NTSB Safety Recommendation Letter P-96-001

Page 1Official PDFNational Transportation Washington, D. C. 20594 Safety Recommendation Date: February 6, 1996 In Reply Refer To: P-96-1 Honorable D.K. Sharma Administrator Research and Special Programs Administration Washington, D.C. 20590 In a 15-month period between December 1991 and March 1993, ruptures of two petroleum product pipelines in Fountain Inn, South Carolina,' and Reston, Virginia; resulted in releases totaling nearly 1 million gallons of diesel fuel that affected major water supplies of the surrounding communities. Pipelines transport about 57 percent of the crude petroleum and petroleum products moved within the United States. The potential threat to public safety from petroleum product releases has become more severe in recent years as residential and commercial development adjacent to all types of pipelines has accelerated. Further, concerns at the Congressional, State, and local level have been growing about the possible environmental consequences of releases from pipeline systems, particularly those transporting petroleum and petroleum products, which potentially pose the greatest risk to the environment. In response to these concerns, the National Transportation Safety Board conducted a special investigation to review Research and Special Programs Administration (RSPA) efforts to implement safety recommendations that apply to petroleum product pipe lie^.^ In particular, the Safety Board reviewed those recommendations that address the prevention of excavation damage, the control of corrosion damage, the inspection and testing of pipelines, and methods to more rapidly detect, locate, and shut down failed sections of pipeline. The Safety Board also analyzed petroleum product pipeline accident data compiled by RSPA to assess accident trends and causes. In its d y s i s of the accident data, the Safety Board used pipeline system data compiled by the Federal Energy Regulatory Commission (FERC) to compare the accident and product release rates of Colonial Pipeline Company (the operator in the Fountain Inn and Reston accidents) with 13 other petroleum product pipeline companies. The Board also evaluated RSPA procedures for collecting and analyzing accident data to identify safety problems and compare the safety performance of individual pipeline companies. 'Pipeline Accident Brief No. DCA92FW01. March 2, 1994. 'Pipeline Accident Brief No. DCA93MW07, March 2, 1994 3For more detailed information, see Pipeline Special Investigation Report--Evoluafion of Acciden! Dafa and Federal Oversight of Petroleum Product Pipelines (NTSBISIR-96/02). 6641#

Page 2In its report on the rupture of a natural gas transmission pipeline in Edison, New Jersey: the Safety Board provided a detailed history of RSPA’s actions to address mhimizihg excavation- caused damages, inspecting and testing pipelines, and limiting product releases from a failed segment of pipeline. The Safety Board’s special investigation evaluated RSPA’s actions to address control of corrosion damage and updated the actions taken by RSPA to address the other safety issues since the adoption of the Edison report. Through its regulatory and other initiatives, RSPA is taking positive action to minimize pipeline accidents caused by excavation damage. The Safety Board supports RSPA’s efforts to address this safety issue not only through regulatory action, but also through public education, training, enhancement of onecall systems, and more timely enforcement against onecall system violations. However, RSPA has failed to take effective and timely action to address corrosion control, inspection and testing of pipelines, and methods to limit the release of product from failed pipelines. The Safety Board concluded, in its investigation of a pipeline rupture in Mounds View, Minnesota,’ that the pipe failed in an area that had been severely weakened by external corrosion and that Federal requkements for cathodic protection of pipelines transposing hazardous liquids provided no guidance other than requiring that a cathodic protection p~ogram exist. Consequently, the Safety Board recommended in 1987 that RSPA. P-87-24 Revise 49 CFR Part 195 to include criteria, similar to those found in Part 192, for liquid pipeline operatoxs to evaluate their cathodic protection systems. RSPA indicated in May 1988 that it would review the criteria set forth in a revised industry standard established by the National Association of Corrosion Engineers and propose comparable standards for both gas and hazardous liquid pipeline operators. On the basis response, Safety Recommendation P-87-24 was classified “Open-Acceptable Response.” Although