Colonial Pipeline Company Petroleum Product Leak

What HappenedOn September 21, 2015, at 12:03 p.m., an employee of Bonefish Grill in Centreville, Virginia, called the Fairfax County 911 Center to report a gasoline odor. The Fairfax County Fire and Rescue Department (FCFRD) immediately dispatched units to the restaurant in the Centre Ridge Marketplace shopping center. After arriving at the scene, firefighters confirmed everyone had left the restaurant; they established an incident command center, and they began the investigation. They did not detect the presence of flammable vapor inside Bonefish Grill and ruled out a natural gas leak; however, they noted a gasoline odor coming from the storm drains at the shopping center. Firefighters detected the presence of flammable vapor in most of the storm drains behind Bonefish Grill and Chipotle. Flammable vapor in some storm drains in front of Bonefish Grill was as high as 100 percent of the lower explosive limit (LEL); however, no liquid was visible in the storm drains. After establishing that the gasoline did not come from the gas station that was located about 400 feet west of Bonefish Grill and that gasoline was not illegally dumped into a storm drain, firefighters considered that the odor could be coming from a leak in a nearby, buried Colonial Pipeline Company pipeline. Colonial confirmed the pipeline leak 2 days later.#

What We FoundWe determined that the probable cause of the release of gasoline and other refined petroleum liquids from the Colonial pipeline was a through-wall corrosion fatigue crack that developed at a dent in the pipeline due to residual and operational stress and exposure to the underground environment. Contributing to the accident were vague Pipeline and Hazardous Materials Safety Administration regulations that allowed the dent to remain in the pipeline. Also, contributing to the delay in recognizing the release were the limitations of pipeline Supervisory Control and Data Acquisition systems to detect small pipeline leaks.#

What We RecommendedWe made recommendations to the Pipeline and Hazardous Materials Safety Administration, the Colonial Pipeline Company, and the Association of Oil Pipe Lines and the American Petroleum Institute.#

PAB-17-01, page 1Official PDFNational Transportation Safety Board Pipeline Accident Brief Colonial Pipeline Company Petroleum Product Leak Centreville, Virginia The Accident On September 21, 2015, at 12:03 p.m., an employee of Bonefish Grill in Centreville, Virginia, called the Fairfax County 911 Center to report a gasoline odor. 1 The Fairfax County Fire and Rescue Department (FCFRD) immediately dispatched units to the restaurant in the Centre Ridge Marketplace shopping center. (See figure 1.) After arriving at the scene, firefighters confirmed everyone had left the restaurant; they established an incident command center, and they began the investigation. They did not detect the presence of flammable vapor inside Bonefish Grill and ruled out a natural gas leak; however, they noted a gasoline odor coming from the storm drains at the shopping center. Firefighters detected the presence of flammable vapor in most of the storm drains behind Bonefish Grill and Chipotle. Flammable vapor in some storm drains in front of Bonefish Grill was as high as 100 percent of the lower explosive limit (LEL); however, no liquid was visible in the storm drains.2 After establishing that the gasoline did not come from the gas station that was located about 400 feet west of Bonefish Grill and that gasoline was not illegally dumped into a storm drain, firefighters considered that the odor could be coming from a leak in a nearby, buried Colonial Pipeline Company pipeline. Colonial confirmed the pipeline leak 2 days later. 1 All times in this document are eastern daylight time. 2 LEL refers to the lowest concentration of gas in the air that is capable of igniting. For natural gas, the LEL is about 5 percent; 100 percent of the LEL means that the vapor concentration in the air is 5 percent. For gasoline, the LEL is about 1.4 percent. 56301 NTSB/PAB-17/01#

PAB-17-01, page 2Colonial Pipeline Company Petroleum Product Leak Figure 1. Aerial view of the accident site; dotted lines show the locations of Colonial pipelines. Locating Leak and Initial Response About 1:37 p.m., the Fairfax County fire marshal’s office asked Colonial—which operates underground 36- and 32-inch-diameter pipelines (lines 3 and 4, respectively) that transport gasoline and other refined petroleum liquids—to determine if the company’s pipelines could be the source of the gasoline odor. Two Colonial right-of-way inspectors contacted the Colonial Control Center to determine if there were abnormalities in the pressures in lines 3 and 4. The Control Center told them the line pressures were normal. The inspectors examined the Colonial right-of-way and told the fire department incident commander there was no evidence of a leak—including an odor, dead vegetation, or gasoline on any pavement or in nearby water retention ponds; the inspectors left the area about 3:30 p.m. With the source of the odor still unknown, the FCFRD hazardous materials (hazmat) team continued checking the storm drain system and reviewed the storm drain drawings provided by the Fairfax County Department of Public Works to locate the outflow points. After discovering the outflow culvert near Sweetwater Tavern was blocked, the hazmat team cleared the vegetation and debris from the outlet of a 60-inch-diameter storm drain that ran under Bonefish Grill’s front parking lot. Almost immediately, the collection weir (barrier) filled with water covered with a black petroleum product. The hazmat team assigned the name “recovery site 1” to the location and began pumping the black petroleum product into a 95-gallon, poly-overpack drum with a small portable pump. The crew also placed absorbent pillows and containment booms around the weir2#

