final risk assessment report · risk assessment for ngong ping effluent pipeline in the proximity...

Risk Assessment for Ngong Ping Effluent Pipeline In the Proximity of Shek Pik Reservoir Final Risk Assessment Report

R/8111/03/1 Issue 3, December 2002 Drainage Services Department

Report Ref: R8111/03/1 Issue 3

Date: December 2002

AGREEMENT NO. CE 29/2001 OUTLYING ISLANDS SEWERAGE, STAGE 1, WORK PHASE I

NGONG PING SEWAGE TREATMENT WORKS AND SEWERAGE

Risk Assessment for Ngong Ping Effluent Pipeline in the Proximity to Shek Pik Reservoir

Final Risk Assessment Report

Prepared by BMT Asia Pacific Limited

in association with Lloyd’s Register ARS

BMT Asia Pacific Limited

DOCUMENT CONTROL SHEET

Client: Drainage Services Department

Title:

AGREEMENT NO. CE 29/2001 OUTLYING ISLANDS SEWERAGE, STAGE 1, WORK PHASE I NGONG PING SEWAGE TREATMENT WORKS AND SEWERAGE Risk Assessment for Ngong Ping Effluent Pipeline In the Proximity of Shek Pik Reservoir Final Risk Assessment Report

Job No: 8111 Ref: R/8111/03/1 Issue 3 Version: Final Date: 4 December 2002

Prepared under the Management of:

Signature:

Name T. L. Yip Position Senior Marine Engineer

Reviewed and Approved by:

Signature:

Name Norman Di Perno Position Managing Director Filename \\hkgnts19\civil\23400 - Secretary\Risk Assessment Report (BMT) for Effluent Export Pipe\Version

3 from BMT\Final Report.doc Distribution: DSD and forward distribution Page: 1 of 1


R/8111/03/1 Issue 3, December 2002 i Drainage Services Department

CONTENTS

1 INTRODUCTION 1

1.1 Background 1 1.2 Objective 1 1.3 Scope of Work and Overview of Methodology 1

2 THE STUDY AREA 3

2.1 The Sewage Treatment Works and Pipeline 3 2.2 Safety and other Design Features 3 2.3 Other Study Area Information 4

3 HAZARD IDENTIFICATION 6

3.1 Introduction 6 3.2 Site Visit 6 3.3 Literature and Database Review 6

Guidelines for Natural Terrain Hazard Studies, GEO SPR 1/2002, April 2002 7 The Natural Terrain Landslide Study, Phases I and II, GEO Report No. 73, 1999 7 The Natural Terrain Landslide Inventory (NTLI) on the GEO website 8 F C Dai and C F Lee, Terrain Mapping of Landslide Susceptibility using a Geographical Information System: A Case Study. 2001 8 F C Dai, C F Lee and Y Y Ngai, Landslide Risk Assessment and Management: An Overview. 2001 9 F C Dai and C F Lee, Frequency-Volume Relation and Prediction of Rainfall-Induced Landslides. 2000. 9 Ductile Iron Pipe Research Association (DIPRA). External Corrosion and Protection of Ductile Iron Pipe. (Plus other references from their website) 9 Chlorine Chemistry Council. Are our Pipes Safe? October 1998. 9 Approaches to Chemical Safety Management in the Chemical Industry. Stan Grossel, Process Safety and Design, Inc. 10 Data from WSD on DI pipe failures 10 Data from DSD on DI and HDPE Pipe Failures 11 Miscellaneous International Data on Pipework, Valve and Joint Failures 11

3.4 Hazard Identification Workshop 14 Time and Venue 14 Workshop Participants 14 Methodology 15 Phases 15 System and Sub-systems 15 Question Categories 15 Workshop Findings 16

3.5 Failure Case Definition 19

4 FAILURE FREQUENCY ANALYSIS 20


R/8111/03/1 Issue 3, December 2002 ii Drainage Services Department

4.1 Introduction 20 4.2 Pipeline Failures due to Causes other than Landslides 20

Introduction 20 DI Pipe Leaks 20 Joint Leaks 21 Valve Leaks 21

4.3 Natural Terrain Landslide Risk Model 21 Introduction 21 Landslide Initiating Frequency 22 Event Tree Analysis 22 Application of the NTL Risk Model 24 NTL Risk Results 24 Calibration of the results 24

4.4 Summary of Initiating Event Failure Frequencies and Probability of Operation of Safety Systems 26

Summary of Failure Case Frequencies 26 Probability of Operation of Safety Systems 26

4.5 Event Tree Analysis and Summary of Outcome Frequencies 26

5 FAILURE RELEASE RATES AND QUANTITIES 28

6 RISK RESULTS AND ASSESSMENT 31

6.1 Introduction 31 6.2 Risk Assessment Criteria 31 6.3 Assessment 34 6.4 Sensitivity of the Results to Assumptions and Modelling 34 6.5 Risk Mitigation 35

Introduction 35 Potential Risk Mitigation Measures 35 Measure 1 - Fabricate 450m Critical Section from Continuous Welded Corrosion Resistant Material 36 Measure 2 – Uprate 1700m Section within LDGG 36 Measure 3 - Increase capacity of leak collection system to 100% of flow 37 Measure 4 - Provide adequate protection so that worst case landslide would not damage pipeline 37 Measure 5 - Treat water to standards so that it could be fed into a reservoir 37 Measures 1 and 4 Combined 37 Measures 3 and 4 Combined 37 Measures 1, 3 and 4 Combined 37 Summary 37 Conclusion 38

7 CONCLUSIONS AND RECOMMENDATIONS 40

7.1 Introduction 40 7.2 Risk Assessment of the Original Design 40


R/8111/03/1 Issue 3, December 2002 iii Drainage Services Department

7.3 Recommendations for Risk Reduction 40 7.4 Conclusion 40

8 REFERENCES 42

LIST OF FIGURES

Figure 1 Location of Sewage Treatment Works and Overall Pipeline Route Figure 2 Pipe Section Under Study Figure 3 The Leakage Collection System Figure 4 Outline Methodology Figure 5 Natural Terrain Landslides which have occurred on Slopes above Pipeline Figure 6 Hazard Identification Workshop Flowchart Figure 7 The Definition of Sub-slopes used in the Natural Terrain Landslide Risk

Assessment Mode Figure 8 Concentration versus Distance from Discharge Figure 9 Event Tree for Landslide, External Effect and Damage by Others Figure 10 Event Tree for Pipe Break due to Internal or External Corrosion Figure 11 Event Tree for Pipe Leak . 15% of Flow due to Internal or External Corrosion Figure 12 Event Tree for Pipe Leak , 15% of Flow Figure 13 Cumulative Frequency of Leakage for Mitigated Case, Additional Cases I and II

LIST OF TABLES

Table 1 Unofficial Traffic Count along Keung Shan Road (3 Sept 2002, 4:30pm to 4:50pm)

Table 2 Incidence of DI Fresh Water Pipe Leakage (WSD)

Table 3 Incidence of DI Salt Water Pipe Leakage (WSD)

Table 4 Incidence of DI Sewage Pipe Leakage (DSD)

Table 5 Records of Natural Terrain Landslides on the Hillside above the Pipeline

Table 6 Team Members Qualifications and Positions

Table 7 Incidence and Frequency of DI Fresh Water Pipe Leakage (WSD)

Table 8 Incidence and Frequency of DI Salt Water Pipe Leakage (WSD)

Table 9 Incidence and Frequency of DI Sewage Pipe Leakage (DSD)

Table 10 Geological Categories used in the NTL QRA Model

Table 11 Natural Terrain Landslide Risk Model – Input Data for each Sub-slope

Table 12 Natural Terrain Landslide Risk Model – Results for each Sub-slope


R/8111/03/1 Issue 3, December 2002 iv Drainage Services Department

Table 13 Event Tree Outcome Frequencies

Table 14 Released Quantity for each Failure Case with reduced Packet Size

Table 15 Worksheet for Input and Output Data

Table 16 Risk Guidelines

Table 17 Risk Assessment Matrix

Table 18 Risk Reduction Measures – Residual Risk and Assessment

Table 19 Treated effluent Spill Frequencies with Measures 3 and 4

Table 20 Registered Slopes below the Pipe Section (East)

Table 21 Registered Slopes above the Pipe Section (West)

Table 22 Lookup Table for Terrain Component for Landslide Frequency and Probability of Long Runout and Mobile Factors

Table 23 Lookup Table for Geological Category Landslide Frequency and Long Runout and Mobile Probability Factors

Table 24 Lookup Table for Slope Angle Landslide Frequency Factor

Table 25 Lookup Table for Vegetation Class Landslide Frequency and Long Runout and Mobile Probability Factors

Table 26 Lookup Table for Elevation Landslide Frequency Factor

Table 27 Lookup Table for Head Slope Angle Long Runout and Mobile Probability

Table 28 Discussion of Practicality of Mitigation Measures

Table 29 Leakage Quantities for Sensitivity Cases

Table 30 Detailed Results for the Mitigated Case, and Additional Cases I and II

LIST OF APPENDICES

Appendix A Site Visit Photographs

Appendix B Hazard Identification Workshop Logsheets

Appendix C Details of Ownership of Man-made Slopes above and below the Pipeline

Appendix D Natural Terrain Landslide Risk Model – Input Data, Even Trees and Lookup Tables

Appendix E Pipeline Leakage Event Trees

Appendix F Discussion of Practicality of Risk Mitigation Measures

Appendix G Sensitivity Analysis

Appendix H Comments and Responses


R/8111/03/1 Issue 3, December 2002 1 Drainage Services Department

1 INTRODUCTION

1.1 Background

1.1.1 As part of the Outlying Island Phase I Sewerage Work, a Sewage Treatment Works and the associated sewerage system will be built at Ngong Ping, serving the future developments in the Ngong Ping area on Lantau Island. The effluent from the proposed Ngong Ping Sewage Treatment Work, which will be treated to tertiary level, will be conveyed to the disposal point via the proposed effluent pipe.

1.1.2 The original proposal for effluent disposal was to have the treated effluent conveyed to and discharged at Tai O. During the detailed design phase, an alternative route was identified. This involves diverting the effluent for discharge into Tung Wan. For this alternative discharge option, a section of the effluent pipe (approx. 450 m in length) will be in close proximity to, and within the 100 m safety buffer zone of the Shek Pik Reservoir. This is highlighted in the attached plan (see Figure 1).

1.1.3 Given the close proximity of the effluent pipeline to the reservoir and the need to prevent possible pollution of Shek Pik Reservoir, WSD has requested a Risk Assessment to be carried out for the section of the proposed pipeline located within the 100m safety buffer zone (see Figure 2 and Figure 3).

1.1.4 The pipeline will run underneath Keung Shan Road which is located at the foot of a slope. As such, one of the major concerns relates to the potential pipeline damage caused by a landslide. To this end, a natural terrain landslide risk assessment will be carried out as part of this study to quantify the potential risk from landslides and the results will be used in the calculation of the overall risk.

1.1.5 BMT Asia Pacific Limited, in association with Lloyd’s Register (LRARS) and Binnie Black & Veatch HK Ltd. (BBV), has been appointed by Drainage Services Department to carry out the risk assessment.

1.2 Objective

1.2.1 The objective of this risk assessment is to evaluate the potential risk of polluting the water at the nearby Shek Pik Reservoir in case of pipeline leakage, which may be caused by failure of the pipeline (for example by corrosion) or external events (such as landslides or excavation). By establishing the probability of the occurrence of a failure and the consequence of its occurrence, the risk of potentially contaminating the water in Shek Pik Reservoir and the protection measures required to minimise this risk can be identified. This information will then be used to determine the acceptability of the risks associated with the proposed alternative route (in particular the 450m section under consideration).

1.3 Scope of Work and Overview of Methodology

1.3.1 A flowchart showing the overall methodology followed for the risk assessment is presented in Figure 4. It was agreed by DSD, WSD and Arup before the commission of this Study that the risk assessment should involve the following main tasks: 1. Kick-off meeting, initial data collection A kick-off meeting was to be held to facilitate the exchange of opinions and information to obtain agreement from all parties involved on the study approach at the beginning of the study. The definition of the risk to be assessed would be established (e.g. degree of contamination, illness or fatalities, loss of supply, etc.), and the criteria to assess the risk (EIAO or matrix style) would be discussed and agreed. 2. Site visit



The goal of the site visit was to collect information on the pipeline route and slope characteristics, including the soil type, vegetation, etc, to supplement information obtained from GEO. 3. Data review Relevant databases were obtained and reviewed, e.g. DSD defects database, and records of similar pipeline failure incidents in Hong Kong from WSD & DSD, as well as the background information regarding the slope type and stability. Where local data was not available, international pipeline failure data was referenced. 4. Set up natural terrain risk model The risk of landslide from natural terrain (say 18 sub-slopes) was assessed using a risk assessment model based on “The Natural Terrain Landslide Study, Phases I and II” conducted by GEO. The slopes above the area of concern for the pipework would be divided into a number of sub-slopes. A sub-slope has broadly similar characteristics across its area. The parameters affecting landslide likelihood and consequence were entered into the model for each sub-slope. The results from natural terrain risk model for each sub-slope were summarised. 5. Hazard Identification Workshop A structured brainstorming workshop was held to identify the hazards, mechanisms and issues of concern and the safeguards in place. The criteria to assess the risk (EIAO or matrix style) were confirmed. The workshop was attended by all concerned parties (including DSD, WSD, BMT, Arup, LRARS & BBV) to ensure “buy-in” to the methodology and conclusions of the study. Log sheets were filled during the workshop. An outline flow chart for the workshop is given in Figure 6. 6. Risk Assessment The representative failure cases were identified based on the databases, workshop discussions and the results of the natural terrain landslide risk modelling. The probability / frequency of leakage for the representative failure cases were estimated using the relevant databases obtained, e.g. DSD defects database, records of similar pipeline failure incidents in Hong Kong from WSD & DSD and / or the international pipeline failure records. The release rate and quantity of treated effluent for each failure case were estimated. A method of assessment of the results was developed. The level of risk was assessed and mitigation measures (in addition to those identified in the Hazard Identification workshop) were identified. 7. Reporting The Risk Assessment Report was prepared (Draft and Final) after the completion of the workshop.



2 THE STUDY AREA

2.1 The Sewage Treatment Works and Pipeline

2.1.1 The Ngong Ping Sewage Treatment Works (STW) will be designed for the treatment and disposal of sewage generated from both the committed developments of the cable car project (which includes a terminal at Ngong Ping and associated commercial developments) and the existing developments (Po Lin Monastery, local food stalls, youth hostel and village houses, etc.).

2.1.2 The effluent composition will be as follows:

? Tertiary treated. BOD : 10 mg/l (95th percentile). ? SS : 15 mg/l (95th percentile). ? Ammonia nitrogen : 1 mg/l annual average. ? Nitrate+Nitrite Nitrogen : 7 mg/l annual average. ? E. Coli : 100 count/100ml geometric mean. ? Other parameters according to the Technical Memorandum of the EIAO.

2.1.3 The treated effluent from the STW will be conveyed to a disposal point at Tung Wan via the proposed pipeline, part of which runs close to Shek Pik Reservoir. The overall route of the pipeline is shown in Figure 1. 1700m of the pipeline runs within the Lower Direct Gathering Ground (LDGG). 450m of this is within the 100m Safety Buffer Zone of the reservoir. This 450m section is approximately 3500m from the STW.

2.2 Safety and other Design Features

2.2.1 The pipeline will be 200mm diameter Ductile Iron, according to BS EN 598. According to the standard, an internal cement mortar lining and external metallic zinc coating (or equivalent) will be provided. The cement lining is considered to make the pipe more durable and provide a “15-year design life”.

2.2.2 The pipe and fittings will be rated for 16 bars with a site test pressure of 24 bars. Joints will be socket and spigot tyton joints, except in the valve and manhole chambers where flange joints will be used. Flow will be intermittent at a constant rate of 50 l/s. (Post meeting note – DSD have confirmed that the design flow rate will be 40 l/s in total for twin pipeline arrangement.)

2.2.3 The pipeline will run underground throughout its length, except at the 3 locations shown in Figure 2. For the underground sections there will be a minimum cover of 900mm under the carriageway and 450mm under the footpath.

2.2.4 Manholes will be provided every 60m. Manually operated isolation valves (gate type) will be provided every 120m (at alternate manholes). Tees will be provided in each manhole chamber, offering the possibility of access for inspection (e.g. by CCTV) and bypassing of a section. At this stage bypass pipework has been envisaged as flexible plastic type.

2.2.5 A leakage detection system will be provided based on monitoring by 2 flowmeters, one at the STW and one at Tung Wan. If leakage is considered to be occurring then flow is stopped by closing Remote Operated Valves (ROVs) at the STW. If leakage is detected, it is necessary to allow the contents of the pipeline or at worst the remainder of the batch must be allowed to drain.

