Pipeline Accident Report

Pipeline Rupture and Subsequent Fire

in Bellingham, Washington

June 10, 1999

National 

Transportation 

Safety Board

Washington, D.C.

A

A

N TION

L TRA SPOR

ATIO

N

B OARD

SAF E T Y

N

T

E PLURIBUS UNUM 

NTSB/PAR-02/02

PB2002-916502

Pipeline Accident Report

Pipeline Rupture and Subsequent Fire 

in Bellingham, Washington 

June 10, 1999

NTSB/PAR-02/02

PB2002-916502 National Transportation Safety Board

Notation 7264A 490 LíEnfant Plaza, S.W.

Adopted October 8, 2002 Washington, D.C. 20594
National Transportation Safety Board. 2002. Pipeline Rupture and Subsequent Fire in Bellingham,

Washington, June 10, 1999. Pipeline Accident Report NTSB/PAR-02/02. Washington, DC.

Abstract: About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel pipeline

owned by Olympic Pipe Line Company ruptured and released about 237,000 gallons of gasoline into a

creek that flowed through Whatcom Falls Park in Bellingham, Washington. About 1 1/2 hours after the

rupture, the gasoline ignited and burned approximately 1 1/2 miles along the creek. Two 10-year-old boys

and an 18-year-old young man died as a result of the accident. Eight additional injuries were documented.

A single-family residence and the city of Bellinghamís water treatment plant were severely damaged. As

of January 2002, Olympic estimated that total property damages were at least $45 million.

The major safety issues identified during this investigation are excavations performed by IMCO General

Construction, Inc., in the vicinity of Olympicís pipeline during a major construction project and the

adequacy of Olympic Pipe Line Companyís inspections thereof; the adequacy of Olympic Pipe Line

Companyís interpretation of the results of in-line inspections of its pipeline and its evaluation of all

pipeline data available to it to effectively manage system integrity; the adequacy of Olympic Pipe Line

Companyís management of the construction and commissioning of the Bayview products terminal; the

performance and security of Olympic Pipe Line Companyís supervisory control and data acquisition

system; and the adequacy of Federal regulations regarding the testing of relief valves used in the protection

of pipeline systems.

As a result of this investigation, the National Transportation Safety Board issues safety recommendations

to the Research and Special Programs Administration.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine,

pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board

Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study

transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board

makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and

statistical reviews.

Recent publications are available in their entirety on the Web at <http://www.ntsb.gov>. Other information about available publications also

may be obtained from the Web site or by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 LíEnfant Plaza, S.W.

Washington, D.C. 20594

(800) 877-6799 or (202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To

purchase this publication, order report number PB2002-916502 from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(800) 553-6847 or (703) 605-6000

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports

related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report. 
iii Pipeline Accident Report

Contents

Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Accident Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

System Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Engineering Assistant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The Accident Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Pipeline Operation and Control: The SCADA System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Excavations in Proximity to the Olympic Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Pipeline In-line Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Regularly Scheduled Magnetic Flux Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Washington Department of Ecology Administrative Order . . . . . . . . . . . . . . . . . . . . . . 26

Olympic Postinspection Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

The Bayview Products Terminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Overpressure Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Valve Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Operations Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Postaccident Pipeline Excavation and Segment Retrieval . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Laboratory Examination of the Ruptured Pipeline Segment . . . . . . . . . . . . . . . . . . . . . 42

Laboratory Examination of the Second Damaged Pipeline Segment . . . . . . . . . . . . . . 44

Testing of Additional Material Samples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Testing of Relief Valve RV-1919 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Review of Computer Files and Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Postaccident Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Management Restructuring of Olympic Pipe Line Company . . . . . . . . . . . . . . . . . . . . 48

OPS Investigation and Corrective Action Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Evaluation of Bayview Products Terminal Design and Operation . . . . . . . . . . . . . . . . 49

Evaluation of Pipeline Valve Spacing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

SCADA System Performance and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Federal Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

OPS Preaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Environmental Response and Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Damage to the Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Contents iv Pipeline Accident Report

Excavations in the Area of the Eventual Rupture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Evaluation of In-line Inspection Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

SCADA System Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Actions of the Accident Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Company Oversight of Bayview Products Terminal Construction . . . . . . . . . . . . . . . . . . . 66

Control Valve CV-1904 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Relief Valve RV-1919 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Appendixes

A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

B: Office of Pipeline Safety Corrective Action Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
v Pipeline Accident Report

Executive Summary

About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel

pipeline owned by Olympic Pipe Line Company ruptured and released about 237,000 gallons of

gasoline into a creek that flowed through Whatcom Falls Park in Bellingham, Washington.

About 1 1/2 hours after the rupture, the gasoline ignited and burned approximately 1 1/2 miles

along the creek. Two 10-year-old boys and an 18-year-old young man died as a result of the

accident. Eight additional injuries were documented. A single-family residence and the city of

Bellinghamís water treatment plant were severely damaged. As of January 2002, Olympic

estimated that total property damages were at least $45 million.

The Safety Board determines that the probable cause of the June 10, 1999, rupture of the

Olympic pipeline in Bellingham, Washington, was (1) damage done to the pipe by IMCO

General Construction, Inc., during the 1994 Dakin-Yew water treatment plant modification

project and Olympic Pipe Line Companyís inadequate inspection of IMCOís work during the

project; (2) Olympic Pipe Line Companyís inaccurate evaluation of in-line pipeline inspection

results, which led to the companyís decision not to excavate and examine the damaged section

of pipe; (3) Olympic Pipe Line Companyís failure to test, under approximate operating

conditions, all safety devices associated with the Bayview products facility before activating the

facility; (4) Olympic Pipe Line Companyís failure to investigate and correct the conditions

leading to the repeated unintended closing of the Bayview inlet block valve; and (5) Olympic

Pipe Line Companyís practice of performing database development work on the supervisory

control and data acquisition system while the system was being used to operate the pipeline,

which led to the systemís becoming non-responsive at a critical time during pipeline operations.

The major safety issues identified during this investigation are as follows:

ï Excavations performed by IMCO General Construction, Inc., in the vicinity of

Olympicís pipeline during a major construction project and the adequacy of

Olympic Pipe Line Companyís inspections thereof;

ï The adequacy of Olympic Pipe Line Companyís interpretation of the results of inline inspections of its pipeline and its evaluation of all pipeline data available to it

to effectively manage system integrity;

ï The adequacy of Olympic Pipe Line Companyís management of the construction

and commissioning of the Bayview products terminal;

ï The performance and security of Olympic Pipe Line Companyís supervisory

control and data acquisition system; and

ï The adequacy of Federal regulations regarding the testing of relief valves used in

the protection of pipeline systems.

As a result of this investigation, the National Transportation Safety Board issues safety

recommendations to the Research and Special Programs Administration.

1 Pipeline Accident Report

Factual Information

Accident Synopsis

About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel

pipeline owned by Olympic Pipe Line Company (Olympic)1

 ruptured and released about

237,000 gallons of gasoline into a creek that flowed through Whatcom Falls Park in

Bellingham, Washington. About 1 1/2 hours after the rupture, the gasoline ignited and

burned approximately 1 1/2 miles along the creek. Two 10-year-old boys and an 18-yearold young man died as a result of the accident. Eight additional injuries were documented.

A single-family residence and the city of Bellinghamís water treatment plant were

severely damaged. As of January 2002, Olympic estimated that total property damages

were at least $45 million. (See figure 1.)

Accident Narrative

On the afternoon of June 10, 1999, two pipeline controllers were on duty at

Olympicís control center at Renton, Washington, with each controller operating a different

section of Olympicís 400-mile pipeline system. One controller was operating that part of

the system that included a 16-inch-diameter pipeline extending from Cherry Point south to

Renton station. This was the pipeline that was involved in this accident. This controller

(henceforth referred to as the ìaccident controllerî) was controlling the movement of

gasoline from an Atlantic Richfield Company (ARCO) refinery near the Cherry Point

pumping station to a Tosco storage facility near Renton.2

 The other controller was

operating a separate pipeline system. (See figure 2.)

1 At the time of the accident, Olympic was a corporation consisting of three shareholders: Equilon

Pipeline Company LLC (Equilon), Atlantic Richfield Company, and GATX Terminal Corporation, with

Equilon under contract to manage operation of the pipeline for Olympic (This assertion is disputed by

Equilon. For convenience, the Safety Board in this report will refer to Olympic as the pipeline operator.).

Since the accident, several ownership and managerial changes have occurred within the Olympic

organization with the overall result that British Petroleum (BP) is now the majority owner with

responsibility for operation of the pipeline. At the time of the accident Equilon was wholly owned by

Equilon Enterprises, Inc., which was owned jointly by affiliates of Texaco, Inc., and affiliates of Shell Oil

Company. Since the accident, Shell has acquired the Texaco holdings, and the company is now Shell

Pipeline Company, LP.

2 Because of a criminal investigation into the accident, neither the accident controller nor his

immediate supervisor (the supervisor of products movement) would discuss the accident with Safety Board

investigators. The information contained herein is based on interviews with other Olympic employees and

on the event log recorded by the system computer. As the accident controller and his supervisor declined to

be interviewed by the Safety Board, further details on what actions were performed by the controller, and the

appropriateness of those actions, are unavailable.
Factual Information 2 Pipeline Accident Report

Olympic operated its pipeline through use of a computerized supervisory control

and data acquisition (SCADA) system.3

 Olympicís SCADA system used two identically

configured computers, which the company had designated OLY01 and OLY02. One of the

SCADA computers was used as the primary system, with the other available as a backup.

Figure 1. Postaccident aerial view of portion of Whatcom Creek 

showing fire damage.

3 Pipeline controllers use the SCADA system to remotely control movement of product through the

pipeline. Controllers can monitor flow rates and pressures along the lines and use equipment, such as control

valves and mainline pumps, to adjust the flow and make product deliveries.
Factual Information 3 Pipeline Accident Report

At the time of the accident, Olympic was using OLY02 as the primary control system,

with OLY01 as the backup. Controllers had reported no problems with the SCADA system

earlier in the day on June 10. (The Olympic SCADA control system is discussed in more

detail later in this report.)

Also on duty in the control center on June 10 was an Olympic pipeline controller

who had been temporarily assigned as a computer system administrator. The system

administrator told the Safety Board that beginning shortly before 3:00 p.m. on June 10,

while working at a workstation in the computer room, he created new records for the

SCADA historical database. The new records would be used to hold pump vibration data

that could later be extracted and analyzed. He was working on the OLY02 system, which

was the primary system in use at the time.4

 He said that after he finished the new records

and had entered them into the system, he began a check of the error logs to make sure the

operation was going as intended. He said the error logs initially showed no errors, but

about 3:10,5

 they began to show errors related to the historical database. The SCADA

administrator said he repeatedly checked the format of the new records and found no

errors; thus, he believed something other than the new records was causing the problem.

He said he then left the control center.

Meanwhile, about 3:00, the accident controller, using the SCADA system, had

begun preparing to discontinue product delivery to the Tosco facility and initiate delivery

of gasoline to ARCOís Harbor Island terminal in Seattle. According to the OLY02 event

logger, delivery to Tosco was terminated at 3:17:43. At 3:20,6 the accident controller

contacted personnel at ARCOís Cherry Point refinery and asked them to begin

transferring product from the refinery to the adjacent Cherry Point pumping station.7

As the delivery points were switched, pressure in the 16-inch pipeline began to

build upstream from the delivery point. Controllers said such an increase was normal and

that the initial response was usually to start a second pump at the unattended Woodinville

station. The accident controller issued a command on OLY02 to start the second pump at

Woodinville. At 3:18:58, the event log indicates that the system failed to execute the

command. At the same time, the SCADA system displayed an alarm from Allen station

because of a high discharge pressure of 1,444 pounds per square inch, gauge (psig).

Almost simultaneously, the controller operating the other pipeline section noted that the

OLY02 system had become unresponsive to his commands. He reported the condition to

the system administrator, who had returned to the control center.

4 The SCADA system was designed so that the database of the primary computer would automatically

be ìmirroredî to the backup unit. In this case, the work being performed by the system administrator would

automatically be captured on the database of both the OLY01 and OLY02 computers. The SCADA system

was configured to allow new database records to be created while the system was on line.

5 Henceforth in this report, unless otherwise noted, all times are p.m., Pacific daylight time and were

taken from the SCADA (OLY01 and 02) event log.

6 Times reported by ARCO were based on logs generated by their employees and are not synchronized

with Olympicís SCADA system clock.

7 The ARCO refinery had pumps that drew product from tanks and transferred it through

approximately 1/2 to 3/4 mile of 16-inch-diameter pipeline to Olympicís Cherry Point station, adjacent to

the northwest corner of the refinery.
Factual Information 4 Pipeline Accident Report

Figure 2. Olympic Pipe Line Company system. 16”

16”

20”
Factual Information 5 Pipeline Accident Report

The system administrator said he returned to the computer room and noticed the

computer was unresponsive at about the same time he was notified of it by the controller.

He said he then attempted to delete from OLY01 (then the backup system) the new records

he had created. He planned to bring OLY01 on line to take over for the unresponsive

OLY02.

An electrician on duty at the Allen pumping station at the time said that he was

contacted by the accident controller, who asked him to shut down a pumping unit at Allen

station because the controller had lost communications and was unable to do so remotely.

The electrician shut down one of the units and reported back to the controller. The event

log indicates that the first unit at Allen station was shut down at 3:23:34.

The OLY02 systemís event logger continued to record events for several minutes

after the system became unresponsive to controller input. At 3:22:59, the system recorded

that a booster pump had shut down at the Bayview terminal (about 2 miles upstream of

Allen station), followed a few minutes later, at 3:24:53, by the uncommanded shutdown of

the Bayview terminal. As the station shut down and the pressure increased, the OLY02

system recorded a high pressure alarm at Bayview and the subsequent initiation of the

closure of the inlet block valve (thus closing off the pipeline) upstream of Bayview

terminal. These were the last events recorded by the OLY02 system before the

administrator took the system off line.

As the block valve closed and stopped product flow into Bayview, the SCADA

system captured pressure data upstream of this inlet block valve that indicated a pressure

increase from 215 psig at 3:27 to 1,494 psig at 3:28 (as the block valve closed). At 3:29,

the system recorded the pressure at this location dropping back down to 230 psig. (It

would later be determined that this pressure drop was the result of a rupture in the pipeline

that occurred between the Ferndale and Bayview stations at about 3:28.)8

 (See figure 3.)

Because OLY02 was not responding to commands, the administrator was not able

to effect the normal transfer from OLY02 to OLY01; instead, he said he had to halt OLY02

to initiate the change. OLY01 came on line about 3:28. At 3:28:05, the system recorded

that the inlet block valve upstream of Bayview terminal was closed. Within seconds, the

system also recorded the uncommanded shutdown of pumps at the Cherry Point and

Ferndale stations. With the shutdown of the Cherry Point and Ferndale pumping stations,

the 16-inch pipeline was essentially shut down from Cherry Point to Renton, with a single

pumping unit at Woodinville the only remaining operating pump.

The controller operating the other pipeline section told investigators that he

noticed that the 16-inch line had gone down and that, because the accident controller had

left the room, he issued an OLY01 command to shut down the pump at Woodinville. The

event log indicates that commands were issued to shut down the remaining unit at

8 Because the SCADA system was slow or unresponsive between about 3:10, when the computer

problems were first noted, and about 3:48, when OLY02 came back on line and stabilized, it could not be

determined how much of the information recorded by the system during this period was available to the

controllers at that time.
Factual Information 6 Pipeline Accident Report

Woodinville at 3:29:35 and again at 3:30:41. The event log also records an uncommanded

shutdown of the Woodinville unit at 3:31:04.

When the accident controller returned a few minutes later, the other controller told

him that the line was down and that he had shut down the Woodinville pump. At

approximately 3:35, the accident controller contacted ARCO and asked that transfer of

product from the refinery to the Cherry Point station be suspended.

According to the system administrator, the OLY01 computer had never come up

fully ìhealthy and alive,î so he decided to revert back to OLY02 as the primary. The last

recorded SCADA entry for OLY01 was at 3:34:17, after which OLY01 was halted. The

rebooted OLY02 came back on line at 3:44:30. The system administrator said that about

that time, the control center supervisor (supervisor of product movement) came into the

control center and then the computer room. He said he explained what had happened, after

which the supervisor went into OLY02 and deleted the new records that had been mirrored

Figure 3. Graph displaying pressure trend upstream of Bayview terminal at time of accident. Note pressure spike and subsequent drop as pipe ruptured. (Graph generated 

by the Safety Board based on Olympic SCADA data. Such a display had not been 

developed for the controller to readily access on the day of the accident, and investigators could not determine precisely when the information would have been available to 

the controller if he had attempted to display it.)
Factual Information 7 Pipeline Accident Report

from one computer to the other. The system administrator said he noticed that the records

now contained a typographical error that he said was not there when he created them.

The system administrator said that at about 4:00, the accident controller came into

the computer room and asked if the pipeline could be restarted. The administrator said the

control center supervisor answered that it could. About 4:04, the system administrator

restarted OLY01, allowing data from that computerís database (which included data

captured at the time of the rupture) to be transferred to the OLY02 system.

According to the OLY02 data logger, the accident controller, at 4:11:22, reopened

the inlet block valve at Bayview. The electrician at Allen station (downstream of

Bayview) reported that he was again contacted by the accident controller and asked to

verify the pressure (either suction or discharge, the electrician could not remember which)

at the station. He said he reported the pressure to the controller and stated that the

controller responded that that sounded ìabout rightî to him. The electrician said he did not

deem this activity abnormal and stated that the controller did not seem concerned. At

approximately 4:15, the accident controller contacted the ARCO refinery and asked that

product transfer be reinitiated. At 4:16:29, the accident controller started a pump at the

Cherry Point station, followed at 4:17:34 by the starting of a pump at the Ferndale station.

A computerized pipeline leak detection system software package was running on

the Olympic system. The software used both volume balancing and real-time transient

modeling based on pressure and other pipeline operating data collected through the

SCADA system to detect, and alert controllers to, possible leaks.9

At 4:29:22, a SCADA

alarm indicated that the leak detection software issued an alert.10At 4:30:52, the accident

controller issued a command to start another pump at Ferndale station. The pump started

at 4:31:39.

About this same time, an Olympic employee, who had been on his way home,

called the Olympic control center to report smelling gasoline at a bridge over Whatcom

Creek. This employee had already called 911 to report the gasoline odors.

Shortly thereafter, pumps went down at the Cherry Point and Ferndale stations. At

4:32:18, the accident controller initiated the closing of mainline block valves to isolate the

rupture location. Those valves were recorded as closed at 4:34:14, about 1 hour and 5

minutes after the rupture.

At about 4:35, the accident controller again contacted ARCO and asked that the

transfer be discontinued. ARCO personnel stated that it was not uncommon for shutdowns

to occur and that they were given no reason for the shutdown request. They also stated that

the conversations were brief and to the point.

9 Although the leak detection system software runs on its own computer, separate from the SCADA

system, it requires a SCADA data feed and at least 15 minutes of baseline data upon which to run its

analysis.

10 The leak detection system first issues an ìalert.î If pipeline conditions are not reconciled, the system

issues an alarm.
Factual Information 8 Pipeline Accident Report

Meanwhile, ARCO personnel at the Harbor Island terminal had been told to expect

delivery of product starting at about 4:20. When the delivery did not begin as expected,

those personnel, at about 4:30, contacted the Renton control center and asked when

delivery might be expected to begin. The Olympic controller who answered the call

reported that there was a problem, but he did not elaborate, nor could he predict when

delivery might be expected. Approximately 30 to 45 minutes later, after receiving a call

from an ARCO employee who had witnessed a fireball ignition, ARCO personnel

contacted Olympic to ask if the fire involved Olympic and whether the valves into the

terminal should be closed. They were told that Olympic was involved and that the valves

should be closed.

After the accident, Olympic contracted with Stoner Associates to perform

hydraulic modeling of its system to determine the pressure profile along the pipeline

during the accident sequence. The Stoner modeling indicates that the pressure reached

1,433 psig at the rupture location. The model further predicted pressures of 1,402 psig at

the Ferndale discharge and 1,515 psig at the inlet to Bayview. Pressures recorded during

the accident reached a maximum of 1,500 psig at the Bayview inlet before the pipeline

ruptured. The paper on the pressure-recording chart at Ferndale had run out the day before

the accident.

Emergency Response

The rupture occurred within the Dakin-Yew water treatment plant, which is owned

and operated by the city of Bellingham. The released product proceeded to flow from the

subsurface to the surface and then into Hannah Creek, a tributary of Whatcom Creek.

Once the product reached Hannah Creek, it flowed approximately 1,200 feet northwest to

its confluence with Whatcom Creek.11

About 4:24,12 a 911 operator at the Bellingham Fire Department communication

center received a telephone call from a citizen who reported that as she was driving across

the bridge on Woburn Street, she smelled an ìincredible odorî that made breathing

difficult. A minute later, the first engine was dispatched to the area for an ìoutside odor

investigation.î At 4:26, the crew of Bellingham Fire Department engine 54, which had

just completed a training assignment, answered the call because the location was in the

crewís area of response.

At 4:27, the resident of a dwelling near Whatcom Creek called 911 and reported a

strong petroleum odor. He also reported that Whatcom Creek was discolored. A short time

11 Whatcom Creekís headwater originates at Lake Whatcom. The creek flow is generally east to west

for 1 mile within Whatcom Fall Park and then extends through residential and business areas in Bellingham

before it empties into Bellingham Bay, a part of Puget Sound. The rupture location is approximately 3 miles

inland (east) of Bellingham Bay.

12 Times in this section are from emergency response agency records.
Factual Information 9 Pipeline Accident Report

later, the same resident made a second call to 911 and stated that his dog was convulsing

and that he was evacuating his residence because the odor was overwhelming.

