1958 ASME

and Other Gas by standards into regulations, including
Pipeline: Minimum the concepts of class location and
Federal Safety block valve spacing. (See above:
Standards–Title 49 Part ASME B31.8, including Sections
192 805 and 848.)

2000 U.S. DOT Pipeline Integrity 49 CFRc 195.452 requires an

Management in High operator to take measures to prevent
Consequence Areas and mitigate the consequences of a
(Hazardous Liquid pipeline failure that could affect a
Operators with more than high consequence area.
500 Miles of Pipeline)
Final Rule

2003 U.S. DOT Pipeline Integrity 49 CFR 192.935 requires operators

Management in High to take additional measures beyond
Consequence Areas (Gas those required by Part 192 to prevent
Transmission Pipelines) and mitigate the consequences of a
Final Rule pipeline failure in a high
consequence area.
2022 U.S. DOT Pipeline and Hazardous See Chapter 3 for a more detailed
Materials Safety discussion of the rule.

PREPUBLICATION COPY—Uncorrected Proofs

118
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Administration’s rupture
mitigation valve rules for
newly constructed and
entirely replaced
segments of pipelines.
a
American Society of Mechanical Engineers.
b
U.S. Department of Transportation.
c
Code of Federal Regulations.
SOURCES: https://www.phmsa.dot.gov/rulemakings/archived-rulemakings/archived-pipeline-
rulemakings-1968-1972; https://www.regulations.gov; https://www.asme.org.

PREPUBLICATION COPY—Uncorrected Proofs

119
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Appendix C
Industry Survey

The committee conducted industry outreach through an anonymized Alchemer form to collect
information on valve installation, type, and spacing. This form was sent out to pipeline operators
by three industry organizations: the American Gas Association, the Interstate Natural Gas
Association of America, and the American Petroleum Institute. The text in Box C-1
accompanied the form and provided background information about the study. On the webpage,
spreadsheets—one for hazardous liquid pipelines and one for gas transmission pipelines—were
available for download (see Figures C-1 and C-2). To provide data about their pipeline systems,
operators were asked to complete the appropriate spreadsheets based on their pipeline operations
and submit the completed files to the committee through the anonymized Alchemer form.

BOX C-1
National Academies of Sciences, Engineering, and Medicine Automatic and Remote-
Control Shutoff Valve Study Survey

At the request of Congress and the Pipeline and Hazardous Materials Safety Administration
(PHMSA), the National Academies of Sciences, Engineering, and Medicine (the National
Academies) is studying the feasibility of installing automatic and remote-control shutoff valves
(ASVs and RCVs) or upgrading existing manual valves to an ASV/RCV capability on existing
gas transmission (GT) and hazardous liquid (HL) transmission pipelines that could affect or are
located within Class 3/4 locations and/or high consequence areas (HCAs).
As part of evaluating the overall feasibility of upgrading existing valves or installing
ASVs/RCVs on existing gas transmission or hazardous liquid pipelines within HCAs, the
National Academies is surveying pipeline operators. While the annual reports pipeline operators
submit to PHMSA provide data and information on the miles of pipelines located within HCAs,
PHMSA does not currently require operators to provide information on where pipeline segments
that are located in or could affect HCAs are fitted with valves, the types of valves fitted, and the
spacing between the valves.
This National Academies’ survey seeks to collect data on what currently exists in the
field with respect to the number of valves, valve types, and the spacing between valves on
hazardous liquid (HL) and gas transmission (GT) pipeline segments that could affect or are
within Class 3/4 locations and HCAs. This data-gathering effort will assist the National
Academies in estimating the potential impact(s) if PHMSA were to issue a rule requiring pipeline
operators to either upgrade existing valves or retrofit existing pipelines within Class 3/4 locations
or HCAs with ASVs/RCVs as per PHMSA’s recently enacted Rupture Mitigation Valve rule for
newly constructed and entirely replaced segments of pipelines within Class 3/4 locations and
HCAs.
The following survey(s) requests data on pipelines in each type of HCA and/or Class 3/4
locations. The spreadsheet(s) request data on the number of valves currently fitted to pipeline
segments within HCAs, their type and spacing between the valves, the commodities
transported, pipe length and diameter, and the decade of pipeline installation.
Per Section 15 of the Federal Advisory Committee Act, any written materials provided to
the National Academies must be made available to the public. Thus, the survey results are
subject to public disclosure and will be made available upon request. The National Academies

PREPUBLICATION COPY—Uncorrected Proofs

120
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

recognizes that the specific location of valves may be considered critical infrastructure
information. As such, the survey has been designed to assure anonymity by avoiding eliciting
sensitive information, so please do not include personal or operator identifiers such as operator
name/ID or email.