2.2.6 Application of a permit to work system for emergency valve closure may introduce to much delay. Two possible options are suggested: (1) Closing of ROVs in an emergency is initiated by pressing a dedicated emergency shut down button which is appropriately interlocked to other equipment so that



emergency shut down and stopping of flow of effluent is always safe. (2) An emergency shut down procedure is developed to ensure isolation is always safely achieved. In both cases a member of staff will always need to be available who is trained and pre-authorised to shut down the necessary part of the STP operation and stop the flow of effluent as soon as possible, and at least before commencement of the flow of another batch of treated effluent.

2.2.7 In case of any difficulty in closing these, the manual valves on the pipeline could be closed. The time to close valves manually has been estimated to be 1 hour. To minimise the quantity spilt, the valve immediately above the leakage point should be closed. If the leakage point is not yet known then all manual valves on and the valve immediately before the 450m section should be closed, one by one, starting with the valve nearest to the STW.

2.2.8 On the 450m section within the Safety Buffer Zone, a leakage collection system will be provided. A sketch showing the leakage containment and collection system is shown in Figure 3. This consists of a concrete channel, within which the pipeline is located, backfilled with coarse (e.g. 10mm diameter) material. Any leakage is collected in perforated PVC tubes located under the backfill material. The system is designed to contain and collect flows of up to 15% of maximum.

2.2.9 In general, visual inspection will be carried out once every 6 months by DSD maintenance staff after installation. When required, CCTV inspection can also be conducted but to avoid interruption to the flow of treated effluent, bypass pipework must be used.

2.2.10 For aboveground sections, which span streams and/or pass beside road bridges, the containment and collection system will be a stainless steel enclosure (not the concrete channel, as for the containment and collection when underground). Any water collected by the perforated tubes from the underground section will feed into the stainless enclosure which will surround the pipeline and this water will then be fed on into the next underground section.

2.2.11 A marker (e.g. coloured tape) will be placed at a level of about 200 mm above the pipe surface along the entire alignment to indicate the pipeline alignment (to minimize the potential damage that may be caused by other utilities laying work).

2.2.12 Drill holes will be installed along the pipeline section within the LDGG to monitor the ground water quality.

2.3 Other Study Area Information

2.3.1 It is likely that there will be utilities laying work by others (e.g. telecom, gas, etc.) along Keung Shan Road in the future as part of the South Lantau Development Project. However, the programme is currently unknown.

2.3.2 It is observed that heavy vehicles (including buses, coaches & lorries) are travelling on Keung Shan Road (although the flow was low during the observation period), see Table 1.

Table 1 Unofficial Traff ic Count along Keung Shan Road (3 Sept 2002, 4:30pm to 4:50pm)

Uphill DownhillLorry 1 1 Bus 3 5 Van 2 3 Private car 1 4 Taxi 1 1



2.3.3 Shek Pik Reservoir has a capacity of 24.46 Mm3. The water from Shek Pik Reservoir is treated before distribution. There are two outlets, both at the southeast corners. One is the normal draw out point and the other is the overflow outlet. The normal expected consumption rate for the reservoir is 35,000Ml per year.

2.3.4 Man-made slopes above Keung Shan Road are maintained by Highways Department (HyD). A list of man-made slopes along Keung Shan Road is included in Appendix C.



3 HAZARD IDENTIFICATION

3.1 Introduction

3.1.1 The hazard identification activities for the project comprise 3 main streams: 1. The site visit. 2. Review of available literature and incident databases. 3. The Hazard Identification Workshop.

3.1.2 The product from these activities is a set of representative failure cases and safety systems. The hazard identification activities also enabled collection of information on the project and the study area.

3.2 Site Visit

3.2.1 A site visit by representatives of DSD, Arup, BMT, LRARS and BBV was carried out on 3 September 2002. The objectives of the visit with respect to the risk assessment were to familiarise the team with the study area, survey the 450m section of pipeline route within the safety buffer zone and to inspect the natural terrain above this section of the pipeline route.

3.2.2 The findings of the site visit, such as slope data for the natural terrain landslide risk assessment, and provision of general background knowledge of the study area for the rest of the study, particularly the workshop, are not written up in detail. The relevant information has been included in the respective sections as appropriate. Other relevant observations are highlighted below.

3.2.3 Keung Sheung Road runs just above the west side of the Shek Pik Reservoir at the foot of natural slopes rising to the west. The pipeline is to run on the reservoir (east) side of the road. The road is constructed by means of cuts into the hillside, embankments and bridges. A number of streams run down the hillside and pass under the road by means of bridges and culverts. Parts of the road are sloping steeply and other parts are relatively level.

3.2.4 The natural terrain above the pipeline is generally covered in shrub / woodland to a height of 3 to 5 meters. This is heavily overgrown and includes a large amount of dead and decaying material.

3.2.5 On relict landslide scars, vegetation is newer and on the largest such scar at the southern end of the pipeline, landslide preventative measures, including buttress and shotcrete / chunam cover of exposed surfaces, had been carried out. However, no significant features were observed within the area above the 450m stretch of pipeline.

3.2.6 No boulders were observed on the hillside above the pipeline.

3.2.7 It is suspected that some of the man-made slopes along the pipeline route were unregistered, probably due to being smaller than the criterion for registration to be required.

3.2.8 Photographs taken during the site visit are included in Appendix A.

3.3 Literature and Database Review

3.3.1 Literature and database searches and review were targeted at two main areas:

? Natural Terrain Landslide Incidence, particularly in this area, and risk modelling. ? Ductile Iron and other suitable types of pipe, their characteristics, performance, failure modes,

failure rates and possible protective measures.



3.3.2 The following references were consulted in relation to the natural terrain hazards: 1. Guidelines for Natural Terrain Hazard Studies, GEO SPR 1/2002, April 2002. 2. The Natural Terrain Landslide Study, Phases I and II, GEO Report No. 73, 1999. 3. The Natural Terrain Landslide Inventory (NTLI). GEO web-site. 4. F C Dai and C F Lee, Terrain Mapping of Landslide Susceptibility using a Geographical

Information System: A Case Study. 2001. 5. F C Dai, C F Lee and Y Y Ngai, Landslide Risk Assessment and Management: An Overview.

2001. 6. F C Dai and C F Lee, Frequency-Volume Relation and Prediction of Rainfall-Induced Landslides.

2000.

3.3.3 The following references were consulted in relation to ductile iron and other types of pipe: 7. Ductile Iron Pipe Research Association (DIPRA). External Corrosion and Protection of Ductile

Iron Pipe. (Plus other references from their web-site) 8. Chlorine Chemistry Council. Are our Pipes Safe? October 1998. 9. Approaches to Chemical Safety Management in the Chemical Industry. Stan Grossel, Process

Safety and Design, Inc. 10. Data from DSD on DI and HDPE pipe failures. 11. Data from WSD on DI pipe failures. 12. Miscellaneous International Data on Pipework, Valve and Joint Failures.

3.3.4 The findings of the review are summarised below.

Guidelines for Natural Terrain Hazard Studies, GEO SPR 1/2002, April 2002

3.3.5 The causes of landslides are highlighted in this and other references below. The dominant factor is heavy, prolonged rainfall, combined with steep slopes and some initiating features such as a crevice, eroded footpath, etc. It is clear that other factors, described below, may make landslides more or less likely, but landslides are not to be expected without rainfall.

3.3.6 This reference contains the definition of facilities below hillsides commonly referred to in relation to landslide hazards. The proposed facilities (i.e. the pipeline) constitute Group 4 facilities or lower – this grouping is relevant to the consideration of Natural Terrain Risk. If combined with the raw water reservoir and the lightly used, restricted Keung Shan Road, they could constitute Group 2b – this grouping is relevant to the consideration of the risk from man-made slopes along Keung Shan Road.

3.3.7 Criteria with 3 levels are specified: Inclusion, Alert and In-Principle Objection. None of these criteria are met and so a hazard assessment is not strictly required.

3.3.8 Three types of assessment are stated as being broadly acceptable:

? Factor of Safety Approach. ? Quantified Risk Assessment Approach. ? Design Event Approach.

3.3.9 This study adopts the Quantified Risk Assessment Approach. However, it is to be noted that the consequences of any landslide are damage to the pipeline, rather than fatalities.

The Natural Terrain Landslide Study, Phases I and II, GEO Report No. 73, 1999

3.3.10 26,780 natural terrain landslides over a period of about 50 years in Hong Kong, some recent some relict, were included in NTLS II. This study provides an extensive and authoritative survey and analysis of natural terrain landslides in Hong Kong. Maps included with the study report show 2 areas of relatively high risk which could affect the pipeline, one to the north west of the pipeline showing a



small area of 5 landslides per year per square kilometre and another to the south west showing concentric areas of 5 and 10 landslides per year per square kilometer.

3.3.11 The NTLI analysed in this report has been superseded by the up-to-date version accessed via the internet, discussed below.

3.3.12 The large size of the database for the whole of Hong Kong is considered to be a good statistical sample, likelihood of occurrence will be simulated based on the detailed findings of NTLS II. The smaller number of landslides (45 are listed in Table 5) on the nearby hillside is considered too small for the adequate simulation of risk. However, this and other more recent information will be used for calibration and discussion of the sensitivity of the results.

3.3.13 The analysis presented provides sufficient basis for a model based on the following parameters:

? Terrain Component. ? Geological Category. ? Slope Angle. ? Vegetation Class. ? Elevation (m). ? Head Slope Angle (degrees).

3.3.14 The details of the natural terrain landslide model used in this study are presented in Section 4.

The Natural Terrain Landslide Inventory (NTLI) on the GEO website

3.3.15 45 natural terrain landslides on the hillside above the 450m section of pipeline are listed in Table 5 and shown in Figure 5. Only one of these landslides had a large runout distance, but even so only reached half of the way from the point of initiation to the pipeline.

F C Dai and C F Lee, Terrain Mapping of Landslide Susceptibility using a Geographical Information System: A Case Study. 2001

3.3.16 This reference contained some useful information, produced by further analysis of the NTLI indicating the influence on landslide susceptibility of:

? Lithology. ? Slope Gradient. ? Slope Aspect. ? Elevation. ? Land cover. ? Distance to drainage line.

3.3.17 There is a danger of double counting of certain factors in this type of assessment. For example, land cover, slope aspect, gradient, elevation and lithology may be interrelated. This information will be considered again later in the report with respect to the sensitivity of the results.



F C Dai, C F Lee and Y Y Ngai, Landslide Risk Assessment and Management: An Overview. 2001

3.3.18 This reference was received at a relatively late stage and not reviewed in detail, it contained details of Risk Guidelines for QRA of Natural Terrain, but was otherwise not found to be useful for this study.

F C Dai and C F Lee, Frequency-Volume Relation and Prediction of Rainfall-Induced Landslides. 2000.

3.3.19 This reference was received at a relatively late stage and not reviewed in detail but was not found to be useful for this study.

Ductile Iron Pipe Research Association (DIPRA). External Corrosion and Protection of Ductile Iron Pipe. (Plus other references from their website)

3.3.20 The problem of lateral thrust due to the flow in the pipe around bends is identified. This can result in sideways creep and separation of the joints due to elongation of the pipework unless proper restraint is provided.

3.3.21 The paper highlights “break rates for this material (DI) in 1992 and 1993 there were 9.3/100km/year and 9.8 breaks per 100km/year, respectively. Between 76% and 78% of the ductile iron pipe failures were reported to have been a result of holes or pits. Also that pitting corrosion was a primary mode of failure and the average maximum pitting corrosion rate for unprotected ductile iron was typically in the range of 0.5 to 1.5mm/yr, with values up to 4.0 mm/yr in some instances.”

3.3.22 In water distribution systems leaks less than 10% are considered acceptable and in excess of 15% are considered unacceptable.

3.3.23 Other failure causes highlighted include: installation of unprotected pipe in corrosive soils, improper application of protection measures, improper installation of the pipe, stray current from grounding services, bi-metallic corrosion from stainless saddles, which cause add-ons to corrosion.

3.3.24 It concludes that:

? Pitting corrosion of DI pipe may be exacerbated by residual oxide scale, casting marks and poor quality zinc or bitumastic coatings.

? Loose polyethylene jacket encasement is a standard corrosion control method recommended by DIPRA.

? Polyeurathane coating combined with a well-designed cathodic protection system is the most cost-effective corrosion protection for DI pipes in corrosive soils.

Chlorine Chemistry Council. Are our Pipes Safe? October 1998.

3.3.25 This refers to a survey conducted by the Canadian National Research Council, stating that each year aging pipes rupture at a rate of 35.9 breaks for every 100 kilometers, and newer metallic pipes still average about 9.5 breaks per 100 kilometers. This is thought to be the same original source as quoted by DIPRA above.

3.3.26 The reference highlights corrosion and ground conditions following heavy rain as major causes of pipe leakage.

3.3.27 It highlights a failure rate for vinyl water pipes in Canada of 0.7 breaks per 100km. Due to greater flexibility and corrosion resistance.



Approaches to Chemical Safety Management in the Chemical Industry. Stan Grossel, Process Safety and Design, Inc.

3.3.28 In this document, good practice features in piping design are highlighted. Those applicable include:

? Minimise joints that can leak. ? Minimise piping size, run length and complexity. ? Specify the correct materials of construction. ? Design the piping to withstand temperature and/or pressure excursions. ? Design the piping to take care of cyclic operations if they are part of the process (e.g., batch

processes). ? Design the piping to handle hydraulic transients (water hammer). ? Design the piping to handle dynamic loading and vibration if they are part of the process

(connected to reciprocating and/or rotating equipment). ? Adequately support and anchor the piping, as needed (especially important for plastic piping,

which needs more support points than metallic piping). ? Use butt-weld joints as they do not produce a local stress riser as do some other types of welded

joints, and they have good fatigue resistance. A butt-weld joint can also be readily examined by most conventional non-destructive techniques.

? Use spiral-wound gaskets preferably as they are less prone to leakage than non-metallic type gaskets (e.g., plastics, graphite, etc.) because they have inner and outer rings that retain the gasket in the flanged seal surface.

? The flange should have a minimum surface finish of 125-250 AARH to ensure a tight joint. ? Use valves that minimise fugitive emissions. Newer types of packing designs and bellows seals

can accomplish this. ? Minimise the use of expansion joints to provide piping flexibility. Use flexible hose or pipe loops

to provide the required flexibility. If expansion joints must be used, use a multiple ply (double-walled) type.

? Consider the use of double-wall (double-containment) piping.

3.3.29 These considerations have been developed for application to piping containing flammable or toxic fluids. The effluent, though treated to a very high standard, is nevertheless considered undesirable as there may be still some residual human psychological concerns if it leaks into the reservoir and so some consideration to these issues should be given in the design. As a risk based approach is being taken on this project, it is proposed that any of the above features not included in the base-case design, be reviewed as potential risk mitigation measures.

Data from WSD on DI pipe failures

3.3.30 The incidence of WSD DI sewage pipe leakage over the last 5 years, is shown in Table 2 for 1,128km of fresh water pipe and in Table 3 for 474km of salt water pipe.

Table 2 Incidence of DI Fresh Water Pipe Leakage (WSD)

Number of leaks Burst Leak

Normal wear and tear 5 119 External effect 50 169 Damage by others 137 58 Total 192 346



Table 3 Incidence of DI Salt Water Pipe Leakage (WSD)

Number of leaks Burst Leak

Normal wear and tear 12 23 External effect 17 42 Damage by others 44 9 Total 73 74

Data from DSD on DI and HDPE Pipe Failures

3.3.31 The incidence of DSD DI sewage pipe leakage over the last 5 years, for 74,013m or pipe is shown in Table 4.

Table 4 Incidence of DI Sewage Pipe Leakage (DSD)

Number of leaks Normal wear and tear 4 Ground Settlement 1 Soil nailing by GEO 1 Total 6 DSD report 1 case due to normal wear and tear for 2,080m of HDPE pipe over 5 years.

Miscellaneous International Data on Pipework, Valve and Joint Failures

3.3.32 The process industry world-wide (including oil, gas, chemical and nuclear), collect data on equipment failures. Calculated failure frequencies are presented in Section 4. A discussion of failure modes and causes is presented below.

3.3.33 Pipes and Pipework – pipework can rupture or leak. Blockage is not considered to be a significant failure mode in this context. Common causes of pipeline leaks (including rupture) are:

? Mechanical defects introduced during design or construction. These may be a result of: ? Design errors missed by the design certification. ? Material defects in the steel missed by quality control during manufacture. ? Construction defects introduced by faulty welding or impact damage during construction on

site. ? Corrosion through the pipe wall. This may be:

? External, as a result of failure of coating or catholic protection. ? Internal, due to the presence of moisture, H2S, CO2 etc in the gas.

