NTSB Safety Recommendation Letter P-03-001 through P-03-003

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: February 27, 2003 In reply refer to: P-03-1 through -3 Honorable Ellen G. Engleman Administrator Research and Special Programs Administration 400 Seventh Street, S.W. Washington, D.C. 20590 At 5:26 a.m., mountain daylight time, on Saturday, August 19, 2000, a 30-inch-diameter natural gas transmission pipeline operated by El Paso Natural Gas Company (EPNG) ruptured adjacent to the Pecos River near Carlsbad, New Mexico. The released gas ignited and burned for 55 minutes. Twelve persons who were camping under a concrete-decked steel bridge that supported the pipeline across the river were killed and their three vehicles destroyed. Two nearby steel suspension bridges for gas pipelines crossing the river were extensively damaged. According to EPNG, property and other damages or losses totaled $998,296.1 The National Transportation Safety Board determined that the probable cause of this accident was a significant reduction in pipe wall thickness due to severe internal corrosion. The severe corrosion had occurred because EPNG’s corrosion control program failed to prevent, detect, or control internal corrosion within the company’s pipeline. Contributing to the accident were ineffective Federal inspections of EPNG that did not identify deficiencies in the company’s internal corrosion control program. Examination of the pipe (EPNG line 1103) at the rupture location revealed five wrinkles in the pipe wall at the top of the pipeline. Wrinkles in the wall of a pipe occur when a pipe is bent, either to align pieces of pipe during construction or from external forces, such as earth movement, after the pipeline is in service. When pipe is bent and wrinkles form on the top of the pipe, a low point is created at the bottom of the pipe opposite the wrinkles. The observed internal corrosion in the pipeline at the rupture location was at such a low point, where liquids likely accumulated into a pool with a fluctuating liquid level. Because the density of water is greater than that of hydrocarbon liquids present in the pipeline, water in the pipeline would remain at the bottom of the pool with the liquid hydrocarbons on top, creating an ideal environment for the development of internal corrosion. The original construction of line 1103 in about 1950 included a block valve and drip approximately 1 mile east of the Pecos River. The block valve, designated No. 6, was on a hill 1 For additional information, see National Transportation Safety Board, Natural Gas Pipeline Rupture and Fire Near Carlsbad, New Mexico, August 19, 2000, Pipeline Accident Report NTSB/PAR-03/01. 7310B#

Page 22 about 62 feet higher than the Pecos River. The underground drip was placed downstream of the block valve and was 31 feet lower in elevation than the pipeline at block valve No. 6. This configuration facilitated the trapping of liquids and solids flowing in line 1103 toward the Pecos River compressor station by the drip, which was upstream of the rupture location. When pigging facilities were added to line 1103 about 25 years after initial construction, a pig launcher was installed at block valve No. 2, and a pig receiver was placed at block valve No. 6. During pigging operations, the pig and some of the liquids and solids being pushed by the pig would be caught in the pig receiver at block valve No. 6. Any material that passed the pig receiver, either during normal operations or because of a pig run, would flow downstream and downhill to the drip. Postaccident visual examination of the drip revealed that, at one point, about 70 percent of the drip cross-section was filled with the blackish oily-powdery/grainy material that acted as a dam inside the drip, preventing some of the materials entering the drip from continuing to the far end of the barrel to the siphon drain. This blockage also likely contributed to movement of liquids and solids past the drip. Materials flowing past the drip could then collect at low points in the downstream pipeline, such as the low point at the rupture location, where they would remain until gas flow of sufficient velocity was available to sweep the liquids farther downstream toward the inlet scrubbers at Pecos River compressor station. Velocity data provided by EPNG for the period 1991 to 2000 indicated numerous periods when the gas velocity was substantially below the preferred sweeping velocity of 25 feet per second. The Safety Board concluded that, as a likely result of the partial clogging of the drip upstream of the rupture location, some liquids bypassed the drip, continued through the pipeline, and accumulated and caused corrosion at the eventual rupture site where pipe bending had created a low point in the pipeline. Periodic use of cleaning pigs can remove water and other liquid and solid contaminants from a pipeline. One of the considerations for the design and construction of a cleaning pig system is to make provisions for effective collection and removal of the accumulated materials from the pipeline after pigging. In line 1103, because of the configuration of the piping, including the location of the pig receiver, the valves at block valve No. 6, and the geometry of the drip, cleaning pigs could not be run in the section of pipeline that ruptured. Some of the liquids and solids that accumulated in front of the cleaning pig were returned to the pipeline and moved downstream by the flowing gas toward the drip. In conjunction with the partially clogged drip, and the introduction of additional liquids into line 1103 from the crossover from line 1100 (from which the drip had been removed) upstream of the line 1103 drip, it is likely that there was incomplete removal of accumulated liquids and solids from line 1103. Postaccident in-line inspection of the segment of line 1103 in which cleaning pigs had been periodically run (from block valve No. 2 to block valve No. 6) found no areas of internal corrosion that the company determined required repair. The Safety Board therefore concluded that if the accident section of pipeline 1103 had been able to accommodate cleaning pigs, and if cleaning pigs had been used regularly with the resulting liquids and solids thoroughly removed from the pipeline after each pig run, the internal corrosion that developed in this section of pipe would likely have been less severe.#

