[Notices] [Pages 25990-25994]
DEPARTMENT OF TRANSPORTATION
Pipeline and Hazardous Materials Safety Administration
[Docket No. PHMSA-2014-0020]
Pipeline Safety: Lessons Learned From the Release at Marshall, Michigan
AGENCY: Pipeline and Hazardous Materials Safety Administration (PHMSA); DOT.
ACTION: Notice; issuance of advisory bulletin.
SUMMARY: PHMSA is issuing an advisory bulletin to inform all pipeline owners and operators of the deficiencies identified in Enbridge's integrity management (IM) program that contributed to the release of hazardous liquid near Marshall, Michigan, on July 25, 2010. Pipeline owners and operators are encouraged to review their own IM programs for similar deficiencies and to take corrective action. Operators should also consider training their control room staff as teams to recognize and respond to emergencies or unexpected conditions. Further, the advisory encourages operators to evaluate their leak detection capabilities to ensure adequate leak detection coverage during transient operations and assess the performance of their leak detection systems following a product release to identify and implement improvements as appropriate. Additionally, operators are encouraged to review the effectiveness of their public awareness programs and whether local emergency response teams are adequately prepared to identify and respond to early indications of ruptures. Finally, this advisory reminds all pipeline owners and operators to review National Transportation Safety Board recommendations following accident investigations. Owners and operators should evaluate and implement recommendations that are applicable to their programs.
FOR FURTHER INFORMATION CONTACT: Linda Daugherty by phone at 816-329- 3821 or by email at linda.daugherty@dot.gov. Information about PHMSA may be found at http://phmsa.dot.gov.
SUPPLEMENTARY INFORMATION:
I. Background
On July 25, 2010, at 5:58 p.m. eastern daylight time, a segment of a 30-inch-diameter pipeline (Line 6B), owned and operated by Enbridge Incorporated (Enbridge), ruptured in a wetland near Marshall, Michigan. The rupture was not discovered or addressed for over 17 hours. During that time period, Enbridge twice pumped additional oil (81 percent of the total release) into Line 6B during two startups. The total release was estimated to be 843,444 gallons of crude oil. The oil saturated the surrounding wetlands and flowed into Talmadge Creek and the Kalamazoo River. Local residents self-evacuated from their homes, and serious environmental damage required long-term remediation. About 320 people reported symptoms consistent with crude oil exposure. No fatalities were reported. Cleanup and remediation continues, and costs have exceeded $1 billion.
The National Transportation Safety Board (NTSB) determined that the probable cause of the pipeline rupture was stress corrosion cracking that grew and coalesced from crack and corrosion defects under disbonded polyethylene tape coating. The NTSB also determined the rupture and prolonged release were caused by pervasive organizational failures at Enbridge that included: (1) Deficient integrity management (IM) procedures, which allowed well-documented crack defects in corroded areas to propagate until the pipeline failed; (2) inadequate training of control center personnel, which resulted in Enbridge's failure to recognize the rupture for 17 hours and through two re-starts of the pipeline; and (3) insufficient public awareness and education, which allowed the release to continue for nearly 14 hours after the first notification of an odor to local emergency response agencies.
PHMSA IM Regulations
Subpart O of 49 CFR part 192 and Sec. 195.452, also known as the IM regulations, require operators of gas transmission and hazardous liquid pipelines to institute a continual process for evaluation of pipeline integrity (see also: Guidance in Advisory Bulletin ADB-2012- 10, Using Meaningful Metrics in Conducting Integrity Management Program Evaluations, 77 FR 72435, December 5, 2012). Specifically, Sec. Sec. 192.937 and 195.453(j) require that an operator have a continual process for the evaluation of pipeline integrity. The evaluation must consider the results of integrity assessments, data collection and integration, remediation, and preventative and mitigative actions in evaluating pipeline integrity. The operator must use the results from this evaluation to identify the threats specific to each pipeline segment that could impact a High Consequence Area (HCA) and the risk represented by those threats. The operator must perform assessments that are specific to those threats and then identify and implement appropriate remedial, preventative and mitigative measures. Sections 192.945 and 195.452(k) require that an operator have methods to measure the effectiveness of their integrity management programs.
An operator's IM program must include the results of past and present integrity assessments, risk assessment information and data integrated from throughout the pipeline system. This information and its analysis must be taken into account when making decisions about remediation, preventive and mitigative actions.
The ability to integrate and analyze threat and integrity related data from many sources is essential for sustaining and continually improving safety performance and a proactive IM program. Operators must use the results from this integrated evaluation to identify the threats specific to each pipeline segment that could impact a HCA. The operator must then perform assessments that are specific to the identified threats and implement remedial, preventive and mitigative measures, as appropriate.
