PAB/99-03

E PL UR IBUS U NUM

NATIONAL TRA SPORTATIO

N

BOARD

SAFE T Y

N

National Transportation Safety Board

Washington, D.C. 20594

Pipeline Accident Brief

Pipeline Accident Number: DCA-97-FP-002

Type of System: Hazardous liquid petroleum products

Accident Type: Overpressure rupture

Location: Murfreesboro, Tennessee

Date and Time: November 5, 1996, about 9:36 a.m. EST

Owner/Operator: Colonial Pipeline Company

Fatalities/Injuries: None

Property Damage: $5.7 million

Material Released: Diesel fuel

Quantity Released: About 84,700 gallons (about 2,017 barrels)

Pipeline Pressure: Approximately 1,820 psig

Component Affected: 8-inch diameter, Grade X-42, 0.188 inch wall

thickness, Electric Resistance Weld (ERW) steel

pipe

The Accident

On the morning of November 5, 1996, Colonial Pipeline Company (Colonial) was

preparing to perform a maintenance operation that required that a section of pipeline be

isolated and purged of product, which in this case was diesel fuel. The pipeline involved

was 8-inch-diameter steel pipe used to transport hazardous liquid petroleum products

from Colonial’s Atlanta Junction in Georgia to its Nashville, Tennessee, delivery facility.

(See figure 1.)

The affected section of the pipeline was between the Murfreesboro, Tennessee,

pump station and the Nashville delivery facility. Colonial planned to begin the operation by

blocking the line at the Murfreesboro station and allowing product to drain into the

Nashville facility. With pressure and product volume decreased in the line, the company

planned to introduce into the pipeline section a mechanical device called a pipeline pig

that, propelled by pressurized nitrogen gas introduced in the pipeline behind it, would

move down the pipeline and displace the remaining product.

A member of the project team at Murfreesboro called Colonial’s pipeline controller

in its Atlanta control center just before 9:00 a.m. eastern standard time to start the project.

The controller first shut down some pumps and opened a valve to divert product into its

Lookout Mountain delivery facility. At 9:12:17 a.m., he closed the remotely controlled,

electric-motor-operated mainline block valve at Murfreesboro.
2

Shortly after the block valve was closed at Murfreesboro, the controller’s shift

supervisor in Atlanta informed the controller that the plan had changed. Members of the

project team had decided to restart the delivery to Nashville long enough to complete

delivery of the product batch to the terminal that was currently on line there.

The controller did not reopen the electric block valve at Murfreesboro before

resuming pumping product through the pipeline. Instead, at 9:19:08 a.m., he began

starting pipeline pumps upstream of Murfreesboro, at Chattanooga, Signal Mountain, and

Coalmont. He also slowed the delivery flow rate at Lookout Mountain. Contrary to

procedures contained in Colonial’s operating manual, the controller had started product

flow in a blocked pipeline.

The increased pipeline pressure was registered at the Coalmont pump station, the

first station upstream of Murfreesboro, but the overpressure shutdown set points at the

station allowed the pipeline to be overpressured before the protective device activated to

shut the pump station down automatically.

Figure 1. Colonial Pipeline Company Atlanta-Nashville stublines

= Pump station

= Delivery facility
3

With the pipeline continuing to operate, pressure was increasing at Murfreesboro.

The controller did not note the overpressure condition that had developed at

Murfreesboro, because the pressure transmitter for the station was downstream of the

closed mainline block valve. (See figure 2a.) The controller was not aware of the actual

pressure transmitter location because the supervisory control and data acquisition

(SCADA) system1 schematic for the Murfreesboro station erroneously depicted the

pressure transmitter as located upstream of the electric block valve, as it was at most other

stations on the pipeline. (See figure 2b.)

The controller attempted to reopen the electric block valve at Murfreesboro for the

first time at 9:35:02 a.m. Although the controller saw no indication of high pressure at the

station because of the location of the pressure transmitter, pressure data evaluated since

the accident indicated that a high differential pressure, at least 1,700 psig, existed across

the valve at that time. This pressure exceeded the design limits (1,440 psi) of the motor

used to remotely operate the valve, and the valve did not open.

Colonial’s operating manual regarding abnormal operations requires that the

controller shut down the pipeline immediately in the event of a blocked line. The controller

did not attempt to shut down the line. Instead, during the next minute, he twice more sent

commands to try to open the valve at Murfreesboro. He then called the station to request

that a technician check the valve. A technician did check the valve and control equipment

and found no problems.

Next, the controller turned off pumps at the Coalmont and Signal Mountain

stations and increased the flow rate at the Lookout Mountain delivery station, which

would lower the pipeline pressure so the electric block valve could be opened. The valve

opened on the controller’s fourth attempt, made at 9:39:07 a.m. Unknown to the

controller, the pipeline had already ruptured at approximately 9:36:21 a.m.

