F PB98-916502

 NTSB/PAR-98/01

NATIONAL

TRANSPORTATION

SAFETY

BOARD

WASHINGTON, D.C. 20594

PIPELINE ACCIDENT REPORT

PIPELINE RUPTURE AND RELEASE OF FUEL OIL INTO

THE REEDY RIVER AT FORK SHOALS, SOUTH CAROLINA

JUNE 26, 1996

6758A
Inside Cover

Abstract: About 11:54 p.m. eastern daylight time on June 26, 1996, a 36-inch-diameter

Colonial Pipeline Company pipeline ruptured where a corroded section of the pipeline crossed the

Reedy River at Fork Shoals, South Carolina. The ruptured pipeline released about 957,600 gallons of fuel oil into the Reedy River and surrounding areas. The estimated cost to Colonial for

cleanup and settlement with the State of South Carolina exceeded $20.5 million. No one was

injured in the accident.

The major safety issues addressed in the report are as follows: effectiveness of Colonial’s

operations management in ensuring that the pipeline is operated within safe pressure limits; adequacy of the training given to controllers and shift supervisors as it relates to preparing them to

recognize and effectively respond to abnormal conditions, emergency situations, and leaks in the

pipeline; and effects of Colonial controller work schedules on safe pipeline operation.

As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the Research and Special Programs Administration and to Colonial Pipeline

Company.

The National Transportation Safety Board is an independent Federal Agency dedicated to

promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of

1974 to investigate transportation accidents, study transportation safety issues, and evaluate the

safety effectiveness of government agencies involved in transportation. The Safety Board makes

public its actions and decisins through accident reports, safety studies, special investigation

reports, safety recommendations, and statistical reviews.

Recent publications are available for viewing or printing at http://www.ntsb.gov/. Information about available publications may also be obtained by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L’Enfant Plaza, East, S.W.

Washington, D.C. 20594

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(703) 605-6000
Title Page

Pipeline Accident Report

Pipeline Rupture and Release of Fuel Oil Into

National Transportation Safety Board

 490 L’Enfant Plaza East, S.W.

 Washington, D.C. 20594

NTSB/PAR-98/01

PB98-916502

Notation 6758A

Adopted: November 4, 1998

the Reedy River at Fork Shoals, South Carolina

June 26, 1996

N AT I ONA L TR A S PO R TAT IO N

E P L UR I B U S U NU M

B O A R D

SA F E T Y

N

iii

EXECUTIVE SUMMARY ...............................................................................................v

FACTUAL INFORMATION ...........................................................................................1

Accident Narrative...............................................................................................................1

Emergency Response...........................................................................................................6

Injuries .................................................................................................................................6

Damage ................................................................................................................................7

Personnel Information..........................................................................................................7

Relief Controller ...........................................................................................................7

Shift Supervisor ..........................................................................................................10

Site Description..................................................................................................................10

Operations Information......................................................................................................11

Toxicological Information .................................................................................................13

Meteorological Information...............................................................................................14

Events Preceding the Accident ..........................................................................................14

Other Information ..............................................................................................................17

Controller Training .....................................................................................................17

General Work Schedules for Controllers and Relief Controllers ...............................19

Colonial Guidance for Abnormal Procedures, Emergency Conditions, and Leaks ...20

Colonial Actions Since the Accident..........................................................................21

ANALYSIS .......................................................................................................................23

Accident Discussion ..........................................................................................................23

Colonial Actions With Regard to the Reedy River Crossing ............................................25

Pipe Thickness Measurements....................................................................................25

Operational Restrictions .............................................................................................25

Controller’s Actions During the Accident Sequence.........................................................26

Shift Supervisor’s Actions During the Accident Sequence ...............................................28

Controller Training for Emergency Situations ..................................................................29

Relief Controller Training and Experience on Line No. 2 ................................................29

Employee Training in the Pipeline Industry ......................................................................30

Controller Fatigue ..............................................................................................................30

Postaccident Drug and Alcohol Testing ............................................................................32

CONCLUSIONS ..............................................................................................................33

Findings .............................................................................................................................33

Probable Cause ..................................................................................................................33

RECOMMENDATIONS.................................................................................................35

APPENDIX A

Investigation.......................................................................................................................37

Contents
iv

APPENDIX B

Excerpts from General Physics Postaccident Report on 

Colonial’s Supervisory Control and Data Acquisition (SCADA) System ........................39
v

Executive Summary

About 11:54 p.m. eastern daylight time on June 26, 1996, a 36-inch-diameter Colonial

Pipeline Company pipeline ruptured where a corroded section of the pipeline crossed the Reedy

River at Fork Shoals, South Carolina. The ruptured pipeline released about 957,600 gallons of

fuel oil into the Reedy River and surrounding areas. The estimated cost to Colonial for cleanup

and settlement with the State of South Carolina was $20.5 million. No one was injured in the

accident.

The National Transportation Safety Board determines that the probable cause of the

rupture of the corrosion-weakened pipeline at the Reedy River crossing was the failure of

Colonial Pipeline Company (1) to have adequate management controls in place to protect the

corroded pipeline at the Reedy River crossing; and (2) to ensure that pipeline controllers were

adequately trained to both recognize and respond properly to operational emergencies, abnormal

conditions, and pipeline leaks.

The major safety issues addressed in the report are as follows:

• Effectiveness of Colonial’s operations management in ensuring that the pipeline is

operated within safe pressure limits; 

• Adequacy of the training given to controllers and shift supervisors as it relates to preparing them to recognize and effectively respond to abnormal conditions, emergency

situations, and leaks in the pipeline; and

• Effects of Colonial’s controller work schedules on safe pipeline operation.

As a result of its investigation, the National Transportation Safety Board makes safety

recommendations to the Research and Special Programs Administration and to Colonial Pipeline

Company. 
this page intentionally left blank
1

Factual Information

Accident Narrative

On the evening of June 26, 1996, a Colonial Pipeline Company relief pipeline

controller1 was on duty at Colonial’s pipeline control center in Atlanta, Georgia, operating

a 36-inch-diameter Colonial pipeline (designated line No. 2) between Pasadena, Texas,

and Greensboro, North Carolina. The controller was making and monitoring deliveries of

No. 2 fuel oil from the pipeline to terminals in Atlanta, Charlotte, and Greensboro.

At 11:43:30 p.m. eastern daylight time,2

 the operator at Atlanta Junction notified

the pipeline control center that deliveries to the Atlanta terminal would be stopped in 2

minutes. At 11:45:30 p.m., the Atlanta Junction takeoff valve was closed. (See table 1 for

a summary of critical events occurring during the following 20 minutes.) When the

delivery was terminated, the pipeline controller began sequentially increasing pumping

capacity3

 at the unattended pumping stations downstream (to the northeast, see figure 1) of

Atlanta to accommodate the additional product that was now moving through the pipeline.

At 11:50:13 p.m., the controller started a second pumping unit at the Simpsonville, South

Carolina, station, bringing that station’s pumping power to 7,000 hp. 