PREPUBLICATION COPY—Uncorrected Proofs

121
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

FIGURE C-1 Spreadsheet used for gathering industry data for hazardous liquid pipelines.

FIGURE C-2 Spreadsheet used for gathering industry data for gas transmission pipelines.

PREPUBLICATION COPY—Uncorrected Proofs

122
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Appendix D
Study Committee Biographical Information

Ian P. Savage (Chair) is a professor of instruction in the Department of Economics and

Transportation Center at Northwestern University and the associate chair of the Department of
Economics. His research has centered on transportation safety; urban public transportation; and
the economics of safety, safety regulation, and transportation. He has conducted research into
safety performance and the effectiveness of safety regulations in most modes of transportation,
with a particular emphasis on the trucking and railroad industries. He has written several book
chapters on economics and transportation, including “Economics of Transportation Safety” in the
International Encyclopedia of Transportation and “Economic Regulation of Transport:
Principles and Experience” in the International Handbook on Economic Regulation. He has
served on the organizing committees of local, national, and international professional
organizations, including as the president of the Transportation Research Forum (2017–2018) and
the president of the Transportation and Public Utilities Group of the Allied Social Sciences
Associations (2022). He earned a B.A. in economics from the University of Sheffield and a
Ph.D. from the School of Economic Studies and Institute for Transport Studies at the University
of Leeds. He has been involved in several Transportation Research Board (TRB) activities,
including serving as a member on committees for several reports evaluating the Federal Railroad
Administration’s Research and Development Program (2007, 2011, and 2020) and the committee
for the special report Safely Transporting Hazardous Liquids and Gases in a Changing U.S.
Energy Landscape. In addition, he is a member of the TRB Standing Committee on
Highway/Rail Grade Crossings.

Lori S. Bennear is the Juli Plant Grainger Associate Professor of Energy Economics and Policy
at the Nicholas School of the Environment at Duke University with secondary appointments in
economics and public policy. She is serving as the senior associate dean for academics at the
Nicholas School. Her research focuses on evaluating the effectiveness of flexible environmental
policies, including information disclosure regulations, management-based regulations, liability
regimes, and demand-side management programs. She has applied these evaluations across a
range of environmental domains, including energy, toxics, and drinking water. Her recent work
focuses on developing best practices for adaptive regulation of emerging technologies in the
energy domain, including deepwater oil and gas, offshore wind, and autonomous vehicles. She
co-edited Policy Shock: Recalibrating Risk and Regulation After Oil Spills, Nuclear Accidents
and Financial Crises. She received a Ph.D. in public policy from Harvard University, an M.A. in
economics from Yale University, and an A.B. in economics and environmental studies from
Occidental College. She previously served on the Transportation Research Board’s committee
for the special report Modernizing the U.S. Offshore Oil and Gas Inspection Program for
Increased Agility and Safety Vigilance.

Robert B. Gilbert (NAE) is the chair of the Department of Civil, Architectural and
Environmental Engineering at The University of Texas at Austin, where he has taught for almost
30 years. Before joining the faculty, he practiced as a geotechnical engineer for 5 years with
Golder Associates Inc. His technical focus is the assessment, evaluation, and management of risk

PREPUBLICATION COPY—Uncorrected Proofs

123
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

for civil engineering systems. Recent activities include analyzing the performance of offshore
platforms and pipelines in Gulf of Mexico hurricanes; performing a review of design and
construction for the new Bay Bridge in San Francisco; and managing flooding risks for levees in
California, Louisiana, Texas, and Washington. He has been awarded the Norman Medal from the
American Society of Civil Engineers and an Outstanding Civilian Service Medal from the U.S.
Army Corps of Engineers. He is a member of the National Academy of Engineering and he sits
on the boards of the Geo-Institute of the American Society of Civil Engineers and the Academy
of Geo-Professionals. He holds a B.S., M.S., and Ph.D. in civil engineering from the University
of Illinois at Urbana-Champaign. He previously served on the National Research Council
committee that produced the report Assessment of the Performance of Engineered Waste
Containment Barriers.

Sara R. Gosman is an associate professor at the University of Arkansas School of Law. Prior to
joining the School of Law, she was a lecturer at the University of Michigan Law School and
practiced as a water resources attorney at the National Wildlife Federation and as an assistant
attorney general in the environmental division of the Michigan Department of Attorney General.
Her research explores the ways in which uncertainty about risk creates both challenges and
opportunities for policy. In her recent work, she focuses on the governance of risks from the
development and transportation of oil and natural gas. She is an expert on the laws governing the
risks of energy pipelines, and she has written on rationalism in pipeline safety policy and the
treatment of risk in pipeline siting. For 5 years, she has represented the public on the Gas
Pipeline Advisory Committee, a federal advisory committee to the Pipeline and Hazardous
Materials Safety Administration of the U.S. Department of Transportation. She is the president
of the board of directors for the Pipeline Safety Trust, a nonprofit organization devoted to
pipeline safety. She received an A.B. in religion from Princeton University, a J.D. from Harvard
Law School, and an M.P.A. in public policy and administration from the John F. Kennedy
School of Government of Harvard University. She previously served on the Transportation
Research Board’s committee for the special report Safety Regulation for Small LPG Distribution
Systems.

