Enbridge Inc. Natural Gas Transmission Pipeline Rupture and Fire

What HappenedOn August 1, 2019, at 1:23 a.m. local time, an Enbridge Inc. 30-inch natural gas transmission pipeline ruptured in Danville, Kentucky, releasing about 101.5 million cubic feet of natural gas that ignited. The accident resulted in 1 fatality, 6 injuries, and the evacuation of over 75 people. Five residences were destroyed by resulting structure fires, and an additional 14 were damaged. A nearby railroad track was also damaged, and over 30 acres of land were burned. At 1:26 a.m., numerous local emergency response agencies were dispatched to the accident; the Lincoln County Fire Protection District was the first to arrive at 1:37 a.m. The fire department and other emergency responders focused on evacuations and medical transport while Enbridge crews worked to isolate and shut down the pipeline. At 2:19 a.m., the ruptured pipeline segment was isolated. By 4:13 a.m., all fire suppression activities had concluded.#

What We FoundThe probable cause of the August 1, 2019, Enbridge Inc. pipeline rupture and resulting fire was the combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project, which resulted in hydrogen induced cracking at the outer surface of Line 15 and the subsequent failure of the pipeline. Contributing to the accident was the 2014 gas flow reversal project that increased external corrosion and hydrogen evolution. Also contributing to this accident was Enbridge’s integrity management program, which did not accurately assess the integrity of the pipeline or estimate the risk from interacting threats.#

PIR-22-02, page 1Official PDFIssued: August 15, 2022 Pipeline Investigation Report: NTSB/PIR-22/02 Enbridge Inc. Natural Gas Transmission Pipeline Rupture and Fire Danville, Kentucky August 1, 2019 Abstract: This report discusses the August 1, 2019, rupture of an Enbridge Inc. 30-inch natural gas transmission pipeline in Danville, Kentucky, which released about 101.5 million cubic feet of natural gas that ignited. The accident resulted in 1 fatality, 6 injuries, and the evacuation of over 75 people, as well as property damage in the surrounding area. Safety issues identified in this report include nonconservative assumptions used to calculate the potential impact radius, incomplete evaluation of the risks caused by a change of gas flow direction, limitations in data analysis related to in-line inspection tool usage, incomplete assessment of threats and threat interactions, and missed opportunities in training and requalification practices. Three recommendations are made to Enbridge Inc., and three recommendations are made to the Pipeline and Hazardous Materials Safety Administration.#

PIR-22-02, page 2Pipeline Investigation Report NTSB/PIR-22/02 Contents Figures ................................................................................................................. iv Tables .................................................................................................................... v Abbreviations and Acronyms ............................................................................... vi Executive Summary ..............................................................................................vii What Happened.............................................................................................................. vii What We Found .............................................................................................................. vii What We Recommended ............................................................................................. viii 1. Factual Information .......................................................................................... 1 1.1 Accident Description ............................................................................................... 1 1.2 Emergency Response .............................................................................................. 2 1.2.1 Enbridge Response ...................................................................................... 2 1.2.2 Local Emergency Response ........................................................................ 3 1.3 Injuries and Damages from the Gas Fire ............................................................... 4 1.4 Enbridge Natural Gas Systems and Pipeline Specifications ............................... 5 1.4.1 Texas Eastern Transmission, LP, Line 15 .................................................... 5 1.4.2 Danville Compressor Station ...................................................................... 7 1.4.3 Gas Control Center....................................................................................... 7 1.5 Postaccident Pipeline Examination and Testing .................................................. 8 1.5.1 On-Site Visual Examinations ........................................................................ 8 1.5.2 Microscope Examination of the Fracture Origin .................................... 10 1.5.3 Microhardness Testing ............................................................................... 11 1.5.4 Microstructure ............................................................................................. 12 1.5.5 Other Examinations .................................................................................... 12 i#

PIR-22-02, page 3Pipeline Investigation Report NTSB/PIR-22/02 1.6 Line 15 Incident History ......................................................................................... 13 1.6.1 2003 Rupture ............................................................................................... 13 1.6.2 2014 to 2017 Operational Modifications ................................................ 14 1.6.3 2019 Danville Compressor Station Emergency Shutdown ................... 15 1.7 Enbridge Procedures, Operations, and Maintenance ...................................... 16 1.7.1 Company Background ............................................................................... 16 1.7.2 Emergency Response Plan ........................................................................ 17 1.7.3 Cathodic Protection ................................................................................... 18 1.8 Integrity Management ........................................................................................... 21 1.8.1 High Consequence Area Identification ................................................... 23 1.8.2 Threat Identification and Interaction ........................................................ 24 1.8.3 Risk Assessment .......................................................................................... 26 1.8.4 Integrity Assessment .................................................................................. 26 1.8.5 Hard Spot In-Line Inspection Data Analysis ............................................ 28 1.8.6 Data Validation ............................................................................................ 29 1.8.7 Response and Repair ................................................................................. 30 1.8.8 Program Performance ................................................................................ 30 1.8.9 Recent Integrity Management Program Changes .................................. 31 1.9 Postaccident Actions ............................................................................................. 32 2. Analysis .......................................................................................................... 34 2.1 Introduction ............................................................................................................ 34 2.2 The Accident ........................................................................................................... 35 2.3 Calculation of the Potential Impact Radius ......................................................... 37 2.4 Management of Gas Flow Reversal ..................................................................... 39 ii#

PIR-22-02, page 4Pipeline Investigation Report NTSB/PIR-22/02 2.5 In-Line Inspection Tool and Data Analyses ......................................................... 40 2.6 Threat Assessment and Interactions .................................................................... 42 2.7 Training and Requalification Practices ................................................................ 44 3. Conclusions .................................................................................................... 45 3.1 Findings .................................................................................................................... 45 3.2 Probable Cause ....................................................................................................... 46 4. Recommendations ......................................................................................... 47 4.1 New Recommendations ......................................................................................... 47 Appendix A: Investigation .................................................................................. 49 Appendix B: Consolidated Recommendation Information ................................ 50 References ........................................................................................................... 53 iii#

PIR-22-02, page 5Pipeline Investigation Report NTSB/PIR-22/02 Figures Figure 1. Aerial view of the Indian Camp Subdivision overlaid on Google Earth image. .................................................................................................................................................. 1 Figure 2. Process flow diagram for pipeline isolation. ...................................................... 2 Figure 3. Homes of decedent and rescued couple, rupture location, and gas flame direction. .................................................................................................................................. 5 Figure 4. Crater and ground bedding at rupture site. ....................................................... 9 Figure 5. Ejected pipeline segment. .................................................................................. 10 Figure 6. East face of the fracture origin. ........................................................................... 11 Figure 7. Map of Texas Eastern Transmission pipelines. (Courtesy Enbridge.) ........... 17 Figure 8. Map of the right of way for Lines 10, 15, and 25. ............................................. 19 Figure 9. Voltage outputs at Goodnight and Harris Creek rectifiers. ............................ 20 Figure 10. Integrity management process flow. ............................................................... 22 Figure 11. Human-occupancy buildings within the potential impact radius. (Courtesy of Enbridge.) ......................................................................................................................... 24 iv#

PIR-22-02, page 6Pipeline Investigation Report NTSB/PIR-22/02 Tables Table 1. Enbridge emergency response actions ................................................................ 3 Table 2. Local emergency response actions ....................................................................... 4 Table 3. Recent ownership history for Texas Eastern Transmission ................................. 6 Table 4. Pipeline specifications of Line 15 at the rupture origin ...................................... 7 Table 5. External metal loss anomalies identified in ILI runs........................................... 21 Table 6. Integrity assessments performed on the ruptured pipeline segment between 2003 and 2019 ...................................................................................................................... 27 v#

PIR-22-02, page 7Pipeline Investigation Report NTSB/PIR-22/02 Abbreviations and Acronyms API American Petroleum Institute CFR Co de of Federal Regulations CS compressor station DEGT Duke Energy Gas Transmission HCA high consequence area HSMFL hard spot magnetic flux leakage ILI in-line inspection IM integrity management L15 VS4 assessment segment “Line 15 Valve Section 4” LCFPD Lincoln County Fire Protection District MAOP maximum allowable operating pressure NTSB National Transportation Safety Board PHMSA Pipeline and Hazardous Materials Safety Administration PIR potential impact radius P-PIC Process Performance Improvement Consultants, LLC psig pounds per square inch, gauge SCADA Supervisory Control and Data Acquisition STD Standard TET Texas Eastern Transmission, LP vi#

PIR-22-02, page 8Pipeline Investigation Report NTSB/PIR-22/02 Executive Summary What Happened On August 1, 2019, at 1:23 a.m. local time, an Enbridge Inc. (Enbridge) 30-inch natural gas transmission pipeline ruptured in Danville, Kentucky, releasing about 101.5 million cubic feet of natural gas that ignited. The accident resulted in 1 fatality, 6 injuries, and the evacuation of over 75 people. Five residences were destroyed by resulting structure fires, and an additional 14 were damaged. A nearby railroad track was also damaged, and over 30 acres of land were burned. At 1:26 a.m., numerous local emergency response agencies were dispatched to the accident; the Lincoln County Fire Protection District was the first to arrive at 1:37 a.m. The fire department and other emergency responders focused on evacuations and medical transport while Enbridge crews worked to isolate and shut down the pipeline. At 2:19 a.m., the ruptured pipeline segment was isolated. By 4:13 a.m., all fire suppression activities had concluded. What We Found We found that the combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project resulted in hydrogen-induced cracking at the outer surface of the pipeline and its subsequent failure. We also found that the Pipeline and Hazardous Materials Safety Administration’s (PHMSA’s) equation for determining the potential impact radius of a pipeline rupture is based on assumptions that are inconsistent with findings from recent natural gas ruptures and human response data; thus, high consequence areas determined using the equation do not include the full area at risk. Enbridge and Spectra Energy Partners LP did not effectively identify, investigate or manage the impact of a 2014 gas flow reversal project for the level of hydrogen evolution, or generation, in the pipeline surface, which ultimately contributed to the failure of the pipeline. The extent of hard spots on pipelines evaluated using the hard spot magnetic flux leakage in-line inspection tool is likely unknown because of the limitations of the tool and analysis techniques found during this investigation. Further, insufficient data were available to support Enbridge’s classification of the threat of hard spots in the accident pipeline as inactive. Enbridge underestimated the risk posed by hard spots because its processes and procedures were inconsistent with PHMSA guidance and industry knowledge of hard spot threat interactions. Enbridge also missed an opportunity to address a lack of knowledge displayed by the Danville compressor station operator in an emergency shutdown earlier in vii#

PIR-22-02, page 9Pipeline Investigation Report NTSB/PIR-22/02 2019; addressing this may have reduced the delay in the operator’s response at the station on the morning of the accident. We determined that the probable cause of the August 1, 2019, Enbridge pipeline rupture and resulting fire was the combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project, which resulted in hydrogen-induced cracking at the outer surface of Line 15 and the subsequent failure of the pipeline. Contributing to the accident was the 2014 gas flow reversal project that increased external corrosion and hydrogen evolution. Also contributing to this accident was Enbridge’s integrity management program, which did not accurately assess the integrity of the pipeline or estimate the risk from interacting threats. What We Recommended As a result of this investigation, we made a recommendation to PHMSA to revise the regulations regarding potential impact radius methodology based on data from recent natural gas pipeline ruptures and human response considerations. We also recommended that PHMSA advise natural gas transmission operators on the circumstances of this accident, the need to evaluate the risks associated with flow reversal projects, the impacts of such projects on hydrogen-induced cracking, the possible data limitations associated with the use of in-line inspection tools and analysis used in hard spot management programs, and the need to follow industry best practices when conducting in-line inspection data analysis. We made recommendations to Enbridge to evaluate the effectiveness of its corrosion control equipment and infrastructure following a major change in operations, like a gas flow reversal; modify its integrity management program to better address threats and threat interactions; and require disqualification, remedial training, and/or requalification of covered tasks whenever an employee does not follow procedures when responding to an emergency shutdown, rupture, or other abnormal operation. viii#

PIR-22-02, page 10Pipeline Investigation Report NTSB/PIR-22/02 1. Factual Information 1.1 Accident Description On August 1, 2019, at 1:23 a.m. local time, a 30-inch-diameter natural gas transmission pipeline, Line 15, owned and operated by Enbridge Inc. (Enbridge), ruptured near Danville, Kentucky.1 As a result of the rupture, 1 person was fatally injured, 6 people were hospitalized, and over 75 residents were evacuated from the Indian Camp Subdivision, a residential community. The rupture released about 101.5 million cubic feet of natural gas and ejected a 33.2-foot-long section of pipeline that landed about 481 feet southwest of the rupture site. The releasing gas ignited and burned. Five residences in the subdivision were destroyed by fires, and an additional 14 were damaged. (See figure 1.) A nearby railroad track owned and operated by the Norfolk Southern Corporation sustained fire damage. Figure 1. Aerial view of the Indian Camp Subdivision overlaid on Google Earth image. Enbridge personnel completed isolation of the affected pipeline segment at 2:19 a.m., while a Lincoln County Sheriff’s Office deputy sheriff and the Lincoln 1 (a) Visit ntsb.gov to find additional information in the public docket for this NTSB accident investigation (case number PLD19FR002). Use the CAROL Query to search safety recommendations and investigations. (b) The ruptured pipeline was one of three parallel pipelines traversing the area. The pipelines will be discussed in more detail in section 1.4.1. (c) All times in this report are local time. 1#