PAB-17-01, page 3Colonial Pipeline Company Petroleum Product Leak to contain the liquid. A fire marshal investigator then notified Colonial that the hazmat team had discovered some unknown petroleum product in the storm drain. Within about 5 hours of the initial odor complaint, the hazmat unit had collected about 90 gallons of product (a combination of liquid hydrocarbon and water). Because some product remained in the storm drain, the Fairfax County fire marshal’s office requested assistance from a hazmat contractor to continue the cleanup operation. The contractor dispatched a vacuum truck crew to the scene and continued to collect product along with water from the rain that began to fall shortly after they discovered the spill. At that point, the FCFRD believed the gasoline was likely from an illegal dumping operation, and the incident was contained. By 7:30 p.m., the cleanup crews had collected more than 3,000 gallons of water-petroleum product mixture in the vacuum truck. Crews also deployed absorbent booms and collected a similar mixture in a vacuum truck at the storm water retention pond northwest of Sweetwater Tavern. Because spill estimates continued to increase during that evening, investigators had to reconsider their conclusion that the source was illegal dumping; they again suspected there was an active leak. The fire marshal’s office contacted the Colonial Control Center at 8:53 p.m. and requested assistance. After discussing the situation with the right-of-way inspector, the Colonial controller started shutting down lines 3 and 4 as a precaution and dispatched inspectors to the site. Colonial shut down the line 3 and 4 pumps and the main-line block valves at the Chantilly and Remington stations in Virginia by 9:17 p.m. (See figure 2.) Colonial inspectors arrived about 10:00 p.m. About 2 1/2 hours later, Colonial’s lead operator contacted the company’s district environmental coordinator and the director of northeast operations to report he still did not know if the Colonial pipeline might be the source of the product in the storm water drain system. Over the next 3 hours, Colonial engineers analyzed computer operating data, but they were unable to determine whether either pipeline might be leaking. Colonial crews at the scene conducted bar hole testing in the pipeline right-of-way to try to identify a leak location; however, the rocky soil made it difficult to insert the probes deep enough to obtain meaningful data. Colonial crews also continued working with responders to determine where the product might be entering the storm water system. 3#

PAB-17-01, page 4Colonial Pipeline Company Petroleum Product Leak Figure 2. Valves for lines 3 and 4 (clouded areas) used to isolate leak on line 4 (identified by arrow). On September 22, 2015, about 1:00 a.m., Colonial initiated a district-level response to address a potential leak; they elevated it to a companywide response about 8 1/2 hours later. About 10:00 a.m., Colonial performed a static pressure analysis between two block valves of lines 3 and 4 to determine whether a leak existed. The analysis suggested a possible leak in line 3 but not in line 4.3 Just before noon, Colonial employees and contract personnel arrived and began marking dig locations along the right-of-way to search for product and the leak location. Colonial then began excavating at possible leak locations around lines 3 and 4 on the south side of Route 28 and south of New Braddock Road, which the Colonial Integrity Management senior engineer identified and prioritized using information about appurtenances, prior repairs, and recent inline inspections. The company selected and excavated six dig sites throughout the afternoon. About 7:00 p.m., excavation began above a dent in line 4 that had been documented in an inline inspection. Product-contaminated soil was exposed near the centerline of the buried pipe. Further excavation continued throughout the night until the entire pipe diameter was exposed. This allowed access to the existing dent at the 6 o’clock position where, the following morning, the workers discovered a crack in the pipe and saw product dripping and accumulating in the trench. (See figure 3.) 3 Valve leakage and changes in temperature can result in false indications when using this leak detection technique. 4#

PAB-17-01, page 5Colonial Pipeline Company Petroleum Product Leak Figure 3. Leak discovered at the bottom of line 4 (arrow points to leak). Colonial captured and removed the product and installed a sleeve around the pipe to stop the leak. (See figure 4.) The company prepared a restart plan and submitted it to the Pipeline and Hazardous Materials Safety Administration (PHMSA) for approval. Following satisfactory installation of a repair sleeve on September 25, 2015, PHMSA approved the temporary restart for line 4, which included a 20 percent reduction in operating pressure. 5#