At 11:50:16 p.m., the delivery to the Charlotte, North Carolina, terminal was

completed and the valves there were closed. At 11:51:27 p.m., the pipeline controller

attempted to remotely start the 5,000-hp No. 3 pumping unit at the Gastonia, North Carolina,

station. The controller stated that a green light illuminated on the supervisory control and

data acquisition (SCADA)4 system console, indicating to him that the pump was starting.5

(Unknown to the controller, the pump did not start.) Believing that he now had two pump

units on line at Gastonia, and without waiting for SCADA pressure readings to confirm

the starting of the No. 3 pump, the controller, at 11:51:33 p.m., shut down the 2,000-hp

pumping unit that had been running at Gastonia. Shutting down this unit left no pumps on

1 The relief controller was working in place of the regularly assigned controller. For the sake of simplicity, the on-duty relief controller will henceforth in the “Accident Narrative” portion of this report be referred

to as “the controller.” (In the Colonial system, relief controller is a higher pay grade position than controller.)

2 All times referenced were taken from Colonial’s supervisory control and data acquisition system

report.

3 Pumping capacity could be increased either by starting an additional pump at a station or by turning on

a larger (higher hp rating) pump and turning off a smaller one.

4 Pipeline controllers use the SCADA system to remotely control movement of product through the

pipeline. Controllers can monitor flow rates and pressures along the lines and use control valves and mainline pumps to adjust the flow and make product deliveries. The Colonial SCADA control system in the

Atlanta control center consisted of six cathode ray tube (CRT) screens that could be configured to display a

wide variety of pipeline instrument readings, alarms and alarm messages, and control settings. 

5 Safety Board investigators could not confirm that the green light had, in fact, illuminated when the

controller attempted to start the Gastonia pump.
Factual Information 2

line at Gastonia, with the result that, at 11:51:39 p.m., 11 seconds after the shutdown, the

automatic mainline block valve began opening to allow product to bypass the pump units

at the Gastonia station. This triggered a SCADA alarm, which the controller

acknowledged at 11:51:44 p.m. The controller took no further action regarding Gastonia

at that time. Instead, he changed the SCADA monitor screen (which he was using to

control pump starts and shutdowns) to display the next downstream station at Kannapolis,

North Carolina. At 11:51:58 p.m., the controller sent a command to start a 5,000-hp

pumping unit at the Kannapolis station. 

Table 1. Summary of critical events (from SCADA records)

Location Event Time (p.m.) T 

(delta)

Atlanta Junction Fuel oil delivery terminated 11:45:30 -

Smyrna Pump No. 4 started 11:45:55 0:25

Dacula Pump No, 4 started 11:47:09 1:15

Danielsville Pump No. 1 started 11:48:45 1:36

Anderson Pump No. 2 started 11:49:28 0:43

Simpsonville Pump No. 3 started 11:50:13 0:45

Charlotte Fuel oil delivery terminated 11:50:16 0:03

Gaffney Pump No. 4 started 11:50:32 0:16

Gastonia Pump No. 3 start command failed 11:51:27 0:55

Gastonia Pump No. 1 stopped (first surge) 11:51:33 0:06

Kannapolis Pump No. 4 start command 11:51:58 0:25

Gastonia Pump No. 4 started 11:52:26 0:28

Gaffney Pump No. 4 auto shutoff (second surge) 11:52:56 0:30

Kannapolis Pump No. 3 started 11:53:03 0:07

Lexington Pump No. 4 started 11:53:43 0:40

Gaffney Pump No. 3 started 11:53:52 0:09

Simpsonville Pump No. 1 auto shutoff 11:53:58 0:06

Simpsonville Pump No. 3 auto shutoff (third surge) 11:54:01 0:03

Simpsonville Pump No 2 started 11:54:29 0:28

Simpsonville Station suction pressure = 328 psig 11:54:20-27 (0:07)

Simpsonville Station suction pressure = -8 psig (rupture) 11:54:28 0:04

Anderson Pump No. 1 started 12:01:30 7:02

Anderson Pump No. 1 stopped 12:05:42 4:14
Figure 1. Colonial Pipeline Company’s line No. 2 from Atlanta, Georgia, to Greensboro, North C

AtlantaJunction

Smyrna

Dacula

Athens

Anderson

Danielsville Belton Junction

Simpsonville

Spartanburg

Gaffney

Gastonia Charlotte

Kannapol

Lexington

Reedy River

NORTH Direction of Flow

Breakout Tanka

Delivery Facilit

Booster Station

Booster Station 

Main Line

Line No. 2

PipelineRupture
Factual Information 4

The controller said he noticed the “pressure spread” on the strip charts6 displayed on

the SCADA console and realized that the Gastonia No. 3 pumping unit was not on line. He

noted that the pressure was increasing at Gastonia and that no pump units were operating

there. In a situation in which a pumping station is lost, Colonial’s operating manual and

policy called for the controller to immediately shut down all the pump units at the first

pumping station upstream of the affected station and then to “initiate the Multiple Station

Shutdown function to shut down all other upstream stations.” The controller said that on

the night of the accident he felt he had “to get something on [at Gastonia],” and at

11:52:26 p.m., he started the 5,000-hp No. 4 pumping unit there. 

Meanwhile, the controller’s shutting down of the only operating pump at Gastonia

had, at 11:51:33 p.m., generated a pressure surge in the pipeline. The surge traveled

upstream, reaching the Gaffney, South Carolina, station at 11:52:56 p.m. The pressure surge

caused the 5,000-hp No. 4 pumping unit (the only unit running) at Gaffney to shut down

because of high discharge pressure. At 11:53:18 p.m., the high pipeline pressure caused a

flow relief valve7

 to open at Spartanburg, South Carolina, which sounded an alarm on the

SCADA console. The controller said this alerted him that “the pressure had backed up down

at Spartanburg.” He said he also noticed at that time that the No. 4 pumping unit at Gaffney

had shut down. According to SCADA system records, the controller tried to restart the No. 4

pump. When that pump would not start, he started the 5,000-hp No. 3 pump instead.

At 11:53:58 p.m., the 2,000-hp No. 1 pumping unit at Simpsonville shut down on

high discharge pressure, followed 3 seconds later by the shutdown of the 5,000-hp No. 3

unit. The controller said he noticed both of the pump units at Simpsonville suddenly go

down and noticed the pressure increase there. He started the 5,000-hp No. 2 pumping unit at

Simpsonville, but this unit ran for only 19 seconds before it too shut down. The shutdown of

these pumps increased pressure in the pipeline upstream of the Simpsonville station.

According to SCADA records, the pipeline suction pressure8 at Simpsonville stayed

at 328 pounds per square inch, gauge (psig), its highest value during the event sequence, for

about 7 seconds, from 11:54:20 p.m. to 11:54:27 p.m. At 11:54:28 p.m., the Simpsonville

suction pressure dropped to -8 psig. Unknown to the controller, line No. 2 had ruptured

about 5 miles upstream of Simpsonville where the pipeline crossed the Reedy River at Fork

Shoals, South Carolina. Colonial calculated that the rupture occurred at 11:54:20 p.m.