the requirements in 49 CFR 195.414 for cathodic protection were 1991 and 1994, and the requirements in 195.416 for external conosion control were amended in 1994, the standards for cathodic protection and external corrosion control were not significantly changed and still do not include criteria similar to those in 49 CFR Part 192. WPA officials verbally confkmed in September 1995 that no regulatory project is planned to revise the cathodic protection requirements of Part 195 because RSPA bas given other projects higher priority. The Department of Transportation (DOT) semiannual regulatory agenda, published on November 28, Pipeline Accident Report--lkas Eastern Transmission Corporation Naural Gar Pipeline Etplosian and Fire, Edtson. New Jersey, March 23, 1994 (NTSBIPAR-95/01). 5 Pipeline Accident Report--wi[liams Pipe Line Company Liquid Pipeline Rupture and Fire, Moundr View, Minnesota. July 8, I986 (NTSBIPAR-87/02).#

Page 33 1995, did not list any existing or proposed regulatory project to revise the cathodic protection requirements of 49 CFR Part 195. External corrosion failures continue to account for nearly 20 percent of the accidents involving petroleum product pipelines. In the 8 years since Safety Recommendation P-87-24 was issued, RSPA has not taken any meaningful action to address this issue. Further, there is no indication from the DOT regulatory agenda that RSPA intends to act on this recommendation. Because of RSPA’s inaction, the Safety Board has reclassified Safety Recommendation P-87-24 “Closed--Unacceptable Action. Regarding the inspection and testing of pipelines, the Safety Board issued to RSPA, following the investigation of two pipeline ruptures that took place in Beaumont and Lancaster, Kentucky,6 Safety Recommendations P-87-4 through -7. They urged that RSPA: ~ P-87-4 Require operators of both gas and liquid transmission pipelines to periodically determine the adequacy of their pipelines to operate at established maximum allowable operating pressures by performing inspections or tests capable of identifying corrosion-caused and other time-dependent damages that may be detrimental to the continued safe operation of these pipelines and require necessary remedial action. - P-87-5 Establish criteria for use by operators of pipelines in determining the frequency for performing inspections and tests conducted to determine the appropriateness of established maximum allowable operating pressures. Require existing natural gas transmission and liquid petroleum pipeline operators, when repairing or modifying their systems, to install facilities to incorporate the use of in-line f,iinternal] inspection equipment. p-87-7 Require that all new gas and liquid transmission pipelines be constructed to facilitate the use of in-line [internal] instrument inspection equipment. 6 Pipeline Accident Report-Tem Eastern Gar Pipeline Company Ruptures and Fires in Beaumont, Ken- lucky, on April 27, 1985 and Loncaster, Kentucky. on February 21, 1986 (NTSBIPAR-8lIQ1).#

Page 44 In 1992, RSPA issued a notice of proposed rulemaking (NPRh4) on internal inspection of pipelines. In the final rule, published on April 12, 1994, RSPA required that new and replacement gas transmission and hazardous liquid pipelines be designed to accommodate internal inspection devices? Because of the regulations, the Safety Board classified Safety Recommendations P-87-15 and -7 "Closed-Acceptable Action" on February 7, 1995. RSPA also indicated that it was planning to issue an NPRM proposing that internal inspection devices or other equivalent inspection methods be required on gas pipelines in highly populated areas and on hazardous liquid pipelines in highly populated areas, environmentally sensitive areas, and navigable waterways. In the Edison report, the Safety Board reaffirmed the need for periodic inspections of high-pressure pipelines, particularly in urban and environmentally sensitive areas, to assess their fitness for continued safe operation. The Board also Iestated that RSPA should take complete regulatory action to require that internal inspection technology be used to periodically assess the condition of pipelines, and to establish criteria for operators to use in determining how often pipelies should be internally inspected to ensure unsafe conditions are detected before a pipe fails. The Safety Board affmed the "Open-Acceptable Response" classification of Safety Recommendation P-874, reiterated the recommendation, and urged RSPA to complete action on this issue in 1995. RSPA held a public workshop on October 18, 1995, to discuss the development of regulations Iequiring increased inspection of certain gas and hazardous