PAB-17-01, page 6Colonial Pipeline Company Petroleum Product Leak Figure 4. Two NTSB investigators examine red repair sleeve on line 4. The line 4 leak occurred in a high consequence area. 4 No fatalities or injuries resulted from this accident. Colonial estimated that 4,000 gallons of product were released from the pipe. Colonial estimated the cost of accident-related expenses at $16.5 million, including initial emergency response, environmental cleanup and remediation, pipe replacement, and inline inspection. Colonial Pipeline Company Colonial is an interstate pipeline company that delivers refined petroleum products (gasoline, kerosene, home heating oil, and jet fuel) to cities, airports, and military bases throughout the southeastern, mid-Atlantic, and northeastern regions of the United States. The Colonial pipeline system begins in Houston, Texas, and ends in Linden, New Jersey. It crosses 13 states, 4 A high consequence area is defined in 49 Code of Federal Regulations [CFR] 195.450 as (1) a commercially navigable waterway, which means a waterway where a substantial likelihood of commercial navigation exists; (2) a high population area, which means an urbanized area, as defined and delineated by the Census Bureau, that contains 50,000 or more people and has a population density of at least 1,000 people per square mile; (3) an other populated area, which means a place, as defined and delineated by the Census Bureau, that contains a concentrated population, such as an incorporated or unincorporated city, town, village, or other designated residential or commercial area; or (4) an unusually sensitive area as defined in §195.6. 6#

PAB-17-01, page 7Colonial Pipeline Company Petroleum Product Leak spans more than 5,500 miles, and connects 29 refineries on the US Gulf Coast to 270 marketing terminals. The Colonial pipeline system consists of four, large-diameter (30 inches or more) main transmission pipelines and numerous small-diameter pipelines (stub lines) that serve local markets. All four main lines (lines 1–4) and most stub lines are continuously monitored and controlled using a Supervisory Control and Data Acquisition (SCADA) system in the Alpharetta, Georgia, control center. Some of the stub lines and delivery lines are controlled locally. The pipeline system is divided into three operational districts: northeast, southeast, and Gulf Coast. Lines 1 and 2 run from Houston, Texas, to Greensboro, North Carolina. Line 3 runs from Greensboro to Linden; line 4 runs from Greensboro to Dorsey, Maryland. Lines 3 and 4 transport gasoline, kerosene, and fuel oil and are in the same right-of-way at the leak location. The maximum operating pressure for line 3 ranges from 663 to 695 pounds per square inch, gauge; the maximum operating pressure for line 4 ranges from 657 to 682 pounds per square inch, gauge. 5 The pipe for line 4 has a 32-inch nominal pipe diameter with a 0.281-inch-thick wall and double submerged arc-welded longitudinal seam; the pipe is coated with asphalt enamel. It is 288 miles long and began operating in 1964. The depth of cover on line 4 in the vicinity of the leak was between 5 1/2 and 6 1/2 feet. Corrosion protection for the pipeline in the area of the leak was provided by an impressed current cathodic protection system. Field Investigation Colonial was not aware of a possible leak in either line 3 or line 4 until the fire department notified the company on September 21, 2015, that firefighters were responding to an odor complaint in the vicinity of the pipeline right-of-way. Control room operators closely examined the SCADA operating records for the two pipelines, but they were unable to identify evidence of a possible leak. Additionally, Colonial inspectors did not see soil discoloration, distinct areas of dead vegetation, or a colorful sheen on water, nor did they detect an odor of petroleum products in the pipeline right-of-way that would confirm a leak. But after the fire department personnel discovered product in a storm water retention pond located hundreds of feet from the pipeline right-of-way, Colonial investigated further. On September 21, 2015, about 9:00 p.m., the company shut down both pipelines as a precaution and dispatched field inspectors to Centreville to again search for the source of the odor. As a part of the investigation, Colonial excavated down to the buried pipes at numerous locations along the right-of-way until—almost 2 days after the first odor report—they discovered the line 4 leak from a crack at a previously documented dent. 5 Colonial officials said the company does not set a single maximum operating pressure for the entire line because pressures in their refined petroleum pipeline can fluctuate due to temperature, surges, transient conditions, flow rates, and the type of batch being delivered. 7#

PAB-17-01, page 8Colonial Pipeline Company Petroleum Product Leak As an added precaution, Colonial excavated around line 4 at a second previously documented dent location that was 70 feet upstream from the leak location. The pipe coating was intact, and magnetic particle inspection showed no evidence of cracks in the dent. A few weeks after the temporary sleeve was installed at the leak location, the two dented pipe sections were removed. Colonial installed new pipe and returned the pipeline to service as permitted by the PHMSA Corrective Action Order (CPF No. 1-2015-5018H), which was issued on September 29, 2015, and amended on October 22, 2015. Two 4-foot-long pipe segments containing dents were shipped to the NTSB materials laboratory for further evaluation. In the pipe section containing the leak, a through-wall crack is visible on both the outside surface and the inside surface in the area of the dent. (See figures 5 and 6.) Figure 5. Magnetic particle inspection shows multiple longitudinal cracks on pipe outer wall (inside oval). 8#