Orville D. Harris is the president of O.B. Harris, LLC, an independent consultancy specializing
in the regulation, engineering, and planning of petroleum liquids pipelines. Prior to this role, he
spent 15 years as the vice president of Longhorn Partners Pipeline, LP, where he was responsible
for the engineering, design, construction, and operation of a 700-mile-long pipeline carrying
gasoline and diesel fuel from Gulf Coast refineries to El Paso, Texas. For 5 years, he was the
president of ARCO Transportation Alaska, which owns four pipeline systems in the state,
including the Alyeska Pipeline Service Company. During his time as president, he directed the
efforts of a team of corrosion engineers in making $400 million of repairs to the Alyeska system,
which transports 25% of the crude oil from the North Slope of Alaska to the Port of Valdez.
Earlier in his career, he held several supervisory and managerial positions at ARCO Pipeline
Company, including manager of the northern area, manager of products business, and district
manager for Houston and Midland, Texas. Previously, he served on the board of directors of the
Association of Oil Pipelines and was a member on the Technical Hazardous Liquid Pipeline
Safety Standards Committee of the U.S. Department of Transportation’s Pipeline and Hazardous
Materials Safety Administration. He holds a B.S. in civil engineering from The University of
Texas at Austin and an M.B.A. from Texas Southern University. He served on the National

PREPUBLICATION COPY—Uncorrected Proofs

124
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Academies of Sciences, Engineering, and Medicine’s Transportation Research Board committees

for the reports Effects of Diluted Bitumen on Crude Oil Transmission Pipelines and Designing
Safety Regulations for High-Hazard Industries, as well as the Division on Earth and Life Studies
committee for the report Spills of Diluted Bitumen from Pipelines: A Comparative Study of
Environmental Fate, Effects, and Response.
He is a court-appointed independent third party to ensure compliance by a pipeline
operator under a consent decree.

Gary D. Kenney is a managing principal at Sine Rivali, LLC, where he provides technical
consulting services in the areas of accident investigation, audit, and development and
implementation of integrity and risk management systems. He has been consulting for more than
35 years, with experience in pipeline safety regulation and law, regulatory economics and impact
analysis, safety and environmental management programs, and human factors in accidents and
system failure. He led several technical and forensic investigations into significant pipeline
failures and gas explosions across the world, including the BP Macondo/Deepwater Horizon
blowout in the Gulf of Mexico; the Varanus Island gas pipeline explosion in Western Australia;
the Longford gas plant explosion in Victoria, Australia; and the Piper Alpha offshore platform
explosion in the North Sea. He has provided technical advice to the U.S. government to assist
with the administrative oversight of the operation of a network of hazardous liquid pipelines. He
was seconded to and assisted the United Kingdom Health and Safety Executive, the Australian
Government’s WorkSafe agency, and the British Columbia Safety Authority and Oil and Gas
Commission to develop and implement major accident hazard regulations. He holds a B.Sc. in
physics and mathematics from the University of Akron, an M.Sc. in environmental engineering
and business from the University of Cincinnati, and a Ph.D. in environmental health from the
University of Cincinnati.
He has been retained as a subcontractor for an independent third party (Orville D. Harris)
to ensure compliance by a pipeline operator under a judicial consent decree.

Scott A. Marshall is the pipeline safety program manager for the Virginia State Corporation
Commission, which is responsible for the inspection, investigation, and enforcement of
regulations for intrastate gas and hazardous liquid pipelines. As a program manager, he leads a
team of pipeline safety professionals. In addition to his leadership duties, he leads complex
pipeline inspections and investigations, including numerous in-depth fire and explosion
investigations, and other major incident investigations. He works closely with the U.S.
Department of Transportation’s Pipeline and Hazardous Materials Safety Administration
(PHMSA) as part of the federal–state partnership, as an associate instructor for PHMSA’s
Training and Qualification Division, and as part of the Commission’s Hazardous Liquids Federal
Interstate Agent. He has more than 26 years of public safety experience in corrections, law
enforcement, and the fire and emergency medical services. He serves as a senior firefighter and
nationally registered emergency medical technician for Hanover Fire and EMS in Hanover,
Virginia. In addition, he serves on National Fire Protection Association Technical Committees
58 and 59 for liquefied petroleum gas safety. He is also the past Eastern Region Chair for the
National Association of Pipeline Safety Representatives and is a Certified Fire and Explosion
Investigator (CFEI) and a CFEI Instructor. He earned his M.S. in emergency services
management from Columbia Southern University and a B.S. in criminal justice from Old
Dominion University.