Low suction pressure alarms for the Simpsonville station sounded on the SCADA

console, and the controller acknowledged them. He said he called the shift supervisor over to

his work station and told him about the problems he was having on the line. The controller

said he was concerned because the pressures had been increasing through the area from

6 The strip chart simultaneously displays line pressures and pump station discharge and suction pressures. It also shows the mainline block valve and pumping unit status for each station. Station pressures are

displayed for a 1 1/2- to 2-hour period and are compressed into a small area on the screen. 

7 Flow relief valves at various locations along the pipeline open in the event of high pipeline pressure

and route excess product to relief tanks.

8 Suction pressure refers to liquid pressure measured in psig on the upstream, or inlet, side of a pump. 
Factual Information 5

Simpsonville to Gaffney. The controller testified that he told the shift supervisor, “I’ve got a

problem at Simpsonville—I can’t get the units to run.” He said he was trying to start the

5,000-hp No. 4 pumping unit at Simpsonville. The records show that the controller again

tried to turn this pumping unit on at 11:55:09 p.m. 

The shift supervisor stated that he arrived at the controller’s console after the

Simpsonville pump units had shut down (11:54:01 p.m.). He said that he had not been

monitoring line No. 2 “in particular” on his SCADA console during these events. After the

controller had briefed the shift supervisor on his problems with the line, a determination was

made to begin shutting down the pipeline.9 At this time, the controller said, the SCADA

system was receiving intermittent status readings from the Simpsonville station. The shift

supervisor attempted to activate a telephone data backup communication link with the

station but was initially unsuccessful. The shift supervisor said that his failure to establish

the backup link helped confirm his suspicion that power had failed at the station.10 The shift

supervisor stated, “I was not convinced, and really did not think, we had a leak.” 

The controller’s first action to shut down the line was recorded by the SCADA

system at 11:58:07 p.m. As he began to shut down pumps along the line, the controller

attempted to communicate with the operator at the Collins station11 in order to stop more

product from being injected into the pipeline. The controller said that, after failing twice to

reach the Collins operator on an open voice communication circuit (speaker box), he

telephoned the operator, which he estimated took an extra 15 to 20 seconds. The controller

could have stopped the injection from his SCADA workstation, but he did not attempt to do

so.12

The controller shut down several pump units north of the Collins injection station.

He then contacted the operator at the Baton Rouge injection station13 by speaker box and

ordered him to shut the injection down at that station. Injection of product at Baton Rouge

stopped about 3 minutes later. The controller then sequentially shut down the segment of

pipeline between the Baton Rouge and Collins stations.

The controller, at the direction of the shift supervisor, attempted to relieve high

pressures at Smyrna and Dacula, Georgia, by starting a pumping unit at the Anderson, South

Carolina, station (the first station upstream of the rupture), even as the line was being shut

9 In Safety Board testimony, the shift supervisor stated that he told the controller to begin shutting down

the pipeline. The controller testified that he unilaterally decided to begin shutting down the line. 

10 As would be determined later, a power failure had not occurred at the station.

11 Collins station, located in southcentral Mississippi, is one of several Colonial injection stations where

product is put into the pipeline. 

12 According to Colonial, the booster pumps that provide product to Colonial’s main pumps at the injection stations belong to the terminals and not to Colonial. Unexpectedly shutting down the injection station

can damage these pumps; therefore, the shutting down of injection stations is normally accomplished by the

injection station operators. Before closing down the station, the station operators give notice to the terminal

operators, who then shut down the booster pumps. 

13 The Baton Rouge injection station in southeast Louisiana is upstream (to the southwest) of the Collins

station.
Factual Information 6

down. The controller stated that the Anderson pumping unit was started to prevent another

overpressure condition and a possible failure at another point in the pipeline. The pumps at

Anderson station were started at 12:01:30 a.m. and were not shut down until 12:05:42 a.m.

This additional pumping power at Anderson increased the amount of product that entered

the Reedy River. 

The shift supervisor said that at this time he was trying to get information on what

was wrong at the Simpsonville station. He said he did not believe that the negative

Simpsonville pressure readings displayed on the SCADA console were valid because of the

suspected power failure at that station. He said he only became aware that the readings were

valid when the backup communications with the station (using a different modem) were

established and the displayed SCADA readings “didn’t change.”

After determining that the pressure readings from Simpsonville were valid, the shift

supervisor telephoned the Spartanburg delivery station and requested that an electrical

technician assigned to the Spartanburg facility be sent as soon as possible to check the

Simpsonville station. The electrical technician reported that when he arrived at the

Simpsonville station at about 12:30 a.m. on June 27, 1996, he found no pressure at the

station. He said he immediately telephoned the shift supervisor and reported the lack of

pressure. He said he told the shift supervisor that he could hear a “hissing sound” from the

pump seals, indicating that the pump was “pulling a vacuum.” 

Although the shift supervisor stated that he then “pretty much knew” that a pipeline

failure had occurred, he asked the electrical technician to go to the Reedy River crossing,

about 5 miles away, to check for a leak in line No. 2. The electrical technician stated that

when he had gone about halfway down the access road to the river, he began to smell fuel

oil. He said he immediately returned to the main road and called the shift supervisor to

inform him of the leak. The shift supervisor “blocked” the line by closing valves that would

help isolate the leak. He also activated Colonial’s emergency oil spill response plan.

The ruptured pipeline eventually released about 957,600 gallons (22,800 barrels) of

No. 2 fuel oil into the Reedy River and the surrounding areas.

Emergency Response 

Colonial’s cleanup contractors were called at 1:15 a.m. on June 27, 1996. Local

police departments were notified at 2 a.m. At 2:15 a.m., Colonial emergency response and

other personnel were called. The National Response Center was notified at 2:34 a.m. Eight

cleanup areas were established along the river downstream of the pipeline rupture, as well as

a cleanup area at the leak site itself. According to Colonial, by July 8, 1996, the company

had recovered 897,120 gallons of the spilled fuel oil. By January 30, 1998, an additional

4,136 gallons had been collected from groundwater recovery wells near the spill site,

bringing the total recovered to 901,256 gallons, or about 94 percent of the amount spilled.

Injuries

No one was injured as a result of this accident.
Factual Information 7

Damage

Damage to the

pipeline itself occurred

only in the immediate area

of the rupture. At the rupture itself, a flap of material bulged out about 16

inches from the center of

the 34-inch-long crack.

(See figure 2.) Safety

Board investigators measured the wall thickness of

the ruptured section of

pipeline after it was

removed from the accident

site. Near the rupture area,

the thickness measured, at

its thinnest point, 0.069

inch, which is about 25 percent of the wall thickness

specified (0.281 inch) for

that pipeline.

The released fuel

oil traveled 22 miles downstream in the Reedy River,

killing an estimated 35,000

fish and causing other

environmental damage.

The cost to Colonial of the

cleanup exceeded $14 million. In December 1997, Colonial reached a $6.5 million settlement with the State of

South Carolina in compensation for natural resource damages and other State claims.