liquid pipelines. The issues to be addressed included the: (1) adequacy of DOT safety regulations that require periodic inspection of pipelines for corrosion and leaks; (2) circumstances in which the regulations should require the use of instrumented internal inspection devices; (3) types of defects that should be required to be detected by internal inspection devices; (4) alternatives to the use of instrumented internai inspection devices; (5) definitions for "highdensity population," "environmentally sensitive areas," and "navigable waterways;" and (6) costs of inspections with internal inspection devices. By conducting the workshop in October 1995, RSPA prolonged the regulatory process. In an update of its regulatory agenda published on November 28, 1995, RSPA piojected that an NPRM concerning regulations requiring increased inspection of certain gas and hazardous liquid pipelines would not be published untiI spring 1996, despite the Safety Board's strong urging for RSPA to complete action on this issue in 1995. The Safety Board recognizes that RSPA's need to coordmte with industry about the problems and potential solutions for the inspection and testing of pipelies is valid, but much of 'Passage of Imeiml Inspection Devices, Docket PS-126-1 at 57 Federal Register (FR) 54745 on No- vember 20, 1992. and at 59 FR 17275 on April 12, 1994. I#

Page 55 the coordination could and should have been accomplished much earlier. Although coordination with industry is likely to be an ongoing process, RSPA could and should have proceeded with the regulatory process in those areas in which there was a consensus by industry and government, Consequently, the Safety Board found that RSPA has not been responsive to this issue and classified Safety Recommendation P-87-4 “Open-Unacceptable Response.” Further, the establishment of criteria for determining the frequency of inspections and tests as called for in Safety Recommendation P-87-5 cannot be addressed in a meaningful way until the action needed to implement Safety Recommendation P-87-4 has been completed. Consequently, the Safety Board also classified Safety Recommendation P-87-5 “Open-Unacceptable Response. ” Because of the urgency of this issue, the Safety Board reiterated Safety Recommendations P-87-4 and -5. The Safety Board has also addressed pipeline monitoring and leak detection and the use of remotely operated or automatic valves as methods to achieve a rapid shutdown of failed pipeline segments, to isolate the failed pipeline segments, and to limit the release of product from the pipeline. In Safety Recommendation P-91-1, which was issued in the North Blenheim, New York, accident report: the Safety Board recommended that RSPA p-91-1 Define the operating parameters that must be monitored by pipeline operators to detect abnormal operations and establish performance standards that must be met to detect and locate leaks. In response to this recommendation, RSPA committed to undertake a 2-year study to determine whether supervisory control and data acquisition (SCADA) systems and SCADA- based leak detection systems should be required on gas and hazardous liquid pipelines. In May 1992, RSPA contracted with the Volpe National Transportation Systems Ceuter (Volpe) to analyze SCADA systems and computer-generated leak detection systems to determine (1) the feasibility and costs of requiring operators to use SCADA systems with a leak detection subsystem and (2) existing impediments or needed improvements to minknix the time that SCADA systems require to detect and locate leaks. The study was also to recommend resolutions for identified difficulties. The study, which was completed in September 1995? indicated that a SCADA or leak detection system “can be found to suit most pipeline environments.” It further stated: Field instruments coupled with a telephone line and a personal computer can, in most cases, provide the pipeline operator with reliable status information on the pipeline. Implementation of a 8 Pipeline Accident Report-Liquid Propane Pipeline Rupture ond Fire, Texos Ez~tern Products Pipeline Company. North BlerJleim. New York. March 3, 1990 (NTSBIPAR-91IOl). ’Sheny Smith Borener, et al. Remote Cowol Spill Reduction Technology: A SUNW and Annlysis of Appli- carionS for Liquid Pipeline @stems, US. Department of Transport;llion (Cambridge. Massachusetts: Volp National Transportation Systems Center, 1995).#