The fire department dispatcher notified the responding fire captain that more calls

about unusual odors were being received. The fire captain upgraded the response to a

Hazmat 1 incident.13 As a result, additional resources were dispatched to respond to the

incident.

At 4:30, an employee of Olympic Pipeline Company who happened to be in the

area called 911 on his cellular phone. He reported the presence of gasoline fumes, gave his

location as the Woburn Street Bridge over Whatcom Creek, and said he would remain at

that location until the fire department arrived. The Olympic employee then called the

Olympic control room in Renton to alert personnel there to the situation.

At 4:33, the fire captain upgraded the incident to a Hazmat 2 incident.14 He then

advised the fire department dispatcher that gasoline was present in Whatcom Creek and

asked that the Bellingham Police Department respond and close the bridges crossing

Whatcom Creek and the streets adjacent to the creek. Four Bellingham Police Department

units responded immediately and began to stop traffic and establish a perimeter around the

area.

The deputy director of the Whatcom County Division of Emergency Management

was monitoring the Bellingham Fire Department radio. The deputy director called the

Whatcom County Division of Emergency Management program specialist by mobile

telephone to confirm that he had been monitoring the call for the ìoutside odor

investigation.î When conditions were escalated to a Hazmat 2 incident, the deputy

director and the program specialist agreed that the program specialist would respond to the

incident command post and represent the Whatcom County Division of Emergency

Management.

At 4:37, the specialized emergency response program team15 was notified by page

that the incident was presently a Hazmat 2 incident, and the public works department was

notified that barricades would be needed to stop access to the Whatcom Creek area. The

Bellingham Fire Department battalion chief 1, who was the incident commander, arrived

on scene at 4:45 and established a command post.

13 A Hazmat 1 incident is defined as an incident or threat of a release that (1) may be controlled by the

first response agencies, (2) may only require evacuation of the incident site, and (3) does not pose an

immediate threat to life or property.

14 A Hazmat 2 incident is defined as an incident that involves a greater hazard or larger area than a

Hazmat 1 incident and that poses a potential threat to life, property, or the environment and/or may require a

limited evacuation of the area surrounding the incident or that may require expertise or resources of the State

government or private organizations/individuals.

15 The specialized emergency response program team is a hazardous materials response team that is

administered by the Bellingham Fire Department and that consists of members from professional and

volunteer fire departments and from industries who have expertise in hazardous materials response. The

supervisor activated the team at 4:42.
Factual Information 10 Pipeline Accident Report

At 4:46, the fire department dispatcher called the Olympic emergency response

number. The Olympic employee answering the call stated, ìWe got people on the way, and

our line is shut down at this particular point.î The Olympic control center supervisor told

the fire department dispatcher that Olympic had field personnel on site. The fire

department dispatcher then notified the incident commander that personnel at the

Whatcom Creek fish hatchery had been notified, that Olympic had personnel on site, and

that the pipeline was shut down. The fire department dispatcher called a local radio station

and asked that it alert the public of the incident and of the need to avoid the Whatcom

Creek area.

A Bellingham Police Department sergeant arrived at the command post at 4:55.

The incident commander requested that the police department evacuate an area 150 to 200

feet on the north and south sides of Whatcom Creek. The incident commander asked that

no traffic be allowed to cross Whatcom Creek. Shortly thereafter, a Bellingham Police

Department lieutenant arrived and began to devise a plan to evacuate the Whatcom Creek

area. The lieutenant requested assistance from the Washington State Patrol and the

Whatcom County Sheriffís Office.

Olympic called the fire department dispatcher at 4:57 to report a possible release

of product into Whatcom Creek.

At 5:02, fire department personnel reported witnessing a fire igniting in Whatcom

Creek. Bellingham Police Department personnel also witnessed the ignition. The police

department lieutenant immediately requested all police units to patrol in their vehicles

along the 200-foot evacuation area of Whatcom Creek and use the vehiclesí public

address systems to warn residents and pedestrians to evacuate the area. The Bellingham

Police Department lieutenant advised all responding police personnel who were not in the

process of evacuating buildings to stop all traffic near the creek. At the same time, the

Whatcom County disaster plan was implemented, and the deputy director activated the

emergency operations center. The emergency operations center was staffed, and

notifications of the incident were made to key personnel.

The gasoline pool fires extended approximately 1 1/2 miles from the pipe break at

the Dakin-Yew plant, approximately 1,200 feet down Hannah Creek to its confluence with

Whatcom Creek, and through industrial and residential areas of Bellingham. The incident

commander requested the full response of the Bellingham Fire Department and the

response of mutual aid fire and police departments. The Whatcom County Sheriffís Office

responded with 15 deputies. The following police departments were on site to assist:

Washington State Patrol, Western Washington University Police Department, and

Ferndale Police Department.

At 5:20, St. Joseph Hospital, Bellingham, issued a staff alert after the fire

department dispatcher advised the hospital staff of the fire in Whatcom Creek. The

hospital staff prepared to receive a large number of patients and made additional

notifications to the staff at Harborview Medical Center Burn Center, Seattle, Washington.

About 10 minutes later, the St. Joseph Hospital emergency room staff was notified that

two 10-year-old patients were being transported by ambulance to the hospital. The two
Factual Information 11 Pipeline Accident Report

patients arrived at 5:40 and were subsequently airlifted by helicopter to the Harborview

Medical Center by 6:25.

At 5:30, a Bellingham Police Department command post was established for the

29 police department personnel who had been involved in the incident. The Bellingham

Mountain Search and Rescue team arrived and began a primary search of Whatcom Falls

Park and Whatcom Creek. The search and rescue team subsequently located the body of

the 18-year-old young man who had been fatally injured. The search and rescue team then

conducted a secondary search for victims.

The incident commander estimated that the gasoline in Whatcom Creek burned for

approximately 1 hour. Small brush fires continued to burn along the creek banks and

eventually were extinguished by Whatcom County Fire Protection Districts 1ñ8. On

June 14, 1999, foam was applied to extinguish the last fire in the water treatment plant

near the pipeline rupture. By this time, the extensive fires had burned 25 acres throughout

the area.

Olympic personnel had determined that the ìinitial worst-case spill estimateî was

around 6,598 barrels of ARCO unleaded regular gasoline. The final loss calculation, made

after measuring the remaining product displaced from the line, showed a release of 5,638

barrels (236,796 gallons) had occurred. Of this total, Olympic estimated that 1,890 barrels

were released as the line was restarted, with the balance lost through drain down of the

pipeline. (See the ìOther Informationî section of this report for detailed information on

postaccident environmental remediation.)

Injuries

A police officer patrolling the accident area was alerted by residents that two boys

needed medical assistance. The police officer immediately called for the assistance of a

Bellingham Fire Department medic unit. The two 10-year-old boys were taken by

ambulance from the 1900 block of Iowa Street to St. Joseph Hospital in Bellingham.

Hospital staff stabilized them before each patient was flown by helicopter to the burn unit

of Harborview Medical Center in Seattle. Each boy had received extensive second and

third degree thermal burn injuries of the head, trunk, and extremities (80 to 90 percent

total body surface area). Both boys died on June 11, 1999.

The body of an 18-year-old man was found in Whatcom Creek by members of the

Bellingham Mountain Search and Rescue team. Bellingham Police Department

investigators arrived at the creek and documented the body as having been found partially

submerged near the north bank of Whatcom Creek. According to the Whatcom County

medical examiner, cause of death was chemical asphyxia from hydrocarbon inhalation

poisoning. The death certificate does mention inhalation of hydrocarbons (gasoline) but

states the cause of death as ìasphyxia due to fresh water drowning.î The autopsy report

notes that the victim was most likely ìovercome by volatile hydrocarbon fumes, lost

consciousness, and died from hypoxia by freshwater drowning.î
Factual Information 12 Pipeline Accident Report

Eight other individuals transported themselves to the hospital with minor

inhalation injuries.

Damage

The Dakin-Yew water treatment plant was damaged by the accident, and

temporary facilities had to be constructed to ensure uninterrupted water service to the

approximately 30,000 customers supplied by the system. A single-family dwelling was

also destroyed.

As of January 2002, Olympic estimated that the total property damages were at

least $45 million. Fines from the applicable regulatory agencies and civil litigation for loss

of pipeline use and other issues could bring the total damages for the accident into the

hundreds of millions of dollars. Criminal charges involving Olympic, Equilon, and

individual employees are pending.

Personnel Information

Accident Controller

The accident controller satisfactorily completed the required course of study and

internship and became certified as an operations controller on October 31, 1983. On his

most recent performance and development review (covering the period from June 1996 to

April 1998), he had received either ìOutstandingî (the highest of seven performance

ratings) or ìStrongî (the second highest performance rating) on the majority of the

performance factors. His overall performance rating was determined to be ìStrong.î His

performance during this rating period was a slight improvement from the previous rating

period (June 1992 ñ June 1994), when he had received a ìGood+î (the third highest rating

possible). He had successfully completed pipeline simulator workshops and had passed

the hydraulics class.

System Administrator

The individual identified in this report as the system administrator joined Olympic

as a pipeline controller in 1994 after working for 5 years in the same capacity at another

pipeline company. At Olympic, he worked as a relief pipeline controller, filling in for

other controllers when necessary. His computer responsibilities were a ìspecial

assignment.î He said his primary computer responsibility had been building SCADA

display screens, especially those associated with the new Bayview facility. Before the

accident, he had received no formal training on the SCADA system, the SCADA software,

or the SCADA computer operating system. He said experienced personnel provided him

with on-the-job training and supervision in using the SCADA system to control the

pipeline and in customizing the SCADA system displays.
Factual Information 13 Pipeline Accident Report

Engineering Assistant

The Olympic engineering assistant (who evaluated the results of in-line pipeline

inspections as detailed in the ìOlympic Postinspection Actionsî section of this report) said

he joined Olympic in February 1980 as a dispatcher. He remained in that position until

February 1989, when he became a central area supervisor for operations. He became the

engineering assistant in March 1991 and remained in that position until he resigned from

the company in July 2000. The engineering assistant said that he had taken college courses

but had not received a degree.

Toxicological Information

In accordance to U.S. Department of Transportation (DOT) regulations, within 2

hours of the accident, Olympic management ordered that the accident controller and the

system administrator be tested for drugs and alcohol. According to documentation

provided by Olympic, the controllers were directed to nearby Valley Medical Center

because the facility that normally performed random drug and alcohol testing for

Olympic, Renton Occupational Health, was closed for the day. According to the

documentation, medical personnel at Valley Medical Center performed the drug tests,

which were negative for all tested drugs. Those personnel were not aware of the

requirement that tests be conducted for alcohol, and such tests were not conducted. A

week passed before Olympic officials learned that tests for alcohol had not been done. As

a result of this experience, Olympic subsequently made arrangements with another facility

that could be used to conduct DOT-required drug and alcohol tests in the event of any

future accident that occurs outside normal business hours.

The Accident Pipeline

The Olympic system consists of about 400 miles of pipelines transporting refined

petroleum products from refineries in the northwest portion of Washington State to

delivery locations as far south as Portland, Oregon. One 16-inch-diameter pipeline (the

accident pipeline) originates adjacent to a refinery near Cherry Point, extends southward

to a pumping station near Ferndale, Washington, that is adjacent to another refinery, and

then extends farther southward through booster pumps at Bayview products terminal into

another pumping station near Allen, Washington.

A second 16-inch-diameter pipeline originates adjacent to two refineries near

Anacortes, Washington, and extends eastward through pumping units at Bayview products

terminal into Allen station. At Allen station, the two 16-inch-diameter pipelines

interconnect. Extending southward from Allen station are a 16-inch-diameter pipeline and

a 20-inch-diameter pipeline that run in parallel until reaching a pumping station in Renton,

Washington. A single 14-inch-diameter pipeline extends from Renton station south to

Portland. Additional lateral lines to various delivery locations form the balance of the

Olympic pipeline system.
Factual Information 14 Pipeline Accident Report

The following pumping facilities are located on the section of pipeline involved in

this accident: Cherry Point, Ferndale, Bayview,16 Allen,17 Woodinville, and Renton. These

facilities are at mileposts (MP) 0.0, 0.0,18 39.1, 41.4, 86.8, and 112.9, respectively. The

rupture occurred at MP 15.9, which is between the Ferndale and Bayview terminals.

Approximately 37.4 miles of the 16-inch steel pipeline from Ferndale station to

Allen station were originally installed in 1964. In 1966, Olympic rerouted a 724-foot-long

section of the pipeline to facilitate the construction of the Dakin-Yew water treatment

plant by the city of Bellingham. This is the section of pipe in which the rupture occurred.

The rerouted section of pipeline was constructed of externally coated, American

Petroleum Institute (API) grade X52 steel line pipe with a wall thickness of 0.312 inch. At

2,028 psig, the pressure within the pipeline would produce a hoop stress19 of 100 percent

of the steelís specified minimum yield strength of 52,000 psi.

The rerouted section of pipeline was hydrostatically tested to 1,820 psig on

June 20, 1966, before being placed into service. The maximum design pressure for this

section of pipeline, as defined in 49 Code of Federal Regulations (CFR) 195.106(a), was

1,460 psig. The maximum operating pressure, based upon 80 percent of the initial

hydrostatic test pressure and calculated in accordance with 49 CFR 195.406(a), was 1,456

psig. In January 1985, Olympic established the maximum allowable operating pressure on

the rerouted line section at 1,440 psig. After the accident, the maximum allowable

operating pressure on this line section was restated as 1,456 psig based upon the original

hydrostatic testing. At the time of the accident, the established maximum operating

pressure listed for the 16-inch Ferndale-to-Allen segment of pipeline was 1,370 psig as

measured at the Ferndale discharge.

The pipeline safety regulations at 49 CFR 195.406(b) limit the allowable pipeline

pressure to 110 percent of the maximum operating pressure during surges and other

variations from normal operations. At the rupture location, the maximum allowable surge

pressure was calculated after the accident to be 1,602 psig. At the Ferndale discharge and

the inlet to Bayview, the maximum allowable surge pressures were calculated to be 1,507

and 1,584 psig, respectively.

16 Construction of the Bayview products terminal was completed in 1998, and operations at the facility

commenced in December of that year. Construction and operation of the facility will be discussed in detail

later in this report.

17 When the Bayview facility was installed, additional pipeline was tied in just upstream of Allen

station, installed past Allen station to Bayview and then back to Allen, so the mileage increased by

approximately 4 miles. Allen station was located at MP 37.3 before the Bayview pipeline extension was

completed. All references in this report to downstream locations will use the original mileage stationing.

18 Ferndale was the original northern terminus of the pipeline and the initial starting point for the

original pipeline mileage stationing. The 5.0 miles of pipe from Cherry Point to Ferndale were added later.

19 Hoop stress is tensile stress in the wall of a pipe in a circumferential orientation (hence the term

ìhoopî) due to internal pressure. Although hoop stress is expressed in pounds per square inch, it is a value

quite different from the pipeís internal pressure.
Factual Information 15 Pipeline Accident Report

Pipeline Operation and Control: The SCADA System

As do most major liquid pipeline operators, Olympic used a SCADA system to

operate and control its pipeline. A SCADA system consists of field sensors and actuators,

remote terminal units, a communications link, and the main SCADA computer. Field

sensors and actuators include pumps, valves, pressure transducers, temperature monitors,

flow meters, and other devices for the measurement of field data and the signal

input/output to those devices. In a SCADA system, remote terminal units (RTUs) collect

signals from the field hardware and convert them to digital signals for transmission to the

control center. RTUs also receive control signals from the SCADA computer and relay

them to the individual field sensors. Programmable logic controllers (PLCs) are often used

in place of or in addition to RTUs; PLCs can be programmed to control some less critical

local functions that do not need to communicate with the SCADA computer. A

communications link transmits data to and from the host computer to the field hardware.

Traditional SCADA communications methods include leased telephone lines, dial-up

telephone lines, and cellular, satellite, and microwave circuits.

Pipeline conditions are displayed to the operators, and alarms are generated when

field conditions exceed preset levels. In addition to pipeline operators, data users can be

accounting personnel, computer technicians monitoring the system, training classes, and

computer personnel developing new modules or models.

The Olympic Pipeline SCADA system consisted of Teledyne Brown Engineering20

SCADA Vector software, version 3.6.1., running on two Digital Equipment Corporation

(DEC) VAX Model 4000-300 computers with VMS operating system Version 7.1. In

addition to the two main SCADA computers (OLY01 and 02), a similarly configured DEC

Alpha 300 computer running Alpha/VMS was used as a host for the separate Modisette

Associates, Inc., pipeline leak detection system software package.

The Olympic system was configured with both RTUs and PLCs for collection of

field data. At the time of the accident, most of Olympicís field units also had local

controllers embedded in their hardware that were designed to protect the station

equipment and downstream piping in the event contact was lost with the main SCADA

computer.

Olympicís SCADA communication link between the main computer and the field

sensors and controllers was a combination of leased telephone lines and more advanced

frame relay service, both of which were provided by local utilities. The communications

link did not experience any service problems on the day of the accident. A

communications subprocess within the SCADA computer queried field devices every 3 to

7 seconds over the communications link. This subprocess stored the incoming data so that

it could be accessed by different SCADA system users. This ìworkingî database was in

the physical memory of the SCADA computer as well as on the computerís hard disk. In

20 Since the accident, Teledyne Brown has become part of METSO Automation, a SCADA system

provider based in Calgary, Canada.
Factual Information 16 Pipeline Accident Report

the event of a SCADA system failure, the SCADA computer could read the hard disk

database and begin operations where it had left off before the failure.

The display and control subprocesses routed the data to the controllerís screens

and the commands the controllers sent to the field devices. Preprogrammed screens were

available on any of the computer workstations to display pressure trends or other data in a

variety of formats. More than 40 of these pre-programmed screens had been created for

Olympicís system, but each workstation was only capable of displaying one SCADA

screen at a time. Not all features available in the SCADA software used by Olympic were

implemented.

In addition to the pre-programmed screens, which could be accessed via a mouse

click, the controllers could issue commands to the system to construct custom displays if

necessary. At the time of the accident, screens to display conditions at the Bayview

terminal were being developed but were not available. Thus, a controller wishing to

display pressure trends at Bayview (such as depicted in figure 3) would have had to create

a custom display.

Olympicís SCADA system hosted a number of terminals and workstations other

than those used by pipeline controllers. These terminals and workstations were connected

to the SCADA system either through network connections or via modem using one of the

several serial communications ports located on the two SCADA computer units. Most of

the day-to-day system support and development work was done using one of these remote

terminals. The system did not create a keystroke record of the commands entered via one

of the remote terminals or workstations. Direct dial-in access to the VAX computer was

available from the outside, provided the user knew the phone number and had an

authorized dial-up account and system password.

The SCADA host computers, the control room computers, and the leak detection

computer where interconnected via an Ethernet backbone network. This means that each

device was connected to one common connection point and that there was only one path

from any one device to another. A bridge connected the Ethernet in the SCADA control

room with the companyís administrative computer network. The bridge device offered

some protection and isolation of the pipeline control from the administrative segments of

the networks. This protection was primarily from hardware network failures and faults.

Although it also offered some protection against a casual intruder into the network, it did

not offer protection equivalent to that of a full-featured intrusion firewall. No virus

protection or access monitoring was incorporated into the system.

The VAX-VMS was designed to be a multi-user system and was capable of

keeping track of hundreds of simultaneous users. Each user was allocated his share of

system resources, and each user was only permitted to run or view files associated with

that personís user identification (login). Extensive operating system accountability and

permission logs documented the resources used by any individual. Only one login was

being used by all of the Olympic operators, which allowed all the operators to have system

administrator privileges. This permitted any of the users to manipulate or delete any of the

files contained on the system.
Factual Information 17 Pipeline Accident Report

In the Olympic SCADA configuration, one computer functioned in a primary

mode, the other as a backup. The primary computer constantly communicated with the

backup to make sure that both computers had the same data. The backup computer was

designed to function as a ìhot spareî that could seamlessly assume the primary role (with

a current database) if necessary. The two computers switched roles once a week, when the

operating primary system was intentionally shut down to bring the backup on line for the

next week.

The Vector SCADA system made permanent disk records of data that were used

by the system and of all the commands issued. At midnight each day, the system created a

complete set of historical records for that day. As the system continued to operate, these

files were appended with the new data until midnight, when the appended records became

the historical record for that day. The Olympic system was set up with the default VMS

system file attributes. This means that the system would not overwrite older versions of a

file but would create a new file with a different version number. It kept a record of all files

created or modified, and a file purge could only be accomplished by the creator of the file

or by a user with the appropriate system privileges.

The VMS system was designed to log all system operations, errors, and hardware

failures. Each entry in the log contained a short descriptive message along with the system

time and date. VMS also contained a security log that kept a record of who was logged

into the system. The security log would contain an entry if someone had attempted to

break into the operating system. Each time a user typed an incorrect user name or

password, a break-in entry would be made in the security log. VMS, by default, allowed

the user six attempts to enter the correct password. If a valid password was not entered in

the six tries, that particular account was locked out for a period of time. The system was

designed to thwart programs or users who randomly try likely passwords in an attempt to

gain access to the system. The security log contained no evidence of an unauthorized

attempt to access the system.

Olympic made daily backup tapes of all new and modified files found in the

SCADA system for both OLY01 and OLY02 computers. This backup was done at about

6:00 a.m. and was accomplished while the systems were operating. A weekly backup of

the entire Vector system was made of both machines every Monday. This Monday backup

coincided with the weekly alternating of primary and backup computers.