Personnel Information

Relief Controller

Experience and Training. The relief controller operating line No. 2 at the time of

the accident began working for Colonial on September 18, 1978, as a utility operator in

Greensboro, North Carolina. A utility operator is assigned to assist the regular operator at

specific station locations along the pipeline. (The utility operator is not responsible for

monitoring and control operations at that site except as part of a training assignment or

when a trained utility operator is relieving the regular operator.) The relief controller

remained in the capacity of utility operator until March 15, 1981, when he was selected for

the position of associate controller. 

Figure 2. Ruptured pipe after removal from Reedy River
Factual Information 8

The associate controller position is described by the company as a position in

which the individual is trained to use the SCADA system to control main and stub lines.14

The relief controller was subsequently promoted into controller positions of greater

responsibility while operating stub lines from 1981 until 1988. On August 2, 1988, he was

promoted to senior controller, the duties of which included independent operation of main

pipeline sections.15

The relief controller worked as senior controller operating Colonial’s line No. 116

from December 1988 until January 1996, when he became a relief controller. As a relief

controller, he was to fill in as controller on any of the pipelines whenever the regular

controllers were sick, on vacation, or otherwise unavailable for duty. From January 1996

until the time of the accident, he was in training on various lines. The training program

consisted of his operating each of the lines with a controller trainer. According to

Colonial, no controller or relief controller was allowed to operate a line independently

unless and until the trainer judged the controller fully qualified to operate that line. The

training and experience received by the relief controller on each Colonial line is detailed

below:

Line No. 1: The relief controller received no additional training on line No. 1, since

operating that line had been his previous full-time assignment.

Line No. 2 (the accident line): The relief controller reported he had had four

assignments on this line, two as a trainee with other controllers and two as a relief

controller without a trainer. His two trainee assignments were 12-hour shifts worked on

April 21 and 22, 1996. He worked two 12-hour shifts, on June 15 and 16, 1996, as

controller, without a trainer. The day of the accident was his third shift operating line

No. 2 independently.

Line No. 3: Line No. 3 is a 36-inch line that runs from Greensboro, North Carolina,

to Linden, New Jersey. The relief controller had been trained on the line but had not

operated it independently. 

Line No. 4: Line No. 4 is a 32-inch line that runs from Greensboro, North Carolina,

to Dorsey Junction, Maryland. The relief controller had been trained on the line but had

not operated it independently.

The relief controller had also received training on 9 of the 13 stub lines on the

system. 

14 Stub lines are branch lines off the main pipeline.

15 The designation senior controller was later eliminated, and the position of shift supervisor was created.

16 Colonial’s pipeline No. 1 parallels line No. 2. It is a 40-inch line between its origin at Pasadena,

Texas, and Baton Rouge, Louisiana, a 36-inch line between Baton Rouge and Atlanta, and a 40-inch line

between Atlanta and the termination point at Greensboro. 
Factual Information 9

The relief controller stated that he had received 20 hours of training on line No. 2,

but that this training was at a flow rate of 20,000 barrels per hour (bph) (840,000 gallons per

hour). The rate at the time of the accident was 34,000 bph (1.4 million gallons per hour).

The relief controller stated that the flow rate significantly affected the operation of the

line. For example, he said, a low flow rate not only requires fewer pumps than a high rate,

it usually results in lower pipeline pressures and makes more time available to conduct

operations. He also stated that, compared with line No. 2, line No. 1 had fewer pumps and

booster stations, usually less pressure, a lower flow rate, and a larger (40-inch) diameter

pipe. He said line No. 1 usually carried gasoline rather than the heavier kerosene or fuel oil

that typically was transported in line No. 2. He said that these differences made line No. 2

the more demanding of the two lines to operate. The relief controller said he had experienced

pump failures and pressure surges while operating line No. 1. He said he had not

experienced either event on line No. 2 prior to the night of the accident. 

The relief controller reported that he was in good health generally, was not ill on

the day of the accident, and was not taking any medication. He had passed his most recent

company-sponsored physical 3 months before the accident. He wears glasses to read, and

he said he was wearing them during his shift on the night of the accident.

Recent Work Schedule. According to company records, immediately preceding

the accident, the relief controller worked the schedule shown in table 2.

The relief controller in this accident said he did not always know when he was

going to be called upon to work. He said he sometimes got an hour or perhaps 2 hours’

notice of when to report and that sometimes he reported for work with no sleep. When

asked about his general sleeping habits, the relief controller said that the amount varied.

He said that some days he might get 7 or 8 hours’ sleep, and others perhaps only 3 hours.

Accident Day Activities. The relief controller stated that when he completed his

shift at 7 p.m. on June 25, 1996, he returned home and went to bed between 10 and

11 p.m.

Table 2. Relief controller work schedule 

Date Hours Assignment

June 19/20 7 p.m. to 7 a.m. Line No. 6

June 20/21 7 p.m. to 7 a.m. Line No. 6

June 21 Off N/A

June 22 Off N/A

June 23 Off N/A

June 24 Off N/A

June 25 7 a.m. to 7 p.m. Line No. 1

June 26/27 7 p.m. to 7 a.m. Line No. 2
Factual Information 10

On June 26, 1996, the day of the accident, the relief controller said he awoke at

about 7 a.m. He did not recall whether he had gotten any additional sleep before reporting

back to work at 7 p.m. The relief controller did not recall and Colonial had no record of

when he was notified that he was to report for duty on the evening of June 26.

Shift Supervisor

Experience and Training. The control room shift supervisor at the time of the

accident was 44 years old and was a 24-year Colonial employee. He began in May 1973 in

field operations as a utility operator at the Atlanta Junction tank farm. Over the next

6 years, he moved into increasingly more responsible positions in field operations, during

which time his work included maintenance at the tank farm and at booster stations. In

September 1979, he became an associate controller in the operational control center in

Atlanta. He was later promoted to controller and was trained on the operation of all lines at

that time and worked on line Nos. 2 and 3 and the Atlanta stub lines. He was subsequently

promoted to relief controller. In February 1989, he was promoted to one of the newly

created positions of shift supervisor in the control center, where his duties involved

oversight of the controllers in their daily operation of the pipeline system. 

The shift supervisor reported that he was in good health generally and was not ill

on the day of the accident. He wears glasses and was wearing them during his shift on the

night of the accident. 

Recent Work Schedule. Colonial employs four shift supervisors, but only one is

working at any one time. Shift supervisors work 12-hour rotating shifts in synchronization

with the same group of controllers, so the supervisors work with the same team of people

each shift. The shift supervisor and the relief controller involved in this accident have

known each other and worked together on occasion since the relief controller began in the

control room in 1981, though they have not been a regular part of the same team before.

In the week before the accident, the shift supervisor was off duty on Wednesday

and Thursday, June 19 and 20. He then worked the day shift (7 a.m. to 7 p.m.) on Friday,

Saturday, and Sunday, June 21-23. He was off duty again on Monday and Tuesday,

June 24 and 25 and began the night shift (7 p.m. to 7 a.m.) on Wednesday, June 26, the

night of the accident.

