NTSB Safety Recommendation Letter P-07-010

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: June 25, 2007 In reply refer to: P-07-10 Mr. Robert G. Phillips President and CEO Enterprise Products OLPGP, Inc. 1100 Louisiana Street, 18th Floor Houston, TX 77002 The National Transportation Safety Board is an independent Federal agency charged by Congress with investigating transportation accidents, determining their probable cause, and making recommendations to prevent similar accidents from occurring. We are providing the following information to urge your organization to take action on the safety recommendation in this letter. The Safety Board is vitally interested in this recommendation because it is designed to prevent accidents and save lives. This recommendation addresses controller training. It is derived from the Safety Board’s investigation of the October 27, 2004, anhydrous ammonia pipeline rupture near Kingman, Kansas,1 and is consistent with the evidence we found and the analysis we performed. As a result of this investigation, the Safety Board has issued four safety recommendations, one of which is addressed to Enterprise Products Operating L.P. (Enterprise). Information supporting this recommendation is discussed below. The Safety Board would appreciate a response from you within 90 days addressing the actions you have taken or intend to take to implement our recommendation. About 11:15 a.m. central daylight time on October 27, 2004, an 8-inch-diameter pipeline owned by Magellan Midstream Partners, L.P., (Magellan) and operated by Enterprise ruptured near Kingman, Kansas, and released approximately 4,858 barrels (204,000 gallons) of anhydrous ammonia. Nobody was killed or injured due to the release. The anhydrous ammonia leaked into a creek and killed more than 25,000 fish including some from threatened species. Enterprise reported the cost of the accident as $680,715, including $459,415 for environmental remediation. The National Transportation Safety Board determined that the probable cause of the pipeline rupture near Kingman, Kansas, on October 27, 2004, was a pipe gouge created by heavy equipment damage to the pipeline during construction in 1973 or subsequent excavation activity at an unknown time that initiated metal fatigue cracking and led to the eventual rupture of the 1 For additional information, see National Transportation Safety Board, Anhydrous Ammonia Pipeline Rupture Near Kingman, Kansas, October 27, 2004, Pipeline Accident Brief NTSB/PAB-07/02 (Washington, DC: NTSB, 2007). 7896A#

Page 22 pipeline. Contributing to the severity of the accident was the pipeline controller’s failure to accurately evaluate available operating data and initiate a timely shutdown of the pipeline. Beginning at 11:15:43 a.m. on October 27, 2004, and continuing over the next 6 minutes, the pipeline controller received nine alarms for three pump stations on the alarm screen of the supervisory control and data acquisition (SCADA) system. Had the controller reviewed the trend screens for Conway Station, Harper Station, or Partridge Station during this time, he could have observed graphically the rapid decrease in pipeline pressure at each station starting about 11:16 a.m. By 11:19:55 a.m., approximately 4 minutes after the rupture, the controller had received a high-level low-low pressure alarm and an uncommanded pump shutdown alarm at Conway Station in addition to two rate-of-change alarms. These alarms alerted the operator to abnormal operating conditions that met the criteria for initiating a pipeline shutdown. Although the controller knew of several abnormal operating conditions within 6 minutes after the rupture, including low pipeline pressures and rapid changes in pipeline pressure at three adjacent pump stations, he took no action to shut down the pipeline. Sufficient data from SCADA alarms were available to the controller within approximately 6 minutes for determining that the integrity of the pipeline was in question and for him to shut down the pipeline. Enterprise’s controller training taught that the correct response to the alarms received was to initiate a pipeline shutdown and monitor pressure. Instead, the controller believed incorrectly that the pipeline pressure would return to normal, and he waited for the situation to correct itself. Then, at 11:27:50 a.m., he issued a command to increase flow to the control valve upstream of the rupture at Enid Station from about 450 barrels per hour to about 550 barrels per hour. The controller’s decision to open the control valve more than 13 minutes after the rupture indicates that he did not recognize that the series of pipeline alarms, including a sudden drop in pressure followed by a pump shutdown, indicated a possible leak. Nor did the controller use all of the SCADA tools available to him to evaluate the abnormal pipeline conditions. The controller did not contact personnel at Conway Station to determine whether personnel working there had caused the pump to shut down until 11:28 a.m., about 8 minutes after he had received a low-low pressure alarm and the Conway pump had shut down. Even at 11:30 a.m., after Conway personnel told the controller that they had not caused the pump shutdown and 15 minutes since the initial SCADA indications of an abnormal condition and possible rupture, the controller responded to the situation by continuing to wait for the pipeline pressure to return to normal. Thus the pipeline remained in service for more than 30 minutes until the control center telephone started ringing, which was when the controller decided to shut down the pipeline immediately. During those 30 minutes, the controller received numerous SCADA alarms but did not respond by shutting down the pipeline as he had been trained. In its 2005 SCADA Safety Study,2 the Safety Board documented that several training coordinators for pipeline operators reported that on-the-job training for leak detection was difficult because such events are rare and may not occur during the training period. Training coordinators who used simulators for training reported that the simulators were invaluable for leak detection training. In order to improve training for abnormal operations, pipeline operators 2 National Transportation Safety Board, Supervisory Control and Data Acquisition (SCADA) in Liquid Pipelines, Safety Study NTSB/SS-05/02 (Washington, DC: NTSB, 2005).#