Page 66 system, including dispatcher training, can allow almost any pipeline operator to conduct effective mpture detection. The Safety Board began in 1970 to address the need for rapid shutdown of failed pipe segments, and subsequently identified the need to rcquire automatic control valves and/or remote control valves to facilitate rapid shutdown of failed pipelines. As a result of its investigation of the Mounds View, Minnesota, accident, the Safety Board recommended in 1987 that RSPA P-87-22 Require the installation of remote-operated valves on pipelines that transport hazardous liquids, and base the spacing of remote- operated valves on the population at risk. Between 1987 and 1992, RSPA conducted research studies and published several proposed rules in response to Safety Board recommendations and Congressional proposals. Despite these initial actions, RSPA has not implemented any requirements for automatic control valves or remote control valves as means of achieving rapid shutdown of failed pipeline segments. On September 2, 1992, RSPA advised the Safety Board that the Pipeline Safety Act of 1992 (Public Law 102-508) mandated that RSPA complete a study on emergency flow restricting devices for hazardous liquid pipelines by October 1994 and issue a final rule by October 1996. Under this act, RSPA’s study was to assess the effectiveness of emergency flow restricting devices (including remote conh.01 valves and check valves) and equipment used to detect and locate pipeline ruptures and minimhe product releases from pipeline facilities. On Januay 19, 1994, RSPA issued an advance notice of proposed rulemaking (ANPRM) (Docket No. PS-133, 59 FR 2802) soliciting comments on a series of questions on emergency flow restricting devices and leak detection systems to assist it in developing requirements. In the ANPRM, RSPA reviewed its actions on this issue since 1978, including its publication of a March 1991 study entitled the Emergency Flow Restricting Devices Study. In the Edison report, the Safety Board stated its belief that RSPA’s 1991 study report on emergency flow restricting devices was seriously flawed and caused the Congress, in Public Law 102-508, to inappropriately limit considerations of emergency flow restricting devices to hazardous liquid pipelines. The Safety Board also noted that its review of RSPA’s 1991 study and the Edison accident clearly demonstrated that RSPA needed to reconsider its actions on using remote control valves and automatic control valves as main line valves to promptly limit the flow of natural gas to failed pipeline segments, especially in urban or environmentally sensitive areas. To that end, the Safety Board classified Safety Recommendation P-87-22 “Closed- -Unacceptable ActiodSuperseded” and recommended that RSPA: I#

Page 77 p-95-1 Expedite requirements for installing automatic- or remote-operated mainline valves on high pressure pipelines in urban and environmentally sensitive areas to provide for rapid shutdown of failed pipeline segments. In a May 1995 response to Safety Recommendation P-95-1, RSPA stated that it intended to publish an NF’RM in fall 1995 that would specify those circumstances under which operators of hazardous liquid pipelines would be required to use emergency flow restricting devices. The Safety Board classified the recommendation “Open-Acceptable Response” on July 17, 1995. On October 19, 1995, RSPA held a public workshop on emergency flow restricting devices. RSPA stated that the workshop’s purpose was “to enable government and industry to reach a better understanding of the problem and the potential solutions before proposed rules are issued.” Placement of emergency flow restricting devices, leak detection sensitivity, requirements for a leak detection system, and use of emergency flow restricting devices at pump stations and breakout tanks were addressed at the workshop. According to the semiannual DOT regulatory plan, an NPM proposing requirements for the use of emergency flow restricting devices and other procedures, systems, and equipment to detect and locate pipeline ruptures was scheduled to be published in December 1995. Subsequently, a RSPA staff member advised a Safety Board investigator that RSPA projected publication of the NPRM in the first quarter of 1996. Many of the topics discussed at the workshop had been considered in the Volpe study. Because it scheduled the workshop as a prelude to the development of proposed rules, RSPA could not meet its commitment to issue an NPRM in fall 1995 and is predicting an additional delay of 3-6 months. As is the case with the inspection and testing of pipelines, RSPA has performed studies, conducted research, and sought industry input, but has failed to cany through and develop requirements for leak detection and rapid shutdown of failed pipelines. The Safety Board acknowledges the complexity of SCADA systems and leak detection systems that would