PIR-22-02, page 11Pipeline Investigation Report NTSB/PIR-22/02 County Fire Protection District worked to rescue and evacuate residents and minimize the spread of the fire. The grass fires in the surrounding area were extinguished at 3:20 a.m., and the structure fires were extinguished at 4:13 a.m. 1.2 Emergency Response 1.2.1 Enbridge Response An Enbridge employee received a call at 1:23 a.m. about the event from a friend who lived near the rupture site. Enbridge’s gas control center received an informational pressure rate-of-change alarm on the discharge (south) side of the Danville compressor station (CS) on Line 15 at 1:24 a.m. 2 This alarm indicated a pressure drop in the pipeline of about 105 pounds per square inch (psi) in 1 minute. At 1:25 a.m. the Enbridge gas control center received a second pressure rate-of-change alarm. To isolate the affected pipeline segment, Enbridge personnel needed to close valves manually at the Danville CS (valve 15-393) and at a valve station located near Highway 49 (valve 15-382). (See figure 2). Figure 2. Process flow diagram for pipeline isolation. At 1:28 a.m., the Enbridge’s area supervisor received a call at home about the rupture from the employee first notified at 1:23 a.m. The supervisor directed that employee to the Highway 49 valve station to close valve 15-382. Then the area supervisor called the station operator at the Danville CS at 1:35 a.m. and instructed him to close valve 15-393 to isolate the damaged pipeline segment on the north side of the rupture. Although an on-duty station operator was present, saw a visible fire 2 Compressor stations increase the pressure of gas in a pipeline by compressing it. The discharge side of a compressor station is the higher-pressure output side. The suction side of a compressor station is the lower-pressure input side. The Danville CS was the closest compressor station to the rupture site, located 4.1 miles to the north. 2#

PIR-22-02, page 12Pipeline Investigation Report NTSB/PIR-22/02 from the station, and saw a low-pressure alarm at the CS, he did not act to close the manual valve at the CS until instructed by the area supervisor. The station operator manually closed valve 15-393 at 1:39 a.m., isolating the affected pipeline segment on the north side of the rupture. The Enbridge employee sent to manually close valve 15-382 arrived at the Highway 49 valve station at 2:13 a.m. and confirmed valve 15-382 was the correct valve to close by checking Enbridge’s Stanford Area Emergency Response Manual (2015), which was in his company vehicle. The employee closed valve 15-382, completing isolation of the ruptured segment at 2:19 a.m. The total time from the rupture to isolation was 56 minutes. Table 1 provides a detailed timeline of Enbridge’s emergency response actions. Table 1. Enbridge emergency response actions Time Activity 1:23 a.m. Enbridge employee receives notification of rupture from friend 1:24 a.m. First alarm received in Enbridge gas control center 1:25 a.m. Second alarm received in Enbridge gas control center 1:26 a.m. Enbridge gas control center attempts to contact Danville station operator 1:27 a.m. Enbridge gas control center receives report of accident from the public 1:28 a.m. Enbridge area supervisor dispatches employee to Highway 49 valve station 1:29 a.m. Danville station operator notifies Enbridge gas control center of fireball 1:30 a.m. Enbridge gas control center shuts off compressors at an upstream compressor station 1:30 a.m. Enbridge area supervisor notifies gas control center of valve closures required for isolation 1:35 a.m. Enbridge area supervisor instructs Danville station operator to close valve 15-393 1:39 a.m. Danville station operator manually closes valve 15-393 2:13 a.m. Enbridge employee arrives at Highway 49 valve station 2:19 a.m. Enbridge employee manually closes valve 15-382 at Highway 49 valve station, completing isolation 1.2.2 Local Emergency Response At 1:23 a.m., Bluegrass 911 Central Communications Center (Bluegrass 911) received a call from a motorist traveling by the accident site, who reported an explosion and massive fire.3 Shortly after, Bluegrass 911 requested emergency response to the accident site. At 1:35 a.m., an engine and a rescue/brush truck were dispatched from Fire Station 3 of the Lincoln County Fire Protection District (LCFPD), the closest station. Additionally, mutual aid was provided by several adjacent emergency services jurisdictions, including the Stanford Fire Department, Boyle County Fire Department, and Danville Police Department. The entire emergency response totaled 81 firefighters, 10 engines and 21 trucks. All structure fires were 3 Bluegrass 911 received 71 additional reports of the accident from the public after this initial call. 3#

PIR-22-02, page 13Pipeline Investigation Report NTSB/PIR-22/02 extinguished by 4:13 a.m. Table 2 provides a detailed timeline of local emergency response actions. Table 2. Local emergency response actions Time Activity 1:23 a.m. Initial report to Bluegrass 911 1:26 a.m. Bluegrass 911 requests response to the accident site 1:35 a.m. Engine and truck dispatched from LCFPD Fire Station 3 1:37 a.m. LCFPD arrives at accident site 1:39 a.m. LCFPD Assistant Chief assumes incident commander role 1:40 a.m. Command post established at Indian Camp Road and Route 127 2:19 a.m. Ruptured pipeline segment isolated 2:56 a.m. Suppression of grass fires begins 3:00 a.m. House-to-house searches performed by LCFPD, no individuals found 3:20 a.m. Surrounding grass fires extinguished 3:29 a.m. LCFPD checks area for natural gas with gas detectors, none observed 3:57 a.m. Suppression of structure fires begins 4:13 a.m. Structure fires extinguished A part-time, off-duty Lincoln County Sheriff’s Office deputy sheriff also responded to the accident site. While approaching the source of the natural gas fire, the deputy observed a man lying on the front porch of a burning residence about 480 feet from the rupture site. The deputy placed the injured man and the man’s wife, who he rescued from just inside the door to the house, in the police cruiser. In a postaccident interview with the National Transportation Safety Board (NTSB), the deputy described the heat in the area of the accident as “more than I [could] handle.“ The deputy also attempted to render aid to a woman lying on the ground nearby but determined she was deceased and, due to the intense heat, was unable to recover her. The deputy left the area with the two evacuees and transferred them to nearby ambulance personnel. 1.3 Injuries and Damages from the Gas Fire After rescuing the two injured individuals, the deputy sheriff drove to a local medical trauma center to have a minor burn injury treated. Three other residents of the subdivision were also transported to the facility for treatment. All five of the injured residents and the deputy sheriff were subsequently released after receiving medical care. The home of the deceased was located about 310 feet south of the rupture location. The deceased individual was about 640 feet south of the natural gas fire when she was found by the deputy sheriff. 4#

PIR-22-02, page 14Pipeline Investigation Report NTSB/PIR-22/02 Five residences were destroyed by resulting structure fires. Fourteen other residences suffered property damage to various degrees; some were 1,100 feet from the rupture crater. The gas flame direction, as shown by the darkened area of soil indicated with a black arrow in figure 3, was oriented along a true bearing of about 80°, or just north of due east. This flame direction was consistent with the direction of the pipeline at the rupture location. Figure 3. Homes of decedent and rescued couple, rupture location, and gas flame direction. 1.4 Enbridge Natural Gas Systems and Pipeline Specifications 1.4.1 Texas Eastern Transmission, LP, Line 15 The Enbridge asset involved in this accident, Texas Eastern Transmission LP (TET), a natural gas transmission pipeline system, connects the Gulf Coast with the northeastern United States. TET is a wholly owned subsidiary of Spectra Energy Partners LP (Spectra), which was purchased by Enbridge in 2017. Table 3 lists the recent ownership history for TET. 5#

PIR-22-02, page 15Pipeline Investigation Report NTSB/PIR-22/02 Table 3. Recent ownership history for Texas Eastern Transmission Owner of TET Time Period Texas Eastern Corporation January 30, 1947 – June 28, 1989 Panhandle Eastern Corporation June 29, 1989 – July 28, 1994 Panhandle Eastern Corporation/PanEnergy Corp July 29, 1994 – April 15, 2001 Duke Energy Gas Transmission Corporation April 16, 2001 – January 1, 2007 Spectra Energy Corp January 2, 2007 – October 31, 2013 Spectra Energy Partners, Limited Partnership November 1, 2013 – present Enbridge Inc. February 27, 2017 – present At the accident location, three parallel Enbridge pipelines (lines) transport natural gas through a common right-of-way: Line 10, Line 15, and Line 25. The rupture on TET Line 15 occurred at milepost 423.4.4 The impacted TET section was known as Tompkinsville to Danville and was located within the Stanford Area. The Danville CS is located at milepost 408.5 and the Highway 49 valve station was located at milepost 427.5. At the time of the rupture, gas in Line 15 was flowing south from the Danville CS to the Tompkinsville CS at 925 pounds per square inch, gauge (psig), which was less than the maximum allowable operating pressure (MAOP) of 936 psig.5 According to Enbridge, the pressure on Line 15 between the Tompkinsville CS and the Danville CS did not exceed the MAOP in the 5 years before the accident. The external protective coating type for Line 15 in the area of the rupture was coal tar enamel.6 Other pipeline specifications for Line 15 are shown in table 4. 4 A milepost is a unit of measure used to define the location on a pipeline relative to a chosen starting point in miles and fractions of miles. 5 Title 49 Code of Federal Regulations ( CFR ) Part 192.619, Maximum allowable operating pressure: Steel or plastic pipelines, specifies how the maximum allowable operating pressure is determined. 6 Coal tar enamel , also called coal tar wrap, was a coating commonly used in the 1950s. Hot tar formulated from coal tar pitches and inert fillers was applied to the pipeline exterior over a primer. Often, it was then covered with a fiberglass mesh and a felt wrap. Much of this original coating is still present on transmission pipelines across the United States, including on Line 15. 6#

PIR-22-02, page 16Pipeline Investigation Report NTSB/PIR-22/02 Table 4. Pipeline specifications of Line 15 at the rupture origin Pipeline Specification Value Diameter 30-inch Material Carbon Steel Grade/Specified Minimum Yield Strength1 X-52/52,000 psi Long Seam Weld Electric Flash-Welded Manufacturer A. O. Smith Corporation Year Manufactured 1957 Year Constructed 1958 Wall Thickness 0.375 inches Flow Direction (at time of rupture) South Class Location2 2 MAOP, south flow 936 psig Operating Pressure (at time of rupture) 925 psig CS Discharge Temperature (at time of rupture) 115ºF Soil Type Shale Cathodic Protection Method Impressed Current 1 American Petroleum Institute 5LX defines specific grades of carbon steel pipeline, each with a minimum yield strength. The higher the grade of the pipeline, the higher the strength of the steel used to manufacture that pipeline. 2 Title 49 Code of Federal Regulations 192.5 defines class locations, with four class locations representing different population levels present near a pipeline. Class 4 areas have the highest populations around them and present the highest risk, while Class 1 areas present the lowest relative risk. 1.4.2 Danville Compressor Station The Danville CS was the closest compressor station to the rupture site, located 4.1 miles to the north. The Danville CS is manned 24 hours a day, 365 days a year, by a station operator working a 12-hour shift. The station operator is supervised by an area supervisor.7 Station operators perform physical walkthroughs of the station, evaluate Supervisory Control and Data Acquisition (SCADA) information at a computer, and respond to various types of emergencies, including emergency shutdowns or valve isolations of the system.8 1.4.3 Gas Control Center Enbridge’s gas control center for its natural gas transmission pipelines is in Houston, Texas, and is the central location for monitoring and control of pipeline 7 The area supervisor oversees the Stanford Area segment of pipe and manages 15 employees, including 4 station operators. 8 Supervisory Control and Data Acquisition (SCADA) is a computer system for gathering and analyzing real-time data. SCADA systems are used in the pipeline industry to monitor and control pipeline systems. Station operators control and monitor a large amount of data and systems at the station. There are almost 2,500 distinct SCADA inputs at the Danville CS. 7#

PIR-22-02, page 17Pipeline Investigation Report NTSB/PIR-22/02 operations. The gas control center is staffed 24 hours a day, 365 days a year, by six gas controllers working in 12-hour shifts and supervised by personnel within the gas control center. Gas controllers monitor operating conditions, such as line pressure, flow rate, temperature, and gas composition. Depending on the data source, gas controllers can look at data on an instantaneous, per minute, or hourly basis. Gas controllers have authority to take immediate action in the event of an emergency, including a pipeline rupture. They notify the public and emergency response agencies when a potential accident is reported through their central phone line. The gas control center also coordinates information to and from the field during an emergency response, keeping track of which personnel are responding, where they are, and what actions they are taking. Gas controllers are also able to operate valves equipped for remote closure from the gas control center. Most valves on Line 15 require manual operation, including valves 15-382 and 15-393 on either side of the rupture. 1.5 Postaccident Pipeline Examination and Testing 1.5.1 On-Site Visual Examinations A crater was located in the area of the rupture; the crater and ground bedding under the pipe consisted of soil and broken pieces of shale. (See figure 4.) 8#

PIR-22-02, page 18Pipeline Investigation Report NTSB/PIR-22/02 Figure 4. Crater and ground bedding at rupture site. The NTSB’s on-scene examination of the ejected pipeline segment revealed that most of the external coal tar coating was consumed by fire, leaving large regions of the external pipe surface bare. The fracture face of the ejected segment exhibited chevron fracture features, helping investigators locate the origin of the fracture. 9 Figure 5 shows the origin of the fracture as indicated by the brackets; the arrows indicate the general direction of fracture propagation. 9 C hevron features , also known as a river pattern, is a fractographic pattern of marks that look like nested letters “V” or herringbone. The points of the chevrons can be traced back to the fracture origin. 9#

PIR-22-02, page 19Pipeline Investigation Report NTSB/PIR-22/02 Figure 5. Ejected pipeline segment. While on-site, the NTSB cut the ejected pipe section into three pieces to facilitate shipping and handling. The exposed fractured ends of the pipe, located within the rupture crater, were cut at the border of the crater. The pipe sections were crated and shipped to the NTSB Materials Laboratory for testing. 1.5.2 Microscope Examination of the Fracture Origin The NTSB Materials Laboratory examination of the fracture faces from the ejected pipe revealed that the fracture originated at the outer surface, as indicated in figure 6. The origin of the fracture and an area extending below it contained a flat region with a rough texture, shown enclosed by a yellow line. Fracture propagation was in the general direction indicated by the arrows. 10 The origin of the fracture showed no evidence of a gouge or dent and did not originate from a weld. The length of the origin at the outer surface measured about 0.8 inches, and shear lips extended from both ends.11 The fracture face at the inner surface (opposite the 10 Details of the fracture examination can be found in the NTSB Materials Laboratory Factual Report No. 19 -064 , February 6, 2020, in the docket for this accident. 11 A shear lip is a precise 45° lip of metal around the perimeter of a ductile overstress fracture area. 10#