The shift supervisor reported that he has no sleeping difficulties and normally

sleeps 5 to 6 hours during each sleep period regardless of the shift he works. In preparation

for his tour on a night shift, he said he stays up late the night before and sleeps late in the

morning to help acclimate himself to working at night and sleeping during the day.

Site Description

The accident occurred at a bend in the river around a sedimentary oxbow peninsula

extending from the west side of the Reedy River. The western river bank descended

gradually to the water, whereas the eastern bank was steeper. River water washing against

this “cut” bank eroded it at the pipeline crossing location. The river’s width varied
Factual Information 11

depending on precipitation; at the time of the accident, it was about 60 feet wide at the

accident location.

A Colonial employee told the Safety Board that the river was prone to flooding.

Located about 10 feet upstream of the pipeline were crushed car bodies that Colonial had

placed against the east river bank in 1975 to control erosion. Also visible were 10-inch-wide

sheet pilings that had been inserted in the river as part of the barrier Colonial had constructed

around the exposed pipeline in 1976. Other pilings were visible along both river banks.

According to Colonial officials, in 1978 Colonial constructed line No. 1 alongside

pipeline No. 2. The new line followed line No. 2 for most of its length, but at the Reedy

River, the company established and used a new right-of-way about 600 feet north of the

accident site. Colonial officials stated that they purchased the right-of-way so that the new

pipeline would cross the river in a location that was less susceptible to erosion and changes

in the river channel. 

Operations Information

Colonial operates the largest refined petroleum products pipeline in the United

States. The system consists of two parallel main pipelines running from the Gulf Coast

(Pasadena, Texas) to New York Harbor (Linden, New Jersey), passing through 12 States

en route. The pipeline that ruptured (line No. 2) is 1,056 miles long and has 45 pumping

stations with a pumping capacity of more than 40 million gallons per day from Pasadena

to Atlanta and more than 37 million gallons per day from Atlanta to Greensboro. All

pipeline operations are monitored and controlled from Colonial’s pipeline control center

in Atlanta.

Colonial, like many pipeline companies, controls its pipeline delivery operations

through a version of the SCADA system. SCADA systems use remote site sensor

information and computer hardware and software to provide information on the status of

the pipeline and its product flow. Several vendors offer generic SCADA systems, but a

pipeline company usually alters the commercially available system to meet its particular

wants and needs. Colonial used a Valmet, Inc., SCADA system that was installed in

October 1991 and customized for Colonial operations. 

The SCADA system for each line at Colonial included a controller’s work station

with six computer monitors. (See figure 3.) Directly in front of the controller were four

monitors arranged in a square of two on top and two on bottom, flanked by single

monitors on either side. Generally, the most critical information was displayed on the

monitors directly in front of the controller; however, the data available from the SCADA

system could be displayed in various screen formats and on various monitors. The number

of SCADA screens exceeded the number of monitors available to display them, and

controllers had some latitude in determining which screens to display. According to the

company, screen selections were based partly on operational needs and partly on the

individual preferences of the controllers.
Factual Information 12

One Colonial SCADA screen consisted of a strip chart that depicted pressure data

for each station over a time span of approximately 1 3/4 hours. The strip chart was on the

screen that the line No. 2 controller had displayed on his top monitors on the night of the

accident. 

Pressures could also be displayed on another screen, the real time nomograph

(RTN), which displayed pressure changes over a time span of 40 to 60 seconds. Because

of this shorter time span, the displayed pressure changes were more prominently displayed

on the RTN screen than on the strip chart screen. The controller in this accident said he did

not have the RTN screen displayed on any of his monitors at the time of the initial

pressure surge. 

The controller stated that, as was his usual practice, he had the “button box”17

displayed on one of his lower monitors and was using this screen to control pipeline

operations after the shutdown of deliveries to the Atlanta terminal. The button box, which

the controller used to turn pumps on or off, displayed pump status, including suction

pressure, case pressure, and discharge pressure, of the selected pump. The controller

stated that during the accident sequence his attention was focused primarily on the button

box rather than on the other screens at his console. 

17 Like the strip chart screen, the button box screen is a graphic representation of a device controllers had

used to operate the pipeline before the control system was computerized.

Figure 3. Work station from which controllers monitored and operated line No. 2
Factual Information 13

After the accident, the U.S. Department of Transportation’s (DOT’s) Office of

Pipeline Safety (OPS) contracted with General Physics Corporation to assess the

effectiveness and operation of the SCADA system in use at Colonial. See appendix B for

excerpts from that report.

Toxicological Information

Titles 49 Code of Federal Regulations (CFR) 199.11(b) and 199.225(a) require

postaccident drug and alcohol testing of each employee whose performance either

contributed to, or cannot be completely discounted as contributing to, an accident. The

relief controller was the only employee involved in this accident to receive toxicological

tests. At the direction of the operations team leader, the relief controller was tested for

drugs but not for alcohol. 

The operations team leader stated that shortly after the accident, he went to the

control center and was involved in activities related to the rupture. He said that an hour or

two after he arrived, he asked the shift supervisor to arrange for drug testing of the relief

controller. The shift supervisor responded that a specimen collection service was en route.

A urine specimen was obtained for drug testing at 5 a.m. on June 27, 1996, while the relief

controller was still in the control center. The specimen was tested by a certified testing lab

for the five families of drugs specified in the regulations. The results were negative. 

No attempt was made to obtain the breath or blood specimens necessary for

alcohol testing. The operations team leader did not specifically request that alcohol testing

be done. He said, 

Since we had not done any alcohol testing, I presumed that it was part of

the drug testing. I was not aware that it would have to be specifically

requested for postaccident.

Colonial provided to the Safety Board a copy of the company’s “Action Checklist”

dealing with drug and alcohol testing, which Colonial officials said was in effect at the

time of the accident. The checklist shows “Drug Test” and “Alcohol Test” in separate

columns, with both tests marked to be performed after a pipeline accident. In the

“Comments” section, the checklist states:

An alcohol test should be obtained within 2 hours of the event but no later

than 8 hours after the event. A letter of explanation must be sent to [the

drug program coordinator] if the alcohol test is not performed within 2

hours.

Other personnel in the control room at the time of the accident reported that they

did not observe anything that would indicate that the relief controller was under the

influence of alcohol. The relief controller stated that he did not regularly consume alcohol

and that he had consumed no alcoholic beverages before reporting to work on the day of

the accident.
Factual Information 14

Meteorological Information

The weather at the time of the accident, as reported by a surface weather

observation at Greenville-Spartanburg Airport, South Carolina, was overcast skies,

visibility greater than 10 miles, temperature 73°F, dew point 63°F, and winds eastnortheast at 6 knots.

Events Preceding the Accident

According to Colonial, since the mid-1970s, the company has taken a variety of

measures to correct or control erosion and corrosion problems associated with the Reedy

River crossing on line No. 2. In 1975, the company placed crushed car bodies along the

northeast bank to control erosion. In 1976, a barrier consisting of interconnecting steel

pilings driven into the river bottom was constructed around the pipeline to protect it from

floating debris. At the same time, the pipeline was recoated with tape.