PAB-17-01, page 9Colonial Pipeline Company Petroleum Product Leak Figure 6. View of the dent and crack from inside the pipe. . Inline Inspection Colonial records show that line 4 was excavated and examined around the two dents, the one that resulted in the 2015 leak and the other about 70 feet upstream, in 1994 and 2002 respectively. Magnetic particle inspection of the dents during the earlier excavations did not identify any cracks. Because the dents did not exceed the limits that would have required repairs, Colonial removed any large rocks that might have caused the dents, repaired the pipeline coating, and backfilled the excavations. Inline inspections conducted by Colonial from 1998 to 2014 showed no evidence of corrosion or cracking on line 4 along the Centreville right-of-way near the leak. The month following the accident, Colonial conducted an inline inspection using an ultrasonic crack-detection tool before cutting out the dented and cracked segment. This inspection detected the crack in the dent. Pipe Coating Examination Compromised coatings could expose the pipe to underground water, which could corrode these unprotected areas of the pipeline due to shielding from the cathodic protection current even when the overall cathodic protection potentials are adequate.6 NTSB investigators observed 6 The loss of the bond (adhesion) between a pipeline and its protective coating is commonly called disbondment. This could allow moisture to penetrate the gap between the surface of the pipe and the coating, creating an environment that may be corrosive. Under some circumstances, the pipeline’s cathodic protection current is prevented from reaching the exposed pipe surface under the disbonded coating (a phenomenon known as shielding); corrosion can occur on this unprotected pipe surface. 9#

PAB-17-01, page 10Colonial Pipeline Company Petroleum Product Leak disbonded coating in the dented area of the leak, but they could not determine if the extent of the coating damage occurred before the leak or as a result of the leaking product. Environmental Impact Colonial estimated that 4,000 gallons of hydrocarbon product were released in this accident. 7 Cleanup crews used a vacuum truck to recover about 1,285 gallons of light non-aqueous phase liquid (LNAPL) product from the storm water outfall, and about 700 more gallons of LNAPL products were recovered in the week after the release. 8 Cleanup crews excavated contaminated soil containing an estimated 350 additional gallons of product. An environmental contractor installed dual-phase extraction systems in the excavated areas along the storm water drain system. An analysis of groundwater samples collected from various shallow monitoring points indicated that the extraction systems were reducing hydrocarbon contamination along the storm drain system. Colonial Pipeline Emergency Response The Colonial Emergency Response Plan requires an investigation of all reports of a product odor. Accordingly, on September 21, 2015, about 2:00 p.m., two Colonial inspectors responded to the report that the fire marshal’s office was investigating a gasoline odor near the pipeline right-of-way. The inspectors examined the right-of-way and found no soil discoloration, distinct areas of dead vegetation, colorful sheen on water, or odor of petroleum products. In addition, the Colonial Control Center told the inspectors that the pressures in lines 3 and 4 were normal, so the inspectors concluded that lines 3 and 4 were not leaking. They did not use any flammable-gas detection equipment during their inspections. The inspectors performed limited bar hole testing because the dry, hard soil and rock prevented them from effectively probing down to the buried pipelines. On September 21, 2015, Colonial received a second request for assistance at 8:53 p.m. after the fire marshal investigator reported that refined petroleum product was found in a nearby storm water retention pond. At 9:09 p.m., Colonial sent inspectors again, and this time Colonial shut down lines 3 and 4 as a precaution. About 10:00 p.m., two Colonial inspectors, a lead operator, and a senior operator arrived at the incident scene to assist the FCFRD. Colonial inspectors continued to inspect the pipeline right-of-way and attempted additional bar hole testing. They did not see or smell any product on their probe bars, but they continued to have difficultly probing deep enough to get close to the buried pipelines because of the rocky soil. The technicians did not use flammable vapor detectors to search for evidence of a hydrocarbon liquid leak in the bar holes; Colonial procedures did not require it. However, the FCFRD battalion chief showed the Colonial lead operator the drum containing the hydrocarbon product that had been collected earlier in the day from recovery site 1. The lead operator then notified Colonial management that product had been discovered. 7 The leaking pipeline transported several liquids. Although most of the product released was likely gasoline, other liquids transported through the pipeline might have escaped through the crack. 8 LNAPL is a liquid petroleum product that contains almost no water. 10#