PIR-22-02, page 20Pipeline Investigation Report NTSB/PIR-22/02 fracture origin) contained a minor shear lip, indicating the fracture did not start at the inner surface of the pipe. The fracture areas located outside of the north and south ends of the flat region were on a slant plane and contained a chevron pattern, consistent with overstress separation. Figure 6. East face of the fracture origin. A detailed scanning electron microscope examination of the fracture face revealed that the origin exhibited intergranular fracture features, which came from localized embrittlement caused by exposure to hydrogen. 12 The amount of intergranular fracture features decreased toward the inner surface of the pipe. 1.5.3 Microhardness Testing Two metallurgical cross sections, one longitudinal and one circumferential, were made through the wall of the pipe in the general area of the fracture origin. Microhardness testing adjacent to the outer surface of the pipeline identified a hard spot (a pipeline manufacturing defect greater than 2 inches in size in any direction with a hardness equal to or more than 327 Brinell) that measured 5.85 inches by 12 (a) Intergranular fracture is the propagation of cracks along the grain boundaries of a polycrystalline metal or alloy and involves little or no plastic deformation. Plastic deformation is when an applied force causes a material to change shape. (b) Embrittlement is the partial or complete loss of a material’s ductility, thus making it brittle. An embrittled product fails by fracture without deforming. 11#

PIR-22-02, page 21Pipeline Investigation Report NTSB/PIR-22/02 3 inches and had continuous hardness values of between 362 and 381 Brinell.13 Elevated hardness readings extended through the wall. The pipe was manufactured in 1957 to American Petroleum Institute (API) pipeline standards in use at the time. The standards then did not specify rejectable criteria for a hard spot, such as hardness and length (API 1956). By current API 5L standards, this hard spot is considered a rejectable defect because of its size and hardness. 14 According to Enbridge, Line 15 had a hardness typically between 180 and 200 Brinell, which is within the standard range for this grade of pipeline. 1.5.4 Microstructure Examination of the same two sections prepared for microhardness testing revealed the wall of the pipeline contained a microstructure of ferrite and banded pearlite, typical of hot rolled steel. 15 The microstructure of the hard spot contained martensite, which resulted from unintentional localized rapid cooling (quenching).16 1.5.5 Other Examinations NTSB’s examination of the fracture face origin revealed no evidence of branching cracks (multiple cracks initiating from a central crack that often indicate stress corrosion cracking). The NTSB reviewed data from all the in-line inspection (ILI) assessments taken by Enbridge and its predecessors on Line 15 in the area of the rupture between 2003 13 (a) A hard spot is an area in a pipe with a hardness level considerably higher than the pipe’s overall hardness, and it usually occurs during the pipe manufacturing process or during welding operations. Hard spots can vary in size, location on the pipe, and level of hardness, and can be more susceptible to cracking when other threats, such as corrosion, are present. (b) Hardness is the ability of a material to resist deformation from indentation. (c) Hardness tests assess the relative strength of a metal by measuring its resistance to deformation, generally using an indenter or probe. M icrohardness testing is typically performed on cross sections of a material using smaller indenters and loads over a smaller surface area. (d) Brinell , or Brinell Hardness Number, is a scale for the measurement of hardness. It is also referred to in industry practice as HBW. 14 American Petroleum Institute (API) Standard 5L, incorporated by reference into 49 CFR Part 192, discusses hard spot parameters and under what conditions a hard spot must be remediated. 15 Microstructure examination was performed at the NTSB Materials Laboratory. 16 Martensite is a microstructure of steel that is formed by localized quenching, or rapid cooling, that is harder than the ferrite and pearlite microstructures of standard pipe steel. Unintentional localized quenching can occur during the manufacturing process, creating hard spots in the pipeline. 12#

PIR-22-02, page 22Pipeline Investigation Report NTSB/PIR-22/02 and 2019.17 These assessments found no dents within 500 feet of the rupture site that met Enbridge’s criteria for repair. The assessments also identified no internal corrosion near the rupture origin. 1.6 Line 15 Incident History The NTSB examined incident history with Enbridge’s pipeline system involving Line 15. The history includes a 2003 rupture, an operational modification that changed the flow direction between 2014 and 2017, and an emergency Danville CS shutdown in 2019; these events are discussed below. 1.6.1 2003 Rupture On November 2, 2003, Line 15 ruptured at milepost 501.72 near Morehead, Kentucky, between the Danville CS and the Owingsville CS, which is the station immediately north of the Danville CS. No fatalities or injuries occurred because of the rupture or resulting fire, and the parallel pipelines, Lines 10 and 25, were not impacted. The predecessor to the Pipeline and Hazardous Materials Safety Administration (PHMSA), the Research and Special Programs Administration (RSPA), issued a corrective action order to TET, then owned by Duke Energy Gas Transmission (DEGT), in 2003 because of the rupture. As part of the corrective action order, TET was required to conduct a detailed metallurgical analysis to determine the cause of and factors contributing to the rupture (RSPA 2003). TET hired an engineering firm to investigate the rupture cause, including metallurgical testing. In its final report, the engineering firm found the rupture was “caused by hydrogen-induced cracking that initiated at the [outer] surface of the pipe in a hard spot that was coexistent with a mid-wall lamination” (Mesloh and Rosenfeld 2003).18 Both the hard spot and lamination were present at the time of manufacture in 1957, although this segment of Line 15 passed a hydrostatic test of 1,417 psig when it was first installed. The lamination and hard spot at the rupture origin also were not 17 In-line inspection (ILI) is an inspection method in which a highly specialized tool is passed within a pipeline to inspect the pipeline from the inside. ILI uses nondestructive examination techniques to identify, locate, and size various damages and defects, depending on the type of tool. 18 A lamination is an abnormal structure in the pipeline wall that results in a separation or weakness aligned generally parallel to the work surface of the metal. Laminations are manufacturing defects that can be caused by several issues during the manufacturing process, including the formation of blisters or the inclusion of foreign materials. 13#

PIR-22-02, page 23Pipeline Investigation Report NTSB/PIR-22/02 identified during ILIs conducted in 1986 and 1999; the ILI tools used at that time were not capable of detecting hard spots. In response to the 2003 rupture, DEGT initiated a new hard spot management program. As a first step, DEGT identified the areas on its pipeline systems containing pipeline vintages with a known history of hard spots, including 24.76 miles of pipeline on Line 15 manufactured by A. O. Smith Corporation. On July 3, 2004, April 26, 2005, and April 29, 2005, DEGT completed three hard spot ILI runs on various sections of Line 15 and identified 22 hard spots with predicted hardness values between 235 and 340 Brinell. Based on predicted hardness and distance between hard spots, DEGT excavated 14 of the 22 hard spots and performed hardness testing. 19 Four of the excavated hard spots were recoated and backfilled, as the hardness values of each was below DEGT repair criteria. The remaining 10 excavated hard spots were removed for more extensive metallurgical laboratory testing, which generally showed close agreement between the field measurements and ILI predictions. In 2006, DEGT hired CC Technologies Inc. to perform an evaluation of its hard spot management program. CC Technologies Inc. concluded that the ILI tool accurately and reliably detected and estimated the hardness of hard spots (Barkdull and others 2006). However, CC Technologies Inc. also recommended during its review that DEGT request that the ILI vendor provide additional details on how hard spots were identified. Overall, CC Technologies Inc. found DEGT’s hard spot management program to be “consistent with industry best practices.” 1.6.2 2014 to 2017 Operational Modifications Line 15 flowed north when first constructed in 1957. From 2014 to 2017, modifications were completed on Lines 10, 15, and 25 to allow for reverse flow from Pennsylvania to Louisiana. This project changed all three lines from unidirectional flow to bi-directional flow. The conversion was completed at the Danville CS in late 2014 and at multiple other compressor stations and pipeline segments in the following years, with the entire project completed in 2017. 19 None of the hard spots identified during these ILI runs were located near the origin of the 2019 rupture. Of the 22 ILI-identified hard spots, 8 were not excavated, as their predicted hardness values were under 327 Brinell (see section 1.5.3 for more information on hard spot measurements). 14#

PIR-22-02, page 24Pipeline Investigation Report NTSB/PIR-22/02 Spectra performed a management of change review for the flow reversal project.20 During this review, Spectra assessed risks and performed mitigative actions.21 One risk identified was an increased temperature on the discharge side of compressor stations that are in use. In the case of the Danville CS, flow south would result in an elevated temperature on the south side after flow reversal. Increased temperatures pose a higher risk to pipeline integrity because external corrosion can increase as temperature rises. To address this risk, gas coolers were installed at several compressor stations, including the Danville CS, in 2014 when the flow was reversed. 22 From 2014 to 2017, gas flowed south, but the compressors at the Danville CS were not actively used; thus, only about a 5°F temperature increase was noted south of the Danville CS. In 2017, Enbridge began actively using the Danville CS, which resulted in an average 30°F increase in temperature south of the CS even with the gas coolers in use. 1.6.3 2019 Danville Compressor Station Emergency Shutdown On May 8, 2019, the Danville CS experienced an unplanned emergency shutdown.23 This event was caused by a shorted wire in a direct-current circuit, which indirectly caused a buildup of gas pressure at the station. When the emergency shutdown initiated, one of the block valves at the station failed to close properly, allowing gas to continue to flow out of the station. Because of the continued flow of gas, the gas control center in Texas believed there was a rupture near or within the Danville CS. 20 Management of c hange is a standardized approach for reviewing proposed changes to systems to ensure safety, health, and environmental risks are all assessed. It is part of a pipeline safety management system as outlined in American National Standards Institute (ANSI)/API Recommended Practice 1173. A pipeline safety management system is not currently required by PHMSA regulations, nor is ANSI/API Recommended Practice 1173. 21 Spectra was purchased by Enbridge in 2017. 22 Gas coolers are devices used in the pipeline industry to reduce the temperature of gas by heat exchange methods. 23 PHMSA defines emergency shutdown as an abnormal operation in Title 49 CFR 192.605(c). An emergency shutdown is designed to protect a compressor station and its personnel from threats to safety and pipeline integrity. During an emergency shutdown, automated valves isolate the station from the remainder of the pipeline system and release the isolated gas to bring the pressure in the station down to atmospheric pressure (0 psig). 15#

PIR-22-02, page 25Pipeline Investigation Report NTSB/PIR-22/02 During the emergency shutdown, the Danville CS station operator (the same operator on duty for the August 1, 2019, accident), in response to a call from the gas control center, manually closed a valve at the station to try to isolate the station from the remainder of the pipeline system. This action did not halt the flow of gas because the release was from an open valve, not a rupture. Neither the station operator nor the gas controller reviewed the SCADA graphics during the response. The Enbridge area supervisor was then contacted by the gas control center to assist the station operator with the response. The area supervisor reviewed the SCADA graphics, determined that the valve was still in the open position, and immediately closed it, stopping the flow of gas. Enbridge’s internal root cause failure investigation into the May 8, 2019, emergency shutdown found that had the station operator reviewed the SCADA graphics, he would have concluded the valve was open and needed to be shut. Enbridge’s internal failure investigation report stated that the station operator displayed “a lack of understanding” of the emergency shutdown system by failing to confirm all valves had operated as intended. Additionally, the internal investigation found that the gas controller and station operator’s communications resulted in the station operator “attempting to manipulate valves that were irrelevant to the event” (Enbridge 2019a). 24 Between May 8, 2019, and August 1, 2019, the station operator was not disqualified or requalified for tasks related to the emergency shutdown system, nor did Enbridge retrain him. Enbridge’s operator qualification program stated that, if an internal investigation of an accident finds the employee’s performance of a covered task such as responding to an emergency shutdown has caused or contributed to an accident, that employee “will be deemed disqualified” for that task(s) until they are requalified. 25 1.7 Enbridge Procedures, Operations, and Maintenance 1.7.1 Company Background Enbridge transports about 20 percent of the natural gas consumed in the United States. The accident pipeline, TET, is an 8,580-mile transmission pipeline 24 The Enbridge investigation found the gas controller and station operator did not reference the specific valve numbers during their communication. 25 Per 49 CFR 192.801, a covered task is one that is performed on a pipeline facility, is an operations or maintenance task, is performed as a requirement of federal regulations, and affects the operation or integrity of the pipeline. 16#

PIR-22-02, page 26Pipeline Investigation Report NTSB/PIR-22/02 system that can transport up to 11.69 billion cubic feet of natural gas per day. (See figure 7.) TET is federally regulated by PHMSA. Figure 7. Map of Texas Eastern Transmission pipelines. (Courtesy Enbridge.) 1.7.2 Emergency Response Plan Enbridge’s Stanford Area Emergency Response Plan outlined what actions the station operator should take in the event of a rupture or other abnormal operations. The plan included lists of valves requiring closure to isolate specific pipeline segments, including valve 15-393 (which was closed during the accident response), maps, and detailed schematics of the valve stations and compressor stations. The Stanford Area Emergency Response Plan also provided specific details on the activities a station operator should take in response to an emergency shutdown for each compressor station. For the Danville CS, the plan listed which valves should be operated during an emergency shutdown, both automatically and manually. This procedure also required the station operator to contact the gas control center and the area supervisor in the event of an emergency near the compressor station. 17#