The IM regulations supplement PHMSA's prescriptive safety regulations with requirements that are more performance-based and process-oriented. One of the fundamental tenets of the IM program is that each individual pipeline has a unique risk profile that is dependent on factors including the pipeline's physical attributes, its geographical location, its design, its operating environment and the commodity it transports. Pipeline operators use this risk profile to identify appropriate assessment tools, set the schedule for performing integrity assessments and identify the need for additional preventive and mitigative measures such as lowering operating pressures, installing automatic or remote control shut-off valves and installing additional right-of-way markers, among other safety measures. If this risk profile information is unknown, unknowable, or uncertain, the pipeline should be operated more conservatively. Deficiencies Found in Enbridge's IM Program
The following facts illustrate the ways in which Enbridge failed to institute and maintain an adequate IM program:
In 2007, Enbridge experienced a release on its Line 3 in Glenavon, Saskatchewan. Following the Transportation Safety Board of Canada's investigation and issuance of a report, Enbridge changed its assessment process to account for tool tolerances when performing engineering assessments. However, Enbridge did not retroactively apply these changes to the 2005 in-line inspection (ILI) data assessments performed on the line that ruptured near Marshall, Michigan. In its investigation of this incident, the NTSB found that Enbridge's IM program did not incorporate a process of continuous reassessment to all pipeline engineering assessments, and it neglected to apply the revised crack assessment methods to Line 6B. The NTSB also found a lack of data integration was a significant contributor to the consequences of the Marshall, Michigan incident.
The NTSB further concluded:
Enbridge's response to past IM-related accidents focused only on the proximate cause, without a systematic examination of company actions, policies and procedures.
Enbridge's IM program consistently chose a less-than- conservative approach to pipeline safety margins for crack features.
In preparing the risk analysis, Enbridge failed to consider all relevant risk factors associated with the determination of the amount of product that could be released from a rupture on Line 6B.
The results of multiple ILI assessments on Line 6B were evaluated independently and the information from these assessments was not properly integrated to assure pipeline integrity.
Enbridge used a lower safety margin when evaluating crack defects versus corrosion defects. Enbridge's criterion for excavating and remediating a crack defect was when the predicted failure pressure was less than the hydrostatic test pressure (1.25 times maximum operating pressure). Enbridge's criterion for excavating and remediating a corrosion defect was when the predicted failure pressure was less than the specified minimum yield strength (1.39 times maximum operating pressure).
Enbridge used the maximum depth reported in a 2005 UltraScan Crack Detection (USCD) ILI tool run without accounting for tool accuracy or performance specifications. Further, Enbridge did not compare the 2005 USCD-reported wall thickness to a 2004 UltraScan Wall Measurement tool run that measured local wall thicknesses. Enbridge used the thicker, incorrect measurement in determining the predicted failure pressure and crack growth calculations.
Enbridge did not account for the interaction between corrosion and cracking. Assessments for corrosion in 2004 and for cracks in 2005 showed areas of overlap. Using the crack depth measurements alone likely resulted in an underestimation of the total wall loss.
The ILI vendor's junior analyst classified certain features from the 2005 USCD ILI tool run as crack-field features, but the ILI vendor supervisor re-classified them as crack-like features in the report to Enbridge. Enbridge policies allowed longer crack-like features to persist without further evaluation than crack-field features. The post-accident investigation determined that the features were in fact crack-field features. Although the excavation threshold for crack-field features was 2.5 inches, the misclassified features measured 3.5 inches and were not examined further.
The Enbridge crack management group used a fatigue-crack growth model to predict the remaining life of the pipeline. In 2011, an independent consultant determined that the environmentally assisted cracking mechanism that is most prevalent along Enbridge's liquid pipeline system is either near-neutral pH SCC (stress corrosion cracking) or corrosion fatigue. The growth rates of environmentally assisted cracks can be exponentially greater than nominal fatigue-crack growth rates.
PHMSA Control Center Operations and Training Regulations
Sections 192.631 and 195.446 contain the requirements for gas transmission and hazardous liquid control room management, respectively, which establish roles and responsibilities, tools and procedures that allow operators to perform their duties, alarm management and training. The requirements address many of the deficiencies NTSB noted that led to the prolonged release of crude oil in Marshall, Michigan (see also: Guidance in Advisory Bulletins ADB- 2005-06; Countermeasures to Prevent Human Fatigue in the Control Room; 70 FR 46917; August 11, 2005, and ADB-2010-01; Leak Detection on Hazardous Liquid Pipelines; 75 FR 4134; January 26, 2010). Deficiencies Found in Enbridge's Control Center Operations and Training
With respect to Enbridge's control center operations and training, the NTSB concluded:
Due to the rapid growth of Enbridge's pipeline system, Enbridge hired additional control center staff without objectively assessing whether that growth in personnel would affect safe operations.