PAB-17-01, page 11Colonial Pipeline Company Petroleum Product Leak Colonial activated the Northeast District Response Team on September 22, 2015, about 1:00 a.m. Colonial staff in the Alpharetta control center reviewed alignment sheets, inline inspection data, static pressure analysis, and SCADA data to determine possible leak locations. A dig plan and priorities were being developed as Colonial response resources were arriving at the accident site that morning. This included the hazardous liquids cleanup contractor that took over cleanup efforts at the weir wall—a barrier at the storm water outfall pond (recovery site 1). Colonial employees told NTSB investigators that the company would not positively confirm its pipeline was the source of a hydrocarbon product leak until they could see liquid escaping from one of the two transmission pipelines. On September 23, 2015, at 9:30 a.m., Colonial employees saw liquid dripping from line 4, nearly 24 hours after the companywide response team was activated and about 2 days after the initial odor report. Colonial then assumed responsibility for the spill and began aggressive clean-up activities. Liquid Pipeline Small Leak Detection Colonial informed the NTSB that four additional pipeline leaks had occurred in their pipeline system that were undetectable on the SCADA system. One leak occurred about 5 months before the Centerville accident, and the other three occurred in less than 6 months after the Centerville accident. These leaks were discovered by the landowner, aerial patrol contractors, or inspectors. On April 2, 2016, TransCanada reported a similar liquid pipeline failure involving a small leak near Freeman, South Dakota, that went undetected on its SCADA system. Detecting small leaks in large hazardous liquid pipelines in a reliable, timely, and cost-effective manner has been a challenge for hazardous liquid pipeline operators and regulators.9 The PHMSA party representative on the Centreville accident investigation said: PHMSA is not aware of widely used industry technologies to detect small leaks similar to the one that occurred on Colonial’s line 4 in Centreville. However, PHMSA is taking a number of approaches through rulemaking, R&D [research and development], and taking part in standard development related to enhancing leak detection on hazardous liquid and natural gas pipelines. He further stated that he was not aware of any automated systems that are capable of detecting small leaks in large diameter, long-distance pipelines. Typically, SCADA systems use computer programs to calculate losses based on mismatches in liquid transfer quantities between process equipment. Considering all the process variables, typically, the SCADA system is not capable of accurately detecting actual leak rates below about 2 percent of the flow volume in a liquid pipeline. 9 Hazardous Liquid Leak Detection Techniques and Processes, Report No. DTRS56-02-D-70037-01, Dr. Jim C. P. Liou, PE; Robert J. Hall, PE; Mona C. McMahon, PE; General Physics Corporation—Elkridge, Maryland, 21075; Prepared for US Department of Transportation, Washington, DC; April 2003.11#

PAB-17-01, page 12Colonial Pipeline Company Petroleum Product Leak Colonial told the NTSB that the average flow volume in line 4 is about 15.6 million gallons per day, or about 10,800 gallons per minute. Considering a 2 percent detection limit, the smallest leak that the SCADA system could detect is about 216 gallons per minute. Assuming the recovered liquid volume is doubled to 8,000 gallons to account for unrecoverable product and a leak duration of 2 weeks based on when witnesses said they first smelled gasoline, the estimated leak rate would be 571 gallons per day, or 0.4 gallons per minute. This estimated leak rate, based on our outlined assumptions, represents only 0.004 percent of the average flow, which is about 550 times lower than the SCADA leak detection performance limit. Technology and computer models are available to detect small hydrocarbon leaks. In 2015, the Environmental Protection Agency published new standards for underground storage tanks to help prevent and detect leaks. The new regulation requires facilities (such as gas stations and airport fuel supply systems) to have leak detection systems capable of detecting small leaks.10 PHMSA has conducted research on leak detection methods that can be practically applied to hazardous liquid transmission pipelines. In 2012, PHMSA completed a study of leak detection systems that was required by the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011. 11 The same year, PHMSA held a pipeline research forum to identify technological gaps and issues, including the advancement of leak detection methodologies. In April 2016, PHMSA published a notice of proposed rulemaking on leak detection that considered these studies and other available research. 12 Until the technology is improved so that these small-flow-rate leaks in a long transmission pipeline can be detected in a cost-effective manner, the liquid pipeline industry will continue to rely on visual observation as evidence of a leak. By the time a small leak is detected in a buried pipeline, days or months may have passed since the leak began, resulting in the likelihood of significant environmental damage as occurred in the September 2013 crude oil pipeline leak in Tioga, North Dakota.13 Alternatively, leak detection devices could be installed along a pipeline at specific locations where inline inspection data confirm the pipe has been damaged, such as at a dent.14 The leak detection device could provide an early warning that a through-wall crack or corrosion damage in the pipeline has begun to leak. The operator could then take immediate corrective action to repair the damaged pipe before a large, environmentally damaging spill results. Therefore, the NTSB recommends that Colonial Pipeline Company revise the dent excavation evaluation procedure to require either (a) the repair of all excavated dent defects, or (b) the installation of a local leak 10 Title 40 CFR 280.41, Requirements for Petroleum UST Systems. 11 US Department of Transportation, Leak Detection Study – DTPH56-11-D -000001, Final Report no. 12-173 , Decem ber 10, 2012. 12 Safety of Gas Transmission and Gathering Pipelines Notice of Proposed Rulemaking (NPRM), Volume 81, No. 68, Federal Register, 20722, April 8, 2016. 13 A farmer discovered oil in his 7.3-ac re wheat field. Investigators found that a 6-inch nominal pipe diameter crude oil pipeline leak had released more than 20,000 barrels of oil. State health officials estimated the cleanup could take up to 4 years, http://fuelfix.com/blog/2015/05/25/cleanup-of-oil-spill-at-nd-farm-to-take-2-more -ye ars/ (accessed August 2016). 14 US Department of Transportation, Leak Detection Study – DTPH56-11-D -000001, Final Report no. 12-173 , Decem ber 10, 2012. 12#