Page 33 The American Society of Mechanical Engineers (ASME) code for gas piping (ASME B31.8, Gas Transmission and Distribution Piping Systems) and the American Gas Association’s AGA Guide for Gas Transmission and Distribution Piping Systems include design and construction considerations related to internal corrosion control for new pipelines and modifications to existing pipelines. Although some operators may incorporate these considerations or have their own engineering standards for the design and construction of pipelines to minimize liquid accumulation and to remove liquids from a pipeline, there are no Federal regulatory requirements applicable to all operators. Federal regulations for gas pipelines include two sections that have requirements for an internal corrosion control program and one section that requires that the procedures for the program be included in the operator’s operating and maintenance manual. The regulations do not define “corrosive gas” but do state that such gas may not be transported by pipeline unless its effect on the pipeline has been evaluated and its potential to cause internal corrosion has been minimized. For internal corrosion to occur, water must typically be present in the pipeline, along with corrosive contaminants such as chlorides, H2S, CO2, O2, or bacteria. The regulations do not specifically address microbiologically influenced corrosion or the way that water and contaminants in the pipeline can combine to contribute to the corrosion process. The regulations also do not specifically address the importance of the following: minimizing liquids and liquid accumulation in the pipeline, removing liquids from the pipeline, maintaining drips, and the role of gas velocity in corrosion control. Because the Federal regulations do not specifically address the above issues, the Safety Board concluded that the current Federal pipeline safety regulations do not provide adequate guidance to pipeline operators or enforcement personnel in mitigating pipeline internal corrosion. On May 15, 2000, EPNG issued revised operating and maintenance procedures for internal corrosion control. Between May 15 and September 25, 2000, the Office of Pipeline Safety (OPS) conducted six safety inspections of EPNG. In each of these inspections, compliance with the Federal regulations for internal corrosion control was noted by the inspectors as “satisfactory.” After the accident, however, the OPS cited EPNG for a number of probable violations related to its internal corrosion program. For example, in its June 20, 2001, notice of probable violation, the OPS stated that EPNG’s internal corrosion control program was not carried out by, or under the direction of, a person qualified in pipeline corrosion control methods. But in each of the six inspections between May 15 and September 25, 2000, OPS inspectors had noted that the company’s program was “…under the direction of a qualified person, with associated records….” In several cases, the inspector included on the form a brief description of the qualifications of EPNG’s principal coordinator of corrosion services. At no time did the OPS inspection process, even under the system integrity inspection pilot program, indicate a personnel qualification issue with EPNG’s corrosion program. The postaccident notice of probable violation also cited EPNG for not following its own procedures and sound engineering practice by not performing corrosiveness tests on the liquids and solids that were removed from lines 1103 and 1110 after pigging operations. But at no time during the inspections conducted before September 2000 did the OPS indicate that such testing of liquids and solids was required or that it was sound engineering practice.#