? Impacts (also known as third-party damage and external interference), which may be due to: ? Vehicles, lifting or nearby maintenance or construction work (for above-ground sections). ? Excavating work, farming activities etc (for buried pipelines). ? Anchoring, vessels sinking etc (for underwater pipelines). ? Beached vessels (for pipelines in the coastal zone).

? Natural hazards, including: ? Subsidence. ? Landslide. ? Earthquake. ? Washout of earth underneath by rain.



? High winds and storms. ? Operational overload as a result of:

? Failure of the pressure protection upstream. ? Pressure surges due to sudden valve closure, e.g. in Emergency Shut Down (ESD). ? Thermal expansion.

? Fatigue due to cyclic loads produced by: ? Diurnal temperature variations. ? Vibration produced by associated rotating machinery, nearby equipment, turbulence in the

fluid in the pipe or turbulence of air movements past the pipe. ? Operator error, which may occur in a variety of forms, including:

? Opening the wrong valve, allowing a leak to atmosphere. ? Hot-tap, deliberately cutting into the pipeline, unaware that it is pressurised.

? Sabotage by terrorists, vandals, disaffected workers or members of the public. ? Knock-on events from other facilities nearby.

3.3.34 This data indicates that due to reduced strength, plastic pipe is considered up to 5 times more likely to fail than steel. (It is noted that this conflicts with the reference from the Chlorine Chemistry Council, above.)

3.3.35 Joints – the only significant failure mode for joints is an external leak. The literature principally applies to flanged joints with gaskets, but also considers bellows, pipe joints, screwed fittings, O-ring joints, welded, etc. Principal causes of failure are failure to tighten, overtightening, failure of the joint sealing material and movement of the joint (e.g. process vibration, external forces, etc.). Leaks from joints are usually small.

3.3.36 Welded joints appear to be the least prone to leaks and flanged joints with spirally wound gaskets being the next most reliable. Leaks from other types of joints are relatively frequent.

3.3.37 Valves – failure modes for valves are: failure to open, failure to close (stuck open), leaking internally when closed, external leak, and for automatic valves – spurious operation (e.g. without command). Human error is a common cause of failure to open or close, however blockage can also occur. An internal leak may be caused by human error or wear and tear (e.g. internal erosion or corrosion). An external leak will often be through the valve spindle and therefore small.



Table 5 Records of Natural Terrain Landsl ides on the Hil lside above the Pipel ine

Slide Id. Code Slope Cover Width Year Head Elevation (m) Tail Elevation (m)13NWB0182 2 34 Grass <20m 1945 140 122 13NWB0184 2 27 Grass <20m 1945 110 95 13NWB0185 2 34 Grass <20m 1945 115 105 13NWB0186 2 30 Grass <20m 1945 140 125 13NWB0187 2 39 Grass <20m 1945 150 135 13NWB0191 2 45 Grass <20m 1945 150 130 13NWB0194 2 34 Grass <20m 1945 130 120 13NWB0195 2 30 Grass <20m 1945 125 115 13NWB0197 2 30 Grass <20m 1945 100 85 13NWB0198 2 34 Grass <20m 1945 105 90 13NWB0199 2 39 Grass <20m 1945 85 75 13NWB0200 2 39 Grass <20m 1945 85 75 13NWB0473 62 39 Bare >20m 1993 290 230 13NWB0521 62 45 Bare <20m 1993 215 197 13NWB0472 62 30 Bare <20m 1993 295 272 13NWB0471 62 39 Bare <20m 1993 295 250 13NWB0496 62 34 Bare <20m 1993 307 297 13NWB0168 2 45 Grass <20m 1945 200 177 13NWB0361 62 30 Bare <20m 1982 165 155 13NWB0173 2 30 Grass <20m 1945 140 125 13NWB0174 2 34 Grass <20m 1945 135 120 13NWB0172 2 34 Grass <20m 1945 160 145 13NWB0523 62 34 Bare <20m 1993 160 155 13NWB0177 2 27 Grass <20m 1945 135 125 13NWB0178 2 30 Grass <20m 1945 127 120 13NWB0520 62 22 Bare <20m 1993 117 115 13NWB0494 62 34 Bare <20m 1993 125 115 13NWB0175 2 34 Grass <20m 1945 125 115 13NWB0176 2 30 Grass <20m 1945 120 113 13NWB0519 62 39 Bare <20m 1993 95 83 13NWB0164 2 34 Grass <20m 1945 125 115 13NWB0165 2 30 Grass <20m 1945 120 110 13NWB0180 2 24 Grass <20m 1945 165 155 13NWB0181 2 30 Grass <20m 1945 155 140 13NWB0183 2 30 Grass <20m 1945 115 103 13NWB0513 62 45 Bare <20m 1993 300 280 13NWB0360 62 45 Bare <20m 1975 180 167 13NWB0431 62 24 Bare <20m 1992 185 183 13NWB0179 2 27 Grass <20m 1945 178 165 13NWB0166 2 34 Grass <20m 1945 225 213 13NWB0167 2 39 Grass <20m 1945 220 197 13NWB0354 62 45 Bare <20m 1982 285 265 13NWB0419 62 39 Bare <20m 1992 280 240 13NWB0420 62 34 Bare <20m 1992 260 240 13NWB0470 62 45 Bare <20m 1993 270 160



3.4 Hazard Identification Workshop

3.4.1 To ensure that all hazards which could affect the pipeline are identified, a systematic, expert team based hazard identification has been carried out, using the What-If analysis methodology with advance preparation of a checklist for hazard issues by the Consultants.

3.4.2 During the workshop, a series of pertinent questions (examples or causes of hazards) were asked so that the team were able to identify their consequences and existing safeguards and give their view on whether the risk for each hazard is considered to be adequately controlled. In this case, the purpose of the workshop was identification of hazards and respective safeguards and so it was not considered necessary to rank the likelihood and severity.

Time and Venue

3.4.3 The hazard identification workshop was held from 09.00 to 13.00 on Thursday 12 September 2002, in the DSD offices, Room 4328, Revenue Tower, Wanchai.

3.4.4 The consultants provided a laptop computer for recording of the workshop. Drawings and other materials were provided by all team members as required for reference during the workshop. DSD provided a digital projector for display of the workshop logsheets during the workshop. The logsheets were circulated for review by all team members after the workshop and amendments were made based on the comments received (Appendix B).

Workshop Participants

3.4.5 Team members are listed in Table 6, which also shows their qualification and position, confirming their expert knowledge of the project and qualification to participate in the workshop. This and the additional requirement that consensus be reached during discussions, enhances the authoritative nature of the minutes and conclusions of the workshop.

Table 6 Team Members Qualif ications and Posit ions

Participant Qualifications Position K. W. Mak BSc(Eng), MHKIE, MICE,

Barrister DSD/CM2 (Senior Engineer)

Michael Fong BSc(Eng), MHKIE, MICE DSD/CM5 (Engineer) Alan W. K. Chan MSc, CEng, MIEE, MHKIE DSD/E&MP (Engineer) T. K. Tsang MICE DSD/HK&I (Senior Engineer) H. W. Leung BEng, MHKIE DSD/HK&I (Engineer) Leslie L. S. Siu BEng, CEng, MICE, MHKIE WSD (Senior Engineer) Albert, P. N. Lee BSc(Eng), CEng, MICE,

MIStructE, MHKIE, PEng WSD (Engineer)

Alfred C. K. Lee BSc, MSc, MRSC WSD (Waterworks Chemist) Eric W. L. Lee BSc, CPEng, MIEAust,

MCIWEM, MHKIE Arup (Senior Engineer)

T. L. Yip BEng, PhD BMT (Senior Marine Engineer) Dudley W. Tait MA(Chem Eng) , MHKIE, ASA,

RSO LRARS (Principal Consultant)

David J. Steel (part-time) BSc BBV (Engineering Geologist)



3.4.6 Since the team was larger than the ideal size of 6 persons, David Steele was invited to attend only to contribute to the discussions on landslide, rock and boulder fall.

Methodology

3.4.7 The general methodology for the hazard identification workshop is shown in Figure 6.

3.4.8 For each What-if question category, a preliminary list of What-if questions (examples of, or leading to hazards), identified by the Leader prior to the workshop was supplemented by further What-if questions identified by the team during the workshop.

3.4.9 For each What-if question in turn the team was asked:

? To identify effects resulting from the What-if question. ? To identify existing safeguards to control the hazard identified. ? To assess the significance of the risk.

3.4.10 If the risk was found to be inadequately controlled, a recommendation was drafted. Normally the intent of the recommendation is not to provide a design to solve the problem, simply to state the hazard and the need for a control measure. In some cases, where the control measure was clear to the team, a specific measure was recommended.

Phases

3.4.11 The operational and maintenance phases were considered together. Abnormal operations including maintenance were covered under one question category. No construction phase hazards were assessed.

System and Sub-systems

3.4.12 It was not considered necessary to sub-divide the project into sub-systems. It was borne in mind during the workshop that there are various parts to the system, points of interface and modes of operation. These included: concrete channel, leak detection system and associated cabling, leak containment system, valves, the sewage plant, etc., emergency, maintenance and other abnormal operations. These are simply individual components with relatively simple modes of failure which were addressed as individual What-ifs or hazards.

Question Categories

3.4.13 The question categories considered were:

1. External Impact

2. Process Conditions Deviation

3. Deterioration

4. Design/Fabrication/Installation Defect

5. Safety Systems Failure

6. Interfaces

7. Emergency, Maintenance or other Abnormal Operations



Workshop Findings

3.4.14 The logsheets showing the findings of the workshop are provided in Appendix B. These identify a number of important safety features in the design and make recommendations for further consideration in the risk assessment.

3.4.15 The safety features in the design considered most relevant to, and assumed in, the risk assessment are summarised below: With respect to landslide, rock and boulderfall hazards: ? Smaller debris flows would be confined to the drainage channel, only very large flows will affect

the pipeline. ? Most of pipeline will be underground, except at bridges over existing drainage channels such as

Bridge N300. ? Since the natural terrain angle is low close to the pipeline and road, this will be the deposition

phase of a channelised debris flow and hence damage to buried sections of the pipeline is not expected.

? All registered slopes should already be stabilised to a degree adequate for the facilities (e.g. road and raw water reservoir) nearby.

? Deep-seated failure (the only way in which a man-made slope was considered to be able to affect the pipeline) is not common.

? A rock slope landslide is unlikely to reach the pipeline. ? No credible path exists for rockfalls to reach the pipeline, except for entrainment in channelised

debris which has been already considered. ? No boulders were observed on the hillside. (Post meeting note – any unobserved boulders are not

considered to be able to affect the pipeline since they will be small and the hillside is densely wooded.)

With respect to flooding hazards: ? Drains are present on the road. ? Flood impact would require severe elevation of the water table. ? Site investigation will provide information on the water table level.

With respect to lightning: ? This is a very unlikely event. ? The pipeline and stainless steel box will be grounded.

With respect to vehicle impact: ? Keung Shan Road is restricted and lightly used.

With respect to digging up: ? Identification tape is buried in the ground above the pipeline. ? A comprehensive excavation permit system is operated by HyD to facilitate co-ordination and

checking before digging up.

With respect to tree root ingress: ? The pipeline route runs close to the road – any trees are set back from the road.

With respect to process conditions deviation and general deterioration of the pipeline: ? The pipeline is designed to hold 16 bars. ? A partial vacuum in the pipeline is not considered to be a problem. ? Oil and grease are removed in the treatment plant. ? DI pipe will have a cement mortar lining to prevent internal corrosion. ? The treatment plant will fail safe – i.e. the flow stops if any fault arises.



? The pipeline will have an 11mm wall thickness. ? Valve chambers and hatchboxes are provided for access. ? Epoxy coating or similar is provided on the outside of the pipe to prevent external corrosion. ? A second level of protection is provided by the concrete trough. (The outside of pipe should

normally be dry and hence minimise corrosion, but will also contain leakage.) (Post meeting note – the leakage collection system also applies to other causes of leakage, except landslide).

? Groundwater on Lantau is not expected to be corrosive. ? The effluent is free of particulates. ? The pipeline is generally supported by the concrete trough. ? The concrete trough surrounding the pipeline should contain thrust. ? Appropriate design standards for vertical cover on roads have been adopted. ? The pipeline is covered or enclosed for all of the 450m length. ? Valves are provided every 120m for manual isolation. (Post meeting note – this also applies to

other causes of leakage).

With respect to inadequate design, incorrect construction or installation: ? The design will be reviewed and commented on by all parties before tendering. ? Work will be tightly supervised by DSD.

With respect to potential failure modes for safety systems and emergency plans: ? Boreholes will be drilled deep enough to reach groundwater and monitoring wells will be

appropriately maintained. ? The concrete trough will be designed as a water retaining structure. ? In case of failure of the collection system, the leakage detection system will provide the safeguard. ? The storage system at the STW provides 3 to 5 days storage. If the problem is not rectified in 3 to

5 days, tankers can be used to transport the treated effluent and/or a bypass pipe can be rigged up. ? The flow will be stopped by isolation valves at the plant, if the leakage alarm sounds.

? If the STW is manned, an operator will arrive at location to close the valve in the STW within 5 minutes and on the pipeline in 60 minutes.

? If the STW is not manned, this could take 1 day. ? If there is a road crossing (2 traffic lanes) twin pipelines will be provided to facilitate bypass of a

section which is leaking or subject to maintenance or inspection. ? The pipe will be drained before opening for maintenance or inspection.

3.4.16 The following recommendations made in the hazard assessment workshop featured as assumptions in the QRA study: 1. For the aboveground sections at bridges and culverts, DI pipe spanning channel should be one

section without joints. (Post meeting note – if the gap is wider than a standard pipelength, it will be necessary to consider other material or taipor made DI pipe.) The stainless steel box should be strong enough to resist rapidly overflowing flood water. The foundation design and jointing of the stainless steel box to the concrete channel should take into account possible erosion by rapidly flowing water.

2. Following rainstorms and periodically, the drainage channels and pipe should be inspected. 3. In case of a landslide over buried sections of the pipe, the pipe and leakage collection system

should be inspected. 4. Pipe should run as far from the toe of the slope as possible to minimise landslide risk. 5. Review whether rock slope failure impacting on the pipeline is credible and consider additional

mitigation if necessary. 6. Review which slopes could be prone to deep-seated failure, which could affect the pipeline and

consider the risk. If risk is high, consider mitigation measures on or close to the pipeline. (It has



been assumed in the study that either deep-seated failure was not a significant risk or that suitable mitigation measures would be in place.)

7. If the leakage collection system appears to be collecting large quantities of ground water, then inspection and maintenance of the leakage collection system should be considered.

8. Consider measures to prevent vehicle impact on the pipeline (e.g. concrete protection, concrete upstand / high kerb, crash barrier, reroute pipe).

9. Consider providing an additional marker, e.g. coloured tiles, to reduce the risk of excavation impact on the pipeline.

10. The maintenance manual should consider possible movement of the concrete trough due to tree root action.

11. The proximity of large trees is to be noted during any future site surveys and construction to identify the potential for tree root impact.

12. Continue to consider methods for limiting the pressure in the pipeline – pressure reducing valves were found not to be appropriate. (Post meeting note – this refers to pressure reducing valves considered up to the time of the workshop. DSD have since indicated that use of an appropriate valve should be considered further).

13. The design is to consider the possibility of pitting corrosion. 14. Valves must be clearly labelled (open / closed). 15. Inspection procedures are to include procedures for proper operation of valves. 16. The pipe design is to consider water hammer. 17. The rate of valve closure must be controlled by a procedure or in the manual to avoid hammer

head. 18. Consider providing sulphide resistant lining on the 450m section. 19. There should be no joints on self supporting sections. (Post meeting note – if the gap is wider than

a standard pipelength, it will be necessary to consider other material or tailor made DI pipe.) 20. If required, thrust blocks must be provided on bends. 21. The flowmeters must be calibrated according to manufacturers’ specifications and DSD standards. 22. Monitoring wells must be covered and locked to prevent damage, etc. so that they are available for

use when needed. 23. Confirm that the STW will be manned (including during the night), to ensure that isolation can be

promptly achieved. (Post meeting note – DSD have confirmed that the STW will be served by a mobile team only.)

3.4.17 The recommendations carried forward for further consideration were as follows: 24. If the landslide risk to aboveground sections at bridges and culverts is high, consider additional

protection to the pipework or erecting grilles upstream of the box culvert or deepening the drainage channel.

25. Consider the use of CCTV to inspect for internal corrosion after 3 years and every 1 or 2 years thereafter.

26. Consider the need for ball valves (instead of gate valves) to reduce the likelihood of external release.

27. The QRA should consider the need for Remote Operated Valves (ROVs) at the ends of the 450m section.

28. Consider testing the water collected by the leakage collection system and if it is polluted consider shutting down sewage treatment. (Post meeting note – this means stopping the flow in the pipeline.)