In 1987, a “smart pig” (a magnetic flux internal inspection tool) was, for the first

time, run through the section of line No. 2 pipeline that included the Reedy River crossing.

According to Colonial officials, the inspection contractor noted an anomaly in the pipe at

the crossing location, but the anomaly was assessed as a dent that required no corrective

action. 

On March 7, 1996, another internal inspection was made of a pipeline segment that

included the river crossing. The inspection generated data that were then transcribed to

printed “field logs.” On March 12, 1996, an employee of the inspection contractor and a

Colonial project engineer examined the data from the March 7 inspection. The engineer

stated that the data indicated a corrosion problem at the Reedy River site. On March 13,

two Colonial employees went to the Reedy River site to visually inspect the pipeline. They

stated that they could see the pipe partially above the water. They said that the protective

coating that should have been on the pipe had been washed away by the river current. 

Based on the results of these inspections, Colonial began to plan for the replacement

of the corroded section of pipeline. The company hired a directional drilling consultant18 and

began building the access road that would be needed to bring heavy equipment to the river

crossing. Construction of the access road was begun on March 18, 1996, and was completed

9 days later. Replacement of the corroded pipe was expected to take 60 to 90 days. 

On March 29, 1996, Colonial’s operations team leader sent an e-mail message to

shift supervisors informing them that a corrosion problem existed upstream of

Simpsonville and that a temporary clamping repair19 would be made to the affected pipe.

The message advised, “until these repairs are made have the controllers run the line with

Simpsonville suction below 100 psi.”

18 The company determined that horizontal drilling (boring a horizontal hole and then pulling the pipe

through it) under the river would be more expeditious than conventional excavation and would make the

new crossing less susceptible to damage from corrosion or changes in the course of the river. 

19 A clamping repair involves temporarily tightening a large cylindrical metal clamp around the weakened section of pipe.
Factual Information 15

On April 1-4, 1996, a Colonial crew worked at the Reedy River crossing to effect a

temporary clamping repair of the corroded section of line No. 2. According to the

company, the instability of the piling structure forced the crew to abandon the attempt.

On April 4, 1996, a Colonial project engineer (one of the employees who had

visually inspected the pipe on March 13) went to the Reedy River site and used a handheld

ultrasonic testing device to take pipe-thickness measurements at the corroded section of

pipe. He said he walked out on the pipe 10 to 15 feet from the northeast shore and took

several readings from the top of the pipe, which was 6 to 12 inches below the surface of

the water. The measurements were taken approximately 2 feet southwest of the point at

which the pipe would later rupture. The pipe wall thickness at that location measured from

0.180 to 0.200 inch. The project engineer completed a safety-related condition (SRC) report

and forwarded it to Colonial management for approval and transmittal to the DOT. 

Colonial’s operations team leader sent an April 4, 1996, e-mail to shift supervisors

relating the problems encountered in the attempted temporary repair and forwarding the

pipe wall thickness measurements. The message addressed the operational measures that

needed to be observed to compensate for the weakness in the pipe at the river crossing.

The message stated that, based on the measured wall thickness of the pipe and until the

pipe could be repaired or replaced, 374 psig was the maximum allowable operating

pressure at the river crossing. The message reiterated the 100-psig suction pressure

restriction at Simpsonville. The message also stated that “controllers should pay special

attention to this area of pipe and take immediate action to minimize pressure surges in this

area.”

Colonial forwarded the SRC report to the DOT on April 9, 1996. The document

stated that an area of corrosion approximately 10 feet long was located at the Reedy River

crossing of line No. 2, that the pipeline pressure at the Reedy River crossing had been

reduced commensurate with the 0.180-inch pipe wall thickness at that location, and that the

pipe would be replaced as soon as possible. 

The Colonial hydraulics engineer was tasked with devising a safe method of

operating the corroded pipeline. He determined that the most likely scenario for exceeding

the calculated 374 psig pressure would be a power failure (pump shutdown) and subsequent

line blockage at the nearest downstream pumping station from the crossing, which was

Simpsonville. Using the parameters (provided by Colonial management) of 100 psig

maximum suction pressure at the Simpsonville station and a maximum 30,000 bph flow rate,

the engineer used the company’s transient flow modeling computer program to perform

several simulations. The hydraulics engineer sent an April 8, 1996, e-mail to the operations

team leader stating that:

If you absolutely want the pressure at [Reedy River] not to exceed 374 psig

in all cases, I would suggest that we temporarily lower the main line block

valve pressure switch at Simpsonville to 270 psig and not to run more than

5,000 hp at Simpsonville.
Factual Information 16

The operations team leader sent an April 9, 1996, e-mail to the shift supervisor

stating that:

In order to keep the pressure below the MOP [maximum operating pressure] at the Reedy River crossing, the suction pressure at Simpsonville was

restricted to 100 psig as of April 4, and the main line block valve pressure

switch setting there should be reduced.

The message stated that the valve pressure switches should be adjusted as soon as

possible and that “Simpsonville Station is limited to a maximum of 5,000 hp.” According to

the message, these restrictions were approved by Colonial’s vice president of operations and

would “remain in effect until the pipe has been replaced.”

The operations team leader contacted the hydraulics engineer and inquired about the

effects of increasing the flow rate through line No. 2 from 30,000 bph to 34,000 bph. The

engineer ran another flow model calculation and communicated the results in an e-mail

dated April 9, 1996. In the message, the hydraulics engineer suggested maintaining the

previous valve settings at Simpsonville and resetting the main line block valve at Gaffney

and the relief pressure setting at Spartanburg to ensure that the pressure at Reedy River

stayed below 374 psig. The message recommended that the proposed changes be

implemented immediately, “unless you find that [they] could cause some difficulty in

normal operations.” 

No evidence was found that Colonial took any specific measures to enforce the

restrictions or to monitor how well controllers adhered to them. A maximum suction

pressure alarm for the Simpsonville station was not installed to alert controllers or

supervisors when the suction pressure restriction was exceeded;20 shift supervisors were not

directed to specifically monitor the operation of line No. 2 to help ensure compliance; and

controllers were not directed to immediately report to supervisors any difficulties they noted

in adhering to the restrictions. 

On May 1, 1996, the operations team leader sent an e-mail to shift supervisors

informing them that “the line No. 2, Simpsonville Station pressure restriction issued on April

9, 1996, served to protect the Reedy River location at a flow rate of 30,000 bph” and that

the “flow rate will increase [effective] tonight to 34,000 bph.” The message stated that, to

ensure that the pressure at the Reedy River did not exceed 374 psig, “technicians must reset

certain pressure switch settings on mainline block valves, relief pressure valves, and notify

the supervisor when completed.” The message noted that these restrictions had been

approved by the vice president of operations and would remain in effect until the pipe could

be replaced. According to Colonial records, the valves and switches were reset in accordance

with these directions. 