PREPUBLICATION COPY—Uncorrected Proofs

125
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Edward M. Marszal is the president of Kenexis and responsible for instrumented safeguard
design basis development and verification/validation projects. At Kenexis, he works on safety
instrumented system (SIS) implementation and risk analysis projects for a variety of process
plants in diverse worldwide locations. He has 20 years of experience in the design and
implementation of engineered safeguards in process industries, including SIS, fire and gas
detection and suppression systems, alarm systems, and relief systems. He began his career with
UOP, a licensor of process units to the petroleum and petrochemical industries, where he
performed field verification of control systems and SIS at customer sites. After UOP, he led
multiple risk analyses and instrumented safeguard consulting teams that led to the establishment
of Kenexis. He has authored numerous technical papers, the International Society for
Automation (ISA) book Safety Integrity Level Selection, and the ISA book Security PHA Review.
He is a fellow with ISA, was a past ISA Safety Division Director, and participates on ISA
standards committees, including a standards panel for safety instrumented systems. He teaches
many of the Kenexis and ISA courses on SIS, as well as fire and gas topics, and he provides
regular input to the Purdue Process Safety and Assurance Center as a member of its scientific
advisory board. He earned his B.S. in chemical engineering from The Ohio State University.
His firm has no contracts with pipeline operators, though Kenexis was previously
engaged by pipeline operators for the placement of gas detectors at compressor stations. Kenexis
does not provide services related to pipeline emergency isolation.

Alison E. Millerick is a retired natural gas and environmental professional with extensive
experience in overseeing and leading natural gas control operations and environmental
remediation projects for major energy organizations. Her career path has covered several highly
regulated areas within the natural gas utility industry, including environmental, gas supply, and
pipeline safety. Before retiring, she was the manager of gas control for several natural gas
utilities in the Midwest, including the third largest U.S. city’s gas utility for 10 years, where she
gained experience in the use, design, and operation of remote-controlled and automatic shutoff
valves. During this time, she ensured that the proper protocols and training for the control center
were followed, developed, and implemented per control room management (CRM) regulations
and the organization’s CRM Plan. Prior to this role, she held other technical and project
management positions in various operational areas of the gas utility, such as environmental
affairs, gas supply, and gas control. Throughout her career, she has actively participated in
American Gas Association committee work, including the Environmental and Federal
Regulatory Committees, as well as serving 2 years as the chair of the Gas Control Committee.
She holds a B.S. in general engineering from the University of Illinois at Urbana-Champaign and
an M.S. in environmental management from the Illinois Institute of Technology.
She was employed by WEC Energy Group from 1999 to 2020. Her spouse is currently
employed by WEC Energy Group and has been working there since 1999.

Cassandra K. Moody is the president and principal engineer of Time For Change, LLC, a
consultancy that delivers solutions in the pipeline sector for integrity management programs,
engineering optimization, change management leadership during improvement and
implementation initiatives, training, and regulatory compliance. Before establishing her
consultancy firm, she led teams and managed projects as an operations engineer for Hilcorp
Energy Company and Harvest Midstream Company, a midsize North American pipeline

PREPUBLICATION COPY—Uncorrected Proofs

126
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

operator. Her experience with automated remote valves comprises environmental impact and
hydraulic modeling, engineering design, threat and risk analysis, retrofit or optimization
evaluations, associated cost-benefit analysis, and operability considerations for onshore and
coastal liquid pipeline systems. In addition, she has performed operations analysis of new and
existing natural gas and hazardous liquid pipeline systems and facilities, including analysis for
operability optimization, asset reliability, cost consciousness, and regulatory compliance. She
was a founding leadership team member of Young Pipeline Professionals, USA and is active
with the Society of Women Engineers–Houston Section. She is registered with the Texas Board
of Professional Engineers and Land Surveyors as a mechanical engineer. She earned her B.S. in
biochemistry and genetics from Texas A&M University and an M.S. in environmental
engineering from the University of Houston.

PREPUBLICATION COPY—Uncorrected Proofs

127
Copyright National Academy of Sciences. All rights reserved.
Ensuring Timely Pipeline Shutdowns in Emergencies: When to Install Rupture Mitigation Valves

Copyright National Academy of Sciences. All rights reserved.