29. Define a procedure (e.g. an emergency plan) for when the flow is to be stopped and other actions, dependent on the alarm situation that has arisen.

30. Consider installing pressure gauges at tees and develop a procedure to detect leakage.



31. Review hazards for any temporary systems at the time of implementing (e.g. bypass pipe). Also provide guidance in the O&M Manual on suitable systems and procedures for any temporary bypass.

32. Consider how to differentiate leaks and false alarms and how to locate leaks within the 3 to 5 days capacity of the storage tank in the STW. Also develop a procedure for what to do in case the location of a leak cannot be found.

33. Bleed valves should be provided at appropriate positions to release the air in the pipeline prior to start-up.

34. Consider whether, on start up, the pipeline should be tested for leaks with water prior to filling with treated effluent. This may require additional water supply at STW.

3.5 Failure Case Definition

3.5.1 Based on the hazards identified earlier in this section, the following representative Failure Cases are defined: 1. Natural Terrain Landslide – which will affect only aboveground sections of the pipeline. This is

considered separately because in this case the leakage collection system will be destroyed by the incident. This results in a different set of diagnostic information (e.g. flow from leakage collection system) and so is analysed separately from Failure Case 2. Other catastrophic failures such as vehicle impact, subsidence, earthquake, washout, etc. will have frequencies considerably lower than landslide and can be considered to be included in the total for this failure case.

2. Pipeline break – due to pipe rupture (corrosion, digging up etc.). 3. Pipeline leak (nominally 50% of flow) – due to leaks from pipework (corrosion, digging up, etc.). 4. Pipeline leak (nominally 15% of flow) – due to leaks from joints and valves.

3.5.2 The following safety systems are considered relevant to the development of the risk scenarios:

? Leak detection (rapid detection based on pressure profiles and other methods leading to delayed detection, such as flowmeters, inspection, observation of flow from leakage collection system, monitoring wells, etc.). Flowmeters will detect leaks of >15% of normal flow.

? Isolation at the STW can be achieved immediately on detection of the leak using ROVs, although a delay in detection and response by DSD is expected (this was advised at the workshop to be 5 minutes although the exact delay is not critical, provided that the flow is stopped before the next batch of treated effluent).

? Manual Isolation on the pipeline cannot be achieved since the line is not designed for the static head and must be drained before these valves are closed. An example manual isolation case has been included, in case of later improvements to the design, which assumes a nominal 1 hour delay in manual isolation (although it is understood that it may take up to 1.5 hours for staff to arrive).

? Leakage containment system is assumed to contain leaks up to 15% of full flow.



4 FAILURE FREQUENCY ANALYSIS

4.1 Introduction

In this section the frequencies for the failure cases and the probabilities of operation of the safety systems identified in Section 3.5 are estimated.

4.2 Pipeline Failures due to Causes other than Landslides

Introduction This section considers all frequencies other than the frequency for the landslide failure case, which is addressed in Section 4.3. Safety system probabilities and a summary of the calculated failure case frequencies are presented in Section 4.4. The generic, or average territory or world-wide, data is analysed and, if appropriate, adjustments for site specific conditions are made.

DI Pipe Leaks

4.2.1 The incidence and estimated frequency of WSD DI sewage pipe leakage over the last 5 years is shown in Table 7 for 1,128km of fresh water pipe and in Table 8 for 474km of salt water pipe. This is considered to be a good statistical sample and relevant to the study area with the exception of “damage by others”. With the measures assumed to prevent accidental digging up, the incidence of damage by others has been reduced 10 fold.

Table 7 Incidence and Frequency of DI Fresh Water Pipe Leakage (WSD)

Number of leaks Frequency /km/yr Burst Leak Burst Leak

Normal wear and Tear 5 119 8.87E-04 2.11E-02 External effect 50 169 8.87E-03 3.00E-02 Damage by others 137 58 2.43E-02 1.03E-02 Total 192 346 3.40E-02 6.13E-02 Adjusted total 1.22E-02 5.21E-02

Table 8 Incidence and Frequency of DI Salt Water Pipe Leakage (WSD)

Number of leaks Frequency /km/yr Burst Leak Burst Leak

Normal wear and Tear 12 23 5.06E-03 9.70E-03 External effect 17 42 7.17E-03 1.77E-02 Damage by others 44 9 1.86E-02 3.80E-03 Total 73 74 3.08E-02 3.12E-02

4.2.2 The incidence and frequency of DSD DI sewage pipe leakage over the last 5 years, for 74,013m of pipe is shown in Table 9.



Table 9 Incidence and Frequency of DI Sewage Pipe Leakage (DSD)

Number of leaks Frequency /km/yr Normal wear and Tear 4 1.08E-02 Ground Settlement 1 2.70E-03 Soil nailing by GEO 1 2.70E-03 Total 6 1.62E-02

4.2.3 The apparently lower incidence rate of leaks for the salt water pipework is not fully understood, but may be due to the pipework having been in use for a shorter time.

4.2.4 DSD report 1 case due to normal wear and tear for 2,080m of HDPE pipe over 5 years. This indicates higher frequency of leakage from HDPE pipe, equivalent to a frequency of 0.1 per km per year.

4.2.5 The Canadian National Research Council estimate that aging pipes rupture at a rate of 35.9 breaks for every 100 kilometers, and newer metallic pipes still average about 9.5 breaks per 100 kilometers or 0.095 breaks per km per year. This latter figure is comparable to the unadjusted frequency from the WSD data for fresh water, but the basis for the Canadian figure is not known. The reference paper was not available at the time of writing.

Joint Leaks

4.2.6 International sources for leak data indicate that leak frequencies from joints fall in a wide range from 3E-6 to 3E-2 per year per connection. As sleeve and spigot joints are among the worst type of joints for leakage, a leak rate of 0.03 per joint per connection will be assumed.

Valve Leaks International sources for leak data indicate that external leak frequencies from 12 inch ball type valves are around 3E-4 per valve per year. Gate valves are approximately 5 times more prone to leaks than ball valves. Hence a leak frequency of 1.5E-3 per valve per year will be assumed.

4.3 Natural Terrain Landslide Risk Model

Introduction

4.3.1 The model for quantitative assessment of natural terrain landslide risk in this study has been based on the analysis of natural terrain landslide data contained in “The Natural Terrain Landslide Study, Phases I and II”, GEO 1999.

4.3.2 The model, which is implemented in a spreadsheet, requires the following input data:

? Terrain Component (e.g. Alluvial Plain, Coastal Plain, Concave Footslope, Concave Sideslope, Convex Footslope, Convex Sideslope, Crest or Ridge, Disturbed Terrain, Drainage Plain, Floodplain, Rock Outcrop, Straight Footslope, Straight Sideslope).

? Geological Category (see Table 10). ? Slope Angle (this is the average angle over the slope). ? Vegetation Class (Bare Rock or Soil, Grassland, Low Shrub, Low Shrub with Grass, Plantation

Woodland, Tall Shrub, Tall Shrub with Grass, Woodland). ? Elevation (m). ? Slope Area (m2). ? Head Slope Angle (degrees) (this is the maximum angle on the slope, envisaged as the point at



which the natural terrain landslide might initiate). ? Lateral Range of Landslide at Target Distance (m). ? Width of Target (m). ? Horizontal Distance to Target (m). ? Vertical Distance to Target (m).

Landslide Initiating Frequency

4.3.3 The frequency of a landslide (F) occurring on the slope under consideration is the product of slope area (A), average frequency of landsliding (Fav) and modifying factors dependent on certain input parameters.

F = A x Fav x Terrain Factor x Geological Factor x Slope Angle Factor x Vegetation Factor x Elevation Factor

4.3.4 The factor which corresponds to the value of the parameter for the slope under consideration is looked up in the Table 22 to Table 26 given in Appendix D. The parameters which influence frequency in the risk model are:

? Terrain Component (looked up in Table 22). ? Geological Category (looked up in Table 23). ? Slope Angle (looked up in Table 24). ? Vegetation Class (looked up in Table 25). ? Elevation (looked up in Table 26).

4.3.5 The modifying factors are calculated based on Natural Terrain Landslide Study Phases I and II (Evans, Huang and King, 1999).

4.3.6 The average frequency of landsliding (Fav ) is quoted by Evans, Huang and King (1997) as 0.8 / km2/ yr. It has not been considered necessary to take into account any difference in local rainfall from the average in Hong Kong, or any other local factors, in this model. This will be considered later in a discussion of the sensitivity of the results.

Event Tree Analysis

4.3.7 Event tree analysis is used to determine the likelihood of the debris flow impacting the pipeline. Event trees for each sub-slope are presented in Appendix D. Three issues are considered in the Event Tree Analysis:

? The width of any resultant debris flow. ? The runout distance. ? Whether the debris hits the target.

4.3.8 Width: Evans, Huang and King (1999) stated that:

? 15% of landslides are wide (>20m), nominal width of 40m assumed. ? 85% of landslides are not wide (<20m), nominal width of 10m assumed.

4.3.9 Runout Distance: Three types of landslide were identified by Evans, Huang and King (1999):

? Mobile – i.e. height/length <0.4, angle of reach = 22o. ? Long Runout (i.e. a runout length of > 150m) or Wide and not Mobile –, angle of reach 28o. ? Other (not Wide, not Long Runout, not Mobile), angle of reach 29o. The likelihood of each type depends upon: ? Terrain Component. ? Geological Category.



? Vegetation Class. ? Head Slope Angle.

Table 10 Geological Categories used in the NTL QRA Model

Category Group Units Description TB bt, Jsi, tb, bbt, tbp, v Tuff breccia, blocky brecciated tuff, vent material JSM JSM Fine-coarse ash tuff, tuffite & breccia CT(I) JLH, JMD, cat Coarse ash crystal tuff CT(2) JLH, JTM, It Coarse ash crystal tuff JCB JCB Trachydacite & rhyolite lava E Jcs, JSS, JNM, e, jtt Eutaxite TT t, 11, Jln, JLC Tuff & tuffite TRL Jmw, ta, JSK Trachydacite & dacite lava VT JAC, fa, at, vt, Jnl Fine ash vitric & altered tuff JHI JHI Fine ash vitric & altered tuff with columnar

jointing RHL r, rq, JL T Rhyolite lava

Volcanics

LC(I) ca, rh Coarse ash tuff & rhyolite lava, Lai Chi Chong Formation

Intrusives GD gdm, gdf, gd Granodiorite & dacite, compositionally similar to CT(I)

GC gc, p Coarse granite & pegmatite GM gm, gfm Fine & medium granite GF gf Fine granite

MD tq, mq, sqf, sqm, Iq Trachyte, monzonite, syenite, latite AP gfg, ap Aplite RF rf, rdf, ug Feldsparphyric rhyolite, microgranite

Minor intrusives

LBD I, b, d Lamprophyre, basalt, dolerite LC(2) m Mudstone & siltstone, Lai Chi Chong Formation SV JMK, Jsp Heterogeneous mixture of sediments & volcanics

Volcaniclastic, sedimentary, rock and lava AN JTS, JTU, a Andesitic lavas, volcaniclastic sediments

CB cg, br Conglomerate & sedimentary breccia KKO KKO Calcareous breccias & sandstones SSC DBH, KPS, KPI Sandstone, siltstone, conglomerate SL(I) Jpk, 51, sls Siltstone SST ssl, s Sandstone MSL JTC, PTH Mudstone & siltstone

Sedimentary rock

SL(2) EPC, az, as, dz, sm Well-bedded siltstone CMS cmp, cts, gr, qz Carboniferous siltstone, fine sandstone, graphite

schist, quartzite Metasediments

CQ cs, q Chert & quartz DF Qd, Qpd, Qdt, Qdl,

Qt Debris flow deposits, talus Superficials

ATB Qa, Qah, Qam, Qams, Qat, Qb, Qbb, Qct, Qi, Qpa, Qrb, Qbs

Alluvial, terrace & beach deposits



4.3.10 Any difference in local rainfall from the average in Hong Kong is considered later in a discussion of the sensitivity of the results.

4.3.11 The probability of Long Runout and Mobile cases is looked up in Table 27 in Appendix D for the given Head Slope Angle. This probability is then multiplied by factors looked up as follows: Terrain Component (Table 22), Geological Categories (Table 23), Vegetation Class (Table 25).

4.3.12 Landslide Hits Target: The following input data are used in this calculation:

? Lateral Range of Landslide at Target Distance, determined by inspection of contours on the map, will depend upon whether a channel is present, etc.

? Width of Target.

Probability that Landslide Hits Target = (Width of Target + Width of Landslide) Lateral Range

4.3.13 Frequency of impact on the pipeline: The overall frequency of landsliding is divided up according to the branching probabilities in the tree, to give a frequency for each outcome. The frequencies corresponding to an impact on the pipeline are summed to give the total frequency of impact on the pipeline from that sub-slope.

Application of the NTL Risk Model

4.3.14 For the purpose of modelling the risk, the slope above the treated effluent pipeline has been divided up into sub-slopes, centred on actual or potential drainage lines and with boundaries defined by crests, ridges etc. (typically intersecting stream junctions), shown in Figure 7. This shows 18 sub-slopes, which consist of 8 main drainage channel catchments, with horizontal divisions at appropriate height contours.

NTL Risk Results

4.3.15 The risk model has been applied for each sub-slope in turn to provide a frequency of impact on the pipeline of a landslide initiating within that sub-slope. The input data for each sub-slope are shown in Table 11. The results for each sub-slope are given in Table 12. The results, summarised according to the frequency of impact on the 3 aboveground sections of pipe are as follows:

? Location A 3.33E-04 per year ? Location B 0.00 per year ? Location C (Bridge N300) 4.09E-03 per year ? Total NT Landslides impacting aboveground sections of pipeline 4.42E-03 per year.

4.3.16 The total frequency above is used as the initiating event frequency for pipeline break caused by landslide below.

Calibration of the results

4.3.17 The calculated total frequency of landslides on this section of hillside is 0.76 per year. The historical data shows 45 landslides since 1945, e.g. over 58 years. This gives an actual frequency of 0.78 per year. Therefore the frequency estimated by the model is in good agreement with the historical data.

4.3.18 No landslides have impacted the sections of concern during the past 58 years, this gives an estimated historical frequency of less than 0.017 per year. One landslide in sub-slope area 18 has extended as far as the pipeline, indicating that it is possible for landslides to run out to the distance of the pipeline. The calculated frequency of 4.42E-03 per year is consistent with the historical data.



Table 11 Natural Terrain Landslide Risk Model – Input Data for each Sub-slope

Units 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Terrain Component Factor Concave

Sideslope Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Sideslope

Concave Footslope

Concave Footslope

Concave Footslope

Concave Footslope

Concave Footslope

Concave Footslope

Geological Category Factor

RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL RHL

Slope Angle Factor degrees 25 24 27 31 31 31 31 28 29 27 14 15 18 15 19 13 22 28 Vegetation Class Factor Tall

Shrub Tall

Shrub Tall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

Shrub Tall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

ShrubTall

Shrub Elevation Class Factor m 410 459 440 440 360 300 260 260 260 260 160 160 160 160 170 90 140 160 Sub-slope Area km2 0 0.1 0.1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Head Slope Angle degrees 45 39 39 45 45 45 45 45 45 45 34 45 30 30 22 34 34 34 Lateral Range of Landslide at Target Distance

m 50 50 50 50 30 40 30 50 50 50 50 50 30 40 50 50 100 100

Width of Target m 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 0 0 Horizontal Distance of Target (from top of slope)

m 663 813 831 763 588 469 488 450 475 488 325 325 281 306 294 275 194 175

Vertical Distance of Target (from top of slope)

m 350 399 380 380 300 240 200 200 200 200 100 100 100 100 110 30 80 100

Table 12 Natural Terrain Landslide Risk Model – Results for each Sub-slope

Units 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Total Landslide Frequency per subslope

per year

4.18 E-02

8.36 E-02

1.28 E-01

8.53 E-02

3.12 E-02

6.24 E-02

6.24 E-02

4.68 E-02

4.68 E-02

7.02 E-02

1.46 E-02

1.52 E-02

1.09 E-02

6.44 E-03

8.18 E-03

3.08 E-03

1.70 E-02

2.60 E-02

Vertical Angle to Target degrees 27.8 26.2 24.6 26.5 27.1 27.1 22.3 24.0 22.8 22.3 17.1 17.1 19.6 18.1 20.5 6.2 22.4 29.7

Frequency of Landslide per subslope hitting pipe

per year

1.86 E-04

8.59 E-04

1.31 E-03

3.81 E-04

2.05 E-04

3.33 E-04

4.10 E-04

2.09 E-04

2.09 E-04

3.13 E-04

0 0 0 0 0 0 0 0



4.4 Summary of Initiating Event Failure Frequencies and Probability of Operation of Safety Systems

Summary of Failure Case Frequencies

4.4.1 The calculated failure case frequencies are summarised below: 1. Break caused by landslide impact - 4.42E-3 per year. 2. Pipeline break – the adjusted figure for pipe breaks based on the WSD data for Fresh Water pipes

will be used (1.22E-2 per km per year). For the 450m length of pipeline this gives a failure frequency of 5.48E-3 per year. This is apportioned according to the data: ? 5.08E-3 per year external effect and damage by others. This is added to the frequency of

landslide since these events cannot be contained by the leakage collection and containment system.