PAB-17-01, page 13Colonial Pipeline Company Petroleum Product Leak detection system at each location where a dent is not repaired, continuous monitoring for hydrocarbons, and prompt corrective action to stop a detected leak. Laboratory Investigation Pipe Material Testing Testing at a third-party laboratory revealed that the chemical composition and mechanical properties were consistent with the original specifications (American Pipeline Institute 5L X52 steel) when the pipeline was installed.15 Crack Examination The outside surfaces of both dents, one that contained the leak and another that was located 70 feet upstream from the leak location, were examined using the magnetic particle inspection. For the pipe segment with the upstream dent that was removed as a precaution, no crack defects were identified in the dent or around its perimeter. Magnetic particle inspection of the dent in the downstream pipe segment that contained the leak revealed a network of short longitudinal crack indications within the dent parallel to the main crack. No crack indications were observed around the perimeter of the dent. The dent containing the crack was cut from the pipe segment for further evaluation. After removal, the main crack was opened to expose the fracture surfaces. Laboratory examination of the pipe fracture surfaces revealed the crack was 5.97 inches long at the outside diameter and 4.52 inches long on the inside diameter. The pipe thickness adjacent to the crack was between 0.266 and 0.270 inches; the nominal pipe wall thickness was 0.281 inches. The fracture faces exhibited features consistent with corrosion fatigue crack propagation, including ratchet marks, crack arrest marks, and intergranular facets. These features are consistent with inward crack propagation from multiple crack initiation sites on the outside of the pipe.16 (See figure 7.) 15 API Specification 5L, Specification for Line Pipe, 41st edition. American Petroleum Institute, Washington, DC, (1995). 16 Corrosion fatigue is the process in which metal fractures prematurely under the conditions of simultaneous corrosion and repeated cyclic loading at either lower stress levels or fewer cycles than would be required in the absence of the corrosive environment. Ratchet marks are the lines or the markings on a fatigue fracture surface that result from the intersection and connection of separate fatigue cracks propagating from multiple origins. Ratchet marks are parallel to the overall direction of crack propagation and are visible to either the unaided eye or at low magnification. Crack arrest marks are macroscopic progression marks on a fatigue fracture or a stress-corrosion cracking surface that indicate successive positions of the advancing crack front, typically appearing as either irregular elliptical or semielliptical rings, radiating outward from one or more origins. Crack arrest marks are also known as "beach marks." These marks are usually found on service fractures where the part is: (1) loaded randomly, (2) loaded intermittently, or (3) subjected to periodic variations in either the mean stress or the alternating stress. Intergranular facets are fracture features showing separated microscopic grains. These facets are also called "rock-candy," and these features are indicative of intergranular fracture in a polycrystalline metals or alloys. 13#

PAB-17-01, page 14Colonial Pipeline Company Petroleum Product Leak Figure 7. Close-up of the fracture. Arrows show crack arrest marks, ratchet mark, and initiation sites. Cracks on the fracture surface were observed propagating from exterior surface corrosion pits. Both the pits and the fracture surfaces contained corrosion products/deposits; and the elemental analysis of the material was consistent with an iron corrosion product. These cracks showed no significant branching. (See figure 8.) 14#

PAB-17-01, page 15Colonial Pipeline Company Petroleum Product Leak Figure 8. Photomicrograph of fracture shows straight crack originating from corrosion pit (circled). An examination of the fracture surface with a scanning electron microscope revealed fatigue striations consistent with fatigue crack propagation. The fracture surfaces showed a mix of fracture features (faceted morphology and striations) that are consistent with corrosion fatigue cracks emanating from corrosion pits. Dent Evaluation The dent at the leak location was likely caused by a rock impinging on the underside of the pipeline. A detailed study of the dent showed its depth to be about 1.6 percent of the outer pipe diameter. The dent shape was documented by laser scanning and the shape data were incorporated into a finite element model to determine the stresses in the dent region. Based on the finite element model, the peak stress values after the dent was created exceeded the measured yield strength for the pipe, resulting in areas within the dent with high residual tensile stresses. These residual stresses made the pipeline more susceptible to externally initiated cracking, such as stress corrosion and corrosion fatigue. In addition, the change in geometry in the dent area created stress concentrations sufficient to enable fatigue cracking under cyclic loading conditions caused by pressure variations in the pipeline. 15#