Excavations in Proximity to the Olympic Pipeline

The original Dakin-Yew water treatment plant was constructed after Olympic

rerouted its pipeline in 1966. In the early 1990s, the city of Bellingham planned and

initiated a project to modify the plant. The project involved installing a 17-million-gallon

chlorine contact reservoir, a pumping station, and the ancillary piping. Phase I of the

project involved the construction of the chlorine contact tank.

In 1993 and 1994, Bellingham contracted with IMCO General Construction, Inc.,

to perform phase II of the planned modifications to the facility. Bellingham also
Factual Information 18 Pipeline Accident Report

contracted with Barrett Consulting Group21 to design the modifications and inspect the

construction. Phase II of the modifications consisted primarily of installing an

underground vault containing a four-pump pumping station,22 several additional water

lines ranging in diameter up to 72 inches, and the associated ancillary facilities necessary

to support the plant additions. (See figure 4.)

During the design of the plant modifications, Barrett contacted Olympic to obtain

more information on the pipelineís location and on Olympicís requirements concerning

the installation of facilities in proximity to the pipeline. On February 18, 1993, the city of

Bellingham potholed23 its existing underground water facilities at several locations in the

area of the proposed modification project to determine the exact elevations. On the same

day, the crew also potholed Olympicís pipeline at three locations. Records indicate that

Olympic personnel were present during this activity and documented the potholing on a

diagram-of-changes form. One of the Olympic inspectors noted on Olympicís copy of the

one-call24 report for this excavation: ì2-18-93 Potholed OPL [Olympic] line in 3 places.

Future 72" water line installation. Will notify O.P.L.î The Olympic inspectorís planner

page also contains a notation that indicates he was present on February 18, 1993, for these

excavations. The Olympic inspector reported that he had probed the Olympic pipeline

with a steel bar so that he knew how deep it was as the excavation progressed. He reported

that all the excavations within 2 feet above the pipeline were performed by hand, using

shovels.

In June 1993, the city of Bellingham again potholed its own underground facilities

at several locations to verify the elevations used for the design of the plant modifications.

City interoffice correspondence indicates that the request for the potholing activity was

initiated on June 10, 1993. Even though a one-call was not placed for these excavations,

Olympic was notified, and a notation on the Olympic inspectorís planner page indicates he

was present on June 11, 1993, for the potholing work. The Olympic inspector who

observed the potholing on both of these occasions reported that the pipeline was not hit

while he was present. There are no records of any other potholing conducted near the

water treatment plant.

21 Earth Tech is the successor in interest to Barrett Consulting Group.

22 A fifth pump was later added by the city of Bellingham.

23 Potholing is a method of positively locating a pipeline by exposing it. An Olympic inspector

describes the process he used as follows:

First, you locate the pipe with an electronic locator; that tells you about roughly where the pipe is within a

foot or two. And then you start your hole with an iron bar [probe]. You probe that into the ground and then

you take a smaller diameter probe and probe farther into the hole with that. [If]Öyou probe down 2 or 3

feetÖ[and] youÖhavenít hit the lineÖyou let the backhoe take off a foot of cover and you probe again. You

keep going down a foot at a time, until you actually find the line.

Once the pipeline is located with the probe, it is then excavated as necessary, using hand tools.

24 Anyone planning to perform excavations is required to use the one-call system so that any

underground facilities in the proposed excavation area can be located and marked before the excavation

begins.
CMV Vault

72”

60”

48”

24”

12”

Treatment Plant

16” Dakin-Yew

Service Line

16” 

TEMPORARY 

PUMP HOUSE

Temporary 16” Plastic Water Main

12” Drain

12” Drain Air Gap

Temporary 16” Plastic Water Main

City Sewer

36”

48”

60”

36”

48”

24”

TANK

TANK

Pipeline Rupture

Dakin-Yew Service Line

Whatcom

Creek

Hannah Creek

Olympic Pipeline (approx.) LEG

Air Valve Valve Water MaApproximOlympic Temporar1993-94 W

N
Factual Information 20 Pipeline Accident Report

During the design phase, Olympic personnel responded to three other one-call

requests to the water treatment plant. Upon completion of the design phase of the project,

Barrett provided a set of plans to Olympic for review by its engineering personnel on

July 30, 1993. On August 11, 1993, Olympic responded to Barrett that the clearances

between the new water plant facilities and its pipeline that were proposed in the plans met

or exceeded Olympicís requirements. On November 9, 1993, Barrett provided Olympic

with further information regarding proposed cathodic protection facilities.25 On

November 18, 1993, Olympic notified Barrett that it found no conflict between the

Olympic pipeline and the proposed cathodic protection facilities.

Records indicate that Olympic and IMCO personnel met on January 13, 1994, and

completed an action memorandum documenting IMCOís receipt of Olympicís standard

right-of-way stipulations and requirements. This document stipulates, in part, that

ìDeveloperís contractors are to provide Olympic Pipe Line Company with forty-eight (48)

hours prior notice of any grading or underground crossing over the pipeline.î Olympic

personnel also obtained another set of plans for the project at this time. A planner notation

made by one of the Olympic inspectors states that these plans were sent to the Renton

office. The memorandum, under ìType of Work,î listed ì72" waterline, 24" ductile, 12"

ductile waterline installation.î

IMCO placed one-calls for the excavation activities at the water treatment plant on

March 23, April 25, and May 18, 1994.26 As a result of the first of these one-calls,

Olympic completed a second action memorandum on March 25, 1994, again documenting

IMCOís receipt of Olympicís standard right-of-way stipulations and requirements. This

memorandum, under ìType of Work,î listed ìNew construction. Install water pipelines to

new water tank.î

Two Olympic employees (inspectors) shared responsibility for monitoring the

Dakin-Yew water treatment plant modification project and responding to requests to

locate Olympic pipelines in the area. Olympicís right-of-way surveillance and pipeline

safety procedures called for an Olympic inspector to be on site whenever a ìcontractor or

property owner digs across our line(s).î For this project, both inspectors understood that

one of them should be present whenever IMCO was working within 10 to 15 feet of the

pipeline. The Olympic inspectors stated that they had notified IMCO of this requirement

and had asked the company to notify Olympic in advance of any such excavation. The

inspectors stated that they then relied primarily upon IMCO to let them know when

excavation was to occur.

Both Olympic inspectors stated that, perhaps as often as two to three times per

week, they made unannounced visits to the site to check on the progress of the project.

These site visits were not documented. Neither inspector noticed any evidence during

25 Cathodic protection systems are installed to mitigate corrosion of buried steel (and other metallic)

structures. Because these systems can sometimes interact with other buried metallic structures and actually

increase corrosion on those structures, installation of cathodic protection systems is routinely coordinated

with other underground structure owners.

26 The next one-call placed for this project was on October 17, 1994, as discussed later in this report.
Factual Information 21 Pipeline Accident Report

these visits that IMCO was excavating within 10 feet of the pipeline without notifying

Olympic. Both Olympic inspectors stated that whenever they were on site witnessing the

work, IMCO hand-excavated the pipeline when working within 2 feet above it, as

required. Neither inspector was aware of any damage having been done to the Olympic

pipeline by IMCO during the Dakin-Yew modification project. IMCO personnel also

stated that Olympic representatives were on site whenever excavation was performed in

the vicinity of the pipeline. IMCO personnel did not report any problems contacting

Olympic personnel or with Olympicís responsiveness when called to the site.

Olympicís inspectors did not retain a set of construction plans for their use while

monitoring the Dakin-Yew project. IMCO maintained on site a complete working set of

plans for the project that were kept updated to reflect as-built conditions. Neither Olympic

inspector reported making inquiries during site visits to determine what activities were

planned and how they might impact the pipeline, nor did they report reviewing the

construction plans as the project progressed.

An inspection report27 indicates that Olympicís pipeline was exposed on

May 9, 1994, during installation of a 72-inch-diameter steel water line that was to cross

above the Olympic line. The inspection report notes that Olympic personnel were on site

during the excavation.28 Meeting minutes from May 10, 1994, indicate that Olympic had

been contacted about the placement of controlled density fill (CDF) material29 atop its

pipeline and that the only concerns expressed by the company had to do with the cathodic

protection and any re-excavation. Olympicís pipeline was then covered with CDF material

on May 12, 1994. According to a diagram-of-changes report prepared by Olympic

personnel, dated May 19, 1994, the bottom of the water line was 36 inches above the top

of the pipeline. (See figure 5.)

An inspection report also indicates that Olympicís pipeline was exposed northwest

of the pump station, with Olympic personnel present, on July 6, 1994, during excavation

to install a 24-inch-diameter ductile iron suction water line. Two PVC lines, one 2 inches

and one 4 inches in diameter, were also to be installed in the same trench. Olympicís

pipeline remained exposed throughout the construction of the suction water line. Planner

notes made by one of the Olympic inspectors indicates that additional site visits were

probably made between July 6 and 13, 1994. The inspection report for July 18, 1994,

indicates that additional excavation was performed to realign the ditch as necessary to

accommodate the new lines, again with Olympic personnel present on site. A diagram of

changes, dated August 11, 1994, indicates that the construction of the line crossings had

been completed. The diagram of changes shows that the top of the new water line was 29

27 Barrettís on-site inspector prepared daily inspection reports documenting the progress of the project.

28 Although the daily inspection report indicates that a ìCascade Pipeline inspectorî was present,

photographs confirm that it was Olympicís pipeline that was being excavated, and the Barrett inspector

confirmed that an Olympic inspector was present.

29 Controlled density fill is used in certain types of underground pipe installations to provide better

support for the pipe than standard backfill. In a typical installation, this material, in a slurry form, is poured

under and around the pipe to form a bed. After the CDF material hardens, regular backfill is applied to bring

the fill up to grade.
Factual Information 22 Pipeline Accident Report

inches below the bottom of Olympicís pipeline. The diagram of changes further indicates

that there was 18 inches of clearance to the 2-inch PVC line and 25 inches of clearance to

the 4-inch PVC line. Olympic records indicate that the coating on the bottom of the

pipeline at this location was repaired on August 12, 1994.

Plans for phase II of the water plant modification project included the installation

of a new 24-inch-diameter ductile iron discharge water line from the new pumping station.

The original design called for this discharge line to cross beneath the new 72-inch water

line and tie into an existing 16-inch water line southwest of the pumping station. Because

of a realignment of the 72-inch water line and the presence of the (hardened) CDF

material beneath it, IMCO asked that Barrett modify the design so that the new 24-inch

discharge line would tie into the existing 16-inch water line north of the 72-inch water

Figure 5. Excavation for installation of 72-inch-diameter 

water pipeline as part of water treatment plant modification.
Factual Information 23 Pipeline Accident Report

line, thus eliminating the need to cross beneath it. Once modified, the tie-in, or ìtee,î

connecting the new 24-inch line to the existing 16-inch line was about 21 inches directly

above the Olympic pipeline.

The project plans were modified on May 13, 1994, to reflect the proposed design

change in the discharge lineís location. The Barrett inspector stated that he thought he had

given a plan showing the revisions to one of the Olympic inspectors. No documentation

indicates that Olympic was provided with information concerning this design revision.

None of the meeting minutes discussing the tee installation project mention providing

Olympic with notice of the project or the scheduling changes. Both Olympic inspectors

stated that they were unaware of the teeís installation above the Olympic pipeline. A

diagram-of-changes form documenting the teeís installation was not located. (See figure 6.)

Excavation of the existing 16-inch water line for installation of the new tee

connection began on the afternoon of July 6, 1994, with completing of the tie-in

anticipated for the following day. This excavation was approximately 100 feet south along

Olympicís pipeline from its crossing with the new suction water line. As noted previously,

the daily inspection report prepared for July 6, 1994, indicates that an Olympic

representative was on site for at least a portion of the day. On July 7, 1994, it was

determined that the tie-in could not be made where planned because at that location, the

CDF supporting the 72-inch water line would interfere with the necessary excavation.

Efforts to complete the tie-in on July 7, 1994, were thus abandoned. After discussions,

Figure 6. (Left) Planned location of ìteeî connection joining new with existing water 

lines. (Right) Revised (actual) location of tee, which was installed above Olympic 

pipeline. (Not to scale.)
Factual Information 24 Pipeline Accident Report

IMCO and Barrett revised the alignment of the 24-inch discharge line, shifting it and the

associated tee connection 2 to 3 feet northward. This change necessitated enlarging the

existing excavation. On July 8, 1994, the existing water line was drained and the tee

connection installed. Once this was complete, the excavation remained open for several

days until the discharge water line from the pumping station was constructed and

connected and until the associated concrete thrust block (used to reinforce the connection)

was poured. Photographs indicate that the thrust block had been completed by July 21,

1994.

One of the valves on the tee connection was reportedly found to be inoperative

because the riser installed to allow access to the underground valve stem had become

misaligned during backfilling. Excavation to expose and realign the valve risers was

reportedly performed in August 1994.

During the last week in August 1994, a ductile iron pipeline was installed crossing

beneath the Olympic pipeline. Photographs indicate that the Olympic pipeline was

exposed during this installation. The daily inspection reports do not mention the presence

of Olympic personnel on site during this activity. A diagram-of-changes form

documenting this crossing was not located.

A 12-inch PVC utility duct was also installed crossing above the Olympic pipeline

approximately 17 feet north of the centerline of the tee connection. The inspection reports

do not mention the presence of Olympic personnel on site as this duct was installed across

the Olympic pipeline. A diagram-of-changes form documenting this crossing was not

located.

An electrician working for an electrical subcontractor to IMCO on the water

treatment plant project told investigators that he heard the pipeline being struck by a

backhoe being operated by an IMCO employee during the project. He stated that the

damage occurred just south and west of the pump station entrance and that he was told that

the excavation was being performed to realign the valve risers. He said that the same

operator damaged buried telephone lines on the same day that the pipeline was struck. The

daily inspection report for August 11, 1994, notes that excavation was occurring in the

vicinity of the pump station. The inspection report further notes that ìThe telephone

conduit in front of SW pump station corner, 15' from the 72" line was damaged severely

by Imco loaderÖUS West personnel on site repairing wires. 2 people from noon on

working on wires.î Telephone company records do not document any repairs at the DakinYew water treatment plant on August 11, 1994.

The daily inspection report for August 18, 1994, notes that ìDamage to the

telephone cable occurred just before noon, near treated water meter man hole. The backhoe struck it and took ~1/2 the wires.î Telephone company records indicate that telephone

line repairs were performed at the Dakin-Yew water treatment plant location on August

18, 1994.

The electrician who said he had heard the pipeline strike also said that he was

present when IMCO personnel decided not to notify the Barrett inspector or Olympic
Factual Information 25 Pipeline Accident Report

about the damage. He said that the IMCO personnel coated the area of the pipeline that

had been struck with a mastic coating before backfilling over it. The electrician did not

report witnessing any other occasions when the pipeline was struck. Certified payroll

records for the job reported that the electrician had worked 4 hours on August 11, 1994.

The electrician stated that he had worked on repairing the conduit for the telephone

company after the telephone lines had been damaged and that it was possible his time was

charged back to IMCO for the conduit repairs. A second electrician working at the site on

the same day did not recall the events described by the first electrician and could not

verify the accuracy of his statements.

A laborer who was working for IMCO on the project also said he recalled IMCO

hitting a pipeline on the project. He said he recoated the damaged pipeline with a primer

and white vinyl tape coating material. The laborer stated that the pipeline he had recoated

was a 24-inch ductile iron water pipeline. He had reviewed photographs of Olympicís

ruptured pipeline and stated that he was certain that it was not the pipeline that he had

repaired.

All of the other IMCO employees interviewed denied hitting or repairing a

pipeline in the vicinity of the pumping station during the project. None of the Barrett or

Olympic employees interviewed reported that they were aware of any damage done to

Olympicís pipeline during the project.

On October 17, 1994, a one-call was placed for work at the water treatment plant

to install fencing. On January 2, 1996, a one-call was placed for work at the water

treatment plant to excavate a valve. According to the water treatment plant superintendent,

the valve that was excavated was on a 36-inch water line that was not near Olympicís

pipeline. No other excavation activities were discovered to have occurred within the water

treatment plant between 1991 and 1997.

Pipeline In-line Inspections

Olympic conducted three in-line inspections of the 16-inch segment of pipeline

from Ferndale to Allen between 1991 and the day of the accident. The last two of these

inspections revealed anomalies in the pipeline within the confines of the city of

Bellinghamís Dakin-Yew water treatment plant and in the vicinity of the subsequent

rupture.

Regularly Scheduled Magnetic Flux Inspections

On November 18, 1991, Olympic contracted with Tuboscope Linalog, Inc., to

inspect its pipeline using a conventional resolution magnetic flux inspection tool.30 The

30 A magnetic flux internal inspection tool generates lines of magnetic flux and then analyzes them to

find differences in pipe wall thickness.
Factual Information 26 Pipeline Accident Report

Tuboscope inspection did not reveal any anomalies, either defects or features,31 in the area

of the eventual rupture. After the accident, a consultant for the Office of Pipeline Safety

(OPS) reviewed the original logs from the 1991 inspection and concluded that no

anomalies were present that were missed by the Tuboscope personnel who reviewed the

raw data.

Olympic policy was to conduct magnetic flux in-line inspections on a 5-year cycle,

and a second in-line inspection was performed on this section of pipeline on March 18,

1996, using the same type of Tuboscope tool. The report Tuboscope provided to Olympic

states that because this was a repeat inspection, the data were compared to the previous inline inspection data. Tuboscope reported three anomalies in the vicinity of the subsequent

rupture that had not been detected by the 1991 inspection. One was a defect reported at

Tuboscope wheel count 844+16, which was approximately 11 feet downstream of the

rupture location. This anomaly was classified as a ìpossible mill/mechanicalî defect that

was 0.4 inch long with a 23-percent wall thickness loss. A feature, identified as a ìpossible

mash,î was reported at the same Tuboscope wheel count as the defect. A second feature,

identified as a ìpossible wrinkle bend,î32 was reported at wheel count 844+02. This was

near the location of the subsequent rupture.

To assist Olympic in prioritizing the physical investigation of the reported defects,

Tuboscope also reported a pressure-related (PR) ratio to Olympic for each of the defects

identified on the pipe. The PR ratio compares the strength of the pipe containing the defect

to the strength of an undamaged pipe. A PR ratio greater than 1 indicates that the

remaining strength of the pipe is sufficient for the maximum operating pressure. The PR

ratio reported for the defect identified at wheel count 844+16 was 1.21.33 For these

calculations, Tuboscope used the radial depth and axial length of each defect in the

American Society of Mechanical Engineers (ASME)/American National Standards

Institute (ANSI) B31G34 calculations, which were developed for corroded pipe. These

calculations were not valid for non-corrosion defects such as mill/mechanical defects;

however, Tuboscope still reported PR ratios for these defects. PR ratios were not

calculated for features.

Washington Department of Ecology Administrative Order

As a result of a leak in a 20-inch Olympic pipeline in the Ebey Slough area that

occurred at a buckle in the pipe, the Washington Department of Ecology (WDOE) issued

an administrative order on September 17, 1996, that required Olympic to, among other

actions, conduct a magnetic flux inspection of those pipeline sections for which magnetic

31 Defects are indications of metal loss or thinning of the pipe wall. Features are anomalies that do not

involve metal loss or thinning. Anomalies identified as features are typically, though not always, determined

to be valves, fittings, sleeves, etc.

32 A wrinkle bend is a bend in the pipe that contains one or more buckles. Wrinkle bends usually occur

during the original installation of the pipeline.

33 The flaw list reported the PR ratio as 1.21. The defect report listed the PR ratio as 1.11.

34 American Society of Mechanical Engineers/American National Standards Institute B31G, Manual

for Determining the Remaining Strength of Corroded Pipelines, 1991.
Factual Information 27 Pipeline Accident Report

flux inspection data did not exist and to submit a report explaining the cause of all

identified anomalies. The order further stated that any significant anomalies that could not

be adequately evaluated by examination of the data must be verified by field inspection.

Olympic was also required to run a caliper tool35 through those pipeline sections where

caliper tool data did not exist and to prepare a comparative analysis identifying any

discrepancies between the caliper tool data and construction drawings for the entire

Olympic system. Olympic was again required to investigate, and verify by field

inspection, which included excavation and examination of the anomaly, any significant

discrepancies identified during this evaluation of the caliper tool data.

In its response to the order, Olympic provided a list of the magnetic flux

inspections that had previously been performed on its pipeline system and the proposed

schedule of future inspections. Olympic stated that although the magnetic flux tool was

very effective in pinpointing corrosion, scratches, gouges, and welds, it was not an

effective technology for detecting anomalies, such as dents and buckled pipe, that do not

involve metal loss. Based on this information and further discussions about the various

inspection tool capabilities, the WDOE dropped its requirement for the magnetic flux

inspection data review.

Olympic also reported to the WDOE that its caliper tool inspection contractor,

Enduro Pipeline Services, Inc., had improved its technology so that it could better identify

buckles that were adjacent to bends and fittings. Olympic asked Enduro to review the data

from its previous caliper tool inspections36 and provide an updated interpretation.

Enduroís review identified suspected buckling adjacent to four fittings. Upon excavating

these anomalies, Olympic found and repaired buckles at three of the four locations. No

other areas of suspected buckling were identified during Enduroís review of the rest of the

caliper tool data for the 20- and 14-inch lines.

Because no previous data existed, Olympic had Enduro, on January 15, 1997,

conduct a caliper tool inspection of the 16-inch accident pipeline from Ferndale to Allen.