? 3.99E-4 per year internal and external corrosion. 3. Pipeline leak (nominally 50% of flow) – the adjusted figure for pipe leaks based on the WSD data

for Fresh Water pipes will be used (5.21E-2 per km per year). For the 450m length of pipeline this gives a failure frequency of 2.34E-2 per year. This is apportioned according to the data: ? 1.39E-2 per year external effect and damage by others. This is added to the frequency of

pipeline burst and landslide since these events cannot be contained by the leakage collection and containment system.

? 9.49E-3 per year internal and external corrosion. 4. Pipeline leak (nominally 15% of flow) – the sum of the frequencies of leaks from joints and valves

will be used. Assuming joints every 6m and valves every 120m, there will be 67 joints and 4 valves, giving a leak frequency of 2.02 per year.

Probability of Operation of Safety Systems

4.4.2 The leak detection system is assumed to rapidly detect leaks 99% of the time. However, it is assumed that this will not detect leaks of <15% of normal flow. The lower the detection level, the more sensitive the detection system which implies a higher chance of false alarm. Therefore, in order to reduce the frequency of false alarms of the detection system, a higher detection level of 15% will be set. However, the value will be fine tuned during the commissioning of the pipeline.

4.4.3 The isolation system at the STW is assumed to operate and successfully isolate the flow 99% of the time, provided that the leak has been detected. Isolation is assumed to occur within 5 minutes of detection.

4.4.4 The possibility of the manual isolation on the pipeline is considered in the event trees, since the pipeline is not rated to contain the static head of treated effluent. In case mitigation measures are developed to permit this, manual isolation would be considered to take 1 hour.

4.4.5 The leakage containment system is assumed to work effectively all of the time but only for leaks up to 15% of full flow. It is ineffective for leaks above this flowrate.

4.5 Event Tree Analysis and Summary of Outcome Frequencies

An event tree structure which considers the 4 key safety systems described above has been developed. The same event tree structure has been used for each of the 4 failure cases, but with the variations in probabilities specified above. The event trees used in the analysis are presented in Appendix E.



The frequencies calculated for each outcome are summarised in Table 13. Please note that, Table 13 shows the base case results, i.e. without mitigation.

Table 13 Event Tree Outcome Frequencies

Frequency (per year) Consequence Landslide, external

effect and damage by

others

Pipe Break due to

internal or external

corrosion

Leak >15% due to


corrosion

Leak <15% Total

Leak contained 0 0 0 2.02 2.02 5 minute duration leak + contents of pipeline from plant, not contained

2.30E-02 3.91E-04 9.31E-03 0 3.27E-02

Long duration leak 4.67E-04 7.94E-06 1.89E-04 0 6.64E-04Total frequency of incidents impacting reservoir

2.34E-02 3.99E-04 9.49E-03 0 3.33E-02

Notes: The cases in Table 13 refer to combinations of failures of safety systems (see also Appendix E): ? Where 0 (zero) is shown in the above table, it indicates that the outcome does not or cannot occur. ? “5 minute duration leak + contents of pipeline from plant, not contained” means the flow is stopped by isolation using

ROV at the plant, but not contained. Thus the contents of the pipeline between the plant and the leak point are assumed to be leaked.

? “Long duration leak” means leakage is either not detected or detected and not isolated within the time to complete the transfer of a single batch of treated effluent. In both cases the leakage is not contained. Maximum 1 batch of treated effluent is released.

4.5.1 The calculated frequencies for the base case appear relatively high, but proper assessment of the risk requires consideration of both frequency and consequences, which is presented in Section 6. Risk mitigation measures are applied in Section 6.5 which virtually eliminate the risk.



5 FAILURE RELEASE RATES AND QUANTITIES

5.1.1 To assess the risk, the consequences (e.g. the quantities of treated effluent released) for each release case have been calculated, based on the following assumptions:

? Maximum Flow Rate 50 l/s. ? Distance from plant 3,500 m. ? Distance between valves 120 m. ? Pipeline diameter 200 mm. (Post meeting note – DSD have confirmed after the completion of the analysis that the maximum flow rate of total of 40 l/s will be used. Though the spill quantities shown in the report are based on the maximum flow rate of 50 l/s, it does not affect the conclusions of the study.)

5.1.2 It is assumed (as a worst case) that the contents of the pipeline up to the isolation valve which is closed are released in addition to the flow until the isolation valve is closed. This is conservative since some of the effluent might still be trapped in the pipeline.

5.1.3 The values calculated are shown in Table 14. For the isolation using ROVs, the contents of the pipeline in addition to the 5 minute release (15% and 50% cases) result in a greater spill volume than for the manual isolation case. The long duration case is represented by a single batch of treated effluent.

5.1.4 In the event of a leak being detected, in case the valves at the STW cannot be closed, mitigation measures may need to consider the possible closure of the isolation valves on the line as close as possible to the leak. Hence a case considering isolation after 1 hour has also been included.

5.1.5 It should be noted that the spill volumes calculated above are conceivable or potential outcomes only. An estimate of likelihood of each case has been made in Section 4 and proper assessment of the risk requires consideration of both frequency and consequences, which is presented in Section 6. Risk mitigation measures are applied in Section 6.5 which virtually eliminate the risk.

5.1.6 Since completion of the analysis, the possibility of reducing packet size to 200m3 has been discussed. It is considered that a smaller packet size is likely to result in a smaller maximum spill volume and thus a smaller packet size will reduce the risk and is recommended. This would result in the following revised spill volumes shown in Table 14.

Table 14 Released Quanti ty for each Failure Case with reduced Packet Size

Outcome Quantity Released (m3) Flowrate 15% 50% 100%

Isolation by ROV at STW - 5 minute duration leak + contents of pipeline from plant (3,500m), not contained

112 117 125

Manual isolation on pipeline - 1 hour duration leak + contents of 120m of pipeline, not contained

31 94 184

Long duration leak, not contained (say 1 batch of treated effluent) 200 200 200 Note: Quantity Released = flow volume in duration concerned + volume in pipeline section concerned Quantity Released for long duration leak = packet size

5.1.7 The evaluation of continuous leakage flow is conducted on the basis of US EPA validated 3-dimensional water quality model – CORMIX (www.cormix.info) Version 3.1. CORMIX is developed by Cornell University under the support of US EPA. The methodology of CORMIX for nearfield buoyant jet mixing process is based on asymptotic analysis to classify nearfield flow-patterns and the use of asymptotic solutions. In the farfield, CORMIX uses a buoyant spreading or a turbulent



diffusion model. In the transition between nearfield and farfield, CORMIX uses a control volume model o connect nearfield and farfield models.

5.1.8 The scenario considered is a worst case (uncontrolled discharge, buoyant flow, strong wind) and the input quantities are summarised in the Table 15. The modelling results are shown in Figure 8. The model found that at about 300m from the discharge point, the concentration is diluted to 0.7% and beyond 400m from the spill point, there should be no direct flow exchange in the presence of spill, according to the model.

5.1.9 With the current system design, given the failures modelled, it is envisaged that at least some of the quantities calculated would reach the reservoir. However, it must be noted that the above volumes are extremely small in comparison to the volume of the reservoir (24,460,000m3) and the pipeline is very remote from the reservoir discharge (more than 800m). In the event of any spillage of treated effluent into the reservoir, there will be a need for immediate additional sampling of water, but only in “Improbable” cases where spillage were found to be significant would any shutdown be required. Thus the consequence severity assumed in Section 6 is considered to be at least 1 order of magnitude less severe than a fatality or “Critical” in relation to the Risk Assessment Matrix (Table 17 in Section 6).

Table 15 Worksheet for Input and Output Data

CORMIX INPUT Project Name CE 29/2001 Site Name Ngong Ping Design Case Continuous leaks AMBIENT DATA Water body depth 10m Bounded/Unbounded Unbounded Depth at discharge 10m Ambient flowrate 0m3/s Water Stagnant Manning’s Number 0.02 Wind speed 7.5m/s Average wind speed at Nei Lak Shan, Lantau Density data Water body is Fresh water Density at

Temperature 25 degree C

DISCHARGE DATA

CORMIX 3 Surface Discharge Discharge located on Left bank Configuration Flush Horizontal angle 90 degree Depth at Discharge 10 m Bottom Slope 0 degree Discharge outlet Circular Diameter 0.2m Pipe invert depth 0.2m EFFLUENT Flow rate 0.05m3/s Density 997kg/m3 Buoyant flow Yes Concentration units 100% Conservative substance

Yes

MIXING ZONE Is effluent toxic No



WQ standard No Mixing zone specified

No

Region of interest 800m Grid intervals displayed

50

CORMIX OUTPUT (selected) Centreline (m) Conc. (%) 0 100 101 1.4 201 0.8 300 0.7 >400 2E-15 EFFLUENT QUAL Quality Minimum

Effluent Standard

BOD, mg/L 10 (95 %ile) SS, mg/L 15 (95 %ile) Ammonia Nitrogen, mg/L

1 (annual average)

Nitrate + Nitrite Nitrogen, mg/L

7 (annual average)

E.Coli, count/100mL 100 (geometric mean)



6 RISK RESULTS AND ASSESSMENT

6.1 Introduction

6.1.1 The risk results show a total frequency of spill of treated effluent from the pipeline of 3.33E-02 events per year (Table 13). This is mostly contributed by leaks which are detected and / or isolated but exceed the capacity of the leak collection system. 13% of the frequency is due to leaks caused by landslide, 57% percent is due to external effect and damage by others and 30% is due to wear and tear (considered to be primarily due to internal and external corrosion).

6.2 Risk Assessment Criteria

6.2.1 Assessment criteria are needed to establish the acceptability of the risk. No criteria exist specific to this type of risk and so it is proposed for this study to refer to a number of other risk assessment criteria used in Hong Kong.

6.2.2 SPR1/2002 provides guidance on the need for and type of risk assessment which should be carried out for facilities affected by risks from natural terrain. The facilities at risk in this study are considered to fall below the criteria for which risk assessment is required and therefore the risk from landslides alone may not be unacceptable.

6.2.3 However, a risk assessment has been requested by WSD and the perception is that the combined risk of pipe leakage, of which landslide risk is a component, must be assessed. Referring to the guidelines contained in Landslide Risk Assessment and Risk Management (Dai, Lee and Ngai, 2001), if reservoir pollution is considered an order of magnitude less serious than a fatality, then an unacceptable limit might be 0.01 per year (i.e. once in 100 years) and an acceptable limit, 0.0001 per year (i.e. once in 10,000 years). These criteria are consistent with the HK RG for risk from PHIs (Potentially Hazardous Installations) and the criteria specified by the EIAO (Table 17).

6.2.4 Both MTR and KCR use risk assessment and have similar approaches. A typical risk assessment matrix, described below, in line with the criteria in use elsewhere in Hong Kong provides a comparison with other criteria in the assessment of the calculated risk. A leak resulting in pollution to the reservoir can be considered similar to a system disruption.

6.2.5 The level of risk is defined in the matrix risk assessment criteria based on the consequence and the frequency of the occurrence of the risk, see Table 17. The risks are classified into 4 levels and are defined in Table 16.



Table 16 Risk Guidelines

R1 Unacceptable (immediate action needed) Hazards falling into this category have the highest risk and would be considered unacceptable. The person responsible for controlling the hazard shall propose appropriate control measures to reduce the probability or the consequence of the hazard, and re-assess the risk.

R2 Undesirable (progressive improvement needed) Hazards falling into this category would be considered tolerable but undesirable. The person responsible for controlling the hazard should seek further improvement in a progressive manner.

R3 Tolerable (action needed if there is a clear net benefit) Hazards falling into this category would be considered tolerable and the person responsible for controlling the hazard should only seek further improvement if there is a clear net benefit to both safety and operations.

R4 Acceptable (no action needed) Hazards falling into this category have the lowest risk. The estimated risk is within the limit of acceptability. No immediate action is required but the person responsible for controlling the hazard should review the effectiveness of existing control measure(s) following any changes which could affect the hazard status.



Table 17 Risk Assessment Matrix

CONSEQUENCE

7 6 5 4 3 2 1

Risk Assessment Matrix Trivial Negligible Marginal Serious Critical Catastrophic Disastrous

System (Reservoir Services) Disruption < 20 min 1 hour 1 day 1 week 1 month

WSD / DSD

Service Line (DSD Facility) Disruption 20-60 min Few hours 1 day 1 week 1 month Few months

A Few times per week or more 100 / year R3 R1 R1 R1 R1 R1 R1

B Few times per month 10 – less than 100 / year R4 R2 R1 R1 R1 R1 R1

C Few times per year 1 – less than 10 / year R4 R2 R2 R1 R1 R1 R1

D Few times in 10 years 0.1 – less than 1 / year R4 R3 R2 R1 R1 R1 R1

E Once since operation 10-2 – less than 10-1 / year R4 R3 R3 R2 R1 R1 R1

F Unlikely to occur 10-3 – less than 10-2 / year R4 R4 R3 R3 R2 R1 R1

G Very unlikely to occur 10-4 – less than 10-3 / year R4 R4 R4 R3 R3 R2 R1

H Remote 10-5 – less than 10-4 / year R4 R4 R4 R4 R3 R3 R2

I Improbable 10-6 – less than 10-5 / year R4 R4 R4 R4 R4 R3 R3

F

R

E

Q

U

E

N

C

Y

J Incredible less than 10-6 / year R4 R4 R4 R4 R4 R4 R3



6.3 Assessment

6.3.1 According to the criteria for landslide and PHI risk, the frequency of leakage is unacceptable and requires mitigation.

6.3.2 The modelling of a worst case in Section 5 has shown that in theory a worst case spill will be diluted to the point where it is acceptable beyond 400m from the point of the spill. However, it has been assumed that in the event of any spillage of effluent into the reservoir, there will still be a need for sampling of water and so spillage into the reservoir has been assumed to be “Critical” (see Section 5.1.9) according to the risk assessment matrix (Table 17). Therefore frequencies above 0.01 will be unacceptable, the frequency must be below 10E-5 per year (i.e. once in 100,000 years) to be considered acceptable and below 10E-3 per year (i.e. once in 1,000 years) to be tolerable and the individual controlling the hazard should only seek further improvement if there is a clear net benefit to both safety and operations. According to the matrix criteria the risk is also unacceptable and requires mitigation. It is worth noting that the matrix criteria tend to be applied to individual hazards (e.g. landslide, digging up, corrosion, defect, etc.).

6.4 Sensitivity of the Results to Assumptions and Modelling

6.4.1 In this section the sensitivity of the results to a number of assumptions is discussed. As a general observation, the assessment criteria being applied are broad and there is a degree of uncertainty in many of the assumptions, so variations of a factor of 3 up or down in the calculated risk are not unusual.

6.4.2 Point of initiation of landslide: - The point of initiation has been assumed to be the point on the sub-slope furthest from the pipeline. Generally this assumption is pessimistic, as slopes tend to steepen with distance from toe. The result is not critical to the overall risk as landslides only contribute about 13% of the overall total. Because the model has been set up with a large number of sub-slopes, the total frequency of landslide impact is not particularly significant to this assumption. This result would become more significant if other risks were mitigated.

6.4.3 Horizontal distance to pipeline: The horizontal distance to the aboveground section of pipeline has been taken as the straight line distance. This assumption is pessimistic as drainage channels tend to meander. The result is not critical to the overall risk as landslides only contribute about 13% of the overall total. This result would become more significant if other risks were mitigated.

6.4.4 Local rainfall and other factors not modelled: - Variations in local rainfall from the average in Hong Kong, slope aspect, distance to drainage line and lithology, were not explicitly considered in the model. These may be implicitly considered as part of other factors which were included in the model. The total predicted frequency of landsliding agrees extremely well with the historical record and so it is concluded that the detail of the model is adequate.

6.4.5 Geological category: - A few of the sub-slopes could have been categorised as SL or DF instead of RHL. SL gives a 40% higher calculated risk. DF gives a factor of 10 lower risk, but the slopes concerned are those with a smaller contribution to the total. Overall, these issues cancel each other out and the calculated level of risk is considered to be a good estimate.

6.4.6 Vegetation class: - if the vegetation class is assumed to be woodland, this reduces the calculated risk by about a factor of 4.

6.4.7 Proportion of landslides which can reach road: - This is calculated by first classifying the target angle as: long runout, mobile, etc. (limiting ranges are 22 to 28, 28 to 29 and greater than 29 degrees),



then calculating the probability of that type of landslide. An alternative approach is possible, to look up the actual probability for a given target angle in the cumulative distribution of landslide runout angle. For an individual slope this may give a different result, but because this model is made up of many sub-slopes with a range of target angles, the overall total would not be sensitive to such a change in modelling.