The pipeline ruptured at a longitudinal seam weld. The rupture occurred in a rural

area about 46.2 miles downstream of the Coalmont station and about 10.9 miles upstream

of the Murfreesboro station. The SCADA system indicated a sudden pressure drop of 416

psi at Coalmont station at 9:37:35 a.m.; however no SCADA alarms were generated as a

result of the pressure drop. From this data, Colonial later calculated that the pressure had

reached approximately 1,820 psig at the rupture site before the failure.2 The rupture

depressurization wave was calculated to have taken 74 seconds to travel from the rupture

site to Coalmont. From this data, the time of the failure is estimated to be approximately

9:36:21a.m.

 

1

 Pipeline controllers use the SCADA system to remotely control movement of product through the

pipeline. Controllers can monitor flow rates and pressures along the lines and control valves and mainline

pumps to adjust the flow and make product deliveries.

2

Title 49 Code of Federal Regulations Part 195.406(b) states that no operator may permit the

pressure in a pipeline during surges or other variations from normal operating conditions to exceed 110

percent of the maximum operating pressure (MOP). For this pipeline, 110 percent of the MOP (1,318

psig) is 1,449 psig.
4

Figure 2B. Valve configuration at typical stubline station. Note that pressure

 transmitter is upstream of electrically operated mainline block valve.

C

Pump

Equipment

M Suction Discharge

Flow M

E

E

E

Pressure

Transmitter

8-inch mainline

M = Manual valve

E = Electric-motor-

 operated valve

C = Check valve

Pump

Equipment

Suction Discharge

Flow M M

E

E

E

Pressure

Transmitter

Figure 2A. Valve configuration at Murfreesboro station. Note that pressure

 transmitter is downstream of electrically operated mainline block valve.

C

M = Manual valve

E = Electric-motor-

 operated valve

C = Check valve

8-inch mainline
5

Although the pipeline had ruptured approximately 3 minutes before the Murfreesboro

electric block valve was opened, the controller did not recognize that the leak had

occurred. He restarted the Signal Mountain and Coalmont stations and continued to pump

diesel fuel out of the ruptured pipeline for approximately 1 hour. When he realized that the

expected pressure rise on the line was not occurring, he initiated pipeline shutdown

procedures at 10:35:32 a.m.

The line section containing the leak was isolated at 10:39:44 a.m. Colonial

activated its emergency procedures and began to search for a possible leak. Colonial crews

were dispatched from the Murfreesboro station to examine the pipeline right-of-way, and

a helicopter was used to fly over the pipeline route. At 11:20 a.m., Colonial notified the

Tennessee Emergency Management Agency. After checking the SCADA overfill and

shortage report to confirm the likelihood of a leak, Colonial personnel telephoned a leak

report to the National Response Center at 12:23 p.m. Personnel in a helicopter discovered

the site of the leak at 2:00 p.m..

Colonial reported a release of approximately 84,700 gallons (2,017 bbl.) of diesel

fuel. No fatalities or injuries were reported. The accident did not cause a fire or explosion.

Colonial’s low initial product recovery of 24 percent was influenced by geologic

formations in the leak area. Most of the product entered sink holes or small caverns, and

no signs of product were evident immediately after the leak. Colonial has conducted

ground water remediation and product recovery under the oversight of the Tennessee

Department of Environment and Conservation.

Total diesel fuel recovered through October 1998 was about 36,500 gallons (867

bbl, or 43 percent of the total estimated spill). Diesel fuel recovery efforts are ongoing,

and the company continues to incur costs related to the spill. Cumulative accident-related

expenditures by Colonial as of December 1998 totaled about $5.7 million, which includes

property damages, cleanup and recovery costs, and the value of lost product.

After the accident, Colonial took disciplinary action against the controller

operating the pipeline during the accident. The controller was also retrained in the

procedures he had violated. Since the accident, Colonial has provided additional training

to its controllers and is making improvements in its controller training program, including

instituting initial, refresher, and “train the trainer” programs. Colonial has purchased a

simulator and has implemented training to better prepare controllers to respond to

abnormal and emergency conditions along the pipeline. All controllers are required to

respond to an average of one tabletop training scenario per month regarding critical

pipeline events.

Following the accident, Colonial changed the location of the pressure transmitter

at Murfreesboro so the upstream pressure can be observed when the remotely operated

mainline block valve is closed. Colonial evaluated the hydraulic conditions for its entire

pipeline system and then corrected overpressure protection set points to help prevent an

overpressure condition in the future. Colonial has also reviewed and updated the SCADA

schematic displays for its pipeline system to eliminate inaccuracies.
6

Probable Cause

The National Transportation Safety Board determines that the probable cause of

this accident was (1) the failure of the pipeline operator to follow company procedures for

operating the pipeline and (2) the failure of the pipeline control and monitoring system to

inform the operator of unsafe conditions prior to the rupture. Contributing to the severity

of the accident was the delay in recognizing that a leak had occurred, which delayed

shutting down the pipeline and isolating the rupture.

Approved: April 29, 1999