indicate the proximate location of leaks. However, as noted in the Volpe study, less complex equipment can now be effectively used to enhance an operator’s leak detection capability. Rapid shutdown can be achieved through appropriate use and spacing of remotely operated valves, automatic valves, and other emergency flow restriction devices. Consequently, the Safety Board found that RSPA has not been sufficiently responsive to this issue and reiterated Safety Recommendation P-95-1. The recommendation remains classified “Open-Acceptable Response.” As another part of its special investigation, the Safety Board compared the accident and product release rates of individual operators of petroleum product pipelines, analyzed RSPA’s accident data, and evaluated RSPA’s procedures for collecting and analyzing accident data. The Safety Board notes that RSPA has, by using computer programs to screen the accident data for certain discrepancies, taken some actions to improve the consistency of the accident data reported far gas and hazardous liquid pipelines.#

Page 88 To compare operator performance, the Safety Board nomalized the RSPA accident data and developed equivalent indicators of accident and product release rates for 14 operators for the 3-year period 1992-1994. The Safety Board combined the FERC data for annual product throughput and pipeline mileage with the available RSPA accident data to compute the number of accidents per 1,000 miles of pipeline and the number of barrels of product released per 1 million banels transported. Other than pipeline mileage, which is reported as part of its user fee assessment program, RSPA does not collect or maintain data that can be used to normalize the accident data for hazardous liquid pipelines. The Safety Board recognizes that other methods may be used to normalize and compare operator performance. For example, the FERC reports also include data on pipeline size that could be used with mileage data to normalize accident and product release rates on the basis of an equivalent pipe size. Nevertheless, the Safety Board's analysis demonstrates that such an evaluation and analysis can be done and that a more extensive analysis could be routinely performed with existing computer systems and data retrieval systems. RSPA should perform this type of analysis to evaluate the safety performance of all hazardous liquid pipeline operators. In its analysis of the accident data for petroleum product pipelines, the Safety Board found that the deficiencies of RSPA's accident data base for hazardous liquid pipelines limited the Board's ability to identify any factors affecting accident trends. Because the existing categories for cause on RSPA's curient accident report form 7000-1 are imprecise, poorly defined, and do not account for certain types of failure, the specific causes of reportable accidents do not provide consistent and reliable data for RSPA's accident data base. An accident data base can be a powerful tool for more effective management of the pipeline safety program - particularly for cost-benefit analyses to justify regulatory changes - and can help to identify safety issues, accident trends, and operators with marginal safety records or increased accident rates. An effective accident data base, as acknowledged in a June 1995 joint government and industry task force report on hazardous liquid pipelines," is also essential for successful implementation of a risk management system. RSPA has acknowledged that a complete and viable accident data base is essential for successful implementation of a risk management system. However, to achieve these objectives, it is critical that the accident data base used provide complete data in sufficient detail to show not only the cause of an accident, but also the related factors that could increase or decrease the Likelihood of occurrence. For example, RSPA and the industry consider excavation damage to be the leading cause of pipeline accidents. Yet, excavation damage is not specifically indicated on RSPA's accident form in a separate data element. The purpose of damage prevention programs, onecall systems, notifications by excavators, and marking of the pipeline is to prevent excavation accidents. For these data entries to be meaningful, therefore, they must be linked to excavation accidents only. Similarly, more 10 The Joint Governmenthdustry Risk Assessment Quality Team, Risk Managemen! within the Liquid Pipeline Indusrry, sponsored by the Office of Pipeline Safety, Research and Special Programs Administration. and the American Petroleum Institute, June 20, 1995.#