6.4.8 Probability of detection: - this safety system is important because it is the first line of defence for leaks which cannot be contained by the containment system. If leakage is not detected, no attempt will be made to isolate the flow. As discussed in the Hazard Identification Workshop an additional means of detection, such as flow detection on the leakage collection system, should be considered. However, the results are not particularly sensitive to this probability value, since they are dominated by leaks, which are detected but not contained.

6.4.9 Probability of isolation at STW: The results are not particularly sensitive to this probability value, since they are dominated by leaks, which are detected but not contained.

6.4.10 Probability of isolation on line: - The results are not particularly sensitive to this probability value, since they are dominated by leaks, which are detected but not contained.

6.4.11 Reliability of containment system: – It is critical to the risk that this system is always available due to the very high frequency of small leaks. If this system was only 99% reliable, the frequency of release to the reservoir would increase tenfold. The performance of the containment system is also critical. If the system could contain leaks larger than 15% of the flow the risk would substantially decrease. This is considered below as a risk mitigation measure.

6.4.12 Full flow 100% of time: - The study has assumed full flow in the pipeline all of the time and so is slightly pessimistic.

6.5 Risk Mitigation

Introduction

6.5.1 The purpose of this section is to highlight risk mitigation measures identified by consideration of the main contributors and driving factors in the total risk. As highlighted earlier in this section, the contributors and driving factors include: leaks which are detected and isolated but not contained, and landslides. These are proposed generally in addition to the recommendations from the Hazard Identification Workshop, although there is some overlap in specific cases.

Potential Risk Mitigation Measures

6.5.2 The following preliminary, conceptual measures were identified based on the need to mitigate the main factors driving the risk:

? Increase capacity of leakage collection system to 100% of full flow. ? Provide flow detection on the leakage collection system. In case of significant flow being

detected, flow in pipeline should be stopped. ? Provide impermeable barrier and bund wall to prevent leakage from spilling into reservoir and

ensure all goes into storm drains on road. ? Consider welded continuous pipework. Plastic is not recommended. Steel may provide 10 times or

more improvement in leak frequency. ? Consider remotely operated (automatic) isolation valves on line. ? Consider making isolation fully automatic and immediate (not 5 minutes or 1 hour delay). ? Ensure that pipeline does not drain in case of leak on the critical 450m section.



? In case of successful isolation at STW, also isolate manual valves on line. ? Stop flow of treated effluent in case of landslide warning. Consider closing isolation valves on

critical 450m section.

6.5.3 The practicality of these measures was discussed between Arup, BMT and LRARS, see Appendix F for details. A rationalised list of practical measures was developed and is given below: 1. Fabricate 450m critical section from continuous welded stainless steel. 2. 1,700m section within LDGG to be designed to withstand full static head and manual isolation

valve to be provided immediately before critical 450m section and pressure relief valves to be provided on section before 1,700m LDGG section.

3. Increase capacity of the leak collection system to 100% of flow by adding concrete slab to containment channel. Thus containment and collection system will effectively be sealed to BS8007.

4. Provide adequate protection so that worst case landslide would not damage pipeline. 5. Treat water up to standards suitable for direct discharge into a reservoir.

Measure 1 - Fabricate 450m Critical Section from Continuous Welded Corrosion Resistant Material

6.5.4 The intent of this measure is to virtually eliminate the corrosion mechanism for the pipe, while maintaining or improving strength, to minimise the number of joints and ensure that those joints that are present are less prone to leaks.

6.5.5 It is assumed that the 450m section will be fabricated in 4 continuous welded sections approximately 120m in length each. Each section will have one flange at the hatchway and 4 flanges at the tee and valve. The material of construction is to be corrosion resistant (e.g. a suitable grade of stainless steel).

6.5.6 The joint leak frequency has been assumed to reduce from 0.03 for socket and spigot type to 0.003 for flange type. Spiral wound gaskets should be used to achieve this.

6.5.7 The pipe leak frequencies have been based on international leak frequency data for pipework (assuming that typically 67% of leaks are due to normal and tear, i.e. corrosion). The frequencies used are:

? <15% flow 1.4E-2 per km per year. ? >15% flow 2.2E-4 per km per year. ? Pipe rupture 6.6E-4 per km per year.

6.5.8 This results in a 28.5% reduction in risk to 2.4E-2 per year spills affecting the reservoir since the likelihood of leakage is significantly reduced.

Measure 2 – Uprate 1700m Section within LDGG

6.5.9 The intent of this measure is to facilitate manual isolation of the pipeline at the beginning of or on the critical 450m section, but without resulting in a pipe burst due to the static head of treated effluent from a full pipeline.

6.5.10 It is assumed that 1,700m section within the LDGG is designed to withstand the full static head and manual isolation valve(s) are provided immediately before critical 450m section and pressure relief valves are provided on the section before 1,700m LDGG section.

6.5.11 There is no reduction in leak frequency affecting the reservoir from this measure, but the spill volumes change, so that the typical quantity spilt is a 1 hour release plus the contents of 120m of pipeline, instead of 5 minutes plus the contents of 3,500m of pipeline. It is not thought that this measure offers any significant benefit and is not considered further.



Measure 3 - Increase capacity of leak collection system to 100% of flow

6.5.12 The intent of this measure is for all leaks to be collected by the leak collection system. The design will also protect the pipeline from “external effects and impact by others” incidents.

6.5.13 It is assumed that the design of the leak collection system will be upgraded so that all leaks will be collected. This system is assumed to be available in 99.99% of cases above 15% of flow and in all cases below 15% of flow to perform as designed (i.e. designed to be waterproof to BS8007, with additional protection from digging up, by providing concrete top slab). Thus it is also assumed that the design will also protect the pipeline from 99.9% “external effects and impact by others” incidents.

6.5.14 This measure results in a reduction in risk of 86.7% to 4.4E-3 per year. This measure addresses the same risks as Measure 1, therefore if this measure is applied there is no need for Measure 1. It is to be noted that it may not be practicable to design the leak collection system to 100% of flow under all circumstances as trace amount of effluent may still be leaked through the joints between the concrete top slab and the concrete trough in the event of pipe burst (i.e. 100% of the effluent in the pipeline will be leaked out). Sensitivity analysis is presented in Appendix G assuming 10% and 20% of maximum flow are not contained.

Measure 4 - Provide adequate protection so that worst case landslide would not damage pipeline

6.5.15 The intent of this measure is to virtually eliminate the risk of treated effluent leakage due to landslide.

6.5.16 It is assumed that this risk is reduced by four orders of magnitude by adequately protecting the pipeline from the worst case landslide.

6.5.17 This measure reduces the risk by 13.3% to 2.9E-2, but is particularly important because it controls the risks, which are not controlled by the other measures.

Measure 5 - Treat water to standards so that it could be fed into a reservoir

6.5.18 This measure would eliminate the risk, and is therefore recommended for further consideration of its practicality.

Measures 1 and 4 Combined

6.5.19 This combination results in a 41.7% reduction in risk to 1.9E-2 per year.

Measures 3 and 4 Combined

6.5.20 This combination results in a 99.9% reduction in risk to 2.05E-5 per year. It is mentioned for Measure 3 above that it may not be practicable to design the leak collection system to 100% of flow under all circumstances. Sensitivity analysis is presented in Appendix G assuming 10% and 20% of flow are not contained for cases of leaks greater than 15% of flow. The results in these show small leaks (40m3 or less) occurring at relatively high frequency (4E-4 per year, once per 2,500 years), which is understood to be tolerable.

Measures 1, 3 and 4 Combined

6.5.21 This combination results in a 99.9% reduction in risk to 1.95E-5 per year.

Summary

6.5.22 The residual risk levels and percentage risk reduction for the above risk reduction measures are summarised in Table 18. The assessment of these risk levels according to the Landslide / PHI risk



guideline is shown in Column 4 of Table 17. The assessment in terms of the risk assessment matrix, assuming that any spillage into the reservoir constitutes a level 4 consequence (Critical), is shown. This considers landslide, corrosion, digging-up, defect, etc. as individual hazards, which are each compared to the guideline.

Table 18 Risk Reduction Measures – Residual Risk and Assessment

Risk Assessment Matrix Case Risk (per year)

Frequency(in

100,000 years)

% Risk Reduction

Landslide / PHI RG Landslide,

damage by others

External effect, normal wear

and tear Basecase 3.33E-02 3,330 - Unacceptable R1 R2 M1 2.38E-02 2,380 28.5% Unacceptable R1 R3 M2 3.33E-02 3,330 0.0% Unacceptable R1 R2 M3 4.44E-03 444 86.7% ALARP R2 R4 M4 2.89E-02 2,890 13.3% Unacceptable R1 R3 M1 and M4 1.94E-02 1,940 41.7% Unacceptable R1 R3 M3 and M4 2.05E-05 3 99.939% Acceptable R3 R4 M1, M3 and M4 1.95E-05 2 99.941% Acceptable R3 R4

6.5.23 The most effective mitigation measure is Measure 3. This measure is therefore selected. Measure 2 does not reduce the risk and is not considered further. The most effective of the 2 other measures is Measure 4 and the combination of Measures 1 and 4 reduces the risk to an acceptable level in terms the interpretation of the Government PHI and Interim Natural Terrain Risk Guidelines, and all aspects of the risk are reduced to acceptable levels according to the risk assessment matrix except and “Landslide, damage by others” which remains R3 (tolerable). (Note this is dominated by damage by others and not landslide.) A small additional risk reduction of 10E-6 per year is achieved by adding Measure 1, this is considered a negligible improvement since the risk is already acceptable in terms of the Government RGs and it does not improve the assessment according to the risk assessment matrix. Thus Measure 1 is not recommended but further improvement to the problem of possible “Damage by Others” on the pipeline should be sought in a progressive manner. This can be achieved by monitoring of construction and tree root action, etc. as recommended in the workshop or by further improvements in the treated water quality from the STW.

Conclusion

6.5.24 It is concluded that risk is mitigated to acceptable levels in terms of the PHI / Landslide criteria and tolerable levels in terms of the risk assessment matrix by the combination of Measures 3 and 4, thus, adequate protection must be provided to the above ground sections of the pipeline to withstand a worst case landslide, and a system must be provided, so that all leaks from normal wear and tear are contained by a robust collection and containment system, that will also largely protect against “external effects and actions by others”. (Note – DSD have confirmed that they would adopt Measures 3 and 4 in the design.)

6.5.25 Further improvement to the problem of possible “External Effect and Damage by Others” on the pipeline should be sought in a progressive manner. This can be achieved by monitoring of construction and tree root action, etc. as recommended in the workshop, by possible improvements in the treated water quality from the STW.



6.5.26 The frequencies calculated for treated effluent spills into the reservoir from the pipeline with Measures 3 and 4 in place are shown in Table 19.

Table 19 Treated eff luent Spil l Frequencies with Measures 3 and 4

Frequency (per year) Consequence Landslide, external

effect and damage by

others

Pipe Break due to


corrosion

Leak >15% due to


corrosion

Leak <15% Total

Leak from pipeline, collection and containment system effective (no significant risk)

0 3.99E-04 9.49E-03 2.02 2.03

Isolation by ROV at STW - 5 minute duration leak + contents of pipeline from plant (3,500m), not contained

1.91E-05 3.91E-08 9.31E-07 0 2.01E-05

Long duration leak, not contained (say 1 batch of treated effluent)

3.87E-07 7.94E-10 1.89E-08 0 4.07E-07

Total frequency of incidents impacting reservoir

1.95E-05 3.99E-08 9.49E-07 0 2.05E-05

Note: Where 0 (zero) is shown in the above table, it indicates that the outcome does not or cannot occur.



7 CONCLUSIONS AND RECOMMENDATIONS

7.1 Introduction

7.1.1 A detailed hazard identification and risk assessment study has been carried out to assess the risk of leakage from the 450m effluent export pipeline located within the 100m Safety Buffer Zone of the Shek Pik Reservoir.

7.2 Risk Assessment of the Original Design

7.2.1 A risk assessment has been carried out on the original design of this section of the effluent export pipeline, which basically consists of the construction of a 200mm diameter ductile iron pipeline and a leakage collection system capable of collecting 15% of the maximum effluent flows. A hazard identification and assessment workshop of this original design, literature and database searches have been conducted. These were followed by a detailed analysis to calculate the level of risk for this design due to pipeline leakage arising from the range of potential causes including landslide.

7.2.2 It is considered that spillage of effluent into the reservoir should be considered a “Critical” event in accordance with typical risk assessment matrix in use elsewhere in Hong Kong (see Chapter 6) and frequency of 10E-5 per year (i.e. once per 100,000 years) or below would be considered acceptable. Frequencies between 10E-3 per year (i.e. once per 1,000 years) to 10E-5 per year (i.e. once per 100,000 years) would be tolerable.

7.2.3 The risk of pipeline leakage calculated for the original design is 3.3E-2 per year (i.e. 1 leak per 30 years). 13% of the frequency is due to leaks caused by landslide, 57% is due to external effect and damage by others and 30% is due to wear and tear (considered to be primarily due to internal and external corrosion). According to the risk criteria mentioned in 7.2.2, the risk level of the original design is found to be unacceptable.

7.3 Recommendations for Risk Reduction

7.3.1 The practicality of a group of conceptual improvements to the design has been considered. A rationalised set of practical measures for evaluation in the QRA model has been produced and the residual risk for each of these and practical combinations of them has been estimated and assessed.

7.3.2 It is recommended that the following measures would be effective to achieve a tolerable degree of risk reduction: (i) Increase the capacity of the leakage collection system to 100% of the flows. This design will

also provide protection from “external effect and damage by others” incidents. (ii) Provide protection to pipeline adequate to prevent damage from worst case landslide.

7.3.3 The level of risk with the above two measures in place is 2.05E-5per year (or one leak per 48,875 years). Therefore risks are found to be tolerable (i.e. generally acceptable except for “external effect and damage by others” (i.e. digging up) for which, further improvement to the problem of possible digging up of the pipeline should be sought if there is a clear net benefit to both safety and operations.

7.4 Conclusion

7.4.1 It was concluded that risk is mitigated to tolerable levels by the combination of the measures depicted in paragraph 7.3.2 above. Thus, adequate protection must be provided to the above ground sections of



the pipeline to withstand a worst case landslide, and a system must be provided, so that all leaks from normal wear and tear are contained by a robust collection and containment system, which will also largely protect against “external effects and damage by others”. DSD has confirmed that these measures will be incorporated in the pipeline design.

7.4.2 Notwithstanding the above, it is considered that further improvement can be achieved by: -

? Monitoring of construction and tree root action, etc. as recommended in the workshop ? Possible improvements in the treated water quality from the STW

7.4.3 As part of the risk assessment, possible volumes spilt into the reservoir were estimated for potential accident scenarios and spill dispersion in the reservoir has been modelled for a worst case. The spill volumes calculated are extremely small (200m3 or less) in comparison to the volume of the reservoir (24,460,000m3) and the pipeline is very remote from the reservoir discharge (more than 800m). The dispersion model has found that in theory a worst case spill will be diluted to the point where it is acceptable beyond 400m from the point of spill. However, it is considered that in the event of any spillage of treated effluent into the reservoir, there will still be a need for sampling of water, but only in highly unlikely cases where spillage is found to be significant would any shutdown of the reservoir be required.

7.4.4 The study has not evaluated the disruption to STW operation due to leaks and false alarms. The model predicts total leakage from the pipeline will normally flow into the leakage containment system at a rate of 2 leaks per year. The vast majority of these will be less than 15% of full flow and should be contained.

7.4.5 Furthermore, these relatively frequent but smaller leaks (<15% flow, 2 times per year) have been assumed to be tolerable since they are either contained by the leakage collection system or in the unlikely event that part of a small leak is not contained, then the spilt volume, mitigated by the effect of dispersion in the reservoir will have negligible impact.

7.4.6 The culture of water distribution and sewage transfer world-wide considers 10% leakage as acceptable and 15% leakage as unacceptable. The required culture for satisfactory operation of this section of pipeline is that no leakage is acceptable. It may be appropriate, given the major difference in the requirements for this section of the pipeline from the norm, that WSD carries out regular underground water quality monitoring along the pipeline.

7.4.7 The final design and what is actually built should be reviewed to ensure that the intent of the recommended mitigation measures is met.

7.4.8 Options to (a) provide twin 200mm diameter pipelines (both duty) instead of a single 200mm diameter dedicated pipeline, (b) change the design of the pipeline to a non-full-bore flow condition, (c) reuse part of the effluent in Ngong Ping, and (d) reduce the number of isolation valves, have been raised following the completion of the analysis. Due to the timing of the study, these options have not been considered in detail. However, it is considered that the suggested design changes offer considerable advantages in terms of operation, maintenance and inspection flexibility of the pipeline system. Provided that the measures mentioned in 7.3.2 are implemented, these options are also considered tolerable in terms of risk.