PIR-22-02, page 27Pipeline Investigation Report NTSB/PIR-22/02 1.7.3 Cathodic Protection External corrosion is controlled on Line 15 by impressed-current cathodic protection and design elements such as coating.26 Between the Tompkinsville CS and the Danville CS, there are eight rectifiers. The closest rectifier and anode bed north of the accident site is at Goodnight, and the closest rectifier and anode bed to the south is at Harris Creek. 27 (See figure 8.) The soil in this area is primarily shale. The Enbridge corrosion technician told the NTSB that “it takes a lot more [cathodic protection] with shale,” and that shale “does lower the ability for [cathodic protection] to go through the rock.” 26 Buried steel pipelines will corrode because of the presence of moisture and ground water in the soil. To prevent corrosion, the exterior of the pipe is coated with an insulating material such as coal tar so that the soil does not directly contact the pipe surface. Inevitably, there are unavoidable flaws and defects in the coating, and the exposed steel at the flaws may corrode. To minimize corrosion at the coating flaws, an electrical direct current power supply (rectifier ) is set up between the pipe and an inert electrode (anode ) buried beside the pipe. The power supply provides electrical current that prevents corrosion of the exposed steel at the coating flaws. As a byproduct, hydrogen also evolves at the exposed steel at the coating flaws. This process is called impressed current cathodic protection . 27 Anode beds are a collection of interconnected anodes that work together to protect a pipeline system. 18#

PIR-22-02, page 28Pipeline Investigation Report NTSB/PIR-22/02 Figure 8. Map of the right of way for Lines 10, 15, and 25. Investigators examined 10 years of maintenance activities related to cathodic protection at Goodnight and Harris Creek. In 2017 and 2019, the output from the Harris Creek rectifier was increased to address dropping potential readings. 28 These dropping potentials began in early 2014 after the flow reversal project was completed. Before the flow reversal, cathodic protection voltages were regular and consistent; after the flow reversal, technicians were unable to stabilize readings; at Harris Creek, voltages were increased by 18 percent, and the voltages at Goodnight increased by 58 percent. (See figure 9.) The plot in figure 9 shows the steady potentials up to 2013; after that, they became unstable. In 2018, a new anode was installed at Harris Creek, but it did not successfully raise potentials. 28 When referring to cathodic protection potential readings, low potentials are those that do not meet PHMSA criteria and are more positive than −0.85 volts. When potential readings drop this means they become more positive and may not meet PHMSA requirements. 19#

PIR-22-02, page 29Pipeline Investigation Report NTSB/PIR-22/02 Figure 9. Voltage outputs at Goodnight and Harris Creek rectifiers. Several inspections related to cathodic protection were also performed on Line 15 in the 10 years before the accident, including close interval surveys.29 Specifically, a close interval survey that was performed between the Highway 49 valve station and the Danville CS by Allied Corrosion Industries Inc. on October 25, 2012, found 451 feet of the segment did not meet PHMSA’s minimum federal safety standards for cathodic protection. 30 In response, in 2013, Spectra installed anode beds at three locations in the segment, and additional anodes were added at another location. These activities were performed to address the low potentials identified during the 2012 close interval survey. Allied Corrosion Industries Inc. performed another close interval survey on the same pipeline segment on Line 15 on August 24, 2018, and on June 5, 2019. This close interval survey found that a total of 774 feet of the 19.02-mile segment did not 29 Close interval surveys are part of a class of nondestructive above-ground testing methods. They are used primarily to evaluate the effectiveness of cathodic protection, but they also can be used to detect small coating defects and other issues. 30 Title 49 CFR Part 192 Appendix D specifies PHMSA’s minimum federal safety standards for effective cathodic protection. Five evaluation options are available to operators of steel pipelines. 20#

PIR-22-02, page 30Pipeline Investigation Report NTSB/PIR-22/02 achieve a 100-millivolt differential between on and off potential readings.31 After the 2018–2019 close interval survey, anode beds were installed at three more locations on the pipeline segment to address the low potentials identified during the survey. No pipeline segments were recoated. Enbridge’s local corrosion technician told the NTSB that there was some disbonded coating in the area.32 No internal or external corrosion was identified near the rupture origin during integrity assessments of Line 15 completed in 2010, 2011, or 2018 by the vendors listed in table 5. 33 However, external corrosion anomalies were identified at other locations on several magnetic flux leakage ILI runs conducted as part of the integrity assessments, with the number of anomalies increasing by 166 percent between 2010 and 2018. (See section 1.8.4 for more information on magnetic flux leakage tools and integrity assessment.) Table 5 describes the external metal loss anomalies identified during the ILI runs. Table 5. External metal loss anomalies identified in ILI runs Year of ILI Tool Vendor Location Total Number of External Metal Loss Anomalies Pipeline Joints Impacted (%) Run 2010 PII Pipeline Solutions Tompkinsville CS to Danville CS 4,655 14 2011 NDT Systems & Services (America) Inc. Tompkinsville CS to Danville CS 3,125 N/A PII Pipeline 2018 Solutions/Baker Tompkinsville CS to Danville CS 12,376 31 Hughes 1.8 Integrity Management Integrity management (IM) has three goals: (1) to determine pipeline segments where the potential consequences are the highest; (2) to evaluate the soundness, stability, and reliability of pipelines; and (3) to address risk in a scientific, consistent, and prioritized manner. PHMSA’s regulations on gas transmission IM fall under Title 49 31 Method 3 of PHMSA’s criteria for cathodic protection in 49 CFR Part 192 Appendix D requires a voltage differential of at least 100 millivolts between on and off potential readings. 32 Disbond ment is when the coating applied to the exterior of the pipeline separates from the metal, causing a gap between the coating and pipeline, which can negatively impact pipeline integrity. 33 Integrity assessments are evaluations performed by pipeline operators to determine whether their pipelines have adequate integrity to prevent leaks or ruptures under normal and abnormal operations. 21#

PIR-22-02, page 31Pipeline Investigation Report NTSB/PIR-22/02 Code of Federal Regulations (CFR ) Part 192 Subpart O, Gas Transmission Pipeline Integrity Management.34 By design, IM is a cyclical, nonlinear process that continually feeds data back into other program elements, so that data collected during each part of the process are used to improve other elements. (See figure 10.) IM requires operators to identify threats to pipeline integrity, determine threat severity, validate data, allocate resources, conduct repairs, and evaluate the entire system, reassessing threats and revising system elements as new data or analyses become available. Evaluate Program Performance Identify HCAs and Assessment Segments Repair and Mitigation Threat Assessment Data Integration Data Validation Risk Assessment Integrity Assessments Figure 10. Integrity management process flow. 34 On December 15, 2003, the Research and Special Programs Administration issued its final rule on natural gas transmission integrity management (IM), setting the minimum regulatory requirements for pipelines in high consequence areas. 22#

PIR-22-02, page 32Pipeline Investigation Report NTSB/PIR-22/02 As in all IM programs, the various elements of Enbridge’s IM program relevant to the 2019 accident did not necessarily proceed in a chronological order and are therefore discussed by topic in the following sections. 1.8.1 High Consequence Area Identification To determine which segments of an operator’s natural gas pipeline system are covered by 49 CFR Part 192 Subpart O, an operator must first identify the high consequence areas (HCAs).35 High consequence areas help gas pipeline operators find “segments of their pipeline systems that pose the greatest risk to human life [and] property” by identifying more populated areas (PHMSA 2016). Under 49 CFR 192.903, PHMSA requires pipeline operators to use one of two available methods to evaluate if a pipeline segment falls within an HCA. For most of its pipeline systems, including at the rupture site, Enbridge uses method 2, which defines an HCA as an area within the pipeline’s potential impact radius (PIR) that contains either (a) 20 or more buildings intended for human occupancy (with some exceptions) or (b) an identified site.36 PHMSA defines the PIR by a mathematical equation that includes MAOP and pipeline diameter. The NTSB used this mathematical equation to calculate the PIR at the rupture site to be about 633 feet. Within 633 feet of the rupture site radially (indicated by a red circle in figure 11) were seven private residences as well as other structures not designed for human occupancy, such as garages and sheds. Because the number of buildings intended for human occupancy was below 20 and no buildings met the qualifications of an identified site under 49 CFR 192.903, the rupture site was deemed a non-HCA via method 2. 35 A high consequence area is a location specially defined in pipeline safety regulations as an area where pipeline releases could have greater consequences to health and safety or the environment. 36 An identified site is a location intended for mass occupancy, such as a stadium or office building, or a facility with occupants who would be difficult to evacuate, such as a nursing home or prison. A full definition for an identified site can be found in 49 CFR 192.903. 23#

PIR-22-02, page 33Pipeline Investigation Report NTSB/PIR-22/02 Figure 11. Human-occupancy buildings within the potential impact radius. (Courtesy of Enbridge.) On the date of the accident, PHMSA’s gas transmission integrity rule applied only to pipeline segments located in HCAs. As such, Enbridge was not required to implement any of the regulations in 49 CFR Part 192 Subpart O for the area containing the rupture site, including management of change, risk assessments, or integrity assessments. However, Enbridge voluntarily included pipeline segments that fell outside of HCAs in its integrity management program; these sections were called assessment segments. The rupture site was located within a non-HCA assessment segment known as Line 15 Valve Section 4 (L15 VS4). L15 VS4 extends from milepost 408.5 to milepost 427.5, which is all of Line 15 between the Highway 49 valve station and the Danville CS. 1.8.2 Threat Identification and Interaction As part of IM, within each HCA and assessment segment, the pipeline operator conducts assessments to identify threats to pipeline integrity. The American Society of Mechanical Engineers standard B31.8S, Managing System Integrity of Gas Pipelines , which is incorporated by reference into 49 CFR 192.7(c)(6), divides the threats to pipeline integrity into nine categories (American Society of Mechanical Engineers 2012). Hard spots fall under the category of manufacturing threats. Enbridge also considered pipeline “segments that [had] not been [hydrostatically] pressure tested to a minimum of 1.25 times the MAOP, [contained] susceptible materials, or [had] a history of material related failures” vulnerable to manufacturing threats. 24#

PIR-22-02, page 34Pipeline Investigation Report NTSB/PIR-22/02 Following the 2010 rupture of an Enbridge hazardous liquids pipeline in Marshall, Michigan, the NTSB found Enbridge’s IM program did not consider the interaction between threats (such as between corrosion and crack depths, among other issues) and recommended that Enbridge revise its program.37 In a March 16, 2017, advisory bulletin, PHMSA offered guidance to pipeline operators on how to classify the stability of various threats, noting that threats “may be considered active or inactive, but are never permanently eliminated” (PHMSA 2017). In PHMSA’s classification, threats are active when an integrity assessment is required, and inactive threats can be considered stable and do not require assessment or reassessment as long as they remain stable. When a threat requires reassessment, pipeline operators must evaluate their systems for that threat on a regular basis, called a reassessment interval. The length of these reassessment intervals varies by threat and assessment method.38 When manufacturing threats are active and ILIs are used, 7 years is the maximum reassessment interval allowed under 49 CFR 192.939. According to the 2017 advisory bulletin, manufacturing threats are stable threats that become active (that is, require assessment) when any of the following occur: • The operating pressure increases above the highest operating pressure in the past 5 years. • MAOP is increased. • Stresses are increased that lead to cyclic fatigue. In 2011, Spectra, and later Enbridge, considered hard spots eliminated as a threat on L15 VS4 after one in-line inspection, four excavations, and one repair on that pipeline segment. 37 NTSB Safety Recommendation P-12-11 states, in part, that Enbridge must “develop and implement a methodology that includes local corrosion wall loss in addition to the crack depth when performing engineering assessments of crack defects coincident with areas of corrosion” (NTSB 2012). As of 2014, Enbridge had completed action on that part of the recommendation and was working to implement new IM procedures. The recommendation is classified “Closed—Acceptable Action.” 38 49 USC section 60109(c)(3)(B) allows the Secretary of Transportation to extend the deadline for an additional 6 months to a maximum total of 7 years and 6 months if the operator submits written notice to the Secretary of Transportation with sufficient justification of the need for the extension. 25#

PIR-22-02, page 35Pipeline Investigation Report NTSB/PIR-22/02 1.8.3 Risk Assessment After potential threats are identified, Enbridge assesses the risk from those threats to its pipeline system.39 Enbridge used a risk algorithm from Dynamic Risk Assessment Systems Inc. (Dynamic Risk) to perform its annual risk assessments.40 The algorithm assigns scores to risks from manufacturing threats like hard spots. Hard spot scores ranged from 0 to 10, with 0 having the lowest probability of failure. Enbridge’s average hard spot score for the ruptured pipeline segment was 1.53 for each year between 2010 and 2018. This yearly hard spot score was a function of various inputs: the susceptibility of the pipeline to hard spots (1.53 out of 10), coating condition (1 out of 1), and cathodic protection (0.97 out of 1), among other factors. 41 Each year between 2010 and 2018, Enbridge rated the overall probability of failure from all threats on L15 VS4 as “unlikely, ” Enbridge’s lowest-priority category for performing integrity assessments. In its risk algorithm, Enbridge defined the consequence of failure as the sum of potential impacts to public safety, economic loss, and environmental damage. Within public safety, the algorithm considered consequences from thermal radiation (heat and fire), blast overpressure, and flying debris. Each year from 2010 to 2018, the ruptured pipeline segment had an overall consequence score of 2.71 out of 10. 1.8.4 Integrity Assessment Based on the calculated risk scores, pipeline operators perform integrity assessments to find potential weaknesses (anomalies) in the pipeline system. ILI tools are frequently used by pipeline operators to perform these integrity assessments. Seven integrity assessments were performed on the L15 VS4 segment between May 2003 and May 2019 (2 months before the accident). These assessments looked at various threats, and each threat was assessed about once every 7 years. (See table 39 Risk to a pipeline segment is defined as the probability of failure multiplied by the potential consequences of failure. 40 Dynamic Risk Assessment Systems, Inc., is a Canada-based pipeline integrity company. 41 The value for the susceptibility of the pipeline to hard spots was based on the pipeline vintage and history, with the highest value, 10, assigned to pipelines with known hard spots over 327 Brinell, previous accidents on similar pipelines, and pipelines manufactured by A. O. Smith Corporation before 1953. Coating condition was evaluated on the frequency of external corrosion. Operating stress level was based on the average operating pressure relative to the yield stress of the pipeline. Cathodic protection was based on the percentage of potential readings that were more negative than -1.20 volts. 26#

