NTSB Safety Recommendation Letter P-98-030

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: November 18, 1998 In reply refer to: P-98-30 Ms. Kelley Coyner Administrator Research and Special Programs Administration 400 7th Street, S.W. Washington, D.C. 20590 About 11:54 p.m. eastern daylight time on June 26, 1996, a 36-inch-diameter Colonial Pipeline Company pipeline ruptured where a corroded section of the pipeline crossed the Reedy River at Fork Shoals, South Carolina. The ruptured pipeline released about 957,600 gallons of fuel oil into the Reedy River and surrounding areas. The estimated cost to Colonial for cleanup and settlement with the State of South Carolina was $20.5 million. No one was injured in the accident.1 The National Transportation Safety Board determined that the probable cause of the rupture of the corrosion-weakened pipeline at the Reedy River crossing was the failure of Colonial Pipeline Company (1) to have adequate management controls in place to protect the corroded pipeline at the Reedy River crossing; and (2) to ensure that pipeline controllers were adequately trained to both recognize and respond properly to operational emergencies, abnormal conditions, and pipeline leaks. On the evening of June 26, 1996, a Colonial Pipeline Company relief pipeline controller was on duty at Colonial’s pipeline control center in Atlanta, Georgia, operating a 36-inch- diameter Colonial pipeline (designated line No. 2) between Pasadena, Texas, and Greensboro, North Carolina. The relief controller was making and monitoring deliveries of No. 2 fuel oil from the pipeline to terminals in Atlanta, Charlotte, and Greensboro. At 11:45:30 p.m., the deliveries to Atlanta were terminated, and the controller began sequentially increasing pumping capacity2 at the unattended pumping stations downstream of Atlanta to accommodate the additional product that was now moving through the pipeline. At 1 For more information, read Pipeline Accident Report--Pipeline Rupture and Release of Fuel Oil into the Reedy River at Fork Shoals, South Carolina, June 26, 1996 (NTSB/PAR-98/01). 2 Pumping capacity could be increased either by starting an additional pump at a station or by turning on a larger (higher hp rating) pump and turning off a smaller one. 6758A#

Page 22 11:50:13 p.m., the controller started a second pumping unit at the Simpsonville, South Carolina, station, bringing that station’s pumping power to 7,000 hp. About 1 minute later, the pipeline controller attempted to remotely start the 5,000-hp No. 3 pumping unit at the Gastonia, North Carolina, station. Unknown to the controller, the pump did not start. Believing that he now had two pump units on line at Gastonia, and without waiting for the supervisory control and data acquisition (SCADA) system pressure readings to confirm the starting of the No. 3 pump, the controller shut down the 2,000-hp pumping unit that had been running at Gastonia. Shutting down this unit left no pumps on line at Gastonia, with the result that, 11 seconds after the shutdown, the automatic mainline block valve began opening to allow product to bypass the pump units at the Gastonia station. This triggered a SCADA alarm, which the controller acknowledged. The controller took no further action regarding Gastonia at that time. Instead, he changed the SCADA monitor screen (which he was using to control pump starts and shutdowns) to display the next downstream station at Kannapolis, North Carolina, where he sent a command to start a 5,000-hp pumping unit. The controller said he noticed the “pressure spread” on the SCADA console and realized that the Gastonia No. 3 pumping unit was not on line. The controller said that he felt he had “to get something on [at Gastonia],” so he started the 5,000-hp No. 4 pumping unit there. Meanwhile, the controller’s shutting down of the only operating pump at Gastonia had generated a pressure surge in the pipeline. The surge traveled upstream and caused the 5,000-hp No. 4 pumping unit (the only unit running) at Gaffney to shut down because of high discharge pressure. According to SCADA system records, the controller tried to restart the No. 4 pump at Gaffney. When that pump would not start, he started the 5,000-hp No. 3 pump instead. At 11:53:58 p.m., the 2,000-hp No. 1 pumping unit at Simpsonville shut down on high discharge pressure, followed 3 seconds later by the shutdown of the 5,000-hp No. 3 unit. The controller said he noticed both of the pump units at Simpsonville suddenly go down and noticed the pressure increase there. He started the 5,000-hp No. 2 pumping unit at Simpsonville, but this unit ran for only 19 seconds before it too shut down. The shutdown of these pumps increased pressure in the pipeline upstream of the Simpsonville station. At 11:54:28 p.m., the Simpsonville suction pressure dropped to -8 psig. Line No. 2 had ruptured at the Reedy River, about 5 miles upstream of Simpsonville. When deliveries to the Atlanta terminal were closed out, the controller had to perform a series of operations in a certain sequence and within a fairly brief period of time to prevent an over-pressure condition from occurring somewhere downstream of Atlanta. Because of the weakened pipe at Reedy River and the pressures that were being run in the system, any error in operating the pipeline could have serious consequences. Such an error was the inadvertent shutdown of the Gastonia station. When the controller became aware that the Gastonia station was down, he immediately attempted to start a pump there. The action specified in Colonial’s operations manual for such an event would have been to immediately begin shutting down the line using the multiple station shutdown procedures. This action may or may not have prevented the accident; however, at the#