The purpose of the inspection was to determine the geometrical condition of the pipeline

and to specifically detect buckles in accordance with the WDOE order. Within the

confines of the water treatment plant, near the area of the future rupture, Enduro reported a

0.45-inch total sharp defect37 at the same area identified by Tuboscope as a possible

wrinkle bend. This was at Enduro station 843+69. In its January 27, 1997, field report,

Enduro did not report an anomaly at the same location previously identified by Tuboscope

at wheel count 844+16 as a possible mill/mechanical defect having 23-percent wall

thickness loss with a possible pipe mash feature.38

35 A caliper, or geometry, tool is designed to detect anomalies such as dents, buckles, ovality, weld

penetration, etc., that change the internal diameter of the pipeline.

36 Caliper tool inspections had not been done on the accident pipeline.

37 According to Enduro evaluation criteria, a sharp defect is a reduction in pipe diameter within a 2-foot

length of pipe. The reduction could be caused by, for example, pipe dents, bends, weld misalignment, or

valves.

38 After the accident, an OPS consultant reviewed the log and found indications of deformation at both

locations. At a log scale of 1 inch to 250 feet, however, one of these was missed by Enduro in its

interpretation in 1997.
Factual Information 28 Pipeline Accident Report

In April 1997, Olympic began exposing various locations on its pipeline where

anomalies had been reported. On May 22, 1997, Olympic provided the WDOE with a

letter describing the actions it planned and a schedule for completing the required

inspection work. The schedule consisted of a chart summarizing the results of all of the

anomaly excavations, including a comparison between what was shown by the caliper tool

and what was actually found upon excavation. The 0.45-inch sharp defect at Enduro

station 843+69 was scheduled to be investigated in May 1997. A footnote regarding this

defect indicated that Olympic might excavate if justified by the risk as determined by its

engineers.

All of the anomalies listed in the summary were from the caliper tool inspection

surveys. None of the magnetic flux indications were listed. The only anomaly listed on the

16-inch pipeline between Ferndale and Allen was the 0.45-inch sharp defect at 843+69.

Olympic stated that it planned to submit a final table summarizing the investigation and

disposition of the anomalies as soon as all the work was completed. Olympic planned to

complete the excavations by August 1, 1997. On June 3, 1997, Olympic faxed a copy of

an updated chart of field investigations to the WDOE. This updated summary still listed

May 1997 as the scheduled time frame for investigating the sharp defect. No records were

located to indicate that Olympic had provided any further update to the WDOE or that the

WDOE had requested one. The latest completion date in Olympicís final summary, which

was dated March 1998, indicates that the field excavation inspections were completed by

November 6, 1997, and that no field inspection of the pipeline had been made at the

reported sharp defect.

Olympic Postinspection Actions

In its letter to the WDOE, Olympic indicated that it would use the ASME B31.439

piping code to analyze and repair pipeline anomalies, including gouges, grooves, dents,

and corrosion. The B31.4 code requires that gouges and grooves having a depth greater

than 12 1/2 percent of the nominal wall thickness be removed or repaired. The B31.4 code

also requires that dents greater than 6 percent of the pipe diameter in pipelines with a

diameter exceeding 4 inches and any dent containing a scratch, gouge, or groove be

removed or repaired. The B31.4 code also contains calculations that can be used to

analyze corrosion pitting to determine whether repairs are necessary.

The Olympic operations and maintenance procedures relating to the repair of its

pipelines, which were issued in July 1995 and provided to the OPS in August 1998,

required that any dent with a depth exceeding 2 percent of the nominal pipe diameter on

pipe sizes greater than 12 inches be removed or repaired.40

39 American Society of Mechanical Engineers/American National Standards Institute B31.4, Liquid

Transportation Systems for Hydrocarbons, Liquid Petroleum Gas, Anhydrous Ammonia, and Alcohols, 1992

Edition.

40 Since the accident, Olympic has been unable to determine why this procedure adopted a 2-percent

standard rather than the ASME B31.4 criteria of 6 percent for the repair of dents. Company officials stated

their belief that correspondence from the vice president and general manager to WDOE clearly established

that its company policy at the time of the 1997 evaluations was to use the ASME criteria.
Factual Information 29 Pipeline Accident Report

The Olympic spill prevention plan that was provided to the WDOE on December

31, 1992, contained provisions specific to in-line inspections. The plan states that

ìOlympic Pipe Line will excavate and visually inspect all anomalies that are deeper than

20 percent of the original wall thickness.î

Olympic also noted that it would take into consideration location, sharpness, and

appearance of the defect; location of the seam or joint welds; and other factors that

influence stress at the location of the defect when evaluating defects that did not meet the

codeís criteria to determine whether those defects should also be repaired or removed.

Olympic further stated that data obtained as the excavations were made would be used to

determine whether to continue excavating these lesser defects.

Olympicís engineering assistant reviewed the results of the in-line inspections and

created a dig sheet for the water treatment plant area where the rupture later occurred.

Some general notes made by the engineering assistant on the dig sheet indicate that it was

a difficult area to access and that this location was not inspected. The engineering assistant

completing the evaluation noted the location of the Tuboscope 23-percent wall loss defect

and possible mash at wheel count 844+16 (approximate station 843+83).41 Next to

Tuboscopeís possible wrinkle bend feature at wheel count 844+02, he referenced Enduroís

0.45-inch sharp defect located at station 843+69. In the general notes for the dig site, he

indicated that it was not inspected. He further noted that Tuboscopeís 23-percent defect

was ìmin. [minimum] riskî and that the Enduro sharp defect was ìless than repairable.î 42

The engineering assistant provided a copy of the dig sheet to Olympicís

construction supervisor so that excavation and inspection of the anomalies in the vicinity

of the water treatment plant could be scheduled. The construction supervisor stated that he

had one of his employees go to the site to check the location in anticipation of performing

the excavation. This employee reported back to him that the location was too wet to be

excavated at that time. When the construction supervisor reported this to the engineering

assistant, he was told they would go back and try again when the area was dry. The

construction supervisor said that no further action was taken to excavate the pipeline in

this vicinity before the accident.

The engineering assistant stated that Olympicís spill prevention plan had never

been approved by the State, so he did not think that it was in effect at the time his

evaluations were made. He did not recall any relevant operations and maintenance

procedures applicable to in-line inspection runs. He further stated that he had used the

ASME B31.4 guidelines for deformations. He also said that he used the B31G criteria for

corrosion pitting because that was the best guidance available to him for metal loss

anomalies.

He said that he had compared the 1996 in-line inspection results to those found in

1991 and that he was aware that the 23-percent wall loss defect and pipe features

41 The Tuboscope wheel count did not correspond to Olympicís stationing. Enduroís reported stationing

was, however, correlated to match Olympicís.

42 An indentation of 0.45 inch in a pipe with a diameter of 16 inches is an approximately 3-percent dent.
Factual Information 30 Pipeline Accident Report

identified in the 1996 magnetic flux in-line inspection were not shown on the 1991 results.

But he said he had lost faith in Tuboscopeís ability to identify deformations with the

magnetic flux in-line inspection tool because it had failed to find the buckle that had failed

in the Ebey Slough. He therefore discounted the Tuboscope features called a ìpossible

mashî or ìpossible wrinkle bendî and relied upon the data from Enduro to identify

deformations in the pipeline. He said that he had reviewed the pipeline alignment sheets

and determined that the water treatment plant area was congested with several foreign

pipe crossings. The 72-inch water line, for example, had been installed at approximately

station 843+85. He said that the dates that the line crossings were installed were not

reflected on the alignment sheets and that he had not reviewed the diagram-of-changes

forms to learn when each of the line crossings had been installed. The alignment sheets

would not have depicted the water line tee since a diagram of changes for it had not been

completed.

The engineering assistant stated that after the company had excavated several

locations during the spring of 1997, he reassessed the need to excavate the pipeline in the

Dakin-Yew water treatment plant. He noted that the actual deformations found in the

pipelines that were excavated were not as severe as had been indicated on the Enduro

inspection results. He noted that the Enduro 0.45-inch sharp defect was only about

3 percent, which was less than the 6-percent dent specified in the ASME B31.4 guidelines.

He said that when using B31G to evaluate the 23-percent metal loss anomaly, repairs were

not required. Even though he used the calculations for corrosion pitting, he did not initiate

an investigation into what might be causing the corrosion. He said that he might have

forgotten that the listed defects and features were not identified in 1991 when he did the

reassessment in July 1997. He acknowledged that had he known that construction had

occurred in the area when the water treatment plant was expanded in 1994, or had he

identified metal loss at the same location as the deformation, he would probably have

excavated the pipeline at that location.

He recalled that the ìdifficult to accessî comment related to terrain. He thought

that the pipeline was located in a steep area.43 He did not recall whether the area being wet

was a consideration. He further noted that cost was not a factor in determining whether or

not this location should be excavated.

He stated that he had discussed and reviewed this potential excavation with

Olympic management and that all concurred that it was not necessary to excavate and

visually inspect the pipeline at the water treatment plant location.

The Bayview Products Terminal

In December 1998, Olympic completed construction of a new products terminal

about 2 miles upstream of the existing Allen station. The Bayview products terminal

consisted of five product tanks with a total storage capacity of 500,000 barrels and the

43 The area was actually level and accessible.
Factual Information 31 Pipeline Accident Report

associated delivery and return piping. A 10,000-barrel transmix tank was also installed as

a breakout tank at the facility.44 Three product transfer pumps were installed at Bayview.

Two of these were capable of moving product along the accident pipeline.

Overpressure Protection

Olympic contracted with Jacobs Engineering Group, Inc., to design the facility and

provide additional services during the construction of the terminal, including assistance

with the procurement of its components. The system design called for ANSI 300#-rated

components having a maximum design pressure of 740 psig. Because the accident pipeline

entering the terminal could be operated at pressures considerably higher than 740 psig,

three control devices were employed to protect station piping and components from

overpressure. First, a control valve, CV-1904, was installed on the inlet side of the station

and set at 600 psig to throttle back the flow of product into the station. Second, a relief

valve, RV-1919, was installed just downstream of the control valve. The relief valve was

designed to open and transfer excess product to the transmix tank if the pressure

downstream of CV-1904 exceeded the set pressure of the relief valve. (The pressure

settings for RV-1919 will be discussed in detail later in this report.) Finally, a receiver

manifold arrangement, consisting of three motor-operated and remotely controlled block

valves (MV-1902, MV-1903, and MV-1907) controlled product flow upstream of control

valve CV-1904. Either MV-1902 or MV-1903, depending upon the selected configuration,

was set to close in approximately 60 seconds and completely block the flow of product

into the Bayview terminal if a set pressure of 700 psig was reached inside the facility.

Although the information in this section refers to the pipeline involved in the accident, the

parallel piping from Anacortes was configured in an identical fashion. (See figure 7.)

Additional overpressure protection was provided by high discharge pressure limits

placed on the pumps at Ferndale station. These pumps would shut down automatically if

the discharge pressure reached approximately 1,400 psig.

Valve Configuration

Control Valves. As noted above, the inlet control valve, CV-1904, was intended to

throttle product flow into the Bayview terminal and thus limit pressures entering the

facility. An outlet control valve, CV-1963, was installed in the accident pipeline on the

discharge side of the Bayview pumps to help maintain adequate pressure through the

pumps. Specification sheets prepared by Jacobs indicate that the inlet control valves were

to be rated to ANSI 600#, and the outlet control valves rated to ANSI 300#.

According to correspondence initiated during the design and construction of the

Bayview facility, a representative of Thunderco, Inc., the vendor supplying the inlet and

outlet control valves, contacted Jacobs to determine whether Olympic wanted piston stops

to be extended within the valves. Extended piston stops are used to limit piston travel

within the valve and thus control whether the valve is capable of closing completely or only

44 When pressure in a pipeline exceeds established limits, relief valves open that direct product to

breakout tanks, thus reducing pressure in the main pipeline.
Factual Information 32 Pipeline Accident Report

partially. In the correspondence, Thunderco stated that piston stops are normally extended

in outlet control valves to keep the valve from closing completely, thereby eliminating the

possibility of accidentally pumping against a closed valve. Olympic responded that piston

stops should be extended on the outlet control valves (CV-1963 and CV-1969), but that it

would prefer full closure on the inlet control valves (CV-1904 and CV-1916).

A Thunderco representative stated that piston stops are present in all the

companyís control valves but that they are not extended to limit piston travel short of full

closure unless requested by the customer. The representative further stated that the stops

could be adjusted as necessary in the field without removing the valve from service. After

the control valves were installed and Bayview terminal came on line, Olympic personnel

discovered that the inlet control valves did not close completely. After the accident, it was

determined that piston stops were extended in both the ANSI 600# inlet control valves to

limit the travel of the valve to 90 percent of full closure,45 but they were not extended in

either of the ANSI 300# outlet control valves. (Data recording the position of CV-1904

during the accident indicate that the valve closed to approximately 30 to 40 percent and

that it never reached the stop setting.) Olympic took no action before the accident to adjust

the stops on any of the control valves.

Figure 7. Simplified schematic of Bayview products terminal showing relative locations 

of block, control, and relief valves.

45 Although the stop prevented the final 10 percent of piston travel, this does not correlate to a 90-

percent reduction in product flow. Because of the internal configuration of the valve orifice, the reduction

was potentially much greater than 90 percent.

MV1902

MV1907

FERNDALE

RECEIVER

FROM FERNDALE

16"

16"

MV1903 16"

10"

CV1904

RV1919 8"

TO TANK

209

INTO BAYVIEW

PRODUCTS TERMINAL

M

M

M
Factual Information 33 Pipeline Accident Report

Relief Valves. As noted above, the relief valve on the inlet side of the accident

pipeline was designated RV-1919. RV-1919, as were the other three relief valves on the two

pipelines, was an 8-inch Brooks Model 760 pilot-operated control valve46

manufactured by Fisher-Rosemount.47 The valve is designed to remain closed until the

pressure in the pipeline on the inlet side of the valve reaches a predetermined pilot set

point. When this pressure is reached, the pilot opens, allowing the relief valve itself to

open and permit product flow through the valve. When the pressure drops below the valve

set point, the pilot closes, allowing the relief valve piston to reseat and shut off flow.

According to the manufacturerís specifications, a Model 760 is capable of regulating the

inlet pressure to within ±2 psig of the set point. (See figures 8 and 9.)

As noted, the pressure at which the Model 760 relief valve opens is determined by

the pilot pressure set point. The Model 1760 pilot is available in either a low-pressure (0 to

180 psig) or a high-pressure (150 to 650 psig) configuration. The two configurations have

different pistons, valve covers, and O-rings. Four different pilot springs are available to

further refine the pressure ranges for each configuration. For the low-pressure

configuration, the four springs can support pressure ranges of 0 to 20, 0 to 40, 30 to 80,

and 70 to 180 psig, respectively. The spring used for the 30- to 80-psig range in the lowpressure configuration supports a pressure range of 150 to 350 psig when used with the

high-pressure configuration. Similarly, the 70- to 180-psig low-pressure spring is the same

spring that is used for a pressure range of 350 to 650 psig in the high-pressure

configuration.48 Assuming the correct spring and valve component configuration, the

pressure set point can be ìfine-tunedî by turning an adjustment screw at the top of the

pilot housing, which varies the compression on the pilot spring.

According to design documents prepared by Jacobs during the design of the

Bayview products terminal, the set pressure for RV-1919 and the three other relief valves

intended to protect the ANSI 300# piping from pressure surges was to be 740 psig, the

equivalent of the maximum allowable working pressure for this class of ANSI-rated

components.

Fisher-Rosemount provided the Safety Board with a copy of the Jacobs instrument

specification sheet for RV-1919. The document specified a spring set pressure of 740 psig

(which actually exceeded the maximum pressure of 650 psig for the Model 760 valve) at a

temperature of 100° F. On the specification sheet, the 100° temperature was circled, and

above it was written, by hand, ì70-180.î

46 ìControl valveî is the terminology used in the Brooks literature. Because RV-1919 functioned as a

pressure relief valve, it will be described as such in this report.

47 Purchase orders and invoices for RV-1919 denote Brooks model valves offered through FisherRosemount Petroleum, a division of Emerson Electric Company. Fisher-Rosemount Petroleum later became

Daniel Measurement and Control Division, a division of Emerson. For this report, Fisher-Rosemount will be

used to designate the company/facility that sold RV-1919 and other relief valves used by Olympic.

48 A Brooks (Fisher-Rosemount Petroleum) technical bulletin for control valve pilot springs (number

V-9500-11, dated September 1984) notes that the proper spring and piston are needed to establish the desired

set point range for the pilot valve. A Brooks part list (number PL-V7560-20, dated April 1992) also sets

forth the various parts required to establish the desired rated pressure range for the pilot valve.
Factual Information 34 Pipeline Accident Report

Figure 8. Relief valve schematic.

From pipeline To breakout tank

Pilot Pilot assembly

spring

Pressure set point

adjusting screw

= Inlet pressure

= Outlet pressure

A

B

A

B

From pipeline To breakout tank

Pilot assembly Pilot

spring

Pressure set point

adjusting screw

= Inlet pressure

= Outlet pressure

B

A

Pressure sensing line

Pressure sensing line

(Above) Relief valve is fully closed. Because inlet pressure is below the pressure set 

point, pilot piston (A) is seated, and pressure on both sides of relief valve piston (B) is 

balanced. The main valve spring keeps the relief valve closed.

(Below) Relief valve is fully open. Inlet pressure is greater than pressure set point, 

compressing pilot spring and lifting pilot piston (A) from seat. Liquid flow through pilot 

reduces pressure on back side of relief valve piston (B). Inlet pressure compresses 

relief valve spring and lifts piston from seat, allowing flow to breakout tank. When 

pressure drops below the pressure set point, pilot piston will reseat. Inlet pressure and 

spring force will close relief valve and cut off flow.
Factual Information 35 Pipeline Accident Report

Representatives of Fisher-Rosemount told investigators that the handwritten

notations on the specification sheet were probably made by an employee at the companyís

Statesboro, Georgia, manufacturing facility and that the ì70-180î likely referred to the

spring used for a 100-psig setting for the Model 1760 pilot. In any event, RV-1919 and the

three other ANSI 300# valves were manufactured with the low-pressure configuration and

equipped with the 70- to 180-psig spring. Fisher-Rosemount documentation indicates that

the pilots on the four relief valves were calibrated to a set point pressure of 100 psig before

being shipped to Olympic. Various Fisher-Rosemount invoices and acknowledgements for

the purchase order that it provided back to Jacobs and Olympic identify RV-1919 and the

three other ANSI 300# valves as Model 760 relief valves equipped with Model 1760 pilot

controls set at 100 psig. In addition, each pilot body was stamped with the 100-psig set

point, and a tag affixed to the pilot identified the range of the pilot spring as 70 to 180.

During construction of the Bayview products terminal, Olympic assigned its

mechanic to act as a mechanical inspector on the project. The mechanic reported that he

had compared the serial numbers of all four relief valves to either an equipment list or a

construction drawing provided by the contractor to make sure that Olympic had received

the proper materials.

During the night from December 16 into December 17, 1998, Olympic personnel

began filling the pipeline to bring the Bayview facility into operation. The employees

Figure 9. Closeup of relief valve RV-1919 and pilot.
Factual Information 36 Pipeline Accident Report

noted that as the accident pipeline filled and the pressure increased above 100 psig, RV1919 opened and diverted product to a breakout tank. The employees recalled that the

engineering manager49 was on the site during this activity and that when he noticed that

the relief valve was operating at a pressure lower than intended, he reviewed drawings and

directed efforts to determine why this was happening. The employees were aware that the

available pressure range adjustment on the relief valve was limited by the type of pilot

spring. Without consulting the manufacturerís literature on the valve, which was available,

the employees decided that they could increase the set point by replacing the pilot spring.

One of the mechanics had a spring in his truck that he gave to another of the mechanics

who used it to replace the existing pilot spring in RV-1919. The set point was then

increased, after which the employees were able to fill and pressurize the pipeline. On

December 18, the mechanic reported to other Olympic employees, including those within

the engineering group, that the set pressure of RV-1919 had been established at 700 psig.

He said that after he increased the set point, he used a hydraulic pump to apply pressure to

the pilot to determine the pressure at which the pilot operated.50 He said he tested the pilot

several times and that it opened at the correct pressure each time.

Hoffman Instrumentation Supply Company is a company that Olympic used to

purchase replacement parts. A Hoffman employee based in Renton, Washington, recalled

that an Olympic mechanic contacted him on December 17, 1998, and told him that the

relief valve was discharging at only about 100 psig and that he needed to order four 350-to

650-psig pilot springs from Fisher-Rosemount because the springs he had were for the

wrong pressure range. He passed this along to a second Hoffman employee in Portland,

who looked up the part numbers for the springs and placed the order.

On December 17, 1998, Fisher-Rosemount received and processed a rush order on

behalf of Olympic for the four springs, and the springs were shipped on or about

December 22, 1998. Olympic received the springs and used them to replace the springs

that its personnel had used in the four relief valve pilots. Olympic was not aware that,

because the same spring was used for either the 70- to 180-psig or the 350- to 650-psig

pressure ranges, depending on the valve configuration (high or low pressure), the new

springs were identical to the ones originally supplied in the pilot.

At some point after these springs were delivered, the Hoffman employee based in

Portland, Oregon, having heard that the springs were still not working for the intended

set points, stated that he contacted Fisher-Rosemountís Statesboro plant and learned that

a new piston, pilot cover, and O-ring would be needed to convert the 100-psig valves to

the high-pressure configuration. On January 11, 1999, he faxed this information

to the Hoffman employee in Renton, Washington, who normally worked directly with

49 The engineering manager has refused to answer questions from Safety Board investigators.

50 To conduct the test, the mechanic isolates the pilot from the main relief valve and applies hydraulic

pressure to the pilot through the sensing line. A gauge on the test unit registers (by showing a drop in

pressure) the point at which the pilot operates. This is the same test the company used to perform annual

valve tests required by Federal regulation.
Factual Information 37 Pipeline Accident Report

Olympic.51 The fax included the parts list, with the required part numbers highlighted. The

Hoffman employee in Renton stated that he was certain he had passed this information

along to Olympic at that time, but he did not remember which Olympic mechanic he had

talked to. The Olympic mechanic interviewed by the Safety Board stated that he had not

received it. No additional parts for the relief valves were ordered at that time; however,

after the accident, Olympic obtained the parts necessary to properly configure the pilots on

its similar relief valves.52

Eighteen days after the accident, the pilot on valve RV-1919 was tested and found

to operate at 440 psig. The next day, the valve was removed from the pipeline for

subsequent Safety Board testing (discussed in detail later in this report).