PIR-22-02, page 36Pipeline Investigation Report NTSB/PIR-22/02 6.) Enbridge and its predecessors had determined the reassessment interval for all active (unstable) threats would be 7 years, which, as stated earlier, is the maximum allowable reassessment interval under 49 CFR 192.939. Table 6. Integrity assessments performed on the ruptured pipeline segment between 2003 and 2019 Date of Field Assessment Method Vendor Assessment or Threats Assessed ILI Tool Run Internal corrosion, external corrosion, Magnetic flux leakage ILI Tuboscope 05/12/2003 3rd-party damage, dents, and other deformations Magnetic flux leakage and caliper ILI PII Pipeline Solutions 06/24/2010 Internal corrosion, external corrosion, 3rd-party damage, manufacturing defects (limited capability), dents, and other deformations Hard spot magnetic flux NDT Systems & leakage ILI with Services (America) 04/05/2011 inertial Hard spots, internal corrosion, external corrosion, 3rd-party damage, location Inc. measurement unit Close interval survey Allied Corrosion Industries, Inc. 10/25/2012 External corrosion Magnetic flux Internal corrosion, external corrosion, leakage and PII Pipeline caliper ILI with Solutions/Baker 3rd-party damage, manufacturing defects 05/01/2018 inertial (limited capability), dents, and other Hughes deformations measurement unit Close interval survey Allied Corrosion Industries, Inc. 08/24/2018 External corrosion Caliper ILI with inertial Baker Hughes 05/29/2019 Dents and other deformations, location, geotechnical stress measurement unit Several of the seven integrity assessments used a magnetic flux leakage tool, one of the most common and versatile ILI tools. Magnetic flux leakage tools impose a strong magnetic field within the pipe wall and measure magnetic flux leakage and determine the amount of wall thickness loss. Readings from magnetic flux leakage tools can be used to look for most types of anomalies in which metal loss is present: external corrosion, internal corrosion, external damage such as scrapes and gouges, and voids in the pipe wall. Hard spot magnetic flux leakage (HSMFL) ILI tools use magnetic flux leakage technology to detect hard spots. An HSMFL ILI tool has two sections: the first section contains sensors within a higher magnetic field, followed by a second set of sensors within a lower magnetic field. The higher magnetic field section will detect only metal loss anomalies, while the lower magnetic field section will detect both hard spots and metal loss anomalies. Analysts working for the ILI tool vendor then compare the data collected by each section of the tool to identify hard spots. 27#

PIR-22-02, page 37Pipeline Investigation Report NTSB/PIR-22/02 After the flow reversal in 2014, Spectra did not develop a new baseline assessment plan. Baseline assessment plans are not required by federal regulations when changing flow direction. 42 1.8.4.1 Hard Spots A. O. Smith 30-inch pipe manufactured in the 1950s was known by major industry organizations and PHMSA to have a history of hard spots (Clark and others 2005).43 During the 2011 HSMFL ILI run, the segment of Line 15 between the Tompkinsville CS and the Danville CS was also evaluated for hard spots. Sixteen hard spots were identified; none were located near the 2019 accident site. Enbridge’s IM program manual stated that stable threats, such as hard spots, required assessment until “effectively mitigated. ” The manual required no specific intervals between assessments. Mitigation options listed in the accompanying procedure, Threat Response Guidance Document 440 , Manufacturing , included eliminating or reducing stress on the pipeline segment, eliminating susceptible pipeline, and eliminating or reducing hydrogen generation. Neither Spectra nor Enbridge re-inspected L15 VS4 for hard spots between April 5, 2011, and the accident on August 1, 2019. 1.8.5 Hard Spot In-Line Inspection Data Analysis The NTSB reviewed the performance specifications for the tool NDT Systems & Services (America) Inc. (NDT Systems & Services) used during the 2011 HSMFL ILI run and found the report NDT Systems & Services provided to Spectra did not contain a statement regarding the minimum detection capabilities of the tool.44 Further, the 42 A pipeline operator develops a baseline assessment plan to assess the integrity of all the lines included in its IM program. The baseline assessment plan must show when each line is to be assessed and the assessment method the operator will use. At a minimum, the baseline assessment plan (1) identifies all segments of a pipeline system that could impact an HCA, (2) identifies the specific integrity assessment method(s) to be conducted, (3) specifies the schedule by which those integrity assessments will be performed, and (4) provides the technical justification for the selection of the integrity assessment method(s) and the risk basis for establishing the assessment schedule (49 CFR 192.919). 43 Historical pipeline vintages that are known to have a higher rate of certain defects are described in a 2004 report by the Interstate Natural Gas Association of America entitled Integrity Characteristics of Vintage Pipelines . 44 In 2012, NDT Systems & Services (America) Inc. sold the majority of its assets to Weissker Molch LLC, which is now known as NDT Global LLC. It also discontinued use of the hard spot magnetic flux leakage ILI tool that year. 28#

PIR-22-02, page 38Pipeline Investigation Report NTSB/PIR-22/02 specifications were not complete: they did not clearly state if the probability of detection, location accuracy, and sizing accuracy applied to hard spots, metal loss anomalies, or both. Specialized ILI tools, such as HSMFL tools, rely on proprietary processes for data analysis and interpretation. Spectra relied on the ILI vendor’s contractual requirements, and confirmation using the vendor’s quality checks, for validation of data coverage and quality. Spectra’s data on the total number of miles of pipeline on which NDT Systems & Services ran its hard spot tool in 2011 were incomplete, but according to documentation provided to the NTSB postaccident from NDT Global LLC (NDT Global), at least 1,320.8 miles were run, including 328 miles on TET pipelines. NDT Systems & Services’ July 9, 2011, analysis of the data collected during the 2011 HSMFL ILI run predicted that the closest hard spot was located about 2.2 miles north of the accident site. After the accident in Danville, the NTSB requested a re-analysis of the original data from the 2011 HSMFL ILI run. In August 2019, NDT Global used the raw data from 2011 to conduct a re-analysis that showed a total of 441 hard spots. Of these 441 identified hard spots, 9 were located in the pipeline joint that ruptured, including 2 at the rupture origin (with predicted hardness values of 241 Brinell and 245 Brinell). 45 These two hard spots corresponded with the hard spot at the fracture origin that was measured during NTSB testing. NDT Global reported that the large discrepancy in the number of hard spots identified between the analyses in 2011 (16 hard spots) and 2019 (441 hard spots) was due to significant improvements in computer hardware and software used in data analysis in the 8 intervening years (NDT Global 2019). 1.8.6 Data Validation Enbridge standard operating procedure 9-3010, Response to In-Line Inspection , outlined its procedures for validating ILI data, including field measurements and direct comparisons of ILI runs. Hard spots were not specified in this procedure (Enbridge 2019b). Spectra used field measurements of the four hard spots that were excavated as a result of the 2011 HSMFL ILI run to validate the ILI tool performance. In a response to a postaccident NTSB inquiry, Enbridge concluded that the data for these four anomalies demonstrated generally good agreement between the HSMFL ILI and the field measurements. 45 A joint of pipe is a piece of pipe; multiple joints are welded together to form a pipeline. A standard joint is 40 feet long, but joints can be longer or shorter. 29#

PIR-22-02, page 39Pipeline Investigation Report NTSB/PIR-22/02 Enbridge had an additional procedure for ILI data validation: standard operating procedure 9-3040, Enhanced Survey Analysis (Enbridge 2018). It outlined how an Enbridge analyst would perform an additional, detailed review of the raw ILI data to verify documentation and would conduct a series of data checks, including data validation and integration. Procedures were specified for standard ILI tools but not for HSMFL ILI. These procedures did not require the use of statistical analysis methods for any ILI tools. Statistical analysis methods are an industry best practice and are recommended in the optional appendices of API Standard (STD) 1163. 1.8.7 Response and Repair Enbridge standard operating procedure 9-3010 outlined the specific response, remediation, and repair activities Enbridge personnel should take when different anomaly types and severity levels were found during an ILI run. Procedure 9-3010 stated that hard spots only required excavation and repair when their hardness exceeded 300 Brinell and no cracking was observed. No repaired hard spots were located near the rupture origin. Reports from all excavations noted that the coating was mostly intact with small coating defects present. 1.8.8 Program Performance In 2012, Spectra’s principal metallurgist performed a review of Spectra’s hard spot management program using the information gathered from the 2011 HSMFL ILI run and resulting excavations. He found that the hard spot tool data agreed well with field measurements. The metallurgist also recommended ILI inspections of four other pipeline segments in 2013, including Line 15 between the Danville CS and the Owingsville CS, because these segments contained pipe vintages known to be susceptible to hard spots. Spectra stated that it experienced difficulties finding alternate HSMFL tool vendors after 2013. As of the 2019 accident, the pipeline segments recommended for HSMFL ILI in 2013 had not been inspected for hard spots. In 2012, Process Performance Improvement Consultants LLC (P-PIC) performed an audit of Spectra’s integrity management program. P-PIC found that over time, Spectra “did not evolve … as effectively or at the same rate as its peers” and “must improve … to keep pace” (P-PIC 2012). P-PIC found that corrosion control was one of the key areas where Spectra fell behind. P-PIC stated Spectra’s work planning and management negatively affected the use of data and lessons learned in risk assessment, process improvements, prevention measures, and evaluation of performance, and needed improvement. P-PIC also found that Spectra lacked a robust database to support its IM program, including threat identification, risk assessment, and data integration. 30#

PIR-22-02, page 40Pipeline Investigation Report NTSB/PIR-22/02 P-PIC recommended that Spectra increase its attention to interacting threats, including looking at industry research and past accidents. P-PIC recommended that Spectra perform an annual comparison of yearly pipeline segment risk scores to enable Spectra to show risk was decreasing every year and to identify areas with increasing risk. No evidence was found that Spectra or Enbridge completed these recommended comparisons. Spectra’s and Enbridge’s annual IM performance evaluations from 2014 to 2017 did not recommend any changes to the IM program; however, the number of leaks increased over that time frame, while the number of repairs decreased. In 2018, Enbridge reviewers recommended consolidation of all IM programs and an independent IM program audit. 1.8.9 Recent Integrity Management Program Changes In early 2019, following several accidents, Enbridge determined that its approach to IM was not resulting in expected performance. 46 Enbridge began transforming its organization, programs, behaviors, data, and support systems with the goal of no ruptures and proven pipeline integrity using a quantitative, as opposed to a qualitative, approach to risk assessments. Enbridge estimated this process would be complete around the end of 2023. Enbridge contracted with Dynamic Risk to review its IM program and assess the integrity of Enbridge’s gas transmission and midstream pipelines, including TET (Enbridge 2020). On July 17, 2019, Dynamic Risk completed phase one of its review. Dynamic Risk evaluated Enbridge’s management system, IM program, and seven threat categories related to corrosion, cracking, dents and geohazards. Enbridge did not include hard spots in the threat categories it prioritized for evaluation. Hard spots were determined to have a low probability of failure. Dynamic Risk found extensive external corrosion anomalies and possible outliers in the data (Dynamic Risk 2019). Based on these findings, Dynamic Risk recommended Enbridge complete required excavations more quickly to provide feedback on the capability of ILI tools. Dynamic Risk also found that Enbridge’s subject matter experts needed to validate risk instead of using risk results to validate the subject matter experts’ judgement. Dynamic Risk recommended that Enbridge deploy stronger reactions to smaller indicators of potential issues to get ahead of emerging integrity vulnerabilities. 46 These accidents were not investigated by the NTSB. 31#

PIR-22-02, page 41Pipeline Investigation Report NTSB/PIR-22/02 Dynamic Risk made over 62 recommendations, including: • Continually evaluate all threats rather than discounting certain threats. • Formalize a continuous improvement process. • Conduct an audit of the cathodic protection program to determine effectiveness. • Consider site-specific rupture consequences for non-HCAs in risk analyses. • Include the potential for interaction of threats in risk analyses. 1.9 Postaccident Actions After the 2019 accident, Enbridge acted to identify additional hard spots that may have been missed during the original hard spot ILI runs. Enbridge worked with ILI vendors to develop, test, and evaluate ILI tools capable of detecting, identifying, and characterizing hard spots. Enbridge ran new hard spot tools on several segments of Line 15 and other lines. Over 120 verification digs were completed in response to these new ILI runs; Enbridge used these verification digs to validate the performance specifications of the new ILI hard spot tools. Enbridge modified its procedures on hard spot response and repair criteria. Enbridge created and implemented the framework and processes needed to execute its 3–5-year plan to transform its approach to IM. Enbridge’s goals for this project include changing organization, programs, behaviors, data, and support systems to achieve zero ruptures with confidence. As of May 2022, Enbridge had increased its IM staff from 50 to 124 and added specialists in fields such as reliability and geohazards. It created a new group, focused on clarifying accountabilities and work processes and applying IM program elements, to address Dynamic Risk’s recommendations. Before Enbridge remodeled its IM program, different pipelines operated under unique IM programs; now these programs are combined into one consolidated IM program, based on feedback from Dynamic Risk’s review. To continue this process, Enbridge intends to perform the following actions: • Improve data availability and accuracy, including automated data processing and quality control. • Reinforce shifts in decision making to support conservatism in the absence of certainty. • Expand the detail of the threat matrix for a more complete risk registry. • Use meaningful metrics to drive awareness and continuous improvement. Enbridge also increased the frequency of its integrity-related activities. 32#