The leak detection process was prone to misinterpretation, and control center analysts and operators were not adequately trained in how to recognize or address leaks, especially during startup and shutdown. Therefore, low-pressure alarms, material balance system alarms and sudden and complete loss of pump station discharge pressure were mistakenly attributed to column separation rather than a pipeline rupture. Furthermore, the control center ignored warnings from field and operations personnel that there was a possible leak. In post- accident interviews, control center personnel attributed its disinclination to believe a rupture had occurred to the absence of external leak detection notifications, despite known limitations of the leak detection system.
Control room personnel did not follow the established procedure to shut the pipeline down if column separation couldn't be resolved within 10 minutes.
Enbridge failed to train the control center staff in team performance, which resulted in poor communication and lack of leadership.
PHMSA's Public Awareness/Public Education Regulations
Sections 192.616 and 195.440 contain the requirements for gas transmission and hazardous liquid operators' public awareness programs (PAP), respectively. These regulations incorporate the American Petroleum Institute's (API) Recommended Practice (RP) 1162, Public Awareness Programs for Pipeline Operators, and require that operators notify affected municipalities, school districts, businesses and residents of the location of pipelines and pipeline facilities (see also: guidance in ADB-2010-08; Emergency Preparedness Communications; 75 FR 67807; November 3, 2010, and ADB-2012-09; Communication During Emergency Situations; 77 FR 61826; October 11, 2012). Section 8 of API RP 1162 contains guidance for communicating with emergency responders, periodic evaluation of an operator's PAP, and measuring the effectiveness of an operator's PAP (see also: guidance in ADB-2003-04; Pipeline Industry Implementation of Effective Public Awareness Programs; 68 FR 52816; September 5, 2003, and ADB-2003-08; Self-Assessment of Pipeline Operator Public Education Programs; 68 FR 66155; November 25, 2003). Deficiencies Found in Enbridge's Public Awareness/Public Education Program
The NTSB identified several deficiencies in Enbridge's PAP, including:
Enbridge's PAP failed to effectively inform the affected public, including citizens and emergency response agencies about the location of the pipeline, how to identify a pipeline release and how to report suspected product releases.
Enbridge's review of its public awareness program was ineffective in identifying and correcting deficiencies.
An effective public awareness program would have better prepared local emergency response agencies to identify and respond to early indications of a rupture, which, once communicated to Enbridge, would have prevented the restart of the line.
II. Advisory Bulletin (ADB-2014-02)
To: Owners and Operators of Natural Gas and Hazardous Liquid Pipeline Systems.
Subject: Integrity Management Lessons Learned from the Marshall, Michigan, Release.
Advisory: To strengthen the Department's safety efforts, PHMSA is issuing this advisory bulletin to notify pipeline owners and operators they should evaluate their safety programs and implement any changes to eliminate deficiencies similar to the ones the National Transportation Safety Board (NTSB) found when it investigated Enbridge's July 25, 2010, crude oil release in Marshall, Michigan. Specifically, the NTSB investigation into the circumstances leading up to and following the release identified specific deficiencies in three Enbridge programs: integrity management (IM), control center operations and public awareness. Had existing regulations, guidance, advisories and recommendations regarding these programs been properly acted upon, the consequences of that incident could have been prevented, or at the very least, mitigated.
Integrity Management
A fundamental tenet of the IM program is that pipeline operators must be aware of the physical attributes of their pipelines, the threats and risks posed by and to their pipelines, and the environments which their pipelines transverse. Operator IM programs should reflect the recognition that each pipeline is unique and has its own specific risk profile that is dependent upon the pipeline's attributes, geographical location, design, operating environment, and commodity it transports, among other factors. It is vital for operators to compile and integrate this information into their IM programs to effectively identify and evaluate risk. If this information is unknown, unknowable or uncertain, operators need to take a more conservative approach to operations.
As part of a robust IM program, an operator will match and use the right tools for the threats being investigated, set the proper schedule for pipeline segment integrity assessments and identify the need for additional preventative and mitigative measures that protect pipeline integrity, including lower operating pressures, automatic shutoff or remotely controlled valves and additional right-of-way markers.
However, an operator's IM program must go beyond simply assessing pipeline segments and repairing defects--in fact, American Petroleum Institute (API) Standard 1160, Managing System Integrity for Hazardous Liquid Pipelines, defines pipeline risk assessment as a continuous process and defines risk analysis as a continuous reassessment process. Continual improvement of IM programs (including improvements in the analytical processes involved in analyzing assessment results, identifying threats, responding to risks, the application and implementation of assessments and the development of preventative and mitigative measures) is a key aspect and critical objective of an effective IM program.
