NTSB Safety Recommendation Letter P-98-031 through P-98-033

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: November 18, 1998 In reply refer to: P-98-31 through -33 Mr. David Lemmon President and Chief Executive Officer Colonial Pipeline Company 945 East Paces Ferry Road Atlanta, Georgia 30326 About 11:54 p.m. eastern daylight time on June 26, 1996, a 36-inch-diameter Colonial Pipeline Company pipeline ruptured where a corroded section of the pipeline crossed the Reedy River at Fork Shoals, South Carolina. The ruptured pipeline released about 957,600 gallons of fuel oil into the Reedy River and surrounding areas. The estimated cost to Colonial for cleanup and settlement with the State of South Carolina was $20.5 million. No one was injured in the accident.1 The National Transportation Safety Board determined that the probable cause of the rupture of the corrosion-weakened pipeline at the Reedy River crossing was the failure of Colonial Pipeline Company (1) to have adequate management controls in place to protect the corroded pipeline at the Reedy River crossing; and (2) to ensure that pipeline controllers were adequately trained to both recognize and respond properly to operational emergencies, abnormal conditions, and pipeline leaks. Colonial, once it became aware of the corrosion damage at the Reedy River crossing, immediately made plans to replace the defective pipe. Until the pipe could be replaced, the company placed operating restrictions (consisting of altered pressure valve and switch settings and a 100-psig suction pressure/5,000-hp limit at Simpsonville) on line No. 2 that were intended to protect the corrosion-weakened section of pipe by limiting the maximum pressure to which it might be subjected during an abnormal condition. The restrictions were approved by the vice president of operations and transmitted through official company channels to all affected employees. The Safety Board investigation determined that all controllers and shift supervisors responsible for operating line No. 2 were aware of the restrictions. Less than 1 month after the restrictions were put in place, the operations team leader authorized raising the 5,000-hp limit at Simpsonville to 7,000. The Safety Board is concerned about 1 For more information, read Pipeline Accident Report--Pipeline Rupture and Release of Fuel Oil into the Reedy River at Fork Shoals, South Carolina, June 26, 1996 (NTSB/PAR-98/01). 6758A#

Page 22 this change and the manner in which it was made. The recommendations of the hydraulics engineer had specified both a suction pressure limit and a horsepower limit at Simpsonville. If horsepower were to be increased beyond the specified 5,000, other changes may have been necessary to keep the combined pressure and throughput at a level that, in a worst-case scenario, would not result in a pipe failure at Reedy River. No such reevaluation was made, however. Nor was evidence found to indicate that those involved in this decision to run 7,000 hp had brought the issue to the attention of higher-level management so that ways other than increasing operating horsepower might be found to maintain safe operating conditions at Simpsonville. The original restrictions had been approved by the vice president of operations, but that individual was not involved in the decision to alter them. Instead, the operations team leader removed the horsepower restriction without the knowledge of the vice president of operations and without benefit of a thorough analysis of the change or its implications for safe operation of the pipeline. The Safety Board concluded that technical input was not sought and the appropriate levels of management were not involved in the decision to disregard the 5,000-hp limit at the Simpsonville pumping station, with the result that safeguards designed to protect the corroded section of pipeline were bypassed. For almost 2 months before the accident, Colonial operations management allowed line No. 2 to be operated without the 5,000-hp restriction at Simpsonville. Further, in the 2 weeks preceding the accident, suction pressure at Simpsonville was allowed to exceed 100 psig about 10 percent of the time. Absent an abnormal shutdown of the Simpsonville station or another station downstream of the Reedy River crossing, the pipeline could be operated without incident. During the period when the restrictions for Simpsonville were not being observed, however, any shutdown of the Simpsonville station during abnormal conditions could have precipitated the failure of the pipe at the Reedy River. Colonial management, after issuing directives to address the potential hazard at the river crossing, did not effectively monitor pipeline operations to determine if the directives were practicable or were being observed. A maximum suction pressure alarm for the Simpsonville station was not installed to alert controllers or supervisors when the suction pressure restriction was exceeded;2 shift supervisors were not directed to specifically monitor the operation of line No. 2 to help ensure compliance; and controllers were not directed to immediately report to supervisors any difficulties they noted in adhering to the restrictions. The Safety Board therefore concluded that Colonial management failed to take the necessary measures to ensure that its line No. 2 was operated in a manner consistent with the restrictions placed on the line to prevent a failure in the corrosion-damaged pipe segment across the Reedy River. The ease with which operating restrictions on the Simpsonville station were removed indicates that a more methodical decisionmaking process that is firmly based on an analysis of operating parameters should be institutionalized within Colonial. The relief controller’s work shifts for the day before and the day of the accident represent an “inverted schedule” that may cause circadian rhythm desynchronization. His work shift on the day of the accident was 12 hours out of phase with the shift he had worked the day before and with the sleep/wake cycle he had been accustomed to for the previous 5 days. The day before the 2 Such an alarm was installed after the accident.#