PIR-22-02, page 42Pipeline Investigation Report NTSB/PIR-22/02 From early 2019 to May 8, 2020, Enbridge increased the number of pipeline ILI tool runs from 86 to 371 and subsequently increased the number of anomaly digs from 655 to 980. While data gaps found by Dynamic Risk were being addressed, Enbridge restricted pressure on 101 pipeline segments, which was equivalent to 3,189 miles. Enbridge also restricted pressure on 45 segments with A. O. Smith pipe, corresponding to 2,290 miles. These pressure restrictions affected 28 percent of its total gas transmission and midstream mileage. After the 2019 accident, Enbridge independently hired an engineering firm to study the area surrounding the rupture to gain information on the roles of the environment, coatings, and cathodic protection in the accident. This firm found the likely source of hydrogen was the applied cathodic protection and the abundance of sulfate present in the environment.47 However, the report also noted the cathodic protection levels were consistent with normal operating ranges and satisfied the industry and regulatory expectation. The engineering firm found the ground was a type of shale known to expand during heavy rainfall, and the soil contained high concentrations of sulfate-reducing bacteria, which can enhance hydrogen absorption into the steel. After the accident, Enbridge ran HSMFL ILI tools on 10 segments of Line 15, including the accident segment. These segments represent all of Line 15 between Kosciusko, Mississippi, and Holbrook, Pennsylvania, that contained pipe manufactured by A. O. Smith. These ILI runs were completed as part of the remedial work plan required under a corrective action order from PHMSA. In response to issues identified during the investigation, Enbridge took a number of actions, including hiring a third party to assess its public awareness and emergency response programs. Enbridge modified the Stanford Area Emergency Response Plan and made its safety data sheet for natural gas available on its public website. Enbridge also updated the right-of-way signage for TET, including a telephone number to call for information in the event of an emergency. 47 (a) When a pipe is under impressed current cathodic protection, hydrogen generation, also called hydrogen evolution, occurs at exposed steel pipe surfaces such as coating defects or discontinuations. (b) When pipeline steels with sensitive microstructures and higher hardness (such as hard spot locations near coating defects) are exposed to sufficient stress and hydrogen evolution, hydrogen-induced cracking may occur. 33#

PIR-22-02, page 43Pipeline Investigation Report NTSB/PIR-22/02 2. Analysis 2.1 Introduction On August 1, 2019, at 1:23 a.m., an Enbridge 30-inch-diameter natural gas transmission pipeline ruptured near Danville, Kentucky, in the Indian Camp Subdivision. A 33.2-foot section of the pipeline was ejected and landed about 481 feet southwest of the rupture. Natural gas that released from the rupture ignited, causing a large natural gas fire, several structure fires, and grass fires in the surrounding area. One person died, and six other people were injured, including a deputy sheriff. The fire destroyed 5 residences and damaged 14 others. As a result of the rupture, about 101.5 million cubic feet of natural gas were released. This analysis discusses the accident and following safety issues: • Nonconservative assumptions used to calculate potential impact radius. (See section 2.3.) • Incomplete evaluation of the risks caused by a change of gas flow direction. (See section 2.4.) • Limitations in data analysis related to the 2011 in-line inspection. (See section 2.5.) • Operators’ potential for incomplete assessment of threats and threat interactions. (See section 2.6.) • Missed opportunities in training and requalification practices at Enbridge. (See section 2.7.) Having completed a comprehensive review of the circumstances that led to the accident, the investigation established that the following factors did not contribute to its cause: • Internal corrosion . No internal corrosion was found between Danville CS and Tompkinsville CS during in-line inspections. • Stress corrosion cracking . NTSB testing concluded there were no branching cracks at the rupture origin, which are indicative of stress corrosion cracking. • Mechanical damage . No significant dents or other deformations were observed within 500 feet of the rupture origin during in-line inspections. • Local emergency response . No deficiencies were found in the review of local emergency response activities, and responders arrived in a timely manner after being alerted to the accident. The natural gas fire and the resulting extreme heat the deceased person was exposed to occurred 34#

PIR-22-02, page 44Pipeline Investigation Report NTSB/PIR-22/02 before the arrival of emergency responders. The actions of the Lincoln County Sheriff’s Office deputy sheriff directly resulted in the rescue of two elderly individuals. The NTSB concludes that none of the following were factors in the accident: internal corrosion, stress corrosion cracking, or mechanical damage of the pipeline, or local emergency response. 2.2 The Accident The NTSB investigation found that the fracture of the accident pipeline originated at a hard spot, a flaw in the pipeline created during manufacturing. As a manufacturing defect, hard spots can occur in pipes, particularly those of a certain vintage. Current API 5L standards classify hard spots of more than 2 inches in any direction and with a hardness equal to or more than 327 Brinell as rejectable defects.48 At 5.85 inches by 3 inches and with continuous hardness values of between 362 and 381 Brinell, the hard spot at the fracture origin on the accident pipeline would be considered a rejectable defect by these standards. However, it was not a rejectable defect at the time of manufacture. In 2014, Spectra initiated a gas flow reversal project during which they identified increased temperatures on the south side of the Danville CS as a risk that could increase external corrosion of the pipeline. Spectra installed gas coolers as a countermeasure; however, temperatures on the south side of the Danville CS continued to rise. Enbridge’s ILI data further showed that external corrosion on the south side of the Danville CS also increased: ILI data from 2010 and 2018 indicated a 166 percent rise in metal loss anomalies, and close interval survey data from 2012 and 2018–2019 showed a 72 percent increase in the length of pipeline on the impacted segment that did not meet PHMSA’s cathodic protection effectiveness criteria. (See section 2.4 for additional discussion of the gas flow reversal.) Enbridge and its predecessors increased cathodic protection voltages on the affected pipeline segment to compensate for the increased external corrosion. Further, after the gas flow reversal, Spectra increased the output voltage at the two rectifiers closest to the rupture origin by 18 percent and 58 percent. However, the increased rectifier outputs did not reduce the corrosion, and the number of external corrosion anomalies still increased. Although Spectra identified temperature increase as a risk and tried to address it and the resulting external corrosion, Spectra did not address how the temperature 48 At the time of the pipeline manufacture, the standards then did not specify rejectable criteria for a hard spot, such as hardness and length. 35#

PIR-22-02, page 45Pipeline Investigation Report NTSB/PIR-22/02 increase would affect other critical aspects of corrosion control, such as coating condition. With increased temperatures, coal tar enamels soften and become more pliable. On pipelines located in rockier areas, including shale, risk of coating damage is compounded, since “the effects of mechanical forces from soil stress increase” with a rise in temperature (Spectra 2014). Adhesion to the pipeline can also be affected, and coating damage can occur. The NTSB was unable to view the condition of the coating in the area closest to the rupture origin because of fire damage, but adjacent sections of pipeline unaffected by fire were examined by the NTSB, and coating damage was observed. Further, in a pipeline under impressed-current cathodic protection, the formation of hydrogen (commonly known as hydrogen evolution) will occur at external surfaces where the coating is disbonded, cracked, chipped, or otherwise damaged and may allow hydrogen absorption into the pipeline wall. A 2007 report to PHMSA by Kiefner and Associates, Inc., Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines , reviewed historical accidents associated with hard spots and found that cathodic protection systems are often the source of hydrogen (Kiefner and Associates, Inc. 2007).49 The combination of hydrogen, stress from operating pressure, and a vulnerable microstructure (for example, a rejectable hard spot) can cause hydrogen-induced cracking in locations where there is coating damage. This set of factors, including soil conditions, can also accelerate the growth of existing cracks, disbond coating, and embrittle areas with damaged or disbonded coating. However, if the coating is properly installed, bonded to the pipeline, and intact, hydrogen cannot enter the pipeline wall, and the coating acts as a protective barrier from external corrosion. The NTSB laboratory evaluation of the accident pipe revealed intergranular fracture features at the rupture origin consistent with hydrogen-induced cracking at a hard spot. Because the pipe was under cathodic protection, areas with coating defects that exposed the pipe metal would have been subjected to hydrogen evolution, allowing hydrogen to be absorbed into the steel surface of the pipe (Kiefner and Associates, Inc. 2007).50 49 Atomic hydrogen is created at a cathode (that is, an exposed pipe surface under cathodic protection), and the more negative the potential with respect to a reference voltage, the more aggressively hydrogen is created (Budinski and Wilde 1987). 50 Although the coating damage on the accident pipeline may also have been due to original construction defects, impacts from shale ground bedding, or both, evidence for either is unavailable. 36#

PIR-22-02, page 46Pipeline Investigation Report NTSB/PIR-22/02 The size and hardness of the hard spot at the origin of the fracture—both greater than those permitted by current API 5L standards—made it more susceptible to hydrogen-induced cracking. Therefore, the NTSB concludes that the combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project, resulted in hydrogen-induced cracking at the outer surface of Line 15 and the subsequent failure of the pipeline. 2.3 Calculation of the Potential Impact Radius Federal regulations require operators to mathematically calculate a pipeline’s PIR (the area where a pipeline’s potential failure could have a significant impact on people or property) when deciding whether the pipeline is located in an HCA. The size of the PIR and the accuracy of its calculation directly impact the number and size of HCAs. Gas transmission pipelines that are in HCAs are subject to additional regulatory requirements, such as integrity management regulations. Although Enbridge did perform some integrity management actions on L15 VS4, the NTSB found deficiencies in its IM program, as discussed in sections 2.4, 2.5 and 2.6. The PIR at the rupture site calculated under PHMSA regulations was 633 feet. Physical evidence at the accident site and from the Lincoln County Coroner’s report showed that the PIR of the accident site was larger than what was calculated. The deceased individual was found 640 feet south of the pipeline failure and natural gas fire, and damage to homes was found up to 1,100 feet from the rupture crater. Past accidents have also demonstrated the insufficiency of the PIR calculation. In 2000, a pipeline rupture in Carlsbad, New Mexico, killed 12 people camped about 675 feet from the rupture crater; the PIR would have been calculated at 598 feet by current federal regulations (NTSB 2003). A pipeline that ruptured in San Bruno, California, in 2010 had a PIR of 414 feet, but homes were damaged up to 600 feet from the rupture origin (NTSB 2011). A rupture in Sissonville, West Virginia, in 2012 displayed evidence of thermal damage up to 610 feet from the rupture origin, but the PIR was calculated as 567 feet (NTSB 2014). These discrepancies prompted the NTSB to further evaluate the assumptions on which the PIR equation is based. The NTSB found that the equation is based on nonconservative assumptions, including the flow equation and flow coefficient, which are based on restricted gas flow after the rupture. However, the gas flow from this accident pipeline, as well as that of the other gas pipeline accidents discussed above, was unrestricted because a section of pipeline had been ejected. Unrestricted gas flow rates are significantly higher than restricted gas flow rates. The current PIR equation also assumes a gas flow release factor more consistent with the middle-to-end of a release event, not the beginning, which is when the most 37#

PIR-22-02, page 47Pipeline Investigation Report NTSB/PIR-22/02 significant injuries typically occur. 51 Further, the equation assumes a gas temperature of 59°F; however, temperatures were considerably higher on the ruptured pipeline segment in Danville. 52 Assumptions about the impacted public are also inconsistent with available data. The PIR equation assumes a heat radiation intensity of 5,000 BTU/hr-ft2 . 53 In contrast, API Recommended Practice 521, Pressure-R elieving and Depressurizing Systems , recommends only a 1,500 BTU/hr-ft2 heat intensity in areas where exposures lasting 2–3 minutes may be required by personnel without shielding but with appropriate clothing, and just 500 BTU/hr-ft2 heat intensity in areas where personnel with appropriate clothing may be continuously exposed.54 Appropriate clothing includes items such as fire-resistant clothing, which members of the public cannot be expected to have when a rupture occurs. Thus, the PIR equation uses an acceptable heat radiation intensity at least 3.3 to 10 times the actual maximum survivable level of heat radiation, depending on the length of time the public is exposed to the heat intensity before they are able to leave the area. This does not account for the lack of protective clothing likely to be readily available to the public, which further distorts the survivable level in the presence of heat radiation. In the Danville accident, the off-duty sheriff’s deputy found the injured couple 480 feet from the rupture crater and reported that the intensity of the heat was more than he could handle. He could not approach the decedent, who was 640 feet from the rupture site, because of the heat’s intensity and the duration of his ongoing exposure. PHMSA’s PIR model assumes a 1 percent chance of mortality for a person with 30 seconds of exposure to find shelter. This mortality rate assumes that an individual would take 5 seconds after a fire to analyze the situation, decide to evacuate, run for 25 seconds at 2.5 meters per second, and then successfully find sufficient shelter from the ongoing natural gas fire. Determining the probability of human error is complicated when faced with a circumstance like a gas rupture (Idaho National 51 Natural gas fires are more intense at the beginning due to the larger amount of gas and higher pressure. 52 Gas flow rates increase with increased temperatures. 53 When calculating a potential impact radius, the lower the allowable heat radiation intensity, the more conservative the equation. 54 API Recommended Practice 521 can be used to calculate permissible levels of heat flux for both acute and chronic exposures based on radiation dose load, temperature limits, exposure time, and pain thresholds, among other factors. 38#