Page 44 In addition, the notice of probable violation stated that EPNG’s elevation profile drawings for its pipelines in the area of the Pecos River were incomplete. Specifically, the notice stated that the drawings did not show any elevation profile for line 1103 between block valve No. 6 and the Pecos River compressor station. Therefore, according to the OPS, EPNG did not know the location of low points in the pipeline where liquids could accumulate and thus could not take certain corrosion control steps that could possibly have prevented the accident. However, during none of the six inspections between May and September 2000 did the OPS indicate that profile drawings of pipelines were required or that there were any other compliance or safety issues with the pipeline maps. Further, in April 2000, the OPS conducted a team review of EPNG’s operating and maintenance procedures as part of the system integrity inspection pilot program. No deficiencies in the procedures were identified in this inspection, and the OPS did not require any follow-up actions by EPNG to correct compliance and safety problems. But only four questions related to an internal corrosion control program (coupon monitoring and records and corrosion remedial measures and records) were included on the inspection form. The inspection form did not inquire into the four components of an effective internal corrosion control program identified in the regulations (determining whether corrosive gas is being transported, inspection of pipe removed from a pipeline, qualification of internal corrosion control personnel, and qualification of the person directing the internal corrosion control program). Thus, because its inspections did not seek information from the operator in these four areas, the OPS did not have sufficient basis for evaluating EPNG’s compliance with the Federal regulations for internal corrosion control. Throughout the inspections conducted by the OPS to qualify EPNG for the system integrity inspection pilot program, OPS inspection reports documented that EPNG’s internal audit program was working as designed. However, the procedures and forms used by EPNG for its internal audits only addressed actions to be taken after it had been determined that corrosive gas was being transported. Not addressed in either the EPNG procedures or forms reviewed by the OPS was how to determine if corrosive gas was being transported. Thus, although the program was functioning, the internal audit program was not adequate to uncover potential deficiencies in the company’s internal corrosion control program. Federal inspections of a pipeline operator should provide the operator with accurate feedback and the opportunity for immediate, constructive dialog with the OPS. In addition, the OPS uses data obtained during field inspections to assess the effectiveness of its regulations and identify issues of operator noncompliance. But in this case, the OPS postaccident investigation documented deficiencies in EPNG operations that it had not previously identified. Had the preaccident inspections applied the enforcement criteria in the same manner as they were interpreted after the accident, EPNG may have been prompted to correct deficiencies in its programs. The Safety Board concluded that the OPS did not make accurate preaccident assessments of EPNG’s internal corrosion program and therefore did not identify deficiencies in the program before the accident. Therefore, the National Transportation Safety Board makes the following safety recommendations to the Research and Special Programs Administration:#

Page 55 Revise 49 Code of Federal Regulations Part 192 to require that new or replaced pipelines be designed and constructed with features to mitigate internal corrosion. At a minimum, such pipelines should (1) be configured to reduce the opportunity for liquids to accumulate, (2) be equipped with effective liquid removal features, and (3) be able to accommodate corrosion monitoring devices at locations with the greatest potential for internal corrosion. (P-03-1) Develop the requirements necessary to ensure that pipeline operators’ internal corrosion control programs address the role of water and other contaminants in the corrosion process. (P-03-2) Evaluate the Office of Pipeline Safety’s pipeline operator inspection program to identify deficiencies that resulted in the failure of inspectors, before the Carlsbad, New Mexico, accident, to identify the inadequacies in El Paso Natural Gas Company’s internal corrosion control program. Implement the changes necessary to ensure adequate assessments of pipeline operator safety programs. (P-03-3) The Safety Board also issued one safety recommendation to NACE International. Please refer to Safety Recommendations P-03-1 through -3 in your reply. If you need additional information, you may call (202) 314-6177. Acting Chairman HAMMERSCHMIDT and Members GOGLIA and CARMODY concurred in these recommendations. original signed By: John A. Hammerschmidt Acting Chairman#