PAB-17-01, page 16Colonial Pipeline Company Petroleum Product Leak Pipeline Dent Acceptance Criteria After the accident, the inline inspection data from before and after the accident were reviewed and compared by a consultant hired by Colonial. 17 The detailed study showed the depth of the dent at the leak location was about 1.6 percent of the outer pipe diameter and the upstream dent was 1.57 percent of the outer pipe diameter. Colonial did not repair either dent because they did not meet PHMSA’s repair criteria. PHMSA pipeline regulations do not specifically require dents having depths less than 6 percent of the pipeline diameter to be repaired unless there is an indication of metal loss, cracking, or a stress riser, or unless the dent affects pipe curvature at a girth weld or a longitudinal seam weld.18 The American Society of Mechanical Engineers (ASME) B31.4 piping design code is similar to the PHMSA requirements, including the threshold limits. 19 In addition to the Centreville accident, Colonial reported to the NTSB that pipelines in Pelham, Alabama; Felixville, Louisiana; and Simpsonville, South Carolina (Hunter Road) also developed through-wall cracks in dented pipe. The depths of these dents were less than 2 percent of the pipe outer diameter and were located away from seam and girth welds. Colonial data indicate that through-wall cracks can develop in dents shallower than the current acceptable criteria of 6 percent of the pipe diameter. The Colonial pipeline failure data indicate that PHMSA’s criteria allowing dents with depths up to 6 percent of the pipe diameter to remain in the pipe is not a conservative approach from the safety view point. The curvature of the dent may be more important than dent depth because of stress concentrations, local plasticity, and local surface corrosion effects. Degraded or damaged coating at a dent may contribute to external pipe wall corrosion. Pipeline dents caused by a rock impingement with the rock present (a constrained condition) can have a different stress magnitude and distribution than dents where the rock is later removed (unconstrained conditions), due to system constraint. Unconstrained dents have been shown to fail faster because of higher local hoop stresses.20 Furthermore, the coating material used and the quality of the installation after the removal of an impinging rock can change the dent’s susceptibility to stress corrosion cracking. 21 According to the NTSB’s finite element study of the dent at the leak location, the highest stress values were not found at the point of maximum dent depth, but in areas within the dent and near the dent edges having smaller radii of curvature due to the non-smooth nature of the dent. An experimental fatigue study (also including stress analysis through finite element modeling) was 17 L. Barkdull, M. Lewis. “Detailed Integrating ILI [Inline Inspection] Raw Data Review Corrective Action No. 6” Quest Integrity, L.L.C., Stafford, Texas. (January 20, 2016). 18 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 19 ASME B31.4-2012. “Pipeline Transportation Systems for Liquid and Slurries.” American Society of Mechanical Engineers, New York, New Y ork. (November 20, 2012). 20 S. Tiku, V. Semiga, A. Dinovitzer, G. Vignal. “Full Scale Cyclic Fatigue Testing of Dented Pipelines and Development of a Validated Dented Pipe Finite Element Model.” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012). 21 J. Bratton, T. Alexander, T. Bubenik, S. Finneran, H.O. Heggen. “An Approach for Evaluating the Integrity of Plain Dents Reported by In-Line Inspection Tools,” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012). 16#

PAB-17-01, page 17Colonial Pipeline Company Petroleum Product Leak conducted on the upstream dented pipe section by a Colonial contractor and similar observations were noted.22 PHMSA requires pipeline operators to develop a written integrity management program with pipeline integrity to be evaluated using internal inspection tool or tools capable of detecting corrosion and deformation anomalies including dents; gouges and grooves; pressure test[s]; external corrosion direct assessment; and other technology that the operator demonstrates can provide an equivalent understanding of the condition of the line pipe. 23 The rule also requires pipeline operators to “prioritize anomalies … for evaluation and repair,” requiring pipeline repair in immediate, 60-day, or 180-day timeframes. Pipelines must be assessed every 5 years, although the operator can delay a single assessment up to 8 months beyond the 5-year deadline. 24 The regulations allow exceptions to the 5-year assessment interval under limited circumstances. 25 In addition to the current requirements, pipeline integrity management programs should incorporate all the effects of dents and anomalies when developing risk management strategies, even if those dents and anomalies are below the PHMSA thresholds for repair or replacement. As stated in the Postaccident Actions section later in this report, Colonial has already incorporated these factors into its integrity management program. The factors that impact effects of dents and anomalies include shape, curvature, and depth. In addition, local variations in the steel, coating type, coating adhesion, soil type, seasonal soil conditions, and impingement constraint may be important factors in the failure at or near dents. Therefore, the NTSB recommends that PHMSA work with pipeline trade and standards organizations to modify the pipeline dent acceptance criteria to account for all the factors that lead to pipe failures caused by dents, and promulgate regulations to require the new criteria be incorporated into integrity management programs. Most of the effort associated with evaluating a dent and returning the pipeline to service with or without a repair arises from the excavation work required to expose and examine the buried pipe. The various accepted dent repair methods allowed by the PHMSA pipeline regulations (such as installing a full encirclement sleeve) provide a permanent repair. Because myriad factors are involved in determining if and when an existing dent will develop a through-wall leak, the NTSB believes a more prudent approach is to proceed with a dent repair whenever a dented pipe is excavated. Therefore, the NTSB recommends that PHMSA require operators to either (a) repair all excavated dent defects, or (b) install a local leak detection system at each location where a dent is not repaired, continuously monitor for hydrocarbons, and promptly take corrective action to stop a detected leak. The NTSB also recommends that the Association of Oil Pipe Lines and the 22 S. Tiku, V. Semiga, A. Dinovitzer, G. Vignal. “Full Scale Cyclic Fatigue Testing of Dented Pipelines and Development of a Validated Dented Pipe Finite Element Model.” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012). 23 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 24 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 25 49 CFR 195.452(j)(4) sets requirements for variance from the 5-year intervals in limited situations.17#