7.4.9 Apart from those options mentioned in 7.4.8, it is also confirmed by DSD, after the completion of the analysis, that the Ngong Ping STW will be unmanned and served only by a mobile team stationed at the existing Mui Wo STW or Siu Ho Wan STW. The effect of such an arrangement is that the time to respond to emergency operation at the STW or the effluent pipeline will be changed from 1 hour to 1.5 hours. However, given that leakage can be stopped before the next batch of effluent discharge commences once the leak occurs, this does not affect the conclusions of the study.



8 REFERENCES

Approaches to Chemical Safety Management in the Chemical Industry. Stan Grossel, Process Safety and Design, Inc.

Chlorine Chemistry Council. Are our Pipes Safe? October 1998.

Data from DSD on DI and HDPE pipe failures.

Data from WSD on DI pipe failures.

Ductile Iron Pipe Research Association (DIPRA). External Corrosion and Protection of Ductile Iron Pipe. (Plus other references from their website)

F C Dai and C F Lee, Frequency-Volume Relation and Prediction of Rainfall-Induced Landslides. 2000.

F C Dai and C F Lee, Terrain Mapping of Landslide Susceptibility using a Geographical Information System: A Case Study. 2001.

F C Dai, C F Lee and Y Y Ngai, Landslide Risk Assessment and Management: An Overview. 2001.

Guidelines for Natural Terrain Hazard Studies, GEO SPR 1/2002, April 2002.

Miscellaneous International Data on Pipework, Valve and Joint Failures.

The Natural Terrain Landslide Inventory (NTLI). GEO website.

The Natural Terrain Landslide Study Phases I and II, GEO Report No 73, N C Evans, S W Huang and J P King, 1999 (NTLS II)

Water Mains Break Data on Different Pipe Materials for 1992 and 1993. National Research Council Canada. 1995.



Figures



See attachment

Figure 1 Location of Sewage Treatment Works and Overall Pipeline Route

(PLEASE USE CONTENT PAGE TO VIEW FIGURE 1)



See attachment

Figure 2 Pipe Section Under Study




See attachment

Figure 3 The Leakage Collection System




See attachment

Figure 4 Outl ine Methodology




See attachment

Figure 5 Natural Terrain Landslides which have occurred on Slopes above Pipeline




See attachment

Figure 6 Hazard Identif ication Workshop Flowchart




See attachment

Figure 7 The Definit ion of Sub-slopes used in the Natural Terrain Landslide Risk Assessment Mode




See attachment

Figure 8 Concentration versus Distance from Discharge




Appendix A

Site Visit Photographs



See attachment

(PLEASE USE CONTENT PAGE TO VIEW APPENDIX A)



Appendix BHazard Identification Workshop Logsheets



System: Ngong Ping STW – 450m of Effluent Pipeline within 100m of Shek Pik Reservoir

Design Parameters: Ductile Iron Pipe, PN 16, 200mm diameter

Question Category

What-if Effect Existing Safeguard Recommendation

External Impact Landslide – area prone to channellised debris flows

At aboveground sections, e.g. bridge N300, pipe will be at side of bridge, therefore aboveground and could be damaged by landslide.

Smaller debris flows would be confined to drainage channel, only very large flows will affect pipeline. Most of pipeline will be underground, except at bridges over existing drainage channels such as N300.

If risk is high, consider additional protection to pipe or erecting grilles upstream of the box culvert or deepening the drainage channel.

Minor landslide causes blockage of culvert below overground section of pipe and overflowing water causes damage to treated effluent pipe

Preliminary proposal is stainless steel box containing the DI pipeline and UPVC pipes (imperforated over its length) next to bridge.

DI pipe spanning channel should be one section without joints. Stainless steel box should be strong enough to resist rapidly overflowing flood water. Foundation design and jointing of stainless steel box to concrete channel should take into account possible erosion by rapidly flowing water. Following rainstorms and periodically, the drainage channels and pipe should be inspected.

Buried section of pipe Since the natural terrain angle is low close to the pipeline and road, this will be the deposition phase of a channelised debris flow and hence damage to buried sections of the pipeline is not expected.

In case of a landslide over the pipe, the pipe and leakage collection system should be inspected.

Man-made slope failure

Deep seated failure incorporating a cut slope beneath the road could damage pipe and leakage system

All registered slopes should already be stabilised to a degree adequate for the facilities (e.g. road and raw water reservoir) nearby. Deep-seated failure is not common.

Pipe should run as far from toe of slope as possible. Review for which slopes this could happen and consider risk. If risk is high consider mitigation measures on or close to pipeline.

Failure of cut rock slope

Potential damage to pipe Rock slope is unlikely to reach pipe Review whether rock slope impact on pipe is credible and consider additional mitigation if necessary





Question Category


Rockfall There are some exposed rockfaces

No credible path exists, except for entrainment in channelised debris which has been already considered.

Boulderfall Not a significant hazard No boulders observed on hillside. (Post meeting note – any unobserved boulders are not considered to be able to affect the pipeline since they will be small and the hillside is densely wooded.)

Flood Floodwater including fines ingress into leakage collection system

Drains provided on road Would require severe elevation of water table Site investigation will provide information on water table level.

If leakage collection system appears to be collecting large quantities of ground water, then inspection and maintenance of the leakage collection system should be considered.

Hillfire Not a significant hazard Lightning Damage to aboveground section Very unlikely event

Pipe and stainless steel box will be grounded

Vehicle Impact Could damage pipe on aboveground section.

Road is restricted and lightly used. Consider measures to prevent vehicle impact on pipe (e.g. concrete protection, concrete upstand / high kerb, crash barrier, reroute pipe)

Digging up Pipe could be damaged by excavation

Identification tape buried in ground above pipeline Comprehensive excavation permit system operated by HyD to facilitate co-ordination and checking before digging up

Consider providing an additional marker, e.g. coloured tiles.

Falling tree Not a significant hazard Dropped object Not a significant hazard





Question Category


Tree root ingress

Could cause damage to or movement of concrete trough

Pipe route runs close to road – trees are set back Maintenance manual should consider possible movement of system due to tree root action Proximity of large trees to be noted any during future site surveys and construction

Vandalism / sabotage / terrorism

Not a significant hazard

DG release (e.g. chlorine)






Question Category


Process Conditions Deviation

Pressure High pressure may cause leakage Pipe is designed to hold 16 bar NB partial vacuum in pipe not considered to be a problem

Continue to consider methods for limiting pressure in pipeline – pressure reducing valves found not to be appropriate. (Post meeting note – this refers to pressure reducing valves considered up to the time of the workshop. DSD have since indicated that use of an appropriate valve should be considered further)

Temperature Not a significant hazard Density Not a significant hazard Composition Could result in internal corrosion

of the DI pipe Oil and grease removed in treatment plant DI pipe will have cement mortar lining.

Design to consider the possibility of pitting corrosion

Valve closed downstream – human error – turned in wrong direction

See high pressure above Valves must be clearly labelled (open / closed) Inspection procedures to include proper operation of valves.

Valve closed for maintenance or to regulate flow

See high pressure above Pipe design to consider water hammer. Rate of valve closure must be controlled by procedure or in manual to avoid hammer head.

Treatment plant operations?

Not a significant hazard Treatment plant will fail safe – i.e. flow stops if fault arises.





Question Category


Deterioration Internal corrosion

Pitting could result in possible leakage – typical corrosion rate of DI is 0.5mm/yr, but rates as high as 4mm/yr have been observed.

Cement mortar lining 11mm wall thickness Concrete trough to contain leakage Valve chamber and hatchbox provided for access

Consider CCTV to inspect for internal corrosion after 3 years, every 1 or 2 years thereafter. Consider sulphide resistant lining on 450m section

External corrosion

Pitting could result in possible leakage

Epoxy coating or similar on outside of pipe Second level of protection provided by concrete trough (outside of pipe should normally be dry, but also to contain leakage) Groundwater on Lantau not expected to be corrosive

Internal abrasion

Not a significant hazard Effluent is free of particulates

External abrasion?


Creep (loading) On self supporting sections (above ground) pipe carries self plus effluent weight

Generally supported by concrete trough Concrete surround should contain thrust

There should be no joints on self supporting sections If required thrust blocks must provided on bends

Fatigue (vibration)

Road traffic and cyclic variations in pressure could cause cracking

Appropriate design standards for vertical cover on roads have been adopted

Cracking Cracking could be caused by exposure to sunlight – possible leakage

Pipeline is covered or enclosed for all of 450m length

Supports / foundations






Question Category


Valves fail to close

Cannot isolate section in case of leak or for maintenance

Valves are provided every 120m Consider need for ball valves QRA to consider need for Remote Operated Valves (ROVs) at ends of 450m section.

Valves fail to open


Design/Fabrication/Installation Defect

Inadequate design

Covered in rest of worksheet Design will be reviewed and commented on by all parties before tendering

Incorrect construction / installation

Could be a significant cause of leakage

Work will be tightly supervised by DSD

Safety Systems Failure

Leak detection system (flowmeters)

Leak detection system will not detect leaks of less than 10 to 15% of flow. May get spurious trips if calibration of flowmeters at top and bottom diverges

Flowmeters must be calibrated according to manufacturers specification and DSD standards

Boreholes – could block or no water because holes not drilled deep enough

Cannot use boreholes Boreholes will be drilled deep enough to reach groundwater and appropriately maintained

Cover bore holes and lock to prevent damage, etc.





Question Category


Leakage collection system

May not work during extreme flooding or high water table conditions Will not work if destroyed by deep seated landslide

Should be designed as a water retaining structure Leakage detection system

Consider testing the collected water and if polluted consider shutting down sewage treatment

Containment system

Well protected (landslides and tree roots etc. discussed above)

Isolation system See discussion of “valve fails to close” above

Emergency plans

Storage system – 3 to 5 days storage – if problem not rectified in 3 to 5 days can use tankers and/or bypass pipe can be rigged up. Flow will be stopped if leakage alarm sounds If there is a road crossing (2 traffic lanes) twin pipelines are provided.

Need to define procedure (emergency plan) for when flow is to be stopped and other actions, dependent on what alarm level. Consider installing pressure gauge at tees and develop procedure to detect leakage. Review hazards for any temporary systems at time of implementing (e.g. bypass pipe). Also provide guidance in O&M Manual on suitable systems and procedures for temporary bypass.

Interfaces Cable car project etc.


CLP, HKCG, Hutchison, PCCW

Already discussed under “digging up” above





Question Category


Emergency or other Abnormal Operations

Planned shutdown

Shutdown of STW is not a significant hazard Shutdown of pipe – temporary measures discussed above

Emergency shutdown

Delay in closing of manual valves

If STW is manned, operator will arrive at location to close valve in STW within 5 minutes and on pipeline in 60 minutes If STW not manned, this could take 1 day.

Confirm STW will be manned (including during the night) Refer to recommendation to consider Remote Operated Valves (ROVs) above Consider how to differentiate leaks and false alarms and how to locate leaks, within the 3 to 5 days capacity of the storage tank in the STW, also develop procedure for what to do in case location of leak cannot be found





Question Category


Maintenance and Inspection

Possible release of treated effluent

Pipe will be drained before opening

Temporary “work around”

Leak detection system (flowmeters) may not work (out of range of normal function: flow, pressure, etc.)

To be considered in design of temporary measures.

Start-up (service of pipeline may be intermittent – as spillover)

Air in pipe at start up Revealed leak

Bleed valves should be provided at appropriate positions to release the air in pipe prior to start-up Consider whether, on start up, pipe should be tested for leaks with water prior to filling with treated effluent – may need additional water supply at STW (Post meeting note - i) may need additional water supply at STW; and ii) need to identify location of leakage and go through the start-up procedures within 3 to 5 days capacity of the storage tank in the STW.)



Appendix CDetails of Ownership of Man-Made Slopes

Above and Below the Pipeline



Table 20 Registered Slopes below the Pipe Section (East)

No. Slope No. Government Department Responsible for Maintenance

1 13NW-B/C R234 WSD 2 13NW-B/F 148 HyD 3 13NW-B/C R222 WSD 4 13NW-B/C R224(1) HyD 5 13NW-B/C R224(2) WSD 6 13NW-B/C R223 WSD 7 13NW-B/F R145 HyD 8 13NW-B/C 225 Lands D 9 13NW-B/C R30 WSD 10 13NW-B/C 28 Lands D 11 13NW-B/C R36 WSD 12 13NW-B/C R35 WSD 13 13NW-B/C 34 WSD 14 13NW-B/F/FR59 WSD 15 13NW-B/C R26 LCSD 16 13NW-B/F R63 HyD 17 13NW-B/C R24 WSD 18 13NW-B/C 114 HyD

Table 21 Registered Slopes above the Pipe Section (West)

No. Slope No. Government Department Responsible for Maintenance

1 13NW-B/C 220 HyD 2 13NW-B/C 221 HyD 3 13NW-B/C 29 HyD 4 13NW-B/C 251 HyD 5 13NW-B/C 248 HyD 6 13NW-B/C 245 HyD 7 13NW-B/C 23 HyD 8 13NW-B/C 33 HyD



Appendix DNatural Terrain Landslide Risk Model

Input Data, Event Trees and Lookup Tables



Sub Slope 1



Sub-Slope 2



Sub-slope 3



Sub-slope 4



Sub-slope 5



Sub-slope 6



Sub-slope 7



Sub-slope 8



Sub-slope 9



Sub-slope 10



Sub-slope 11



Sub-slope 12



Sub-slope 13



Sub-slope 14



Sub-slope 15



Sub-slope 16



Sub-slope 17



Sub-slope 18



Table 22 Lookup Table for Terrain Component for Landsl ide Frequency and Probabil i ty of Long Runout and Mobile Factors

Total Long Runout Mobile Terrain Component

Density (no./km2) Frequency Factor Density (no./km2) Probability Density (no./km2) Probability Alluvial Plain 6.90 0.18 0 0.00 0.00 Coastal Plain 3.70 0.10 0 0.00 0.00 Concave Footslope 13.12 0.34 0.07 0.24 0.23 1.00 Concave Sideslope 46.49 1.21 0.29 1.00 0.3 1.30 Convex Footslope 10.16 0.26 0 0.00 0.00 Convex Sideslope 39.82 1.03 0.39 1.34 0.23 1.00 Crest or Ridge 38.07 0.99 0.46 1.59 0.3 1.30 Disturbed Terrain 15.49 0.40 0 0.00 0 0.00 Drainage Plain 23.32 0.60 0.1 0.34 0.18 0.78 Floodplain 9.81 0.25 0 0.00 0.00 Rock Outcrop 29.80 0.77 0.35 1.21 0.12 0.52 Straight Footslope 8.81 0.23 0 0.00 0.00 Straight Sideslope 44.32 1.15 0.14 0.48 0.12 0.52 Average 38.56 1.00 0.29 1.00 0.23 1.00



Table 23 Lookup Table for Geological Category Landsl ide Frequency and Long Runout and Mobile Probabil i ty Factors

Long Runout Mobile Category Group Density (no./km2) Factor Density (no./km2) Probability Density (no./km2) Probability

Volcaniclastic sedimentary rock and lava AN 32.74 0.83 0.00 0.00 Minor Intrusives AP 40.54 1.02 2.7 4.43 0.00 Superficials ATB 16.40 0.41 0.00 0.00 Sedimentary rock CB 54.05 1.36 0.00 0.00 Metasediments CMS 38.44 0.97 0.51 0.84 0.26 1.08 Metasediments CQ 16.67 0.42 0.00 0.00 Volcanics CT(1) 28.32 0.71 0.51 0.84 0.00 Volcanics CT(2) 46.60 1.18 0.4 0.66 0.27 1.13 Superficials DF 15.34 0.39 0.35 0.57 0.17 0.71 Volcanics E 41.48 1.05 1.17 1.92 0.11 0.46 Intrusives GC 17.39 0.44 0.00 0.11 0.46 Intrusives GD 21.28 0.54 0.45 0.74 0.3 1.25 Intrusives GF 28.94 0.73 0.45 0.74 0.31 1.29 Intrusives GM 30.26 0.76 0.34 0.56 0.2 0.83 Volcanics JCB 56.20 1.42 0.00 0.26 1.08 Volcanics JHI 53.60 1.35 2.24 3.67 0.24 1.00 Volcanics JSM 37.32 0.94 0.33 0.54 0.22 0.92 Sedimentary rock KKO 10.00 0.25 0.00 0.00 Minor Intrusives LBD 17.86 0.45 0.00 0.00 Volcanics LC(1) 141.78 3.58 1.01 1.66 2.43 10.13 Volcaniclastic sedimentary rock and lava LC(2) 141.07 3.56 0.00 0.00 Minor Intrusives MD 14.54 0.37 0.13 0.21 0.00 Sedimentary rock MSL 45.80 1.16 0.00 0.00 Minor Intrusives RF 19.56 0.49 0.18 0.30 0.11 0.46 Volcanics RHL 77.12 1.95 1.84 3.02 0.32 1.33 Sedimentary rock SL(1) 61.35 1.55 1.5 2.46 0.56 2.33