Between July and December 1999, a contractor working for Olympic conducted

dynamic tests of the relief valves throughout Olympicís pipeline system. The set points of

the pilots and the actual pressures at which the relief valves opened and closed were

recorded. In all tests for all these valves, the actual pressures at which the relief valves

opened were greater than the set points, with the differences ranging from 8 to 130 psig.

As a result of this testing, Olympic adjusted the set points of all the relief valves on its

system to 30 psig below desired opening pressure.

The pilot on RV-1923, a twin to RV-1919, was tested in place at the same time as

RV-1919 and operated at 650ñ660 psig during both tests conducted. During the flow

testing Olympic conducted after the accident, however, RV-1923 did not function.

Olympic placed an order for the parts necessary to convert the pilot to a high-pressure

configuration on the same day that RV-1923 was tested.

Operations Issues

A hydraulic surge analysis of the Olympic system was performed in 1991. No

additional surge analysis was performed to predict the hydraulic behavior of the pipeline

as a result of the addition of the Bayview facility in 1998. Bayviewís proximity to Allen

pump station, according to a controller interviewed, created operational challenges. For

example, because of the size of the pumps at Allen, product could be drawn away too

quickly from Bayview. The controller said he believed that the proximity of the Bayview

and Allen stations reduced the time that controllers had to react to such problems before

protective devices at the Bayview terminal activated and caused an unintended shutdown

of the pipeline.

Between December 16, 1998, when Bayview went into operation, and the accident

on June 10, the inlet block valve at Bayview closed 41 times because of high pressure

within the Bayview terminal. On 13 of these occasions, the pressure on the pipeline

upstream of the inlet block valve exceeded 1,000 psig, with a maximum pressure of 1,339

51 The fax noted that ìthe 1760 pilot they called out on the original sales order was set @ 100 psi and

was the 70-180 springî and that ìit turns out you cannot simply change the spring to get a higher rating. You

need to also change the piston, cover and piston O-ring.î The fax also listed the part number of the piston,

cover, and O-ring that would be needed, in addition to the spring, to make this conversion.

52 RV-1919 was in the possession of the Safety Board.
Factual Information 38 Pipeline Accident Report

psig on one occasion. Olympicís mechanic stated that, on May 12, 1999, under the

direction of ìsomeoneî in the engineering group, he reduced the set pressure of RV-1919

from 700 to 650 psig.53 Six of the 41 closings of the inlet block due to high pressure within

the Bayview terminal occurred after the relief valve pressure set point was changed.

The Federal pipeline safety regulations, in 49 CFR 195.402, require that a pipeline

operator develop written procedures for handling abnormal operations that include

ìresponding to, investigating, and correcting the cause ofÖunintended closure of valves

or shutdownsî or the ìoperation of any safety device.î Olympic had developed procedures

for addressing abnormal operations. The companyís Operations Manual for Controllers

provided guidance for the pipeline controllers working in the Renton control center. The

manual predates the installation of the Bayview products terminal. It was not updated with

information on Bayview before operations were begun at the facility or before the

accident.

The foreword to this manual states that the prevention of releases and the

minimization of the consequences should a release occur take priority over pipeline

schedules and cost minimization. The foreword states that ìIf there is any reason to

believe that a release might occur or has occurred, the pipeline system should be

immediately shut down and promptly investigated.î

Chapter 5 of the manual covers abnormal operations. Section 5.1 refers to

unintended mainline block closures. In subsection 5.1.2, the controller is instructed to:

Investigate the cause of the high pressure by using all information available to

find the cause and determine the level and duration of the high pressure reported

by the equipment. The Controller should then call his supervisor to discuss the

situation. The Controller will not restart the pipeline without concurrence from his

supervisor.

Subsection 5.1.3 states:

If conditions indicate that a loss of fluid from the pipeline might have occurred,

the pipeline will remain down and appropriate employees will be sent to

investigate.

Subsection 5.1.4 also states:

If a loss of fluid from the pipeline is not apparent a static pressure test by segment

is requiredÖ. If pressure is not lost, the pipeline may be restarted with

concurrence from the supervisor.

Section 5.2 covers unintended shutdowns of a pump unit or pumping station.

Section 5.2 states that:

53 Although Olympicís engineering manager has refused to answer questions from Safety Board

investigators, investigators did learn that an October 14, 1998, design document indicates that Olympic had

revised the intended set pressure of RV-1919 to 650 psig.
Factual Information 39 Pipeline Accident Report

A pump unit shutdown caused by pressure changes such as high discharge, high

case or low suction should be investigated immediately by the Controller to

determine the cause for the pressure change. Data such as computer trends,

protective device settings, and computer alarm limits will provide needed

information to determine probable cause.

Chapter 7 of the manual provides more local information for handling abnormal

operations. Section 7.20, which addresses unauthorized operation of valves, states that

ìValve malfunctions are to be reported to the Supervisor of Products Movement and a

Maintenance Log written regarding the malfunction.î

Section 7.22 requires that:

Any operation that deviates from the normal mode of operations must be

documented by the Operations Controller and by the field personnel involvedÖ.

This information is invaluable to prevent the same situation from occurring again

and to assist personnel in rectifying this event.

Olympic did not document the block valve closures, nor did the company view

them as abnormal operations because the block valve was closing as intended by the

design of the facility.

The General Abnormal Operating Procedures section of Olympicís Operations

and Maintenance Manual contains similar guidance material for handling and

documenting abnormal operations as contained in the Operations Manual for Controllers.

One controller interviewed said that other controllers were initially concerned

when Bayview was first commissioned because it was a new and unfamiliar facility. He

also stated that different operational issues had not had an opportunity to ìmature and be

formally worked out.î He further stated that, during the months after Bayview began

operations, some of these issues did get worked out, essentially by trial and error, although

the controllers had not had an opportunity to try out all the operations that would have

better familiarized them with the Bayview facility.

The Bayview products terminal problems, according to one controller, increased

the workload of the controllers operating that segment of the pipeline. He further stated

that ìany time that the facility shuts down and then closes the valves, it interrupts the

pipeline and the flow of workÖit causes the controller extra work.î During an abnormal

situation along the pipeline, the controller operating that line segment was expected to

identify and remedy that situation while also continuing to monitor and operate the other

segments along his pipeline. Olympic did not have procedures in place whereby another

controller or supervisor is assigned to modify the abnormal situation or operate other

portions of the line. Another controller expressed what he said was a general sense of

frustration with the problems at Bayview. According to documents reviewed by Safety

Board investigators, the controllersí concerns with the Bayview products terminal were

often expressed to supervisors and to members of the engineering department.
Factual Information 40 Pipeline Accident Report

According to Olympic controllers, the company had not provided any structured or

formal training to its operations controllers after the Bayview terminal became

operational. They said that management believed that, because the Bayview terminal was

not fundamentally different from any other delivery or pump station facility on the system,

no special guidance or training for controllers was needed

Olympic added a chapter to the facility index section of its Operations and

Maintenance Manual, effective November 23, 1998, that applied to the Bayview terminal.

It contained a description of the facility, a list of equipment, a list of local alarm and

remote indications, a table of set points for the various protective devices, a list of valves

with their associated functions, and a station inspection checklist.

The remainder of the manual, including the miscellaneous operations and general

abnormal operating procedures sections, was not updated to include any reference to the

Bayview facility. Olympic officials have told the Safety Board that, since the accident, the

company has updated its manuals to reflect the new equipment associated with Bayview

products terminal and has posted a flow diagram of Bayview on its control room wall.

Postaccident Pipeline Excavation and Segment Retrieval

Excavation of the ruptured pipeline was delayed for several days because of safety

concerns associated with the presence of gasoline vapors and ongoing fires. The

excavation was further delayed while a temporary water pumping station and water line

could be constructed to bypass the water treatment plant pumping station. Excavation

began, under Safety Board supervision, on June 27, 1999. On June 30, 1999, a

10 1/2-foot-long section of the pipeline containing the rupture was removed, crated, and

sent to the Safety Boardís Metallurgical Laboratory for further examination. Numerous

gouges and dents were visible on the ruptured section of pipe. (See figures 10 and 11.)

In addition to the ruptured section of pipe, a second section of pipeline that

extended from the south (downstream) end of the ruptured section was also retrieved.

Previous in-line inspections conducted by Olympic had identified this section of pipe as

containing anomalies. On July 8, 1999, the second pipe section was removed, crated, and

shipped to Safety Board headquarters for further examination. The pipe section, which

was about 10 feet long, contained dents about 1 1/2 feet downstream of a girth weld. (See

figure 12.)

At the rupture point, the top of Olympicís pipeline was about 10 feet underground.

About 20 feet south of the rupture, a 72-inch-diameter water pipeline crossed Olympicís

pipeline. The centerline of the 72-inch line was about 68 inches above Olympicís pipeline

(because of the change in grade, the Olympic pipeline was about 14 feet below the surface

at this location). Two water lines, one 24 and the other 16 inches in diameter, joined at a

tee fitting that was about 21 inches above Olympicís pipeline and approximately 8 feet

south of the rupture. Adjacent to the tee, on its west side, was a large concrete thrust block.
Factual Information 41 Pipeline Accident Report

Figure 10. Removal of ruptured pipe section.

Figure 11. Inside view of ruptured pipe section.
Factual Information 42 Pipeline Accident Report

A 12-inch-diameter PVC utility conduit crossed about 31 inches above Olympicís

pipeline, with its centerline approximately 9 feet north of the rupture. (See figure 13.)

Tests and Research

Laboratory Examination of the Ruptured Pipeline Segment54

The ruptured segment of pipe contained a fracture that extended over a

longitudinal distance of approximately 27 inches and had a maximum separation of

7 inches. The fracture originated at an external gouge mark in the pipe that was

approximately 8 1/2 inches long and oriented longitudinally along the axis of the pipe. The

gouge reduced the wall thickness of the pipeline by approximately 20 percent from about

0.31 inch to between 0.24 and 0.25 inch. There was no evidence of deformation on the

inside surface of the pipe coexistent with this gouge. The fracture origin area was on the

top portion of the pipe at approximately the 11 oíclock position.55 The surface of this

Figure 12. Inside view of second removed pipe section showing dent.

54 Substantial delays in the examination of the damaged pipeline segments and the testing of RV-1919

occurred because of a separate criminal investigation into the accident.

55 The clock positions are reported looking downstream along the pipeline, where 12 oíclock is at the

top. Since flow was from north to south, the north end of the pipe segment is the upstream end.
Factual Information 43 Pipeline Accident Report

gouge mark revealed metal flow consistent with an object moving upstream relative to the

pipe. (See figure 14.)

Figure 13. Rupture location before removal of pipe showing proximity of water 

line tee connection.

Figure 14. Sketch (not to scale) of the two pipe sections removed after the accident 

showing rupture site in relation to gouge marks. Gouges at left were near the point at 

which 72-inch water line crossed over the pipeline. (Only a small number of the gouge 

marks found on the pipeline sections are shown.)

Cut line

Crack

Fracture origin

Gouges Gouges

Downstream (south) Upstream (north)

Girth weld

24' 3"
Factual Information 44 Pipeline Accident Report

The 27-inch gaping fracture intersected two other gouge marks. These two gouge

marks extended upstream from the upstream end of the origin gouge mark at an

approximate orientation of 20 percent from the longitudinal axis. These two gouge marks

were 4 1/2 and 5 inches long, respectively. An inward dent was evident on the inside

surface of the pipe coexistent with one of these gouge marks. One of these gouges was

slightly deeper than the gouge at the rupture origin, with a remaining wall thickness of

approximately 0.23 inches. The three gouge marks were connected and followed the

contour of the fracture. The combined lengths of the three gouge marks (18 inches)

intersected a major portion of the fracture.

No metallurgical anomalies (manufacturing defects) such as slag inclusions or

laminations were noted at the fracture origin. The absence of evidence of fatigue cracking

(crack arrest marks) on any portion of the fracture faces indicates that the rupture was an

overstress fracture that occurred in one event.

Tensile testing was performed on three specimens removed from the pipe. The

ultimate tensile strength of the pipe was determined to be between 69,300 and 70,100 psi,

and the yield strength was determined to be between 52,600 and 56,500 psi. These values

are above the minimums specified for pipe manufactured at the time.56 The same

specification also calls for a minimum elongation of 22 percent for the given pipe wall

thickness of 0.312 inches. The elongation for the three specimens measured between 32.6

and 33.8 percent. The chemical composition of a sample of the pipe was also determined

to be in accordance with the specification.

Approximately 27 additional gouge marks were evident on this 10-foot-long pipe

segment. The longest of these additional gouges was approximately 36 inches. Inward

deformations were visible on the internal surface of the pipe that corresponded to many of

the gouges. No evidence of any postinstallation coating material repairs or additions was

observed on the ruptured segment of pipe.

Laboratory Examination of the Second Damaged Pipeline Segment

In order to examine all of the anomalies identified during the in-line inspections,

Safety Board investigators retrieved and examined a second segment of pipe that was just

downstream of the ruptured segment. This segment of pipe was 119.6 inches long.

The inside diameter of this segment contained three dents, each consistent with the

location of an external gouge. These gouges and dents were located on the bottom half of

the pipeline at approximately the 3:30 to 4 oíclock positions. The deepest of these

deformations was 0.69 inch as measured from the inside pipe wall. It was located

approximately 136 inches downstream of the center of the fracture origin. No evidence of

any postinstallation coating material repairs or additions was observed on the ruptured

segment of pipe.

56 The March 1963 issue of the American Petroleum Institute Standard 5LX for line pipe specifies a

minimum ultimate tensile strength and yield strength of 66,000 psi and 52,000 psi, respectively, for this X52

grade pipe.
Factual Information 45 Pipeline Accident Report

Testing of Additional Material Samples

Foreign material was removed from several of the gouges on the damaged pipeline

for comparison with two concrete and one CDF sample collected at the scene of the

accident. The material removed from the gouged dents on the downstream section of

pipeline (the one that did not rupture) was found to be consistent with the CDF backfill

material.

Examination of a section of pipe through the gouge mark at the rupture origin

revealed that a foreign metal had been transferred onto the surface of the gouge mark. The

chemical composition of the transferred metal was found to be consistent with steel with a

high chromium content.

Testing of Relief Valve RV-1919

Under the direction of Safety Board investigators, relief valve RV-1919 was tested

under contract with Stress Engineering Services, Inc., in Houston, Texas. The Safety

Board obtained exemplar Model 1760 pilots, one configured for low pressure and the

other for high pressure, and conducted pressure tests of them on the RV-1919 relief valve,

comparing the results with the performance of the accident pilot.

In all of the pressure tests conducted, a static pressure exceeding the measured set

point of each pilot control valve was applied on the inlet, or upstream, side of the relief

valve. With the accident pilot installed, the pilot did not operate and the relief valve did

not open, even with inlet pressures approaching 800 psig, almost 150 psig greater than the

pilot set point.57 (X-ray examination revealed that adjusting the set point of the accident

relief valve to 650 psig had overcompressed the valve spring, thus rendering operation of

the pilot unreliable.) When the low-pressure exemplar pilot was installed on the relief

valve and adjusted to the same set point as the accident valve, the pilot and relief valve

also failed to operate. When the high-pressure exemplar pilot was installed on the relief

valve, the pilot and the relief valve operated as intended. (See figure 15.)

Once the tests were complete, the pilot and relief valves were disassembled and

examined. The examination revealed no broken parts or any evidence that debris or other

obstruction was present in the sensing lines that might have affected the operation of the

pilot. The pilot cover, piston, and O-ring in the accident pilot were found to be the same as

those in the low-pressure exemplar pilot.

The report of the valve testing contained the following findings:

ï The components in the relief valve and the accident pilot were in good

condition. There was no damage to any of the components that would have

prevented the valve from functioning.

ï No debris or blockages were found in any of the components that would have

prevented the valve from functioning.

57 This pressure exceeds not only the intended set point but also the rated pressure at Bayview terminal.
Factual Information 46 Pipeline Accident Report

ï When fitted with an exemplar high-pressure pilot, the relief valve operated

properly. In each test, the relief valve operated whenever the inlet pressure

exceeded the set point of the high-pressure pilot.

ï The accident pilot was configured as a low-pressure pilot, but an attempt had

been made to increase the set point to that of a high-pressure pilot.

ï Increasing the set point of the low-pressure pilot to that of a high-pressure pilot

compresses the pilot spring such that the relief valve will not operate reliably.

ï It is possible that the accident pilot could have failed to operate when in service

due to the attempt to increase a low-pressure pilot to that of a high-pressure

pilot. The pilot must open in order for the relief valve to open. It is conceivable

that the accident pilot would operate at some times but not at others, rendering

the operation of the relief valve unpredictable.

Figure 15. X-ray photograph showing that when the original 

low-pressure pilot for relief valve RV-1919 was set to 650 

psig or higher, the pilot spring was fully compressed.
Factual Information 47 Pipeline Accident Report

Review of Computer Files and Data

Backup tapes from the Olympic system were reviewed to see if they contained

information about the SCADA system slowdown. Tapes made on June 10 (after the

accident), July 14, and July 26 were examined.

The SCADA historical files contain sensor data from all of the field sensors on the

pipeline. Field devices are queried, or scanned, at varying times by the communications

subprocess. In general, the scanning rate is determined by the nature of the sensor and its

criticality to the operation and management of the SCADA system. On any given day, the

daily historic file from the Olympic system will contain more than 102,000 individual

entries collected repeatedly from the several hundred physical pipeline sensors.

The historical files showed that the scan rate was consistent, scanning for data at

about 3-second intervals, up until 3:19. At that time, the scan rate changed to about 30

seconds. This lasted for 2 minutes, after which the scan rate changed again to more than

400 seconds. The system briefly recovered to a normal scan rate at 3:27 (as OLY01 was

coming on line) for almost a minute, after which it virtually stopped scanning any new

data. The scan rate briefly returned to normal at 3:42 (when OLY02 came on line again)

before changing to about 100 seconds. At 3:48, the scan rate again returned to normal. The

behavior of the scan rate was consistent with the controller and system administrator

observations and was also consistent with the changeover times from OLY02 to OLY01

and back to OLY02. (See figure 16.)

Figure 16. Changes in SCADA scan rate (for pipeline data) during period of slow 

response or non-response of the Olympic SCADA system on the day of the accident.
Factual Information 48 Pipeline Accident Report

The slowing/stopping of the sensor scan pattern was the only abnormality found

that indicated that there was a problem with the SCADA computer control system. None

of the host VAX computer logs or any of the error logs associated with the SCADA

system captured any data that indicated that the system was having a problem completing

its assigned tasks.

A listing of the VMS files showed that 10 versions of the Accounting.dat log files

were missing, five each from OLY01 and OLY02. These files generally contain

information that can be used for billing purposes, such as computer usage time, file usage,

and processor job submissions. Ten Operator.log files were also missing, six from OLY01

and four from OLY02. These files are created each time the system boots and record the

system operations that are being performed by the computer operator. They include tape

backup information, information about print jobs, disk or tape mounts or dismounts, and

the start and end times of user tasks. The missing Operator.log files included the OLY01

file from June 10 that included the SCADA slowdown period. The other missing files did

not contain information from June 10. All of the information in the Accounting.dat and

Operator.log files refers to computer operations only; they are not SCADA system files

and do not contain pipeline information. No Olympic employee interviewed was able to

explain the missing files.

The processing and memory capacities of the VAX computers were evaluated to

see if insufficient computer system resources may have contributed to the SCADA system

slowdown on the day of the accident. Investigations conducted by Olympic determined

that, on the average (over a long period of time), about 75 to 80 percent of the computer

system resources were in use on the Olympic system, with the leak detection software

accessing the database of the primary machine. After the accident, Olympic upgraded the

VAX hardware. With the new system, about 20 percent of system resources are devoted to

SCADA operations (with the leak detection software accessing the database of the

primary machine), with the balance available for unanticipated demands.

After the accident, Equilon and Teledyne Control Applications personnel

conducted investigations to determine if the Teledyne Control Applications SCADA

software contained errors that may have caused the SCADA system to become slow or

unresponsive on the day of the accident. The Equilon analysts suggested that database

errors in the form of corrupted records had been encountered by other users of the

software, and that error-handling routines had not been upgraded. A line-by-line analysis

of the source code by Equilon and Teledyne determined that the error-handling routines

were appropriate and required no modification. Although a variety of errors were

intentionally introduced into new records that were then added multiple times to the

database, analysts were unable to replicate the SCADA slowdown that occurred on the

day of the accident. The testing did not uncover any problems in the error-handling

routines that would place demands on system resources in excess of the reserve processing

capability.
Factual Information 49 Pipeline Accident Report

Postaccident Activities

Management Restructuring of Olympic Pipe Line Company

At the time of the accident, Olympic was a corporation consisting of three

shareholders: Equilon Pipeline Company LLC (37.5 percent), ARCO (37.5 percent), and

GATX Terminal Corporation (25 percent). According to information provided by

Olympic, Equilon was under contract to manage operation of the pipeline for Olympic.