Page 33 very least, shutting down the pipeline at that time would have reduced the amount of product that was eventually released, thereby reducing the amount of environmental damage. Even after the Gastonia and Simpsonville stations shut down automatically because of high discharge pressure, the controller did not initiate a shutdown of the pipeline. A pipeline shutdown was not initiated until after the relief controller had notified the shift supervisor of problems on the line and the two men discussed the situation, which was about 3 1/2 minutes after the rupture. The Safety Board concluded that the controller’s failure to independently effect an earlier shutdown of the pipeline contributed to the amount of product lost from the ruptured pipe. The controller’s work shifts for the day before and the day of the accident represent an “inverted schedule” that may cause circadian rhythm desynchronization. His work shift on the day of the accident was 12 hours out of phase with the shift he had worked the day before and with the sleep/wake cycle he had been accustomed to for the previous 5 days. The day before the accident, the controller’s work day ended at 7 p.m. On the day of the accident, the shift began at that time and was scheduled to end at 7 a.m. the following day. Such a dramatic change of work shift is likely to cause fatigue. Fatigue may also have been exacerbated by the controller’s having been awake for almost 17 hours at the time the accident occurred.3 In any case, the controller could have been suffering from fatigue despite the 8 to 9 hours of sleep he said he got the night before. As noted previously, during the 5 nights prior to the accident, the controller had been asleep at the time of day that the accident occurred. The Safety Board therefore concluded that fatigue resulting from the relief controller’s inverted work schedule may have affected his alertness, vigilance, and responsiveness during the accident sequence. The Safety Board is also concerned about the potential for fatigue with the rotating schedules for pipeline controllers. In an operating environment that demands prolonged periods of continuous vigilance, the potential impact of fatigue on controllers must be carefully assessed. Circadian clocks can be reset to accommodate work shift changes, but the necessary physiological adjustment does not occur quickly. The adaptation may take from days to weeks; some research indicates an adaptation rate of about 1 hour per day.4 Studies have shown that shift workers who rotate schedules that include night shifts are especially prone to fatigue on both the first and second nights of the work week. This slow adaptation process highlights the importance of addressing circadian rhythms in scheduling for 24- hour operations. An employer’s schedule for changing shifts must incorporate sufficient time for the employee to adapt the circadian rhythms. In the view of the Safety Board, a comprehensive assessment incorporating the extensive body of scientific knowledge that exists concerning fatigue, sleep, and circadian physiology as they relate to work/rest schedules has not been made regarding the potential safety risks posed by rotating shifts for pipeline controllers. Therefore, the National Transportation Safety Board makes the following safety recommendation to the Research and Special Programs Administration: 3 Determining the relief controller’s prior wakefulness was problematic because he could not recall whether he had napped before going to work on June 26. 4 Wever, R., “Phase Shifts of Human Circadian Rhythms Due to Shifts of Artificial Zeitgebars,” Chronobiologia 7, 1980, pp. 303-327.#

Page 44 Assess the potential safety risks associated with rotating pipeline controller shifts and establish industry guidelines for the development and implementation of pipeline controller work schedules that reduce the likelihood of accidents attributable to controller fatigue. (P-98-30) Also, the Safety Board issued Safety Recommendations P-98-31 through -33 to Colonial Pipeline Company. Please refer to Safety Recommendation P-98-30 in your reply. Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, GOGLIA, and BLACK concurred in this recommendation. By: Jim Hall Chairman#