During the following week, a shift supervisor (the same one who was on duty at

the time of the accident) raised the horsepower issue with the operations team leader. He

informed the operations team leader that the power optimization model used to determine

20 Such an alarm was installed after the accident.
Factual Information 17

the appropriate horsepower for each station showed that, with the increased flow rate of

34,000 bph, a total of 7,000 hp could be run at the Simpsonville station. The shift

supervisor said he asked the operations team leader if the 5,000-hp restriction was still in

effect and was told that controllers could run 7,000 hp at Simpsonville. The shift

supervisor said that, with the higher flow rates, the higher horsepower would allow a

lower operating pressure to be maintained through the corroded section of pipe. The

operations team leader did not consult the hydraulics engineer before authorizing the

removal of the 5,000-hp limit. 

On May 7, 1996, the shift supervisor modified the operations team leader’s e-mail of

April 9, 1996, and placed copies of the amended message on the line No. 2 SCADA system

console and the shift supervisor SCADA console. He crossed out the line that read, “This email also limits Simpsonville Station to a maximum of 5,000 horsepower,” and wrote

“DISREGARD” next to that line. He initialed and dated the e-mail message.

According to findings documented in the postaccident General Physics report

(appendix B), during the 15-day period preceding the accident, about 10 percent of the time,

Colonial controllers operated line No. 2 with suction pressure at Simpsonville greater than

100 psig. The shift supervisor stated that he was not aware that controllers had frequently

violated the 100-psig suction pressure at Simpsonville, and he said he did not know why

these violations had occurred. SCADA records show that, on the night of the accident, the

suction pressure at Simpsonville varied, but on several occasions prior to the rupture, the

pressure exceeded 100 psig. The shift supervisor said he was not aware that this had

occurred.

Other Information

Controller Training

At the time of the accident, controller training was coordinated and conducted by

shift supervisors and experienced controllers. Training for new and relief controllers was

on-the-job training, with no classroom or simulator training included. 

Vacancies for controller positions were normally filled by existing company

personnel. Candidates were brought to the Atlanta control center for 2 weeks of evaluation

by experienced controllers. During that time, they worked alongside controllers to observe

pipeline operations in a process designed to allow both controllers and candidates to

assess aptitude and interest in the job. After the 2-week period, selected candidates were

assigned as associate controllers and were entered into the training program outlined

below:

• Pipeline orientation (2 weeks);

• Controller orientation (2 weeks, or 4 weeks for new Colonial employees);

• Field training (2 weeks); and
Factual Information 18

• Pipeline control center (1 month per controller position, with a 4-month minimum).

The length of time associated with each step of the program varied depending on

the prior training and job experience of the trainee. The total training length was stated as

whatever was necessary for the trainee to become competent. The typical training length

was 6 months in the control room, not including the field training, if required. In the

pipeline control center phase, associate controllers received on-the-job training by being

paired with experienced controllers.

During the training period, associate controllers were given written reference

materials, which included manuals on operating pressure limits, hydraulics, and quality

control; a controllers’ operating guide; and emergency and contingency plans. They were

also given checklists to ensure that all the training areas were covered. Controllers

completed evaluation forms on associates moving from one line to another. The training

also included eight written tests. 

By the end of a typical 6-month training period, associate controllers should have

performed all required tasks in a satisfactory manner and should have performed them a

sufficient number of times to satisfy both their trainers and their shift supervisors that they

could successfully perform the duties of a controller on the line on which they had been

training.

According to the operations team leader, the controller trainers were selected

based on such factors as the controller’s ability to be patient with the trainee and to make

certain that the candidate had the knowledge, skills, and abilities needed to operate the

pipeline. He stated that the selection was also based on a controller’s interest in being a

trainer.

Controllers who trained relief controllers set up files with checkoff sheets for each

line used for training. When all the items had been addressed and the trainer controller

believed the relief controller had a full understanding of the operation of a particular line,

the trainer certified that the individual had been trained and was ready to work as a relief

controller on that line. This certification was forwarded to the shift supervisors for

approval.

Both associate and relief controllers were expected to learn to handle abnormal

conditions or emergency situations by reading the training guide and by observing and

having discussions with other controllers. The trainers followed a 3-page checklist of

topics containing 107 items in 17 areas. Controller trainers would check off the items that

an associate controller trainee either performed or discussed during each shift of the

training period. All items were covered by the end of training, and the controller trainee

would have taken eight tests (with true/false, multiple choice, and short answer questions)

by the end of the training period. Within the areas covered, four items addressed abnormal

operations and nine addressed emergency operations. Actual experience with such an

event would only occur if an associate or relief controller happened to be working on a

particular line at the time of such an event.
Factual Information 19

According to Colonial officials, in the past, controllers also had annual training

that consisted of a computer program that selected questions from the original eight

associate controller tests, along with some others, and re-presented them for review.

However, in the early 1990s the program was eliminated during several computer changes

and, at the time of the accident, it had not been replaced.

Additional training was also supplied by the shift supervisor, who oversees the six

controllers who are working at any given time. Part of the supervisor’s job is to spotcheck

operations of all of the controllers. During such times, the shift supervisor could observe

controllers’ activities and provide additional instruction as necessary. No specific

guidance was in place that required shift supervisors to conduct a comprehensive

observation of a full range of controller tasks and actions.

Finally, Colonial provided written job descriptions for many of its positions. Those

descriptions contained a series of essential functions ranked in order of importance. The

job descriptions for controller, associate controller, and relief controller all contained the

following essential function:

Monitors pressures and responds to alarms caused by abnormal situations.

Must know [“learn,” for associate controller] the correct response and

quickly execute to prevent emergency situations.

General Work Schedules for Controllers and Relief Controllers 

Since 1989, Colonial’s controllers have worked 12-hour forward-rotating shifts

with 2 or 3 days of work, followed by 2 or 3 days off. Relief controllers generally work

12-hour shifts as well. For scheduled replacement of regular controllers, such as during

vacations, relief controllers may know their schedules weeks in advance. For less

predictable reasons for controller absence, such as illness, less notification time is

available.

The operations team leader stated that the company attempts to give relief

controllers as much advance notice of duty time as possible so that they can come to work

rested. He stated that the company had a shared responsibility with workers to ensure that

controllers were well rested. He said that a person should not come to work if he is tired

and unable to function; however, once a relief controller has been notified of duty,

Colonial supervisors depend on the controller to inform them if he is not rested, or if for

any reason he should not report to work. The operations team leader said that no one is

forced to come to work, and an occasional absence would not be a problem.

The shift supervisor on duty at the time of the accident said that he visits with each

controller during each shift to discuss operations. He said that sleep activities often came

up in conversation, but that he also observes the controllers to detect any physical signs of

fatigue. He stated that the relief controller involved in this accident appeared to be rested

based on his general conversation and appearance. The supervisor added that he had never

had an occasion to send an employee home because he believed the employee was unfit

for duty.
Factual Information 20

Investigators also examined the work schedules for other Colonial operations

personnel and noted that the job description for the operations team leader included a

requirement that the incumbent “must be capable of working extended periods of time

(18-36 hrs) continuously while being able to think and write clearly.”