Equilon disputes that it was responsible for operating the pipeline, stating that it only

loaned employees to Olympic. At the time of the accident, most of Olympicís senior

management, including the president, vice-president/general manager, operations

manager, and engineering manager, were from Equilon.

On the day of the accident, senior Olympic personnel were touring the pipeline

with representatives of a potential new shareholder. After the accident, BP Pipelines (now

designated simply BP) acquired the ARCO holdings. When the contract for operating the

pipeline came up for renewal, Olympic selected BP to operate the pipeline system. BP

then acquired the GATX holding and is now the majority owner of Olympic.

Since the accident, BP has conducted additional training of Olympicís personnel,

revised all of the Olympic procedures and practices, instituted BPís management systems,

and formalized Olympicís integrity management program. As part of that process, BP has

replaced all of the Equilon managers with its own.

OPS Investigation and Corrective Action Order

As a result of its investigation into the June 10, 1999, accident, the OPS issued a

notice of probable violation that cited Olympic and Equilon for violations of several of the

pipeline safety regulations. The notice cited them for, among other things, not adequately

inspecting the construction activity at the water treatment plant, not taking immediate

corrective action when the anomalies were discovered during the in-line inspections

conducted in 1996 and 1997, not testing RV-1919 before placing it into service, and not

investigating the frequent closure of the incoming block valve at Bayview. The notice also

cited inadequate training, procedures, and record-keeping. As a result of these probable

violations, the OPS proposed that a civil penalty of $3,050,000 be assessed against

Olympic and Equilon. This was the highest civil penalty ever proposed by the OPS.

Olympic and Equilon have requested an administrative hearing on the matter that has not

yet been held.

On June 18, 1999, the OPS found that ìthe continued operation of this pipeline

without corrective measures would be hazardous to life, property, and the environment,î

and issued a corrective action order restricting Olympicís operations and outlining specific

actions that Olympic must complete before returning its pipeline to full operation. The

OPS subsequently issued two amendments to the corrective action order. The cumulative

requirements of the corrective action order are summarized at appendix B.
Factual Information 50 Pipeline Accident Report

Evaluation of Bayview Products Terminal Design and Operation

After the accident, and in accordance with the OPS corrective action order,

Olympic contracted with MARMAC to review the design of the Bayview products

terminal. MARMACís January 13, 2000, report, Bayview Terminal Design Review,

proposed several changes to improve operations at the terminal.

One of the changes directly involves relief valve RV-1919. The piping connection

from the incoming pipeline to the relief valve was originally made to the bottom of the

incoming pipeline. Because of the location of this connection, the MARMAC study

concluded that trash and debris could accumulate in this interconnection, thus possibly

impairing the operation of the valve. In fact, debris in the form of sludge and bristles from

a pipeline in-line cleaning device (ìcleaning pigî) was noted during the removal of RV1919 after the accident and during the postaccident testing of RV-1923 performed by

Olympic. This piping has since been reconfigured so that the connection to the relief valve

now comes off the top of the incoming pipeline. The interconnection from the incoming

Anacortes pipeline to RV-1923 was similarly reconfigured.

A second design change effected as a result of the MARMAC study indirectly

involves RV-1919. As originally designed, a flow switch, FS-2099, was installed on the

pipeline to the transmix tank P-209 that produced a SCADA alarm in the control center

whenever product was flowing into the tank. The flow switch was triggered by product

flow from one of several possible sources: the donut manifold relief valves, the tank

header relief valves, the sump pump, or the incoming pipeline relief valves, such as

RV-1919. As a result of the accident, individual flow switches have been installed on each

of the incoming pipeline relief valves, including RV-1919. This is intended as a design

improvement to provide the pipeline controllers with a better understanding of what is

occurring within the facility.

A second relief valve, RV-2229, was also added upstream of the inlet block valve

to Bayview and is intended to protect the pipeline from overpressurization. To further

protect the upstream pipeline, Bayviewís PLC is now programmed to send a signal to the

Ferndale PLC to stage down any running Ferndale units 45 seconds after an alarm

indicates flow through either RV-1919 or the newly added RV-2229.

Two of the changes Olympic made to the Bayview facility as a result of the

accident and the MARMAC study involved control valve CV-1904. The extended piston

stops in CV-1904 (and in CV-1916) were retracted to allow the valve to close completely.

The pressure-sensing control line tap downstream of CV-1904 was also relocated to

provide for quicker pressure sensing.

Since these actions were taken, Olympic has taken the Bayview terminal off line,

and product flow now bypasses the station.

Evaluation of Pipeline Valve Spacing

After the accident, and in accordance with the corrective action order issued by the

OPS, Olympic contracted with MARMAC Field Services, Inc., to perform a review and
Factual Information 51 Pipeline Accident Report

analysis of its valve spacing across the Olympic system. MARMAC prepared two reports:

16" - Ferndale to Allen Block Valve and Check Valve Effectiveness Evaluation, and 16" -

Bellingham and Vicinity Block Valve and Check Valve Effectiveness Evaluation. The two

reports covered the portion of the Olympic system that was involved in the June 10, 1999,

rupture and release.

At the time of the accident, remotely operated block valves were located on the

section of 16-inch pipeline from Ferndale to Allen at MP 0.0 (Ferndale), MP 6.8, MP 16.2,

MP 39.4 (Bayview), and MP 41.4 (Allen).

After the accident and in accordance with the OPS corrective action order,

Olympic installed a check valve, (a one-way valve that prevents product flow back

upstream) adjacent to the block valve at MP 16.2, just downstream of the rupture location.

Although the MARMAC study concluded that the installation of this check valve did not

reduce the static release volumes58 calculated at the accident site because the valve was

installed at the same location as an existing remotely operated block valve, its quicker

action would be expected to reduce release volumes in the event of an upstream failure.

As a result of the MARMAC study, another remotely operated block valve was

installed on the pipeline at MP 11.9. MARMAC concluded that the installation of this

valve reduced the potential static release volume from selected locations on the pipeline

between MP 11.9 and MP 16.2 (the rupture occurred at MP 15.9) by an average of 466

barrels. The greatest reduction of the static release volume, 1,108 barrels, was projected at

MP 12.34.

As a result of the MARMAC study and the valve revisions performed after the

accident, the largest potential static release volume reduction on the 16-inch Ferndale to

Allen pipeline occurred as a result of the conversion of a hand-operated block valve to a

remotely operated block valve at MP 33.7. This reduced the predicted static release

volume by 5,272 barrels (68 percent) from 7,733 barrels to 2,461 barrels at MP 35.3.

As a result of the valve modifications made after the accident as recommended by

the MARMAC study, the largest potential static release on the Ferndale to Allen segment

of pipeline was reduced by slightly more than 50 percent, from 7,733 barrels to 3,943

barrels, and would now occur at MP 32.7 (Samish River crossing).

SCADA System Performance and Security

Since the accident, Olympic has upgraded the VAX computers. Processor speed

was increased, and memory was purchased to match the speed of the new processor.

Various VMS and Vector parameters were updated to optimize computer operations. Both

physical security of the control center and electronic access security of the SCADA

computers have been addressed. Dial-up modems and external terminal connections have

been removed. All connections to the SCADA system are via encrypted virtual private

58 Static volumes are based entirely on drain-down due to elevation changes in the pipeline. The static

volumes do not include product that is released before the leak is discovered and the pipeline is shut down.
Factual Information 52 Pipeline Accident Report

networks. Administrative workstations have virus protection software that is

automatically updated. SCADA and VMS security audit logs, which contain detailed

information about users, are reviewed routinely. Network vulnerability assessments have

been completed and are conducted quarterly.

Also since the accident, Olympic has installed a separate stand-alone computer to

develop and test changes to the Vector SCADA database. All changes are installed and

tested on the developmental computer before they are installed on the operational SCADA

system.

Other Information

Federal Oversight

DOT regulations for pipelines transporting hazardous liquids are found at 49 CFR

Part 195, including testing requirements for overpressure safety devices and overfill

protection systems at 49 CFR 195.428. According to 49 CFR 195.428(a):

ï Each operator shall, at intervals not exceeding 15 months, but at least

once each calendar yearÖ, inspect and test each pressure limiting device,

relief valve, pressure regulator, or other item of pressure control

equipment to determine that it is functioning properly, is in good

mechanical condition, and is adequate from the standpoint of capacity and

reliability of operation for the service in which it is used.

The Federal pipeline regulations for new construction, at 49 CFR 195.262(c), also

state that:

Each safety device must be tested under conditions approximating actual

operations and found to function properly before the pumping station may be

used.

Title 49 CFR Part 195 does not otherwise address testing methods or performance

standards for relief valves or other pressure control equipment. Olympic has told the

Safety Board that the method it used to test the pilot, discussed earlier in this report, was

consistent with industry practice and met Federal regulations.

Since the accident, the OPS has issued its integrity management rule that has

added requirements for the evaluation of defects identified during in-line inspections.

Specifically, 49 CFR 192.452(h)(5)(ii) requires that an operator schedule for evaluation

and repair within 60 days ìall dents, regardless of size, located on the top of the pipeline

(above 4 and 8 oíclock positions).î Title 49 CFR 192.452(h)(5)(iv) also requires that an

operator schedule evaluations and any needed repairs of pipelines if (1) data reflect

possible mechanical damage located on the top of the pipe, (2) data indicate a change from

a previous inspection, and (3) data reflect the presence of an ìabruptî anomaly.
Factual Information 53 Pipeline Accident Report

OPS Preaccident Inspection

Before the accident, on March 15 through 19, 1999, OPS representatives

conducted an inspection of the Olympic pipeline system to determine whether Olympicís

facilities and operations were in compliance with applicable pipeline safety regulations.

As a result of the inspection, the OPS issued a letter of concern to Olympic citing four

areas of concern. The OPS did not issue a notice of any probable violations of the pipeline

safety regulations as a result of its inspection.

The first concern was related to Olympicís operations and maintenance

procedures. The pipeline safety regulations at 49 CFR 195.402(a) require:

Each operator shall prepare and follow for each pipeline system a manual of

written procedures for conducting normal operations and maintenance activities

and handling abnormal operations and emergencies. This manual shall be

reviewed at intervals not exceeding 15 months, but at least once each calendar

year, and appropriate changes made as necessary to insure that the manual is

effective. This manual shall be prepared before initial operations of a pipeline

system commence, and appropriate parts shall be kept at locations where

operations and maintenance activities are conducted.

In its letter of concern, the OPS stated:

OPL [Olympic] has recently adopted Texacoís operations and maintenance

manuals that were reviewed within the last couple of years by a team of OPS

inspectors. These manuals were accepted in their entirety as being in compliance

with 49 CFR Part 195. Also, in discussions with OPL personnel, it was discovered

that OPL will more than likely adopt the Equilon manuals as soon as they are

combined from the Texaco and Shell manuals. OPL has an ongoing plan to

incorporate their site specific plans and procedures into these newly adopted

manuals. Eventually, OPL will complete this manual transformation. Until that

time, care must be taken to ensure compliance with current procedures contained

within the applicable manuals by operations and maintenance personnel.

The remaining three areas of concern involved clearing areas of the pipeline rightof-way to allow aerial patrols, corrosion of the flange bolts in a valve pit, and moving

pipelines under pressure. The OPS did not identify abnormal operations on the Olympic

system, since Olympic had not documented any such occurrences, nor did it note that the

Bayview facility had been commissioned without the testing of RV-1919 under

approximate operating conditions.

Environmental Response and Remediation

On June 10, 1999, U.S. Environmental Protection Agency (EPA) Region 10,

Seattle, Washington, established the unified command in support of the Bellingham Fire

Department and the Washington State Police. The unified command included the EPA, the

WDOE, Washington State Police, the city of Bellingham, the Lummi Tribe, and Olympic.

The unified command managed the incident response involving the Federal, State, and

local agencies including the joint information center, and prepared daily incident action

plans, which directed daily operational activities, and pollution reports, which provided

updates on the operations.
Factual Information 54 Pipeline Accident Report

Under the Olympic spill response plan, Olympic established a command center at

its Renton office to handle notifications and initial response activities. Meanwhile,

Olympic spill team members flew to the city of Bellingham command center, where they

were integrated into the unified command with Federal, State, and local response

agencies. The initial Olympic response resources included a helicopter, a spill trailer with

equipment taken from Olympicís Renton and Allen stations, the Equilon regional response

team, and several spill and consulting contractors.

Upon realizing that a release had occurred, Olympic personnel in the control center

and in the Renton office began to contact and mobilize field employees. Personnel were

sent to obtain boom materials and to proceed to Bellingham. Additional field personnel

were sent to the block valves at MP 7 and MP 16 to verify that they were closed.

During the initial response on June 10, 1999, efforts were underway to track

downstream impacts and secure the mouth of the creek at the harbor with boom. Olympic

environmental response activities initially included boom deployment at the mouth of

Whatcom Creek in Bellingham Bay, along with mop-up of remaining product residues in

the creeks using sorbents and vacuum trucks. Olympic field personnel moved trailers with

sorbent materials and boom to Bellingham and its Allen station. Pockets of product

remaining in Whatcom Creek near Iowa Street and in the vaults at the water treatment

plant were removed by vacuum truck the morning of June 11. Also on June 11, Olympicís

emergency response team, Equiva Services, was mobilized from Houston, Texas, to

Bellingham.

A natural resource damage assessment team consisting of representatives from the

National Oceanographic and Atmospheric Administration (NOAA), the National Marine

Fisheries Service, the U.S. Fish and Wildlife Service, the city of Bellingham, and the

WDOE initially met on June 12 to begin planning the damage assessment of the Whatcom

Falls Park.

Under the direction of the unified command as the principal decision-making

body, Olympic implemented an emergency restoration plan for habitat restoration of the

25 burned acres on Whatcom and Hannah Creeks. The initial restoration of the creeks was

completed in time for the August salmon run.

More than 1,200 feet of the creek bed and banks were removed by excavator along

the upper portion of Hannah Creek where the creek bed and banks were saturated with

gasoline up to 5 feet into the creek face. In these areas, the creek was dammed and

bypassed through a pump and an 8-inch-diameter PVC pipe to Whatcom Creek.

Following its excavation, the creek was backfilled with glacial gravel tills. Trees, jute

mats, gravels, and boulders were placed to groom the creek. Water was eventually

rerouted back into the creek.

Additionally, a 450-foot horizontal boring was installed for an interception trench

25 feet below grade between the subsurface gasoline source area at the Dakin-Yew pump

station vault and Whatcom Creek. This trench successfully intercepted the gasoline

moving north through the shallow bedrock prior to entering Whatcom Creek where seeps
Factual Information 55 Pipeline Accident Report

had been observed in the first days of the incident. Finally, a pump and gasoline/water

separation system was installed, which drew down the ground water and intercepted the

gasoline that migrated toward Whatcom Creek.

To address additional residual gasoline in surrounding areas that were not

excavated, a vapor extraction system was designed and installed with a catalytic oxidation

system. The system was completed under the emergency restoration plan, bypassing any

potential permit delays related to construction, and began operation on December 15,

1999. Future efforts will include the operation and maintenance of the systems for several

years until the site is remedied. It is anticipated that a long-term creek restoration plan will

be developed to include the operation and maintenance of the vapor extraction and ground

water interception systems.

Excavation steps removed the majority of unburned gasoline. Soils were sampled

and trucked to Tacoma, Washington, where they were incinerated. Contaminated soils

near the pipeline break were excavated, and soils were incinerated off site. More than

9,500 cubic yards of contaminated soils were removed, of which 2,000 yards were

removed from Hannah Creek, and 7,500 yards were removed from the pipeline rupture

area and water pump vault area.

As of October 7, 1999, a total of 16,717 gallons of gasoline were recovered, and

Bellinghamís drinking water capacity was restored. Emergency source area remediation

activities were completed in January 2000. The EPA concluded that: ìThe Whatcom

Creek Incident was an excellent example of the incident command system being used as

an effective management tool for a large, multi-jurisdictional emergency response and

subsequent cleanup activities.î

Before the accident, Olympic conducted tabletop and/or equipment deployment

drills to test the readiness of response personnel and equipment on May 7, 1997,

September 9, 1998, and April 7, 1999. Spill management team tabletop and deployment

drills were conducted annually to review the response plan preparedness. In its evaluation

of the May 1997 tabletop drill, the WDOE strongly encouraged Olympic personnel to get

additional training in the incident command system before the upcoming worst-case spill

drill in 1998. Olympic complied with the request, and WDOE evaluation of the company

was that it performed well in the 1998 area exercise.

The area exercise was conducted at the ARCO Cherry Point Refinery in Whatcom

County in September 1998 under the direction of the OPS. This exercise was conducted as

part of a continuing series of spill response training exercises aimed at improving the

effectiveness of the Olympic spill management team. The focus of the drill included

exercising the Northwest Area Contingency Plan, Olympic Oil Spill Response Plan, using

the incident command system, as well as improving the ability of Olympic to work with

Federal, State, and local spill response agencies and form a unified command. The

response exercise involved a hypothetical 5,500-barrel spill of diesel fuel into the

Nooksack River and Bellingham Bay.
56 Pipeline Accident Report

Analysis

The Accident

A number of events and conditions set the stage for the June 10, 1999, rupture of

the Olympic pipeline in Bellingham, Washington. First, chronologically, was excavation

damage that was done to the pipeline in the vicinity of the eventual rupture. This damage

weakened the pipeline and made it susceptible to failure under pressures that an

undamaged pipe could probably have withstood. Although indications of this damage

were detected during subsequent in-line inspections of the pipeline, Olympic did not

excavate and inspect the pipeline to evaluate its condition.

Second was the construction and startup of the Bayview products terminal. During

construction of the terminal, pressure relief valves were installed that were found to be

improperly configured or adjusted, and the actions taken by the company to test and

correct the valve settings were ineffective. When the Bayview terminal came on line,

about 6 months before the accident, controllers discovered operational issues that they

believed resulted from the proximity of the Bayview terminal to a previously existing

pumping station. The controllers said they did not believe they were adequately trained or

otherwise prepared to deal with these operational issues. The controllers reported these

issues, but they were never corrected, apparently because management did not recognize

them as critical.

Finally, on the day of the accident, the SCADA system that controllers used to

operate the pipeline became unresponsive, making it difficult for controllers to analyze

pipeline conditions and make timely responses to operational problems.

This analysis will address these events and conditions and evaluate their respective

contributions to the accident.

Damage to the Pipeline

About 20 feet of the 16-inch accident pipeline, which included the rupture

location, were removed and taken to Safety Board headquarters for further examination.

Laboratory examination revealed 33 gouges in the external pipe surface, almost all of

them along the pipeís upper surface. The 27-inch-long rupture originated at one of these

gouges.

Examination revealed that foreign metal consistent with high-chromium steel had

been transferred to the surface of the pipe in the gouge at the rupture origin. The presence

of high-chromium steel, which is typically used in excavation equipment, such as in the
Analysis 57 Pipeline Accident Report

teeth of a backhoe bucket, indicates that the damage found on the ruptured pipeline

occurred during excavation activities.

Hydraulic modeling performed after the accident indicates that the pressure in the

pipeline at the time and location of rupture reached approximately 1,433 psig. This was

below the maximum operating pressure of 1,440 psig (revised to 1,456 psig after the

accident) for this segment of the pipeline. At 100 percent of yield, the pipeline should

have held 2,028 psig and, just after its installation, the pipe had been hydrostatically tested

to 1,820 psig. Because laboratory testing of the tensile and yield strength for the pipe

material showed that it met original specifications, the Safety Board concludes that had

the accident pipeline not been weakened by external damage, it likely would have been

able to withstand the pressure that occurred on the day of the rupture, and the accident

would not have happened.

Some of the external damage to the pipe resulted in metal loss or internal

deformations that would be expected to register as anomalies during an in-line pipeline

inspection with either a magnetic flux or caliper tool. No anomalies were detected at this

location during a 1991 magnetic flux in-line inspection, but some were found during a

similar inspection in 1996, suggesting that the damage occurred as a result of excavations

performed between 1991 and 1996. One of these anomalies, an internal deformation near

the rupture location, was also reported to Olympic after a caliper tool inspection was

performed in 1997.

Excavations in the Area of the Eventual Rupture

The only excavation activity known to have occurred in the area of the rupture

between 1991 and 1996 was that associated with the installation of the pumping station

and the associated ancillary water lines during modifications to the Dakin-Yew water

treatment plant in 1993-94.

On two occasions in early 1993, during the design phase of the project, the

Olympic pipeline and nearby water pipelines were positively located by potholing. An

Olympic inspector was on site on both occasions. He reported that he had probed the

Olympic pipeline with a steel bar and that all excavations within 2 feet above the pipeline

were performed using shovels. He stated that he did not observe any damage to the pipe

done during either potholing event. Given the nature of this type of excavationdigging

down to locate the top of a pipeline that all present know is therethe Safety Board does

not consider it reasonable that the extensive damage found on the Olympic pipeline

occurred as a result of potholing.

The Safety Board received a report from a witness on site who said that, while

excavating to realign valve risers at a tee connection (about 8 feet south of the rupture), an

equipment operator for IMCO, the cityís construction contractor, struck Olympicís

pipeline. The witness said the IMCO employees decided not to notify the projectís

construction inspector or one of Olympicís representatives but to repair the damage to the
Analysis 58 Pipeline Accident Report

pipeline coating and continue with the work. This report could not be confirmed. Evidence

of a coating repair was not found on the pipeline that ruptured, although it is possible that

the mastic material dissolved after the accident while the pipeline was immersed in soil

saturated with gasoline. Nevertheless, even if the report is accurate, it would explain only

a small portion of the damage found on the pipe.