Occasionally, accident investigations or other events cause changes in how operators analyze assessment data, including analytical procedures, algorithms, software, acceptance criteria or how anomalies are classified. For instance, a change in how an anomaly is classified could impact remediation time frames, assessment intervals, decisions regarding preventative and mitigative measures and the overall perception of the integrity of the pipeline. The NTSB noted that Enbridge accounted for changed tool tolerances when re-analyzing its Line 3 data after an incident, but this change in tool tolerances was not applied to the assessments performed on Line 6B. Operators should evaluate any changes in how assessment data is analyzed to determine if those changes will alter the results of any previously performed integrity assessments. If so, operators should apply those changes to any previously performed integrity assessments as appropriate.
To assist in evaluating possible assessment data analysis changes, operators should ensure that in-line inspection (ILI) vendors communicate any changes in their analytical processes that might require previous assessments to be re-analyzed. Improvements to vendor analytical processes may change anomaly classifications in previous assessments, and while vendors typically apply these changes to future assessments, it is rare for vendors to re-analyze previously performed assessments. Re-analyzing integrity assessments when analytical changes occur is critical for ensuring safety based on the best available data and expertise.
The ability to analyze and integrate threat- and integrity-related data from many sources is essential for operators to continually improve and sustain safety performance and proactive IM programs. However, some operators are not sufficiently aware of their pipeline attributes, are not adequately or consistently assessing threats and risks and are not effectively integrating data as a part of their IM programs. A lack of data integration was a significant contributor to the incident at Marshall, MI.
When performing self-assessments of IM programs, operators should compare their performance measures and program evaluations against the guidance of ADB-2012-10, Using Meaningful Metrics in Conducting Integrity Management Program Evaluations (77 FR 72435, December 5, 2012).
Control Center Operations
Sections 192.631 and 195.446 contain the requirements for gas transmission and hazardous liquid control room management, respectively. These requirements address many of the deficiencies the NTSB noted during their investigation of the incident at Marshall, MI.
PHMSA advises operators to regularly train their control room teams and consider establishing a program to train control center staff as teams in the recognition of and response to emergency and unexpected conditions that include supervisory control and data acquisition indications and leak detection software. Operators should perform periodic evaluations of their leak detection capabilities to ensure that adequate leak detection coverage is maintained during transient operations, including pipeline shutdown, pipeline startup and column separation. PHMSA previously issued ADB 10-01, Leak Detection on Hazardous Liquid Pipelines, (75 FR 4134; January 26, 2010) to provide guidance on this issue. If an operator suffers an unexplained loss of product, the operator should shut down the affected pipeline until the problem is resolved. Operators should additionally assess the performance of their leak detection system following a product release and identify and implement improvements as appropriate.
Pipeline owners and operators are also reminded to evaluate their control room personnel scheduling policies and practices against the guidance of ADB 05-06, Countermeasures to Prevent Human Fatigue in the Control Room (70 FR 46917; August 11, 2005).
Public Awareness Programs
PHMSA advises operators to analyze and evaluate the effectiveness of their public awareness programs and whether local emergency response agencies are prepared to identify and respond to early indications of a rupture. Strong public awareness and education programs can help shorten incident response times and improve overall incident response.
Pipeline owners and operators should perform periodic self- assessments of their public awareness programs against their written public awareness program plans and API Recommended Practice 1162. PHMSA previously issued guidance for these self-assessments under ADB 03-04, Pipeline Industry Implementation of Effective Public Awareness Programs (68 FR 52816; September 5, 2003) and ADB 03-08, Self- Assessment of Pipeline Operator Public Education Programs (68 FR 66155; November 25, 2003). Further, operators are encouraged to review their procedures for communicating during emergency situations to ensure compliance with the guidance previously issued in ADB 10-08, Emergency Preparedness Communications (75 FR 67807; November 3, 2010) and ADB 12-09, Communication During Emergency Situations (77 FR 61826; October 11, 2012).
Proactive Self-Assessment
PHMSA strongly encourages operators to review past and future NTSB recommendations that the NTSB provides to pipeline operators following incident investigations. Operators should proactively implement improvements to their pipeline safety programs based on these observations and recommendations so that the entire industry can benefit from the mistakes of one operator.
Authority: 49 U.S.C. chapter 601: 49 CFR 1.53.
Issued in Washington, DC on April 30, 2014.
Jeffrey D. Wiese,
Associate Administrator for Pipeline Safety.
[FR Doc. 2014-10248 Filed 5-5-14; 8:45 am]
BILLING CODE 4910-60-P