PIR-22-02, page 48Pipeline Investigation Report NTSB/PIR-22/02 Laboratory 2005).55 The ability for a member of the public to respond following a gas rupture may be complicated by, for example, sleeping, being in an interior room where one may not be immediately aware of an emergency, or evacuating other household members who cannot self-evacuate. Furthermore, the speed with which the member of the public is assumed to run (2.5 m/s) is not representative of the general population, including the very young, elderly, mobility-impaired, or those with pre-existing medical conditions. 56 The two evacuees rescued by the deputy sheriff were both elderly and mobility-impaired. Further, a study by an engineering firm showed that the assumptions on which the PIR equation is based would likely result in a mortality rate of over 50 percent for individuals aged between 60 and 80 (DEATECH Consulting Company 2008). PHMSA’s PIR equation also assumes that natural gas would have a vertical flame, and damage would occur radially. Aerial evidence of the fire that followed the rupture in Danville demonstrated that the natural gas flame was primarily oriented east with a large horizontal component and that the heat-affected zone was larger in that direction. In summary, the NTSB concludes that PHMSA’s equation for determining the PIR of a pipeline rupture is based on assumptions that are inconsistent with findings from recent natural gas ruptures and human response data; thus, high consequence areas determined using the equation do not include the full area at risk. Therefore, the NTSB recommends that PHMSA revise the calculation methodology used in their regulations to determine the PIR of a pipeline rupture based on the accident data and human response data discussed in this report. 2.4 Management of Gas Flow Reversal As stated previously, because the pipe was under cathodic protection following the gas flow reversal, areas with coating defects had increased hydrogen evolution, which reduced the pipeline integrity. However, after the gas flow reversal in 2014, neither Spectra nor Enbridge evaluated the data available on temperatures, cathodic protection, and external corrosion anomalies in L15 VS4 to determine the impacts of the project on pipeline integrity. These data are difficult to predict in advance, and cathodic protection may not respond to operational changes in a predictable way. Extensive research on the effects of major operational changes has 55 In the simplified human reliability analysis method used by the Nuclear Regulatory Commission, success is broken down based on available time, stress, complexity, experience/training, procedures, ergonomics, fitness for duty, and work processes. The nominal error rate is 0.011. 56 Data collected from 5-kilometer race results in the United States in 2010 found that male race participants aged between 20 and 40 ran 5.9 miles per hour, and females ran 5.0 miles per hour for the same age group. Although 5.6 miles per hour falls within these averages, only a certain percentage of the population is aged 20 to 40 or competes in 5-kilometer races. 39#

PIR-22-02, page 49Pipeline Investigation Report NTSB/PIR-22/02 not been performed, leaving operators only able to plan for general effects (for example, adding gas coolers to address increased temperatures) and requiring them to perform further study after operational changes to detect more subtle effects (such as unstable or ineffective cathodic protection leading to hydrogen evolution). Because Enbridge and its predecessor did not review critical data, they did not identify the suitability of its corrosion control equipment and infrastructure for reversed flow, recognize indicators of coating damage, or identify the cathodic protection system as a likely source of hydrogen evolution. The NTSB concludes that Enbridge and Spectra did not effectively identify, investigate, or manage the impact of the gas flow reversal project on the level of hydrogen evolution in the pipeline surface, which ultimately contributed to the failure of the pipeline. Therefore, the NTSB recommends that Enbridge evaluate the effectiveness of its corrosion control equipment and infrastructure following any major change in operations, such as a gas flow reversal. The NTSB further concludes that comprehensive management of the changes resulting from the gas flow reversal project on Line 15 would have identified and addressed risks such as coating damage, ineffective cathodic protection, and suitability of corrosion control equipment and infrastructure that led to hydrogen-induced cracking in the pipeline surface. Therefore, the NTSB recommends that PHMSA advise natural gas transmission pipeline operators on a) the circumstances of this accident; b) the need to evaluate the risks associated with flow reversal projects; and c) the impacts of such projects on hydrogen-induced cracking. 2.5 In-Line Inspection Tool and Data Analyses The 2011 hard spot in-line inspection data discussed in sections 1.8.4.1 and 1.8.5 were analyzed twice by ILI vendors: the first analysis in 2011 predicted 16 potential hard spots, while the second analysis in 2019 (requested by the NTSB after the rupture) predicted 441 hard spots. Although hard spots occur during manufacturing and would have been present at the time of the 2011 HSMFL ILI run, the closest hard spot reported by NDT Systems & Services in 2011 following their analysis was located about 2.2 miles from the rupture site. After the 2019 accident, the NTSB performed hardness and microhardness testing in the area of the fracture origin. The NTSB found that two hard spots identified in the 2019 NDT Global analysis near the fracture origin were significantly harder than ILI predictions; in fact, these two hard spots were one hard spot. Further, at an additional location where the 2019 NDT Global analysis predicted a hard spot, the NTSB found that no hard spot was present. Including the four verification digs in 2011 and the NTSB measurements, only seven points were available for comparison between predicted and actual hard spots. A sample size of 7 out of 441 is statistically insignificant, and no trends can be determined from these limited data. Insufficient 40#

PIR-22-02, page 50Pipeline Investigation Report NTSB/PIR-22/02 data are currently available to determine the accuracy of NDT Systems & Services’ hard spot tool, NDT Systems & Services’ 2011 analysis report, or NDT Global’s 2019 analysis report. The NTSB recognizes that the 2019 analysis conducted by NDT Global identified more hard spots than the 2011 analysis. However, the presence of the hard spot found by the NTSB during postaccident testing that exceeded the size and hardness specified by current API 5L standards suggests limitation in either the hard spot tool, the HSMFL ILI inspection method, or of the analysis of the collected data. NDT Systems & Services’ performance specification for its hard spot tool did not clearly state if the probability of detection, location accuracy, and sizing accuracy applied to hard spots, metal loss anomalies, or both. To be consistent with the 2005 edition of API STD 1163, all these specifications should have been included, as well as the limitations of the tool when detecting hard spots. For example, NDT Systems & Services should have listed the upper and lower detection limits for hard spots. At the time of the 2011 HSMFL ILI run, API STD 1163 had been an industry best practice for almost 6 years. The analysis of ILI data further complicates the issue of tool limitations, as some ILI tools, including hard spot tools, rely heavily on analyst interpretation when processing the raw data. Different software settings selected by the analyst, such as gain, and equipment specifications, including monitor resolution, can result in large differences in findings, which in turn impact ILI predictions. NDT Systems & Services’ 2011 analysis did not discuss any specifics on the analysis methods or settings. In addition to running its HSMFL ILI tool on Line 15 and other TET pipelines, NDT Systems & Services ran its tool on at least 1,320.8 miles of pipelines owned by other operators. As stated above, the tool’s performance specifications were incomplete, field verifications consistent with current regulations were insufficient to validate ILI tool performance, and insufficient data were available on the accuracy of the hard spot tool. Even if an operator were to conduct data analyses according to industry standards, because of the deficiencies noted with the tool, the NTSB is concerned that pipelines inspected with NDT Systems & Services’ HSMFL ILI tool may have similar unidentified issues. Therefore, the NTSB concludes that the extent of hard spots on other pipelines evaluated using NDT Systems & Services’ HSMFL ILI tool is likely unknown because of the limitations of the tool and analysis techniques found during this investigation; thus, operators who have relied on this tool for hard spot detection may be unable to effectively manage pipeline integrity. The NDT Systems and Services HSMFL ILI tool was not the only tool of this type on the market in 2011. However, starting in 2013, the number of available HSMFL ILI tool vendors diminished, including NDT Systems and Services, which discontinued the use of their tool the year before. Since 2013, new HSMFL ILI tools have been developed, and the availability and maturity of these tools and the analysis of their data has advanced. The advancement in the analysis of the data was demonstrated 41#

PIR-22-02, page 51Pipeline Investigation Report NTSB/PIR-22/02 by the increase of potential hard spots identified in the 2019 analysis conducted by NDT Global; even using data from the old tool, additional hard spots were identified. However, the NTSB also found that the identification did not represent real world findings following the 2019 analysis; thus, a more advanced tool may help improve hard spot identification. Hard spots are often considered inactive threats, and pipeline operators can consider inactive threats stable. If operating conditions are stable and hard spots are considered an inactive threat, operators would not need to reassess their systems for hard spots. This means that it is possible for a pipeline operator to only run an HSMFL ILI tool on susceptible pipeline segments once over the life of the pipe. Because of the deficiencies noted with the HSMFL ILI tools and analyses used by NDT Systems & Services and potentially others and the fact that improvements have been made since 2013, the NTSB is concerned there are other pipeline operators who performed one- time HSMFL ILI assessments that may not have accurately identified the presence of hard spots. Thus, the NTSB concludes that pipeline operators may not have an accurate understanding about the location, size, hardness, and presence of hard spots on susceptible pipeline segments assessed by HSMFL ILI tools before 2013 or analyzed using this data. Therefore, the NTSB recommends that PHMSA advise natural gas transmission pipeline operators of the possible data limitations associated with HSMFL ILI tools and analyses used in hard spot management programs and reinforce the need to follow industry best practices when conducting ILI data analysis. 2.6 Threat Assessment and Interactions To support threat deactivation, or the point at which threats can be considered stable, an operator must collect data to identify the potential threats. After excavating four hard spots in 2011, Spectra and later Enbridge considered the threat from hard spots eliminated on L15 VS4, thus deactivated. Although measurements from excavations showed conservative agreement with ILI predictions, the number of sites excavated (which were based on the number and severity of anomalies predicted) was statistically insignificant compared with the mileage inspected. After 2011, no further data on hard spots were collected, and Spectra and Enbridge performed no additional HSMFL ILI runs or analyses on Line 15 until after the 2019 accident, when the data were re-analyzed. In its 2019 audit, Dynamic Risk recommended Enbridge consider all threats possible and continually evaluate them, rather than eliminating certain threats entirely (Dynamic Risk 2019). The NTSB concludes that, although Enbridge had classified the threat of hard spots as inactive at the time of the accident on August 1, 2019, insufficient data were available to support this threat status on the ruptured pipeline segment because of the limitations in the HSMFL ILI tool and Enbridge’s analysis. On February 1, 2020, PHMSA published a guidance document on risk assessments and risk modeling, in part to address NTSB Safety Recommendations 42#

PIR-22-02, page 52Pipeline Investigation Report NTSB/PIR-22/02 P-15-10, P-15-12, and P-15-13 (PHMSA 2020). 57 This document recommended pipeline operators address all findings within a 2016 study by Kiefner & Associates, Inc. This study found that changes in operating conditions could intensify certain threats, including those posed by hard spots. Examples of operational changes included changes in temperature and cathodic protection loads, as well as reversal of flow direction (Muñoz and Rosenfeld 2016). Degradation of coating, increased rates of external corrosion, and decreased effectiveness of cathodic protection can also result from operational changes. The flow reversal significantly altered operating conditions on L15 VS4; however, Spectra and Enbridge did not assess L15 VS4 for how the change in operating conditions affected the hard spots between the 2014 flow reversal and the 2019 accident, missing an opportunity to identify threats to pipeline integrity, as discussed in section 2.4. The NTSB concludes that, had the status of threats on Line 15 been re-evaluated after the flow reversal project, Spectra or Enbridge would have had the opportunity to determine how the change in operating conditions affected the hard spots. When considering whether a threat is active or inactive, a pipeline operator must also account for interactions with other threats, according to 49 CFR 192.917. At the time of the 2019 accident, Enbridge’s IM program manual stated manufacturing threats did not interact with corrosion of any type. However, hard spots interact with external corrosion by destabilizing over time from the introduction of hydrogen by cathodic protection, as well as by interacting with internal corrosion. This has been shown in several industry standards and white papers, including API Recommended Practice 1160, Managing System Integrity for Haza rdous Liquids Pipelines , and Kiefner & Associates, Inc.’s 2007 report, Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines (API 2001; Kiefner & Associates, Inc. 2007). Enbridge used data from the 2011 HSMFL ILI run to classify the threat of hard spots as inactive on the accident pipeline in the area of the rupture, but later analysis and external audits indicated that these data were not enough to substantiate that classification. Changes in pipeline operation—such as a major flow reversal project— can have significant impacts on threats such as hard spots, so Enbridge should have re-evaluated these threats after the project. Further, federal regulations require pipeline operators to account for interactions among threats in their pipelines, as certain threats can intensify others. The NTSB concludes that Enbridge’s processes 57 In 2015, the NTSB recommended that PHMSA update its guidance for gas transmission pipeline operators and inspectors on the evaluation of interactive threats (NTSB Safety Recommendation P-15-10); evaluate the safety benefits of risk assessment approaches allowed by IM regulations and disseminate the results of the evaluation (NTSB Safety Recommendation P-15-12); and update guidance for gas transmission pipeline operators and inspectors on critical components of risk assessment approaches (NTSB Safety Recommendation P-15-13). All three recommendations are classified “Closed—Acceptable Action.” 43#

PIR-22-02, page 53Pipeline Investigation Report NTSB/PIR-22/02 and procedures were inconsistent with PHMSA guidance and industry knowledge of hard spot threat interactions, leading Enbridge to underestimate the risk posed by hard spots. Therefore, the NTSB recommends that Enbridge revise its integrity management program to include (a) data required to support the active or inactive status of each threat, including hard spots; (b) conditions and situations that require reassessment and re-evaluation of threat status, including flow reversal and other major projects; and (c) the interactions between hard spots and all types of corrosion. 2.7 Training and Requalification Practices On May 8, 2019, an emergency shutdown occurred at the Danville CS. During this emergency shutdown, the station operator demonstrated a fundamental lack of knowledge of station operations when he failed to use the SCADA graphics to troubleshoot the problem and closed a valve irrelevant to the event. After this incident, the station operator was not disqualified or requalified for any covered tasks nor required to take remedial training. On August 1, 2019, the same station operator was on duty when the rupture occurred. After viewing the fireball caused by the rupture and receiving a call from the gas control center, the station operator did not refer to the Stanford Area Emergency Response Plan , which listed the specific valves that required closure for isolation, and failed to isolate Line 15 at the station until the area supervisor directly instructed him to close valve 15-393. Enbridge employees are required to follow the Stanford Area Emergency Response Plan in the event of an emergency. Valve 15-393 took less than 4 minutes to operate, but it was not closed until about 16 minutes after the rupture. The Danville CS on-duty station operator’s lack of knowledge of emergency response procedures resulted in a delay in the closure of valve 15-393. This delay increased the volume of gas released, which increased the duration and intensity of the fire. The NTSB concludes that had Enbridge disqualified, requalified, or provided remedial training to the Danville CS operator after he displayed a fundamental lack of knowledge during the May 8, 2019, emergency shutdown, the operator’s closure of valve 15-393 during the August 1, 2019, rupture may not have been delayed, potentially reducing the volume of gas released. Therefore, the NTSB recommends that Enbridge disqualify and require remedial training and requalification of the covered task(s) whenever an employee does not follow procedures when responding to an emergency shutdown, rupture, or other abnormal operation. 44#