Page 99 detail about pipe coatings and cathodic protection systems would help identify why external corrosion failures occur. The accident data base must also indicate the consequences of accidents. The environmental impact should be reported separately, apart from property damage. The depth of the pipeline and the location of the accident (urban versus rural locations) are other factors that have a strong bearing on the consequences of an accident. Data on factors that minhize the consequences of an accident, such as remotely controlled valves, leak detection systems, and emergency flow restricting devices, should also be reported to help assess their effectiveness. The Safety Board addressed many of these same deficiencies in its 1978 report on the safe service life for liquid petroleum pipelines." In 1980, the Safety Board issued a report evaluating the effectiveness of RSPA's accident data system for gas pipelinesU that concluded that: (1) the data collected were often inaccurate and not validated; (2) the data system was used to fill external requests for information; (3) RSPA did not have a pipeline data analysis plan, which was necessary to use the data system as a management tool; and (4) the development of a data analysis plan must precede the revision of reporting requirements and data forms to guide the selection and use of the data collected. The deficiencies in RSPA's data reporting system identifed in the special investigation are identical to those identified by the Safety Board in 1978 and parallel the Safety Board's 1980 fmdings regarding the gas pipeline data system. Consequently, the Safety Board concluded that RSPA's failure to fully implement the original 1978 safety recommendations to evaluate and analyze its accident data reporting needs has hampered RSPA's oversight of pipeline safety. As RSPA works to implement a risk management program, the need for accurate and consistent accident data becomes more critical to identify risks and those factors that either mitigate or increase risk. As noted by the 1995 joint government and industry task group, successful implementation of a true risk management approach necessitates a reliable and complete accident data base. The Safety Board supports RSPA in its effort to implement a risk management approach for its pipeline safety program. However, the Safety Board concluded that, with the deficiencies of the current accident data base for hazardous liquid pipelines, RSPA will find it exceedmgly difficult to fully implement an effective risk management program. To address these problems, the National Transportation Safety Board recommends that the Research and Special Programs Administration: Develop within 1 year and implement within 2 years a comprehensive plan for the collection and use of gas and hazardous liquid pipelime accident data that details the type and extent of data to be collected, to provide the Research and Special Programs Administration with the capability to perform methodologically sound accident trend analyses and evaluations of pipeline operator " Pipeline Special Sway-Safe Service Life for Liquid Petroleum Pipelines (NTSB/PSS-78/01). *Safety Effectiveness Evaluation-Safery Effectiveness Evaluation of the Materials Transpomtion Bu- reau's Pipeline Data System (NTSB/SEE-IIO/M).#

Page 1010 performance using normalized accident data. (Class II, Prior@ Action) (P-96-1) Also, to address the concerns raised by the continuing problems with pipeline' safety revealed during its special investigation, the National Transportation Safety Board reiterates. tixi? following safety recommendations to the Research arid Special Programs Administration: Require operators of both gas and liquid transmission pipelines to periodically determine the adequacy of their pipelines to operate at estabIished maximum dowable operating pressures by performing inspections or tests capable of identifying corrosion-caused and other timedependent damages that may be detrimental to the continued safe operation of tfiese pipelies and requke necessary remedial action. Establish criteria for use by operators of pipelines in determining the frequency for performing inspections and tests conducted to determine the appropriateness of established maximum allowable operating pressures. p-95-1 Expedite requirements for installing automatic- or remote-operated mainline valves on high pressure pipelines in urban and enviromentally sensitive areas to provide for rapid shutdown of failed pipeline segments. The Safety Board expects positive action on these three reiterated recommendations within a year. Chaiiman HALL,, Vice C W i FRANCIS, and Members HAMMERSCHMIDT and GOGLIA concurred in this recommendation and these reiterated recommendations.#