The damage found on and near the rupture site could only have occurred as a result

of mechanized excavation equipment contacting the pipeline. The excavations that

occurred during the project were extensive and often involved locating and exposing the

accident pipeline. Moreover, the damage to the pipeline had to have occurred between

1991, when in-line inspection revealed no anomalies in the area of the eventual rupture,

and 1996, when another in-line inspection identified anomalies reflecting the damage. The

water treatment plant excavations, which occurred in 1993 and 1994, were the only known

excavations, other than initial potholing to locate the pipeline, that occurred in this area

within that time frame. And, as noted previously, potholing would not account for damage

of the nature or extent found on the pipeline. About 11 feet away from the rupture was a

group of three gouged dents near the point at which a 72-inch water line crossed the

Olympic pipeline. Photographs taken during IMCOís installation of the water line show

that the Olympic pipeline was exposed during the water line installation and that the

gouged dents would be located near the north edge of the ditch excavated to install it.

Further, the presence of CDF material in the gouged dents indicates that the gouges

themselves must have been present when CDF was poured. The Safety Board therefore

concludes that the damage to the Olympic pipeline that led to its failure on June 10, 1999,

occurred during IMCO excavations associated with the Dakin-Yew water treatment plant

modification project.

The Safety Board documented at least four instances during the water plant

modification project in which IMCO excavated in the immediate vicinity of Olympicís

pipeline without Olympicís knowledge or without an Olympic employee being present,

even though the action memorandum and on-site discussions with Olympicís inspectors

clearly required IMCO to notify Olympic in advance of such excavation. Two of these

instances, the installation of the water line tee and the subsequent excavation of the valve

at the tee to realign the risers, occurred near the rupture location. No documentation was

produced to indicate that Olympic had been notified on either occasion or that its

employees were on site during either excavation. Because Barrett had worked directly

with Olympic during the design phase of the modifications, it should have ensured that

Olympic was aware of the teeís installation. IMCO, however, was clearly responsible for

notifying Olympic before all excavation activities, yet it failed to do so. An Olympic

inspector was on the site for a portion of the day on July 6, 1994, the day that excavation

to install the tee was initiated, but the excavation was not started until the afternoon, and

there is no evidence that the inspector was on scene at that time.

The excavation for the tee did, however, remain open for several days, and

although Olympicís inspector made occasional visits to the site during this time, the

inspector made no documented effort to investigate this excavation or question IMCO

about it, even though it was only about 100 feet away from the excavation he was
Analysis 59 Pipeline Accident Report

reportedly inspecting. In addition, even though Olympic was not notified of the design

change that caused the tee to be installed above its pipeline, these changes would certainly

have been reflected in the as-built drawings maintained by the contractor at the job site.

But Olympic inspectors acknowledged that they did not make it a practice to check the

drawings or routinely discuss planned activities with IMCOís foreman. Had Olympic been

more aggressive in its monitoring of the water treatment plant project, it is possible that

the company would have realized that additional excavation was occurring that it was not

aware of and may have taken action to ensure that the pipeline was exposed and inspected

for damage. The Safety Board concludes that Olympic inadequately inspected excavation

work performed by IMCO during the water treatment plant project and consequently

failed to identify and repair the damage done to the pipeline.

Evaluation of In-line Inspection Information

To comply with a 1996 WDOE order, Olympic was required to review the results

of its previous in-line caliper tool inspections and to run a caliper tool though its pipelines

where caliper tool data did not exist. The purpose of the caliper tool run was to identify

geometric anomalies such as dents and wrinkles, especially those similar to the Ebey

Slough area failure that resulted from buckled pipe and that had prompted the WDOE

order. A report was required to explain the cause of all anomalies identified, and any

significant anomalies that could not be explained by an examination of the data were to be

verified by field inspection.

In early 1997, Olympicís engineering assistant gathered all in-line inspection

reports, including the 1991 and 1996 magnetic flux in-line inspection reports and the new

1997 caliper tool inspection report, and correlated the locations of the anomalies in the

water treatment plant to the physical features along the pipeline so their exact locations

could be pinpointed for excavation. Olympicís engineering assistant noted that the 1996

magnetic flux inspection and the 1997 caliper inspections showed anomalies in the portion

of pipeline that crossed through the water treatment plant. He was also aware that these

anomalies were not identified during the 1991 magnetic flux inspection.

Tuboscope, in its 1996 magnetic flux inspection report, identified a 23-percent

wall loss defect as a possible mill/mechanical defect and one of the features as a possible

wrinkle bend. But mill/mechanical defects are associated with the pipeís manufacture, and

wrinkle bends occur during installation of the pipeline. Thus, both these conditions should

have been found and reported on the 1991 survey. Since they were not, the engineering

assistant should have questioned this report and investigated further to identify the source

of these anomalies.

In order to ensure the integrity of a pipeline, the operator should assemble and

evaluate all of the pertinent pipeline data available. The engineering assistant reviewed the

pipeline alignment sheets and found that several foreign lines crossed the pipeline in the

vicinity of the anomalies, including the 72-inch water line that crossed Olympicís pipeline

approximately 2 feet south of the reported 23-percent wall loss anomaly and the
Analysis 60 Pipeline Accident Report

associated possible mash;59 however, he did not check the date of installation of these

foreign lines. Had he done so, he would have realized that a major construction project

had occurred in the area in 1994 that may have readily explained the presence of the

anomalies in the 1996 and 1997 in-line inspections that were not present in 1991. Gouges

cannot be evaluated in the same manner as corroded pipe. A gouge is considered to be a

defect that is more severe than a corrosion defect of equivalent size because a gouge

typically is associated with metal deformation that leaves a sharp edge. Such an edge acts

as a stress concentrator. With the pipeline information available, the engineering assistant

should have considered that the 23-percent wall loss defect could have been a gouge,

possibly a gouge in a dent because of the reported mash associated with it. As such, it

would exceed the ASME B31.4 criteria of 12 1/2 percent for the repair of gouges, and the

anomaly should have been excavated and examined. In addition, any dent containing a

gouge must be repaired per ASME B31.4, regardless of the depth of the gouge or the

extent of the deformation. Instead, Tuboscope and the engineering assistant evaluated the

anomaly using calculations intended to evaluate the remaining strength of corroded pipe,

even though the anomaly was not identified as corrosion. Based on this evaluation, the

engineering assistant determined that the defect posed a minimal risk. Even though this

anomaly was 11 feet downstream of the eventual rupture, had Olympic excavated and

identified the anomaly as a gouge in a dent, the company would have had sufficient

information to justify further investigation of the other reported anomalies, including the

defect near the rupture site.

Based on the engineering assistantís initial evaluation and its report to the WDOE,

Olympic did plan, in early 1997, to excavate the area where the anomalies were found, but

when company personnel first went to the area, they found that it was too wet to be

excavated, and they postponed the work. Later, in July 1997, the engineering assistant

reevaluated the anomalies and decided that they did not require further investigation. He

said he had probably forgotten when he did his reassessment that these anomalies were not

present in 1991. He also said he had lost confidence in the ability of magnetic flux

inspection tools to locate deformations because Tuboscope did not report a pipe buckle

that later resulted in a leak in another pipeline. But his doubts about the ability of a

magnetic flux tool to find a deformation should have made him even more attentive to

such indications when they were reported to him. He also said his concern about

anomalies identified by the caliper inspection was lessened after several identified

anomalies had been excavated previously and found to be less severe than reported. And

because the dent reported by Enduro was only approximately 3 percent deep, he decided

not to have the pipe visually inspected. But the data from this type caliper tool are

insufficient to accurately characterize such an anomaly, and the ASME criteria relied on

by the engineering assistant in making his decision are not intended to apply to such data

but to data obtained during a visual inspection of the defect.

Since Olympic was performing the caliper inspections under an order from a

regulatory agency and as a result of a previous leak in a pipe buckle, the company should

59 It should be noted that the water line tee located south of the reported possible wrinkle bend and the

associated 0.45-inch total sharp deformation was not shown on the alignment sheets because Olympic was

not aware of its installation.
Analysis 61 Pipeline Accident Report

have been particularly sensitive to the reports of any deformation. In this case, near the

point of eventual rupture, Tuboscope originally reported indications of deformation as a

possible wrinkle bend that was then confirmed by Enduro to be a sharp defect. Thus, two

inspection companies, using different inspection tools, identified anomalies in the same

general area where no anomaly had been found previously. This alone should have

prompted Olympic to act. Even if the defect had been a wrinkle bend, as suggested by

Tuboscope, Olympic should have known that this was an undesirable pipeline feature that

is no longer allowed for new construction. Further, even though Tuboscope, because of

limitations of the magnetic flux tool, did not report any metal loss at this location,

deformations may mask indications of metal loss that would otherwise be found by a

magnetic flux in-line inspection tool. To verify that there was not a gouge within the

deformation, Olympic would have had to excavate and visually inspect the pipeline. Had

Olympic done so, it would have found severe damage to the pipeline that it would have

repaired. The Safety Board concludes that the in-line pipeline inspection data provided to

Olympic, along with the excavation activity Olympic knew occurred in 1993 and 1994,

were sufficient to justify the excavation and examination of the pipeline in the area of

reported anomalies, but the company did not perform the work and thus did not identify

the true extent of the damage.

The OPS integrity management rule that was issued after the accident has added

requirements for the evaluation of defects identified during in-line inspections, including

the requirement that an operator schedule for evaluation and repair, within 60 days, dents

of any size located on the top of the pipeline. Because the deformations found after the

Bellingham accident fall within these criteria, Olympic would have been required to

schedule repairs within 60 days. Additional provisions of the integrity management rule

require that pipelines be evaluated and necessary repairs made if data reflect possible

mechanical damage on the top of the pipe, or if data indicate a change from a previous

inspection, or if data reflect the presence of an ìabruptî anomaly. Any of these provisions,

had they been in effect at the time of the accident, would have applied to the Olympic

pipeline.

SCADA System Performance

After the Bayview products terminal came on line in December 1998, controllers

began to experience operational difficulties that often involved pressure increases within

Bayview that caused the inlet block valve upstream of Bayview to close, essentially

shutting down the pipeline. Between December 1998, when the Bayview terminal came

on line, and June 1999, when the accident occurred, the inlet block valve closed 41 times

because of high pressure at Bayview. On each occasion when the inlet block valve closed

unexpectedly, controllers had been able to take some action that kept the pressure across

the weakened section of pipeline below that which later caused the pipe to rupture. During

13 (32 percent) of these events, pressure upstream of the block valve exceeded 1,000 psig.

The highest pressure recorded upstream of the closed valve was 1,339 psig, which was

less than the 1,500 psig maximum pressure reached on the day of the rupture.
Analysis 62 Pipeline Accident Report

On the day of the accident, however, the SCADA system was unresponsive to the

commands of the controllers. Had the controller been able to start the pump at

Woodinville, it is probable that the pressure backup would have been alleviated and the

pipeline operated routinely for the balance of the fuel delivery. The controller was

apparently attempting to systematically slow or shut down the line, as evidenced by his

call to the electrician at Allen station to locally shut down one of the pumps. Even if the

controller had been unable to prevent the pressure buildup and the subsequent closure of

the inlet block valve at Bayview, had he had full SCADA control, he may have been able

to slow down the pipeline sufficiently to reduce the severity of the pressure increase when

the block valve did close.

Higher than normal pressures and higher stress concentrations in the vicinity of

gouges both increase the likelihood of deformations and cracking that can lead to a

pipeline rupture. However, because the rupture was an overstress separation, with no

indications of fatigue, it is likely that the pipeline would not have ruptured on the day of

the accident had a pressure spike not occurred. The Safety Board concludes that if the

SCADA system computers had remained responsive to the commands of the Olympic

controllers, the controller operating the accident pipeline probably would have been able

to initiate actions that would have prevented the pressure increase that ruptured the

pipeline.

Investigators attempted to determine why the SCADA system, which was not

reported to have experienced operational problems before the accident, became slow or

unresponsive on the day of the accident, and at a critical time during the pipeline

operations.

About the same time the accident controller was preparing to change delivery

points on the 16-inch pipeline (about 3:00), the system administrator was in the control

center computer room entering two new records into the SCADA historical database. The

system administrator was working on the OLY02 computer, which was the primary

SCADA computer at the time. (Had he been working on the backup OLY01 computer, the

result would have been the same, because each computer mirrored changes made to the

other.) At about 3:10, a few minutes after the new records were entered into the system,

the SCADA computer began to generate error messages related to the historical database.

At that point, the system administrator should have notified his supervisor and the

controllers that the computer was acting abnormally. Instead, after checking the records he

had entered and finding no problems with them, he left the computer room and did not

return for about 15 minutes. If the accident controller had been notified promptly at 3:10

that the SCADA system appeared to be malfunctioning, he may have responded

differently before initiating the switch of delivery points. Also, if the control center

supervisor had been notified promptly, he may have been able to quickly restore the

computers to normal operations (as he did 30 minutes later).

The SCADA problems grew more pronounced over the next 20 minutes, during

which, at one point, the system became completely unresponsive. This period of nonresponsiveness coincided with the rupture of the pipeline at about 3:28. The SCADA
Analysis 63 Pipeline Accident Report

problems encountered by the controllers occurred shortly after the system administrator

inserted new records into the system computer and were resolved after the control center

supervisor deleted the new records. Also, the system administrator said that as the new

records were being deleted, he noticed a typographical error in the records that had not

been there when the records were checked earlier. Because of this and the fact that the

SCADA system had not previously exhibited a similar non-responsiveness, the Safety

Board concludes that the degraded SCADA performance experienced by the pipeline

controllers on the day of the accident likely resulted from the database development work

that was done on the SCADA system.

Analysis and testing performed by Olympic and Equilon, working in conjunction

with the SCADA software vendor, failed to identify any coding within the SCADA

software that would have caused the system anomalies encountered on the day of the

accident. The testing data did not uncover any problems in the error-handling routines that

would place demands on system resources in excess of the reserve processing capacity.

Records with known errors were repeatedly input into the historical database, but

the computer slowdown of June 10, 1999, could not be replicated. Because the problems

the SCADA system experienced on the day of the accident could be neither explained nor

replicated (the records entered just before the slowdown were deleted to stop the abnormal

computer operations), the exact fault in the historical database that initiated the systemís

failure on the day of the accident will probably never be known. For the same reason, what

effect, if any, the processing capacity of the SCADA computers had on the slowdown

cannot be determined.

As noted earlier, the system administrator was working on the ìliveî system. And

even though the SCADA system was configured to permit alterations to be made to the

historical database while the system was on line, the Safety Board does not consider this to

be prudent practice. Computer systems, while they have proven their worth in all modes of

transportation, are not infallible, nor are their operators and administrators. Newly

developed computer routines do not always work correctly at first and must be revised.

Sometimes, seemingly simple mistakes can result in catastrophic consequences, even on

the most robust of operating systems. Olympic personnel used the operational system as a

test bed to develop changes and upgrades to the database without first testing the changes

on a separate off-line system.

SCADA developmental work or database modifications should be performed on a

developmental workstation that allows any revisions to be thoroughly tested off line. Only

after such tests have verified that the system works as intended and the testing has been

reviewed by personnel trained in analyzing the test methods and results, should the

changes be entered into the SCADA real-time computer. The Safety Board concludes that,

had the SCADA database revisions that were performed shortly before the accident been

performed and thoroughly tested on an off-line system instead of the primary on-line

SCADA system, errors resulting from those revisions may have been identified and

repaired before they could affect the operation of the pipeline.
Analysis 64 Pipeline Accident Report

Even though, after the accident, Olympic installed a separate stand-alone computer

to develop and test changes to its SCADA database before applying those changes to the

on-line system, the Safety Board is concerned that other operators who use SCADA

systems may still be performing SCADA developmental work on a live system. The

Safety Board therefore believes that the Research and Special Programs Administration

(RSPA) should issue an advisory bulletin to all pipeline operators who use SCADA

systems advising them to implement an off-line workstation that can be used to modify

their SCADA system database or to perform developmental and testing work independent

of their on-line systems. Further, RSPA should advise operators to use the off-line system

before any modifications are implemented to ensure that those modifications are error-free

and that they create no ancillary problems for controllers responsible for operating the

pipeline.

The VAX-VMS system that was used as the platform for Olympicís SCADA

system is a multi-user system, but all authorized Olympic computer operators used the

same login. Thus, even though the operating system could track individual users, the

system had no means of distinguishing one user from another. This single-login policy

severely limited the ability of the company to audit the system or to assign individual

accountability for actions performed on the VAX or SCADA system. Furthermore, all

authorized users had system administrator privileges, allowing them to manipulate or

delete any and all of the files contained on the system. Because they all used the same

login name, no record of exactly who performed what action was available.

Another drawback of using one login account is that all users used one system

resource setting for all of their activities. VMS has the ability to allocate its resources

based on a loginís permissions. This feature is implemented in a multi-user system to keep

one user from consuming all of the available system resources. The one account that the

Olympic operators were using contained sufficient authority to allocate any and all

available system resources for their task, taking all priority away from the operational

pipeline system.

Investigators examined backup tapes from the SCADA system and found a total of

20 missing files. No one available to be interviewed had a satisfactory explanation for the

missing files. These files contained primarily accounting and computer operating system

administrative data; they did not contain pipeline data, and their absence would have had

no effect on SCADA operations.

The SCADA system was connected via a bridge to the rest of the building

network. It was also directly accessible via dial-in modem. No firewalls or access

monitoring were incorporated into the system. These protections should have been

installed to isolate the system from a ìhackerî attack. Although no evidence was found to

suggest that an intrusion by an unauthorized or unknown user caused the computer

slowdown that occurred on the day of the accident, the lack of basic security features

related to the SCADA system could allow such an intrusion in the future.

The Safety Board concludes that Olympic did not adequately manage the

development, implementation, and protection of its SCADA system.
Analysis 65 Pipeline Accident Report

Since the accident, Olympic has taken a number of steps to improve its SCADA

system performance, reliability, and security, including increasing computer processing

speed and capacity and addressing both physical security of the control center and

electronic access security of the SCADA computers.

Actions of the Accident Controller

Safety Board investigators evaluated the timeliness and appropriateness of the

controllerís actions during the accident sequence. This evaluation was hampered by the

fact that the controller declined to speak to Safety Board investigators.

The accident controller had 16 yearsí experience as a pipeline controller at the

time of the accident. He had successfully completed the requisite training and had

received the second-highest overall rating on his most recent performance appraisal. He

had been fully qualified by Olympic to operate the pipeline.

When the delivery points were switched, pressure in the pipeline began to build.

According to other controllers interviewed, this was a normal occurrence, and the standard

response was to start a second pump at the Woodinville station. This is what the accident

controller attempted to do, but he could not start the pump because of the nonresponsiveness of the SCADA system. Because the Woodinville station was unattended,

he had no timely alternative means of starting a pump there. Without the extra

Woodinville pump, pressure would continue to build upstream of that station. In an

apparent attempt to systematically shut the pipeline down, he called an electrician at the

upstream Allen station and asked that a pump there be shut down to slow the flow of

product toward Woodinville.

Meanwhile, the uncontrolled pressure buildup had begun to reach overpressure

protection settings, thus shutting down pumping units along the pipeline and initiating the

closure of the inlet block valve at Bayview. This chain reaction effect went virtually

unchecked because of the slow response or non-response of the SCADA system. The

computer system administrator then shut down the primary SCADA computer in

preparation for bringing the backup computer on line. Approximately 1 minute after the

backup OLY01 system was brought on line as the primary computer, the pipeline ruptured.

At that point, the pipeline had been virtually shut down by the tripping of pumps and the

closing of the valve. The accident controller, about 7 minutes after the rupture, called

personnel at the ARCO refinery near Cherry Point and asked that they discontinue

pumping product to the Cherry Point station.

It is not clear what or how much information was available to the controllers

between the time the SCADA system OLY02 was brought down and the time it was

brought back up and stabilized about 20 minutes later, at about 3:48. But none of the

readily available information indicated that the pipeline had ruptured. The inlet block

valve upstream of the Bayview terminal had closed repeatedly in the preceding 6 months,

and each time, the pipeline was restarted without incident.
Analysis 66 Pipeline Accident Report

Olympic procedures called for the accident controller to determine the cause of a

pressure change that shuts down a pump by reviewing such data as pressure trends. In the

accident, the first pump that went down was one of the boosters at Bayview. Safety Board

investigators could not determine whether the accident controller reviewed any pressure

trends before restarting the pipeline. Because the SCADA screens for Bayview were still

under development 6 months after the facilityís startup, no pressure trend SCADA screen

for Bayview was readily available to the accident controller. Safety Board review of the

data captured by the SCADA system in Renton indicated that the only data that would

have indicated to the accident controller that a rupture had occurred was the pressure trend

upstream of the inlet valve at Bayview that had been recorded on the OLY01 system.

Although this pressure trend data was probably not available to the accident controller

until 4:04, or shortly thereafter, when the OLY01 computer was restarted, had the accident

controller reviewed this trend, and it is unclear whether he would have done so had it been

available, he might have investigated the pressure indications and not restarted the

pipeline.

At 4:11, the accident controller restarted the pipeline by opening the inlet block

valve for Bayview and, a few minutes later, notifying personnel at the ARCO refinery to

resume delivery. By taking these actions, the accident controller significantly increased

the amount of product released. The effect of the additional product release on the

resulting fire cannot readily be quantified. The fact that the accident controller called the

electrician at the Allen station to verify a pressure reading there indicates that the

controller was watching pressures along the pipeline after he restarted it. He probably

thought he had a slack line condition, since the only pump still operating after the line shut

down was at Woodinville. This would have delayed his recognition that a release had

occurred and lessened the perceived validity of any leak detection alert. In taking these

actions, the controller was working under the direction of his supervisor, who had

approved the restart and who thus also apparently did not believe additional actions to

verify the integrity of the pipeline were necessary.