PIR-22-02, page 54Pipeline Investigation Report NTSB/PIR-22/02 3. Conclusions 3.1 Findings 1. None of the following were factors in the accident: internal corrosion, stress corrosion cracking, or mechanical damage of the pipeline, or local emergency response. 2. The combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project, resulted in hydrogen-induced cracking at the outer surface of Line 15 and the subsequent failure of the pipeline. 3. The Pipeline and Hazardous Materials Safety Administration’s equation for determining the potential impact radius of a pipeline rupture is based on assumptions that are inconsistent with findings from recent natural gas ruptures and human response data; thus, high consequence areas determined using the equation do not include the full area at risk. 4. Enbridge Inc. and Spectra Energy Partners, LP did not effectively identify, investigate, or manage the impact of the gas flow reversal project on the level of hydrogen evolution in the pipeline surface, which ultimately contributed to the failure of the pipeline. 5. Comprehensive management of the changes resulting from the gas flow reversal project on Line 15 would have identified and addressed risks such as coating damage, ineffective cathodic protection, and suitability of corrosion control equipment and infrastructure that led to hydrogen-induced cracking in the pipeline surface. 6. The extent of hard spots on other pipelines evaluated using NDT Systems & Services’ hard spot magnetic flux leakage in-line inspection tool is likely unknown because of the limitations of the tool and analysis techniques found during this investigation; thus, operators who have relied on this tool for hard spot detection may be unable to effectively manage pipeline integrity. 7. Pipeline operators may not have an accurate understanding about the location, size, hardness, and presence of hard spots on susceptible pipeline segments assessed by hard spot magnetic flux leakage in-line inspection tools before 2013 or analyzed using this data. 8. Although Enbridge Inc. had classified the threat of hard spots as inactive at the time of the accident on August 1, 2019, insufficient data were available to support this threat status on the ruptured pipeline segment because of the 45#

PIR-22-02, page 55Pipeline Investigation Report NTSB/PIR-22/02 limitations in the hard spot magnetic flux leakage in-line inspection tool and Enbridge Inc.’s analysis. 9. Had the status of threats on Line 15 been re-evaluated after the flow reversal project, Spectra Energy Partners, LP or Enbridge Inc. would have had the opportunity to determine how the change in operating conditions affected the hard spots. 10. Enbridge Inc.’s processes and procedures were inconsistent with the Pipeline and Hazardous Materials Safety Administration’s guidance and industry knowledge of hard spot threat interactions, leading Enbridge Inc. to underestimate the risk posed by hard spots. 11. Had Enbridge Inc. disqualified, requalified, or provided remedial training to the Danville compressor station operator after he displayed a fundamental lack of knowledge during the May 8, 2019, emergency shutdown, the operator’s closure of valve 15-393 during the August 1, 2019, rupture may not have been delayed, potentially reducing the volume of gas released. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the August 1, 2019, rupture of an Enbridge Inc. natural gas transmission pipeline and resulting fire was the combination of a pre-existing hard spot (a manufacturing defect), degraded coating, and ineffective cathodic protection applied following a 2014 gas flow reversal project, which resulted in hydrogen-induced cracking at the outer surface of Line 15 and the subsequent failure of the pipeline. Contributing to the accident was the 2014 gas flow reversal project that increased external corrosion and hydrogen evolution. Also contributing to this accident was Enbridge’s integrity management program, which did not accurately assess the integrity of the pipeline or estimate the risk from interacting threats. 46#

PIR-22-02, page 56Pipeline Investigation Report NTSB/PIR-22/02 4. Recommendations 4.1 New Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration: 1. Revise the calculation methodology used in your regulations to determine the potential impact radius of a pipeline rupture based on the accident data and human response data discussed in this report. (P-22-1) 2. Advise natural gas transmission pipeline operators on a) the circumstances of this accident; b) the need to evaluate the risks associated with flow reversal projects; and c) the impacts of such projects on hydrogen-induced cracking. (P-22-2) 3. Advise natural gas transmission pipeline operators of the possible data limitations associated with hard spot magnetic flux leakage in-line inspection tools and analyses used in hard spot management programs and reinforce the need to follow industry best practices when conducting in-line inspection data analysis. (P-22-3) To Enbridge Inc.: 4. Evaluate the effectiveness of your corrosion control equipment and infrastructure following any major change in operations, such as a gas flow reversal. (P-22-4) 5. Revise your integrity management program to include (a) data required to support the active or inactive status of each threat, including hard spots; (b) conditions and situations that require reassessment and re-evaluation of threat status, including flow reversal and other major projects; and (c) the interactions between hard spots and all types of corrosion. (P-22-5) 6. Disqualify and require remedial training and requalification of the covered task(s) whenever an employee does not follow procedures when responding to an emergency shutdown, rupture, or other abnormal operation. (P-22-6) 47#

PIR-22-02, page 57Pipeline Investigation Report NTSB/PIR-22/02 BY THE NATIONAL TRANSPORTATION SAFETY BOARD JENNIFER HOMENDY Chair MICHAEL GRAHAM Member BRUCE LANDSBERG Vice Chairman THOMAS CHAPMAN Member Report Date: August 15, 2022 48#

PIR-22-02, page 58Pipeline Investigation Report NTSB/PIR-22/02 Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified on August 1, 2019, of the accident that occurred in Danville, Kentucky. A 30-inch natural gas transmission pipeline ruptured, which caused a large natural gas release and fire. The NTSB launched an investigator-in-charge, a senior metallurgist from the NTSB Materials Laboratory, and a survival factors and emergency response investigator. The parties to the investigation are the Pipeline and Hazardous Materials Safety Administration, Lincoln County Emergency Management, Lincoln County Fire Protection District, Enbridge Inc., and NDT Global LLC. 49#

PIR-22-02, page 59Pipeline Investigation Report NTSB/PIR-22/02 Appendix B: Consolidated Recommendation Information Title 49 United States Code (USC) 1117(b) requires the following information on the recommendations in this report. For each recommendation— (1) a brief summary of the NTSB’s collection and analysis of the specific accident investigation information most relevant to the recommendation; (2) a description of the NTSB’s use of external information, including studies, reports, and experts, other than the findings of a specific accident investigation, if any were used to inform or support the recommendation, including a brief summary of the specific safety benefits and other effects identified by each study, report, or expert; and (3) a brief summary of any examples of actions taken by regulated entities before the publication of the safety recommendation, to the extent such actions are known to the Board, that were consistent with the recommendation. To the Pipeline and Hazardous Materials Safety Administration P-22-1 Revise the calculation methodology used in your regulations to determine the potential impact radius of a pipeline rupture based on the accident data and human response data discussed in this report. Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.3 Calculation of the Potential Impact Radius; (b)(2) is not applicable; and (b)(3) is not applicable. P-22-2 Advise natural gas transmission pipeline operators on a) the circumstances of this accident; b) the need to evaluate the risks associated with flow reversal projects; and c) the impacts of such projects on hydrogen-induced cracking. 50#

PIR-22-02, page 60Pipeline Investigation Report NTSB/PIR-22/02 Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.4 Management of Gas Flow Reversal; (b)(2) can be found in 1.8.2 Threat Identification and Interaction; and (b)(3) is not applicable. P-22-3 Advise natural gas transmission pipeline operators of the possible data limitations associated with hard spot magnetic flux leakage in-line inspection tools and analyses used in hard spot management programs and reinforce the need to follow industry best practices when conducting in-line inspection data analysis. Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.5 In-Line Inspection Tool and Data Analyses; (b)(2) is not applicable; and (b)(3) can be found in 1.9 Postaccident Actions. To Enbridge Inc. P-22-4 Evaluate the effectiveness of your corrosion control equipment and infrastructure following any major change in operations, such as a gas flow reversal. Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.4 Management of Gas Flow Reversal; (b)(2) is not applicable; and information supporting (b)(3) can be found in section 1.9 Postaccident Actions. P-22-5 Revise your integrity management program to include (a) data required to support the active or inactive status of each threat, including hard spots; (b) conditions and situations that require reassessment and re-evaluation of threat status, including flow reversal and other major projects; and (c) the interactions between hard spots and all types of corrosion. Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.6 Threat Assessment and Interactions; (b)(2) is not applicable; and information supporting (b)(3) can be found in section 1.9 Postaccident Actions. P-22-6 51#

PIR-22-02, page 61Pipeline Investigation Report NTSB/PIR-22/02 Disqualify and require remedial training and requalification of the covered task(s) whenever an employee does not follow procedures when responding to an emergency shutdown, rupture, or other abnormal operation. Information that addresses the requirements of 49 U.S.C. 1117(b)(1), as applicable, can be found in section 2.7 Training and Requalification Practices; (b)(2) is not applicable; and information supporting (b)(3) is not applicable. 52#

PIR-22-02, page 62Pipeline Investigation Report NTSB/PIR-22/02 References American Petroleum Institute (API). 1956. High -Test Line Pipe , 6th Ed. Standard 5LX, Washington, DC: API. ——— . 2001. Managing System Integrity for Hazardous Liquids Pipelines , 1st Ed. Recommended Practice 1160, Washington, DC: API. American Society of Mechanical Engineers (ASME). 2012. Managing System Integrity of Gas Pipelines . ASME B31.8S, as incorporated in Title 49 Code of Federal Regulations 192.903, New York, NY: ASME International. Barkdull, L. A., Beavers, J. A., Bubenik, T. A., and Vieth, P. H. 2006. Review of DEGT Hard Spot Management Activities . Dublin, OH: CC Technologies, Inc. Budinski, M. K., and Wilde, B. E. 1987. “Technical Note: An Electrochemical Criterion for the Development of Galvanic Coating Alloys for Steel,” Corrosion 43, no. 1: 60–62. Clark, E. B., Leis, B. N., and Eiber, R. J. 2005. Integrity C haracteristics of V intage P ipelines . Washington, DC: The Interstate Natural Gas Association of American, Inc., pp. 20–21. DEATECH Consulting Company. 2008. “Analysis of Report No. GRI – 00/0189 on ‘A Model for Sizing High Consequence Areas Associated with Natural Gas Pipelines.’” Montgomery, TX: DEATECH Consulting Company. Dynamic Risk Assessment Systems, Inc. 2019. Independent Pipeline Integrity Program Review: Phase 1 Summary . Calgary, AB: Dynamic Risk. Issued July 17. Enbridge Inc. 2015. Stanford Area Emergency Response Manual . Houston, TX: Spectra Energy Partners, Limited Partnership. ——— . 2018. Standard Operating Procedure 9-3040, Enhanced Survey Analysis. Selected Excerpts: Spectra Energy Transmission Standard Operating Procedures . ——— . 2019a. Enbridge Gas Transmission and Midstream Danville Sustained Venting from ESD , May 8 th , 2019 . Incident Investigation Report, June 21. ——— . 2019b. Standard Operating Procedure 9-3010, Response to In-Line Inspection. Selected Excerpts: Spectra Energy Transmission Standard Operating Procedures . ——— . 2020. Company Response to NTSB Information Request No. 115 . Issued May 8. 53#

PIR-22-02, page 63Pipeline Investigation Report NTSB/PIR-22/02 Kiefner and Associates, Inc. 2007. Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines . Final Report to US Department of Transportation, Pipeline and Hazardous Materials Safety Administration (PHMSA) No. 05-12R. Worthington, OH: Kiefner and Associates, Inc. Idaho National Laboratory. 2005. The SPAR-H Human Reliability Analysis Method . NUREG/CR-6883. Washington, DC: US Nuclear Regulatory Commission. Mesloh, R. E., and Rosenfeld, M. J. 2003. Final Report on Investigation of the Service Failure of Duke Energy’s Texas Eastern Line No. 15 —Danville Discharge at Mile Post 501.76 on November 1, 2003, to Duke Energy Company . Final Report No. 03-76. Worthington, OH: Kiefner and Associates, Inc. Muñoz, E., and Rosenfeld, M. J. 2016. DTPH56-14-H-00004: Improving Models to Consider Complex Loadings, Operational Considerations, and Interactive Threats . Final Report to PHMSA No. 16-228. Columbus, OH: Kiefner and Associates, Inc. NDT Global. 2019. Linalog® Hard Spot Inspection Report: Re-analysis of Hard Spot Data. Issued September 9. Houston, TX: NDT Global. NTSB (National Transportation Safety Board). 2003. Natural Gas Pipeline Rupture and Fire, Near Carlsbad, New Mexico, August 19, 2000 . PAR-03/01. Washington, DC: NTSB. ———. 2011. Pacific Gas and Electric Company, Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010 . PAR-11/01. Washington, DC: NTSB. ———. 2012. Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release, Marshall, Michigan, July 25, 2010 . PAR-12/01. Washington, DC: NTSB. ———. 2014. Columbia Gas Transmission Corporation Pipeline Rupture, Sissonville, West Virginia, December 11, 2012 . PAR-14/01. Washington, DC: NTSB. PHMSA. 2017. Advisory Bulletin on Pipeline Safety: Deactivation of Threats. FR 82, no. 50 (March 16). Washington, DC: US Department of Transportation, PHMSA. https://www.govinfo.gov/content/pkg/FR-2017-03-16/pdf/FR-2017-03-16.pdf. ———. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation. Washington, DC: US Department of Transportation, PHMSA. Process Performance Improvement Consultants, LLC. 2012. US Operations Integrity Management Program Effectiveness Review. 54#

PIR-22-02, page 64Pipeline Investigation Report NTSB/PIR-22/02 RSPA (Research and Special Programs Administration). 2003. Corrective Action Order CPF 2-2003-1018H. Washington, DC: RSPA. Spectra Energy Partners, Limited Partnership. 2014. Coating Temperature Limitations. Internal company report. 55#

PIR-22-02, page 65Pipeline Investigation Report NTSB/PIR-22/02 The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974, to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)). For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID PLD19FR002. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting— National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2022-100118. For additional assistance, contact— National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 NTIS website 56#