Page 33 could utilize simulations of abnormal operating conditions either on computer simulators or by using noncomputerized simulations, such as tabletop drills. In the Safety Study, the Board concluded that requiring controllers to train for leak detection tasks using simulators or noncomputerized simulations would improve the probability of controllers finding and mitigating pipeline leaks. On December 23, 2005, the Safety Board recommended that the Department of Transportation’s Pipeline and Hazardous Materials Safety Administration (PHMSA): P-05-3 Require controller training to include simulator or non-computerized simulations for controller recognition of abnormal operating conditions, in particular, leak events. On April 26, 2006, PHMSA responded that its Controller Certification (CCERT) project team was examining the effect of SCADA graphics and alarms on controllers and controller training. PHMSA held a public workshop on June 27, 2006, to discuss the findings from the CCERT project and examine opportunities to improve the safety of pipeline control. PHMSA expected the results of the workshop to assist in the completion of the CCERT project’s report and support the American Petroleum Institute’s (API’s) work on its recommended practice, API RP 1165, for the SCADA graphics displays, which PHMSA also has been monitoring. Because of these actions by PHMSA, Safety Recommendation P-05-3 is classified “Open—Acceptable Response.” The controller’s performance in the Kingman accident was consistent with problems noted in the Safety Study with regard to pipeline controllers’ failure to quickly identify and respond to abnormal conditions that indicate pipeline leaks. The controller in this accident did not have the benefit of a training exercise that incorporated the assessment of abnormal conditions associated with a pipeline leak. After the accident, Enterprise recognized a need for training on abnormal condition response to recognize pipeline leaks. The company conducted one-time accident review training sessions for the natural gas liquid and ammonia pipeline controllers using a playback of the ammonia pipeline accident and included instruction on analyzing each alarm and appropriately evaluating associated trend screens. While the one-time review is a positive action, the Safety Board concludes that a recurrent training program is needed to better prepare controllers to identify and respond to abnormal operating conditions related to identifying leaks. The National Transportation Safety Board recommends that Enterprise Products Operating L.P.: Provide initial and recurrent training for all controllers that includes simulator or noncomputerized simulations of abnormal operating conditions that indicate pipeline leaks. (P-07-10)#

Page 44 The Safety Board also issued safety recommendations to PHMSA. In your response to the recommendation in this letter, please refer to Safety Recommendation P-07-10. If you need additional information, you may call (202) 314-6177. Chairman ROSENKER, Vice Chairman SUMWALT, and Members HERSMAN, HIGGINS, and CHEALANDER concurred in this recommendation. [Original Signed] By: Mark V. Rosenker Chairman#