About 4:30, approximately 13 minutes after the pipeline was restarted, the pipeline

leak detection system issued an alert for a possible leak. About the same time, the control

center received a call from an Olympic employee on his way home who reported the

presence of gasoline in Whatcom Creek. Within minutes, the controller had initiated

actions to close mainline block valves to isolate the rupture and to stop the transfer of

product into the pipeline from ARCO.

Company Oversight of Bayview Products Terminal Construction

Control Valve CV-1904

Control valve CV-1904 was installed at the inlet to the Bayview products terminal

to maintain pressure to the facility below about 600 psig. Although CV-1904 had extended

piston stops that limited piston travel to within approximately 10 percent of full closure,

the stop limit was never reached during the accident. The unintended presence of extended
Analysis 67 Pipeline Accident Report

piston stops within the valve therefore did not contribute to the high pipeline pressure and

subsequent pipeline rupture. When Olympic personnel discovered the presence of

extended stops, they could have contacted the valve vendor or consulted the valve

documentation. Had they done so, they would have found that the stops could be adjusted

without taking the valve out of service. But Olympic made no effort to change the stop

settings.

It does not appear that either Olympic managers or engineers reviewed the

configuration of the valve and compared it to the design specifications. If they had, they

would have determined that the valve should not have had extended stops, and they could

have initiated a coordinated effort to properly reconfigure this and similar valves. Also,

they likely would have found that the outlet valves, which should have had extended

stops, did not. As a result, the possibility existed of pumping product against a closed

valve, although this did not occur during the accident sequence.

Relief Valve RV-1919

A comparison of the documents submitted by Olympic with those obtained from

Fisher-Rosemount indicates that a Fisher-Rosemount employee misinterpreted the

specification for RV-1919 and the three other identical relief valves ordered at the same

time. Fisher-Rosemount then manufactured and supplied relief valves with a low-pressure

pilot configuration and a pressure set point of 100 psig rather than a high-pressure

configuration set to relieve at 650 psig.60

All the documentation Fisher-Rosemount provided regarding the relief valves

indicated that they were set to open at 100 psig. Because the first of this documentation

was generated in January 1998 and the station was not actually commissioned until the

following December, Olympic and/or Jacobs had ample opportunity to discover the

mistake and to have the valves reconfigured by the manufacturer. Furthermore, the

manufacturer stamped the set pressure into the body of the pilot and affixed a metal tag to

it that clearly indicated the pressure range of the pilot spring; yet Olympic employees

overseeing construction of the Bayview terminal did not note the incorrect setting when

they inspected the valves during or after their installation. Olympic and/or Jacobs should

have realized from the purchase order supplied with the valves, the order

acknowledgements, the stamped pressure setting in the body of the pilot, or the tag affixed

on the pilot that the relief valves were not set to the specified relief pressure.

Olympic personnel did not discover that RV-1919 was set to relieve pressure at

100 psig until the tie-in to the Bayview facility was completed and they attempted to

restart the pipeline. Even then, they did not consult the valve specifications or literature.

Instead, they decided that they could correct the problem by replacing the pilot spring and

adjusting the pressure setting to 700 psig. Although they were not aware of it at the time,

they actually replaced the spring with an identical one. Further, by changing this lowpressure pilot to a high-pressure setting, they had rendered operation of the relief valve

60 The specification actually called for a pressure set point of 740 psig, but this was beyond the

maximum range of the valve that was ordered.
Analysis 68 Pipeline Accident Report

completely unreliable. Because the Bayview terminal was a new facility, Federal

regulations required that each overpressure safety device at Bayview be tested in

conditions approximating actual operations and found to function properly before the

pumping station could be used. No such test was conducted on the relief valves to verify

the pressures at which the valves would activate.

After December 16, 1998, when Bayview went into operation, the inlet block

valve at Bayview closed approximately 35 times because of high pressure within the

Bayview terminal. During this time, relief valve RV-1919 was set to relieve at 700 psig,

which was the same pressure at which the closing of the block valve would be triggered.

Having the pressures set the same would mask the fact that RV-1919 was probably not

operating reliably. Finally, in May 1999, in the companyís first documented action related

to the inability of the relief valve to prevent the closing of the Bayview inlet valve,

Olympicís mechanic was dispatched to reduce the set pressure of RV-1919 to 650 psig.

But even after this pressure set point adjustment, the block valve closed six more times

before the accident.

It does not appear that any additional effort was made before the accident to

determine why the block valve continued to close when RV-1919 was set at 650 psig.

Olympic did not consider the closing of the block valve to be an abnormal operation

because the valve was operating as designed. But automatic closure of the inlet block

valve was intended as a safety feature to protect the pipeline in the event of an abnormal

condition, specifically, high pressure at the Bayview terminal; the valve was not designed

to close automatically during routine operations. The company apparently never

conducted a systematic investigation to determine why, despite the presence of a control

valve and a relief valve intended to prevent it, pressures at Bayview regularly exceeded

the pressure setting necessary to trigger the closure of the block valve.

It was determined during the evaluation of the relief valve after the accident that

the pilot spring had been compressed to the point that the rising inlet pressure could not

lift the piston. Even though the mechanic who replaced the valve spring in RV-1919 and

reset the pressure set point said he tested the pilot several times (using a hydraulic pump

unit) and it opened correctly, later testing verified that the relief valve did not open at the

intended set pressure. The Safety Board concludes that had Olympic investigated the

failure of relief valve RV-1919 to operate consistently and prevent closure of the inlet

block valve, it would have discovered that the valve was improperly configured, and it

could have taken steps to correct the condition that may have prevented the pressure surge

that ruptured the pipeline.

The controllers reported that they expressed their concerns about problems they

were experiencing with pipeline operations after the Bayview facility came on line.

Management did not provide the controllers with any additional guidance, nor did they

evaluate the operational difficulties and develop specific operating procedures for the

pipeline that may have assisted the controllers working this pipeline and thus reduced the

number of times that the pipeline shut down. Indeed, any improvements in pipeline

operations between the Bayview commissioning and the accident were apparently the
Analysis 69 Pipeline Accident Report

result of trial-and-error experiences of the controllers, not the result of effective

management oversight.

Given that Olympic (1) did not test the performance of all the Bayview safety

devices under actual operating conditions before commissioning the terminal, (2) did not

respond effectively or appropriately when it learned that the upstream control valves did

not completely close and that the Bayview relief valves were configured and set for the

wrong relief pressure, (3) did not investigate and correct the conditions leading to the

repeated closings of the inlet block valve upstream of the Bayview terminal, and (4) did

not develop procedures for use by controllers in meeting the additional operational

challenges posed by the new facility, the Safety Board concludes that Olympic did not

exercise effective management oversight of the construction and activation of the

Bayview products terminal.

After the accident, Olympic commissioned a number of studies and made changes

designed to allow the pipeline to be operated more safely. Olympic has since removed the

Bayview terminal from operation, with no projected date for bringing the facility back on

line.

The mechanic who, during the startup of the Bayview terminal, replaced the pilot

spring in relief valve RV-1919 and adjusted the set point said he tested the pilot several

times (using a hydraulic test rig) after the change and that the pilot operated correctly. He

said he repeated the same test successfully after he adjusted the pressure set point on RV1919 from 700 to 650 psig in May 1999. But while, in each case, the pilot piston may have

lifted enough to indicate that the pilot was working, this test did not indicate that the pilot

would reliably operate or that it would ever cause the relief valve to open. When tested in

place in an identical manner after the accident, the pilot on RV-1919 operated at about 440

psig. After the accident, flow testing performed on the relief valves throughout Olympicís

system indicated that they were relieving at pressures higher (in some cases considerably

higher) than the set pressures of the pilots. More significantly, during controlled tests

performed on RV-1919 after the valve was removed from the pipeline, neither the pilot nor

the relief valve operated even with inlet pressures approaching 800 psig.

Federal regulations at 49 CFR Part 195 require pipeline operators to test pressure

limiting devices, relief valves, and other pressure control equipment once each calendar

year at intervals not exceeding 15 months to determine that they are functioning properly,

are in good mechanical condition, and are adequate from the standpoint of capacity and

reliability of operation for the service in which they are used. These regulations do not

identify specific testing procedures to be used to determine whether the relief valve is

functioning properly. Although RV-1919 was a new valve and not yet subject to the

requirement for periodic inspections, the annual inspections that Olympic performed on

other relief valves within its system consisted of a visual inspection and a test to determine

the set point of the pilot. The test used to check the set point was the same one used by the

mechanic to test the operation of RV-1919. But, as observed during postaccident testing,

the tests used by Olympic were inadequate to determine whether the pilot was configured

properly or whether the relief valve was operating reliably. The Safety Board concludes

that the Federal regulations establishing performance standards for the testing of relief
Analysis 70 Pipeline Accident Report

valves and other safety devices installed on hazardous liquid pipelines provide insufficient

guidance to ensure that test protocols and procedures will effectively indicate

malfunctions of the relief valves and/or their pilot controls.

Because the Bayview products terminal was a new pumping facility, Federal

regulations required that RV-1919 and the other safety devices associated with the facility

be tested under conditions approximating actual operations. Olympic asserts that the

method it used to test the relief valve (that is, isolating the pilot and testing its set point) is

common within the industry and that it meets Federal regulations. Nonetheless, this

testing method did not reveal that the valve was improperly configured and that it could

not be depended upon to operate reliably. The Safety Board notes that RSPA regulations

do not provide adequate guidance to ensure that relief valves are tested under conditions

approximating actual operations. The Safety Board is concerned that, like Olympic, other

pipeline companies, during the commissioning of new pumping stations, may be

conducting tests that do not identify unreliable relief valve operation. Further, operators

may be performing similar annual relief valve tests that do not adequately test the

performance of the valves to ensure that they will protect the pipeline from

overpressurization. The Safety Board therefore believes that RSPA should develop and

issue guidance to pipeline operators on specific testing procedures that can (1) be used to

approximate actual operations during the commissioning of a new pumping station or the

installation of a new relief valve, and (2) be used to determine, during annual tests,

whether a relief valve is functioning properly.

Emergency Response

Bellingham responders, including the fire, police, and public works departments,

responded promptly to the reports of gasoline odors, elevated the response to the incident,

and began to evacuate the area and prevent people from entering the accident area.

Personnel from additional local, State, and Federal agencies also responded promptly to

the resultant fire and environmental damage. The incident command system was

implemented and effectively managed. Based upon on-site observations of the incident

command system, interviews with various responders, the rapid response to the initial

reports of odors, the rapid and effective response to the fire and environmental damage,

and the rapid restoration of the Hannah and Whatcom streambeds, the Safety Board

concludes that the emergency and environmental response to the release was effective and

well managed.
71 Pipeline Accident Report

Conclusions

Findings

1. Had the accident pipeline not been weakened by external damage, it likely would

have been able to withstand the pressure that occurred on the day of the rupture, and

the accident would not have happened.

2. The damage to the Olympic pipeline that led to its failure on June 10, 1999, occurred

during IMCO General Construction, Inc., excavations associated with the Dakin-Yew

water treatment plant modification project.

3. Olympic inadequately inspected excavation work performed by IMCO General

Construction, Inc., during the water treatment plant project and consequently failed to

identify and repair the damage done to the pipeline.

4. The in-line pipeline inspection data provided to Olympic, along with the excavation

activity Olympic knew occurred in 1993 and 1994, were sufficient to justify the

excavation and examination of the pipeline in the area of reported anomalies, but the

company did not perform the work and thus did not identify the true extent of the

damage.

5. If the supervisory control and data acquisition (SCADA) system computers had

remained responsive to the commands of the Olympic controllers, the controller

operating the accident pipeline probably would have been able to initiate actions that

would have prevented the pressure increase that ruptured the pipeline.

6. The degraded SCADA performance experienced by the pipeline controllers on the

day of the accident likely resulted from the database development work that was done

on the SCADA system.

7. Had the SCADA database revisions that were performed shortly before the accident

been performed and thoroughly tested on an off-line system instead of the primary

on-line SCADA system, errors resulting from those revisions may have been

identified and repaired before they could affect the operation of the pipeline.

8. Olympic did not adequately manage the development, implementation, and protection

of its SCADA system.

9. Had Olympic investigated the failure of relief valve RV-1919 to operate consistently

and prevent closure of the inlet block valve, it would have discovered that the valve

was improperly configured, and it could have taken steps to correct the condition that

may have prevented the pressure surge that ruptured the pipeline.
Conclusions 72 Pipeline Accident Report

10. Olympic did not exercise effective management oversight of the construction and

activation of the Bayview products terminal.

11. The Federal regulations establishing performance standards for the testing of relief

valves and other safety devices installed on hazardous liquid pipelines provide

insufficient guidance to ensure that test protocols and procedures will effectively

indicate malfunctions of the relief valves and/or their pilot controls.

12. The emergency and environmental response to the release was effective and well

managed.

Probable Cause

The Safety Board determines that the probable cause of the June 10, 1999, rupture

of the Olympic pipeline in Bellingham, Washington, was (1) damage done to the pipe by

IMCO General Construction, Inc., during the 1994 Dakin-Yew water treatment plant

modification project and Olympic Pipe Line Companyís inadequate inspection of IMCOís

work during the project; (2) Olympic Pipe Line Companyís inaccurate evaluation of inline pipeline inspection results, which led to the companyís decision not to excavate and

examine the damaged section of pipe; (3) Olympic Pipe Line Companyís failure to test,

under approximate operating conditions, all safety devices associated with the Bayview

products facility before activating the facility (4) Olympic Pipe Line Companyís failure to

investigate and correct the conditions leading to the repeated unintended closing of the

Bayview inlet block valve, and (5) Olympic Pipe Line Companyís practice of performing

database development work on the supervisory control and data acquisition system while

the system was being used to operate the pipeline, which led to the systemís becoming

non-responsive at a critical time during pipeline operations.
73 Pipeline Accident Report

Recommendations

As a result of its investigation of the June 10, 1999, rupture of an Olympic Pipe

Line Company pipeline in Bellingham, Washington, the National Transportation Safety

Board makes the following safety recommendations:

To the Research and Special Programs Administration:

Develop and issue guidance to pipeline operators on specific testing

procedures that can (1) be used to approximate actual operations during the

commissioning of a new pumping station or the installation of a new relief

valve, and (2) be used to determine, during annual tests, whether a relief

valve is functioning properly. (P-02-4)

Issue an advisory bulletin to all pipeline operators who use supervisory

control and data acquisition (SCADA) systems advising them to

implement an off-line workstation that can be used to modify their SCADA

system database or to perform developmental and testing work

independent of their on-line systems. Advise operators to use the off-line

system before any modifications are implemented to ensure that those

modifications are error-free and that they create no ancillary problems for

controllers responsible for operating the pipeline. (P-02-5)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

CAROL J. CARMODY

Acting Chairman

JOHN A. HAMMERSCHMIDT

Member 

JOHN J. GOGLIA

Member

GEORGE W. BLACK, JR.

Member

Adopted: October 8, 2002

75 Pipeline Accident Report

Appendix A

Investigation

The National Transportation Safety Board was notified on June 10, 1999, through

the National Response Center, of a pipeline rupture and subsequent fire in Bellingham,

Washington. The Safety Board dispatched an investigative team from its Washington,

D.C., headquarters. The team comprised investigative groups in pipeline operations and

survival factors. Board Member John Hammerschmidt accompanied the investigative

team. No hearings or depositions were held in conjunction with the investigation.

Representatives from the U.S. Environmental Protection Agency; the Washington State

Department of Ecology; Olympic Pipe Line Company; the city of Bellingham; IMCO

General Construction, Inc.; Fisher-Rosemount Petroleum; Earth Tech; the Washington

State Fire Marshalís Office, and the Office of Pipeline Safety participated in the Safety

Boardís investigation. Teledyne-Brown Engineering also participated in the investigation

until the company sold its supervisory control and data acquisition program product.
76 Pipeline Accident Report

Appendix B

Office of Pipeline Safety Corrective Action Order

After the accident, on June 18, 1999, the Office of Pipeline Safety (OPS) found

that ìthe continued operation of this pipeline without corrective measures would be

hazardous to life, property, and the environment,î and issued a corrective action order

restricting Olympicís operations and outlining specific actions that Olympic must

complete before returning its pipeline to full operation. The OPS subsequently issued two

amendments to the order. The cumulative requirements of the items can be summarized as

follows:

With respect to the Ferndale to Allen, Washington, segment:

ï The first three items are to be completed before operating the pipeline segment.

ï Review the supervisory control and data acquisition (SCADA) system to

determine the cause of the deficiencies that occurred on June 10, 1999, and

correct these deficiencies.

ï Test mainline valves intended to isolate sections of the pipeline traversing

populated and environmentally sensitive areas and take any needed remedial

actions.

ï Install a check valve at milepost 16.22.

ï Develop a plan to address the following to the extent they are involved in the

release:

Review the existing mainline block valves and check valves and plan for

additional installations as necessary to minimize the consequences of a

pipeline release. Valves will have remote operation capability as deemed

appropriate by the review.

Review the SCADA system to detect any deficiencies and develop a

schedule for modifications.

Cathodic protection surveys with scheduled remediation.

Pressure testing.

Internal inspection tool surveys and remedial action to insure the integrity

of the pipeline using the best available technology appropriate for assessing

the system based on the type of failure that occurred on June 10.
Appendix B 77 Pipeline Accident Report

ï Restrict the maximum operating pressure (MOP) of the pipeline segment to

1,056 psig, which is 80 percent of the normal operating pressure or 80 percent

of the surge pressure at the point of failure, whichever is lower.

ï Restrict the MOP of the 16-inch Allen to Renton pipeline segment to 80

percent of its normal operating pressure or 80 percent of the surge pressure at

the point of failure, whichever is lower.

ï Include consideration of the Allen to Renton pipeline segment in the plan

developed to address the Ferndale to Allen segment.

ï For a minimum period of one (1) year after the last modifications to the

SCADA system are performed as a result of this Order, monitor the SCADA

systemís operation and report any anomalies to the OPS within 2 weeks.

ï Within 3 months of the 1st amendment, perform the following with respect to

personnel involved with controlling the operations of the pipeline through the

SCADA system:

Develop and implement a training program for controllers that includes

responding to abnormal operations and starting up and shutting down any

part of the pipeline system.

In addition to the training, review the qualifications of each controller to

recognize conditions that are likely to cause emergencies and be able to

predict the consequences of facility malfunctions or failures such as those

that occurred on June 10, 1999.

Provide specific, specialized, technical training to controller personnel

responsible for maintenance and operation of the hardware and software

components of the SCADA system and review the qualifications of these

personnel.

Include classroom instruction, practical exercises, and the use of a pipeline

simulator as appropriate in the training under this item.

ï Perform a design review of the Ferndale to Renton segment to ensure the

station safety devices will shut the segment down within applicable

parameters. The review should include at least the following:

A surge analysis using the worst-case scenario.

A test of the relief valves to determine that capacity is adequate and that

they operate reliably.

A design review of the physical piping in the Bayview products terminal

that includes the interaction of all station safety devices.

ï In conducting any internal inspection, excavate and visually examine any

anomaly that could be associated with excavation damage located on the top

half of the pipe and take appropriate remedial action.
Appendix B 78 Pipeline Accident Report

ï In conducting any internal inspection, consider the possibility of internal

corrosion in conducting the inspection and analyzing the results.

ï Review existing procedures for normal, abnormal, and emergency operations

of the Ferndale to Allen pipeline segment and make any necessary changes to

ensure that they address operations at the Bayview products terminal.

ï Notify the OPS before undertaking any testing, repairs, or construction needed

to prepare for the return of the pipeline to service.

ï Restrict normal operating pressures to 80 percent of the previously established

MOP on the 20-inch Allen to Renton segment, the 14-inch Renton to Portland

segment, the 16-inch Anacortes to Allen segment, and the remaining various

short delivery segments on the system.

ï Conduct hydrostatic pressure testing at a test pressure of 90 percent of

specified minimum yield strength (SMYS) for a minimum period of 8 hours as

follows:

Pressure test the 16-inch Ferndale to Allen segment in its entirety.

Pressure test any sections of the remainder of the Olympic system that are

constructed of pre-1970 electrical resistance welded (ERW) pipe manufactured by Lone Star.

Pressure test any remaining sections of the Olympic system if indicated by

the evaluation and plan provided for in the next item.

Metallurgically test any failure that occurs in a manner which will identify

the cause of the failure.

ï If, during the pressure testing, a failure occurs on line pipe which is not

manufactured by Lone Star, evaluate the need to pressure test the remainder of

the Olympic system and plan any testing that the evaluation indicates is

advisable.

ï A pressure test conducted pursuant to the Order may not be used to establish a

higher MOP than that previously established for the segment without written

approval of OPS.

ï In conducting internal inspections on the Olympic system, do the following:

Select internal inspection devices that can accurately detect metal loss, pipe

deformation and enable strain calculations.

Complete the analysis of internal inspection data and any remedial actions

for anomalies that affect pipeline integrity within six months of completion

of the internal inspection. The analysis shall include a comparison of metal

loss with pipe deformation.
Appendix B 79 Pipeline Accident Report

Develop and follow written procedures for the conduct of the internal

inspections that includes fitness for service criteria for identifying,

prioritizing, and correcting defects. These shall include criteria for

deciding on direct pipeline examination, further integrity assessment, and

corrective measures including repair, replacement, or operational

restrictions. At a minimum, the criteria established in American Society of

Mechanical Engineers (ASME) B31.4 and ASME B31-G should be

considered.

ï Within 6 months of completion of the management audit provided for in the

City Agreement, implement any corrective measures that cover matters

regulated under 49 CFR Part 195, and report progress on the implementation to

the OPS no less frequently than every 3 months.