Page 33 accident, the relief controller’s work day ended at 7 p.m. On the day of the accident, the shift began at that time and was scheduled to end at 7 a.m. the following day. Such a dramatic change of work shift is likely to cause fatigue. Fatigue may also have been exacerbated by the relief controller’s having been awake for almost 17 hours at the time the accident occurred.3 In any case, the relief controller could have been suffering from fatigue despite the 8 to 9 hours of sleep he said he got the night before. As noted previously, during the 5 nights prior to the accident, the relief controller had been asleep at the time of day that the accident occurred. The Safety Board therefore concluded that fatigue resulting from the relief controller’s inverted work schedule may have affected his alertness, vigilance, and responsiveness during the accident sequence. The Safety Board is also concerned about the potential for fatigue with the rotating schedules for pipeline controllers. In an operating environment that demands prolonged periods of continuous vigilance, the potential impact of fatigue on controllers must be carefully assessed. Circadian clocks can be reset to accommodate work shift changes, but the necessary physiological adjustment does not occur quickly. The adaptation may take from days to weeks; some research indicates an adaptation rate of about 1 hour per day.4 Studies have shown that shift workers who rotate schedules that include night shifts are especially prone to fatigue on both the first and second nights of the work week. This slow adaptation process highlights the importance of addressing circadian rhythms in scheduling for 24- hour operations. An employer’s schedule for changing shifts must incorporate sufficient time for the employee to adapt the circadian rhythms. In the view of the Safety Board, Colonial has not adequately considered the potential for fatigue to adversely impact safety. An example is the company’s job description that states that the operations team leader must be able to work “extended periods of time (18-36 hrs) continuously while being able to think and write clearly.” Such a requirement is not scientifically valid. The relief controller was the only employee toxicologically tested after this accident. At the direction of the operations team leader, through the shift supervisor, the relief controller was tested for drugs, but not for alcohol. The operations team leader said that breath or blood samples (for alcohol testing) were not obtained because he believed that such testing would be part of the regular drug test and thus did not specifically request it. The drug and alcohol test checklist provided by Colonial clearly indicated that drug testing and alcohol testing were considered by the company to be separate tests. The form also indicated that both tests were to be performed after a pipeline accident. The investigation of this accident found no evidence that the relief controller may have been impaired by alcohol on the night of the accident, and the controller told investigators that he had not consumed any alcohol before reporting to work. Nonetheless, because Colonial officials did not follow established company procedures and conduct postaccident alcohol testing, neither the Safety Board nor Colonial could empirically determine that alcohol did not play a role in the 3 Determining the relief controller’s prior wakefulness was problematic because he could not recall whether he had napped before going to work on June 26. 4 Wever, R., “Phase Shifts of Human Circadian Rhythms Due to Shifts of Artificial Zeitgebars,” Chronobiologia 7, 1980, pp. 303-327.#

Page 44 accident or in the response to it. The Safety Board concluded that the failure of Colonial to perform postaccident alcohol tests indicates that the company did not effectively communicate to all its operating personnel and managers that postaccident tests must include testing for drugs and alcohol and that both tests must be specified. The Safety Board therefore makes the following safety recommendations to Colonial Pipeline Company: Develop and implement management procedures requiring that proper engineering or hydraulic evaluation and analysis be performed before changes are made to line operating parameters that have been set by company management. (P-98-31) Assess the potential safety risks associated with your controller and relief controller rest/work schedules and modify, as necessary, those schedules to ensure that controller performance is not compromised by fatigue. (P-98-32) Review your drug and alcohol testing program and ensure that all operating employees and managers are familiar with the program and program requirements, to include the distinction between tests for alcohol and tests for other drugs. (P-98-33) Also, the Safety Board issued Safety Recommendation P-98-30 to the Research and Special Programs Administration. The National Transportation Safety Board is an independent Federal agency with the statutory responsibility “to promote transportation safety by conducting independent accident investigations and by formulating safety improvement recommendations” (Public Law 93-633). The Safety Board is vitally interested in any action taken as a result of its safety recommendations. Therefore, it would appreciate a response from you regarding action taken or contemplated with respect to the recommendations in this letter. Please refer to Safety Recommendations P-98-31 through -33 in your reply. Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, GOGLIA, and BLACK concurred in these recommendations. By: Jim Hall Chairman#