PAB-17-01, page 18Colonial Pipeline Company Petroleum Product Leak American Petroleum Institute communicate to their members the findings of this report on the susceptibility of dents to cracking even when the dent is acceptable under current criteria. Postaccident Actions After the accident, Colonial developed a new abnormal operating procedure to improve the process and provide general guidance to all qualified personnel who perform aboveground inspections of facilities and rights-of-way for suspected pipeline leaks and inspections conducted after natural disasters. Colonial trained more than 47 employees on this procedure—including right-of-way inspectors, senior operators, and project inspectors. Third Party Consultant Colonial hired a consultant to analyze the inline inspection data from 17 prior inline inspections on the Colonial system. The consultant’s focus was on cracks in dents, particularly integrating ultrasonic crack tool inline inspection (ILI) data with magnetic flux leakage/caliper combination ILI tool data. Also, Colonial has developed a risk-based approach and prioritization process for dent screening based on the dent size and the pipe characteristics that place an emphasis on bottom-side, rock-caused dents. This independent third-party consultant’s analysis on line 4 identified 10 dent locations—including the original two at the leak location—where verification digs were scheduled to examine the condition of the pipe. As of January 2017, Colonial has completed nine digs. Of these nine, Colonial repaired two by cutting out the damaged portions and installing new pipe. The company confirmed fatigue cracks at three of the remaining seven; they repaired all seven using a Type B steel sleeve.26 Colonial added 40 additional shallow dents to the line 4 supplemental dig list; they have excavated 30 locations. The company has not detected any cracks in the dents. Of the 30 excavations for suspected dents, Colonial repaired 29 dents with a Type B steel sleeve; the company recoated at one location because there was no dent or indication of cracks. Colonial also revised its dent repair criteria, redefined what constitutes an actionable anomaly, and issued an Asset Integrity Directive to project personnel to implement the new repair methodology change. The directive also addresses requirements for the control center personnel to plan for additional repair time and for pipeline availability schedule updates. Colonial incorporated these changes into a revised Pipeline Maintenance Manual and provided training to the Colonial Projects Group, which is responsible for managing and inspecting the Colonial dent repair program. Probable Cause The National Transportation Safety Board determines that the probable cause of the release of gasoline and other refined petroleum liquids from the Colonial pipeline was a through-wall 26 In accordance with ASME B31.4, a Type B sleeve consists of two half-pipe sections of steel that are placed around, and welded to, the exterior wall of a pipeline to provide a full encirclement, pressure-containing repair. 18#

PAB-17-01, page 19Colonial Pipeline Company Petroleum Product Leak corrosion fatigue crack that developed at a dent in the pipeline due to residual and operational stress and exposure to the underground environment. Contributing to the accident were vague Pipeline and Hazardous Materials Safety Administration regulations that allowed the dent to remain in the pipeline. Also, contributing to the delay in recognizing the release were the limitations of pipeline Supervisory Control and Data Acquisition systems to detect small pipeline leaks. Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration Work with pipeline trade and standards organizations to modify the pipeline dent acceptance criteria to account for all the factors that lead to pipe failures caused by dents, and promulgate regulations to require the new criteria be incorporated into integrity management programs. (P-17-1) Require operators to either (a) repair all excavated dent defects, or (b) install a local leak detection system at each location where a dent is not repaired, continuously monitor for hydrocarbons, and promptly take corrective action to stop a detected leak. (P-17-2) To Colonial Pipeline Company: Revise the dent excavation evaluation procedure to require either (a) the repair of all excavated dent defects, or (b) the installation of a local leak detection system at each location where a dent is not repaired, continuous monitoring for hydrocarbons, and prompt corrective action to stop a detected leak. (P-17-3) To the Association of Oil Pipe Lines and the American Petroleum Institute: Communicate to your members the findings of this report on the susceptibility of dents to fatigue cracking even when the dent is acceptable under current criteria. (P-17-4) For more details about this accident, visit the NTSB investigations page, and search for NTSB accident identification number DCA15MP002. Adopted: June 5, 2017 19#

PAB-17-01, page 20Colonial Pipeline Company Petroleum Product Leak The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a pipeline accident in which there is a fatality, substantial property damage, or significant injury to the environment. (49 US Code § 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 USC 1154(b). 20#