Long Runout Mobile Category Group Density (no./km2) Factor Density (no./km2) Probability Density (no./km2) Probability

Sedimentary rock SL(2) 0.00 0.00 0.00 0.00 Sedimentary rock SSC 55.24 1.39 0.21 0.34 0.14 0.58 Sedimentary rock SST 53.53 1.35 0.59 0.97 1.76 7.33 Volcaniclastic sedimentary rock and lava SV 46.41 1.17 0.00 0.45 1.88 Volcanics TB 40.78 1.03 0.3 0.49 0.45 1.88 Volcanics TRL 81.94 2.07 0.00 0.00 Volcanics TT 86.51 2.18 1.25 2.05 0.21 0.88 Volcanics VT 18.89 0.48 0.36 0.59 0.19 0.79 Average 39.63 1.00 0.61 1.00 0.24 1.00



Table 24 Lookup Table for Slope Angle Landslide Frequency Factor

Min Max Density (no./km2) Factor0 11 14.61 0.37 11 15 16.77 0.43 15 18 17.52 0.45 18 22 22.27 0.57 22 27 34.67 0.89 27 30 53.06 1.36 30 34 70.77 1.81 34 39 81.64 2.09 39 45 77.00 1.97 45 90 62.76 1.60

Average 39.13 1.00

Table 25 Lookup Table for Vegetation Class Landslide Frequency and Long Runout and Mobile Probabil i ty Factors

Total Long Runout Mobile Vegetation Class Density

(no./km2)Factor Density

(no./km2) Factor Density

(no./km2) Factor

Bare Rock or Soil 50.04 1.23 1.21 1.89 1.21 4.84 Grassland 48.80 1.20 0.81 1.27 0.22 0.88 Low Shrub 42.37 1.04 0.83 1.30 0.39 1.56 Low Shrub with Grass 48.95 1.21 0.58 0.91 0.36 1.44 Plantation Woodland 28.34 0.70 0.39 0.61 0.34 1.36 Tall Shrub 36.49 0.90 0.38 0.59 0.13 0.52 Tall Shrub with Grass 52.04 1.28 1.05 1.64 0.2 0.80 Woodland 15.80 0.39 0.14 0.22 0.07 0.28

Average 40.62 1.00 0.64 1.00 0.25 1.00 Table 26 Lookup Table for Elevation Landslide Frequency Factor

Min Max Density (no./km2) Factor0 200 39.41 1.01

200 400 40.06 1.02 400 600 36.51 0.93 600 1000 19.32 0.49

Average 39.14 1.00



Table 27 Lookup Table for Head Slope Angle Long Runout and Mobile Probabil i ty

Total Long Runout Mobile Min Max

Number Number Recent Number Probability Number Probability 0 11 8 1 0.70 0.609 0.70 0.609 11 15 59 8 9 1.061 1 0.118 15 18 126 18 3 0.166 2 0.110 18 22 296 43 14 0.329 5 0.118 22 27 1211 174 21 0.121 10 0.057 27 30 2437 350 49 0.140 16 0.046 30 34 4483 644 55 0.085 28 0.043 34 39 8762 1259 117 0.093 64 0.051 39 45 6277 902 73 0.081 25 0.028 45 90 2892 416 57 0.137 5 0.012 Average 26551 3816 398 0.104 156 0.041



Appendix EPipeline Leakage Event Trees



Figure 9 Event Tree for Landslide, External Effect and Damage by Others



Figure 10 Event Tree for Pipe Break due to Internal or External Corrosion



Figure 11 Event Tree for Pipe Leak > 15% of Flow due to Internal or External Corrosion



Figure 12 Event Tree for Pipe Leak < 15% of Flow



Appendix FDiscussion of Practicality of

Risk Mitigation Measures



Table 28 Discussion of Practical ity of Mit igation Measures

Conceptual Measure Proposed Comment Conclusion Increase capacity of leakage collection system to 100% of full flow.

It might not be practicable to increase capacity of leakage collection system to 100% of full flow mainly due to the limited space and the fall by gravity nature of the flow from leakage. In fact there is a ramp within the 450m section and it is not preferred to install the pipeline with the leakage collection system at 4-5 m deep under the road just to keep the gravity flow of the leakage collection pipe. A small pump chamber might be needed to pump the leakage flow at the end of the ramp to the summit of the ramp so that the concrete trough can go over the ramp following the existing road profile. In that case the leakage within the uphill section will flow backward by gravity and be collected by the pump sump.

Due to the criticality of this measure to controlling the risk, Measure 3 will be evaluated: i.e. to make the leakage containment waterproof, like a pipe, to BS8007, which will increase the capacity of the leak collection system to 100% of flow. The design proposed, which includes an additional concrete slab on the top of the collection channel will also prevent 99.9% of external effect and impact by others incidents.

Provide flow detection on the leakage collection system. In case of significant flow being detected, flow in pipeline should be stopped.

It is possible to provide flow detection on the leakage collection system. A sump can be built in the last manhole of the leakage collection system and when certain level of water is reached, the sensor will pick up the signal and send it back to the control room of the STW. However this might cause unnecessary false alarm too often while it is possible for the ground water to enter into the collection system.

This measure is not practical because there is no electrical signal and false alarms would be caused by groundwater ingress.

Provide impermeable barrier and bund wall to prevent leakage from spilling into reservoir and ensure all goes into storm drains on road.

The provision of impermeable barrier and bund wall will also block the passage of surface water across the road surface during heavy rainfall and hence cause flooding

Since flood water must be allowed to flow over the road into the reservoir, this measure is not practical.

Consider welded continuous pipework. Plastic is not recommended. Steel may provide 10 times or more improvement in leak frequency.

Fourth bullet, the use of steel pipe may not be better than ductile iron in terms of corrosion resistance capacity and the pipe strength.

Measure 1: Fabricate 450m critical section from continuous welded stainless steel.

Consider remotely operated (automatic) isolation valves on line.

Fifth bullet, the use of remotely actuated valve will favour the operation of the valve from the plant. However, normally, it is strictly prohibit the closing of the valve during normal operation and the pipe is full of water. The problem is when there is a leak, all of the contents back to the STW drain into the reservoir. That is why the valves on the line need to be closed if a leak is detected. If the pipe will burst when the valves on the line are closed and it is full, then the pipe should be designed to withstand the head when full of water back to the STW. Then valves on the line can be closed. Original design is such that pipeline cannot withstand full static head and

Measure 2: 1700m section within LDGG to be designed to withstand full static head and manual isolation valve to be provided immediately before critical 450m section and pressure relief valves to be provided on section before 1700m LDGG section.



Conceptual Measure Proposed Comment Conclusion so manual valves on line cannot be closed when line is full otherwise line will burst.

Consider making isolation fully automatic and immediate (not 5 minutes or 1 hour delay).

Sixth bullet, due to the distinct nature of flow and the leakage detection system, the effluent leakage can only be carried out by comparing the effluent volume of one batch measured by the two flowmeters. Thus, the action will only be taken after the comparison of the measured volume. However, the control system can be slightly modified in the manner that if the flowmeter in Tung Wan measures only half of the design flow for a period of time, say 0.5 minutes, it is likely that problem will occur .In this case, the control system can stop the operation of the effluent pumps.

It was concluded that the measurement of flow by means of monitoring the pressure profile during pumping was most rapid and the measurement using the flowmeters would give a backup indicative result. More rapid isolation than 5 minutes may be achievable but line would still drain, so no benefit - not considered further.

Ensure that pipeline does not drain in case of leak on the critical 450m section.

Seventh bullet, it might not be practical under the current design of the pipeline to stop the flow at the upstream of the 450m section in case of leak on the critical 450m section. By doing this, the pressure at the closing valve is excessively high and exceeds the pressure rating of the valve and pipe which is extremely danger. Same to the ninth bullet.

See Measure 2 above.

In case of successful isolation at STW, also isolate manual valves on line.

See Measure 2 above.

Stop flow of treated effluent in case of landslide warning. Consider closing isolation valves on critical 450m section.

No comment made. Measure 4: The pipeline would be adequately protected to withstand a worst case landslide.

The option to treat the water to Group A so that it could be fed into a reservoir is considered as Measure 5.


R/8111/03/1 Issue 3, December 2002

Appendix GSensitivity Analysis


R/8111/03/1 Issue 3, December 2002

APPENDIX G - SENSITIVITY ANALYSIS

Since it may not be practicable to design the leak collection system to contain 100% of the leakage under all circumstances a sensitivity analysis is presented below which considers 2 additional cases as follows: ? Case I: 10% of any leakage due to pipe breaks is not contained. ? Case II: 20% of any leakage due to pipe breaks is not contained. Table 29 presents the quantities spilt for Cases I and II.

Table 29 Leakage Quantit ies for Sensit ivi ty Cases

Outcome Quantity Released (m3) Case I

Pipe break, 10% not contained

Case II Pipe break, 20%

not contained 5 minute duration leak + contents of pipeline from plant, mostly contained

12.5 25

1 hour duration leak + contents of 120m of pipeline, mostly contained

18.4 36.8

Long duration leak, mostly contained 20 40 The effect of these sensitivity cases are most clearly shown by listing the detailed results for each outcome shown in Table 30 and cumulative frequency for quantity spilt in Table 30. The sensitivity cases generate additional leakage cases, in which the leakage was considered to be contained in the main analysis. The quantities released the new leakage cases in both Cases I and II are relatively insignificant (i.e. 40m3 or less) and even though these are occurring at frequencies above 10E-4 per year (i.e. once in 10,000 years), these should be considered tolerable provided the performance of the leakage control system is monitored.



Table 30 Detai led Results for the Mit igated Case, and Addit ional Cases I and I I

Quantity Released (m3) Leakage Case Frequency (per year)* Mitigated

Case Case I Case II

Leak contained Landslide, digging up 0 0 0 0 5 minute duration leak + contents of pipeline from plant, not contained Landslide, digging up 1.91E-05 125 125 125 1 hour duration leak + contents of 120m of pipeline, not contained Landslide, digging up 0 184 184 184 Long duration leak, not contained 200 m3 released Landslide, digging up 3.87E-07 200 200 200 Immediate detection (mostly) contained Pipe Break 3.91E-04 0 12 25 Long duration, (mostly) contained Pipe Break 3.95E-06 0 18 37 Detected after long delay, (mostly) contained Pipe Break 3.99E-06 0 20 40 5 minute duration leak + contents of pipeline from plant, not contained Pipe Break 3.91E-08 125 125 125 1 hour duration leak + contents of 120m of pipeline, not contained Pipe Break 0 184 184 184 Long duration leak, not contained 200 m3 released Pipe Break 7.94E-10 200 200 200 Leak contained Leak >15% 9.49E-03 0 0 0 5 minute duration leak + contents of pipeline from plant, not contained Leak >15% 9.31E-07 117 117 117 1 hour duration leak + contents of 120m of pipeline, not contained Leak >15% 0 94 94 94 Long duration leak, not contained 200 m3 released Leak >15% 1.89E-08 200 200 200 Leak contained Leak <15% 2.02 0 0 0 5 minute duration leak + contents of pipeline from plant, not contained Leak <15% 0 112 112 112 1 hour duration leak + contents of 120m of pipeline, not contained Leak <15% 0 31 31 31 Long duration leak, not contained 200 m3 released Leak <15% 0 200 200 200 Note: * Where 0 (zero) is shown in the above table, it indicates that the outcome does not or cannot occur.



Figure 13 Cumulative Frequency of Leakage for Mit igated Case, Addit ional Cases I and I I



R/8111/0/1 Issue 3, November 2002 Drainage Services Department

Appendix HComments and Responses



Comments Response

CE/E&MP, DSD Ref. (23) in DSD EM/8/428DS/NP Pt. 3

Para. 2.2.5 (a) The time for closing the ROVs at the

STW is estimated by the Consultants to be 5 minutes electrically while the time for closing the values manually is estimated to be 1 hour. For manual operation by closing valves on the pipeline, we presume that BCM’s staff will carry out the task by themselves and ST2D’s staff will provide the necessary assistance. Please request the Consultants to advise the nos. of ROVs to be closed.

Noted and thank you for the information. The design will be finalised by the Design Engineer and Contractor.

(b) The maintenance responsibility of the export pipeline rests on BCM Team whereas ST2D will provide assistance whenever necessary. Would the Consultants please advise if permit-to-work system will be adopted for such task of closing valves?

Noted and thank you for the information. A permit to work system may introduce much delay to the responses of leakage.

(c) As mentioned in the latest draft Preliminary Hydraulic Assessment of Effluent Pipeline to Tung Wan Report (November 2002), the proposed system shall be designed mainly by gravity in non-full-bore flow condition. As such the pressure detecting system for detecting leakage will not be effective. Hence leakage could only be detected by the two flowmeters at the upstream and downstream of the pipeline.

Noted and thank you for the information. Leakage will be detected by the two flowmeters in the flow monitoring chambers. The detection will be carried out by comparing with the reference value obtained during the commissioning.

Para.3.4.16(23) We would reiterate that the proposed STW will be unmanned and served by a mobile team stationed at existing Mui Wo STW or Siu Ho Wan STW. This team will serve that district including Ngong Ping. It may take 1.5 hours to reach Ngong Ping STW if ST2D’s staff is required to attend any emergency operation at the STW.

Noted and thank you for the information. The report is amended to reflect this information. It is proposed to retain the numbers of 1 hour to isolate manually as an average response time. Without any change of conclusions, the minimum requirement is that next batch of effluent must be stopped once leak occurs, as stated in 7.4.9



Comments Response

CE/E&MP, DSD Ref. (23) in DSD EM/8/428DS/NP Pt. 3

Para. 3.4.17(28) The STW will stop further delivering effluent to the export pipeline if it is proved that there is leakage of the export pipeline by more than 15% of the full flow.

Noted and thank you for the information.

Para. 3.5.2 The isolation cannot be achieved within 5 minutes of the occurrence of the leak of manually operated valves or immediately for ROVs in unmanned condition. As explained for para. 3.4.16 above, ST2’s staff could only arrive at the STW for emergency operation in about 1.5 hours. The isolation of the STW could only be performed upon the arrival of our staff at site. Please note that the STW will normally be unmanned.


Para. 4.4.2 The leak detection system basing on pressure profile is assumed to rapidly detect leaks 99% of the time. Please ask the Consultants to explain the remaining 15 of the non-detection of leakage. Why the pressure profile is not effective in detecting leakage of less than 15%?

The lower the detection level, the more sensitive the detection system which imply a higher chance of fault alarm. Therefore, in order to reduce the fault alarm of the detection system, it is advised that a higher detection level will be set such as 15%. However, the value will be fine tuned during the commissioning of the pipeline.

Para. 7.2.13 In the first sentence of the paragraph, the text “(1 duty, 1 standby)’ should read “(both duty)” accordingly to the latest Preliminary Hydraulic Assessment of Effluent Pipeline to Tung Wan Report (November 2002).


Fig. 3 The 300mm dia, pipe should now be replaced by two 200mm dia. Pipes.

Noted and thank you for the information. The schematic figure is amended.



Comments Response

CE/HK&I, DSD Ref. (23) in DSD EM/8/428DS/NP Pt. 3

Para. 2.2.10 1. Please indicate the distance of each drill

holes and how deep would the holes are.

The design will be finalised by the Design Engineer and Contractor.

Para 25.1.2 2. Does the scenarios of pipeline break

include the scenario of rupture of both effluent pipeline?

Using twin pipelines will double the residual risk, but provided Measures 3 and 4 are implemented this should still be acceptable.

It seems that the design has changed, the risk assessment report should be revised according to any change of new design.

Please note that the assessment was carried out on the basis of the design at the time of the Hazard Assessment Workshop. Qualitative comments are provided for minor changes.

Comments Response

Water Supplies Department Ref. (4) in WSD(HK) 1409/16/01 Pt. 5

I refer to the revised risk assessment report for the Ngong Ping Effluent Pipeline in the proximity to Shek Pik Reservoir circulated under cover of your memo dated 7-11.2002. As discussed between our Mr. P.N. LEE and your M. Michael FONG on 18-11.2002, we have no further comment on the report except that paragraph 6.3.2 should be suitably revised to include the recommendations from the consultant on the classification of pollution and the acceptable frequency of spillage.

Para 6.3.2 is amended to reflect the acceptable frequency of spillage.

final risk assessment report · risk assessment for ngong ping effluent pipeline in the proximity...

Documents