Colonial Guidance for Abnormal Procedures, Emergency Conditions, and 

Leaks

Procedures detailed in the “Abnormal Operations” and Emergency Operations”

sections of Colonial’s Operating Guide specifically address overpressure situations. The

relief controller signed a log sheet on the date of the accident, indicating that he had

reviewed the materials in the guide. The section states, in part:

6.2.3 LOSS OF A PUMP OR PUMP STATION [Emphasis in original]

Anytime a line is running at high pressure and a large unit shuts down, a

large unit is to be shut down at every upstream station that is within 100 psi

of maximum discharge pressure. If a small unit shuts down, then compensating action is to be taken with either size unit to prevent any excessive

pressures.

When a section of line is running at high pressures (within 100 psi of maximum discharge pressure) and all units at one of the high pressure stations

shuts down, immediately shut down the first upstream station, and initiate

the Multiple Station Shutdown function to shut down all other upstream

stations.

6.3.1.1 Increase in Pressure [Emphasis in original]

An unexpected increase in line pressure above normal operating limits is

indicative of a problem that requires immediate recognition and response

from the controller. Increases in line pressure are almost always the result

of some type of line blockage, such as a control valve or MLBV [main line

block valve] going closed (see Section 6.2 above). Additionally, delivery

takeoff valves, manifold valves and shipper valves can cause similar system responses.

As outlined in Section 6.2, immediately shut down the line if this situation

occurs in order to minimize pressure transients and surges on the line.

6.3.1.2 Decrease in Pressure 

A sudden, unexpected decrease in line pressure is indicative [of] a leak and

must be handled accordingly immediately. Refer to Section 7.3, ‘Leaks or

Suspected Leaks’ for specific action to be taken in the event of a leak. 

7.3 LEAKS OR SUSPECTED LEAKS [Excerpts] [Emphasis in original]

Due to the volume of product being handled and the high rates of flow in

the Colonial Pipeline System, it is urgent that immediate and proper action

be taken in response to a reported or suspected loss of product.
Factual Information 21

If there is doubt, the controller must never hesitate in shutting down the

line and isolating any section.

The following types of reports must be accepted as conclusive evidence of

a leak or puncture:

 (C) Sudden loss of pressure and/or change in flow rate

In the event of a confirmed leak, IMMEDIATELY SHUT DOWN AND

EVACUATE the line as follows:

A. The entire line upstream of a reported leak is to be shut down immediately and the line blocked at the first two upstream stations having

blocking capability (either remote line blocking or having local operator block). Downstream stations are to be operated at the maximum

flow rate possible until the section of line leaking has been pulled as

low as possible. Then the first two locations downstream from the leak

having blocking capabilities (either remote line blocking or having

local operator block) are to be blocked. If opening into a delivery facility will improve the evacuation of the section, it should be done as soon

as possible.

NOTE: Because remote blocking is not available at all locations, personnel

may have to be called out to the first two upstream and downstream stations to block the line. To minimize product loss, it is

imperative this action be taken immediately.

Colonial’s Emergency Response Manual also lists several reports that should be

accepted by controllers or operators as “conclusive evidence of a leak requiring the line be

shut down immediately.” One such report is “sudden loss of pressure and/or change in

flow rate.”

In the event of a confirmed leak, the manual directs the controller or operator to:

—Immediately shut down the affected line segment...

—Remotely close the appropriate block valves to isolate the affected line

segment or dispatch personnel to manually close the appropriate block

valves necessary to isolate the affected line section....

Colonial Actions Since the Accident

According to Colonial, since the accident the company has made a number of

safety-related improvements to its operation in the areas of pipeline inspection, corrosion

detection and repair, SCADA system operations, and operator training and evaluation.

Among the changes are the following:

Pipeline Internal Inspection. Since the accident, Colonial has inspected 3,640

miles of pipeline using a variety of internal inspection devices, as follows:

• 2,378 miles have been inspected using magnetic flux internal inspection

devices to detect corrosion and mechanical damage.
22

• 663 miles of pipeline have been inspected using deformation inspection

devices to detect dents and buckles.

• 567 miles of pipeline have been examined for longitudinal cracks using elastic

wave inspection devices.

• 32 miles of pipeline have been inspected using caliper tools to search for dents,

buckles, and out-of-round conditions.

Corrosion Detection and Repair. According to the company, the above

inspections have resulted in the reporting of approximately 4,000 anomalies. After

inspection, about 3,250 (81 percent) of these anomalies were within code and did not

require repair or replacement; about 750 were repaired with sleeves; and 28 sections of

pipeline containing anomalies were replaced with new pipe. Colonial told the Safety

Board that it has also made a commitment to improve its cathodic protection and corrosion

control systems by allocating, for 1998, $600,000 for cathodic protection systems and $6

million for recoating projects.

SCADA System Operations. Colonial said that it has made modifications and

enhancements to its SCADA systems that include updating the SCADA software and

adding the requirement that all operators of SCADA systems display the two RTN screens

at all times.

Operator Training and Evaluation. Colonial said that it has instituted enhanced

operations training for its controllers and modified the standard training programs. In

1997, controllers attended an 8-hour hydraulics class, and another such class is scheduled

for 1998. The company also initiated a “worst-case scenario” training module based on the

“Abnormal and Emergency Operation” sections of the Colonial Operating Guide.

Exercises in the module are timed and written. Each controller must work through 12 of

these exercises each year.

The company also has purchased a Stoner pipeline simulator and has established a

training program for controllers that is used to evaluate their responses both to normal and

abnormal conditions and to emergency operations of the pipeline. Controllers must

complete a structured 3-hour course by the end of 1998.

Colonial now requires that associate controllers receive skill checkoff procedures

and biweekly evaluations. Associate controllers also now receive worst-case scenario

training.
Analysis 23

Analysis

This analysis is divided into two main sections. In the first section, the Safety

Board reviews the accident itself, highlighting the actions and events that resulted in

problem conditions. The second section discusses the following safety issues that were

identified in this investigation:

• Effectiveness of Colonial’s operations management in ensuring that the pipeline is operated within safe pressure limits; 

• Adequacy of the training given to controllers and shift supervisors as it relates

to preparing them to recognize and effectively respond to abnormal conditions,

emergency situations, and leaks in the pipeline; and

• Effects of Colonial’s controller work schedules on safe pipeline operation.

Accident Discussion

Colonial became aware in March 1996, more than 3 months before the accident, that

a serious corrosion problem existed in the segment of its No. 2 pipeline that crossed the

Reedy River. Based on the remaining wall thickness of the pipe (measured as 0.180 inch),

the company hydraulics engineer calculated that, if pumping power at the Simpsonville

station (the pump station immediately downstream of the river crossing) were limited to

5,000 hp or less and suction pressure were held to the specified 100 psig or less, the

weakened pipe would maintain its integrity even in the projected worst-case scenario. 

Based on this information, Colonial management directed that certain pressure

switches and control valves be adjusted so that the Simpsonville station could be operated

within the parameters established by the hydraulics engineer to protect the corrosionweakened section of pipe. These directives were approved by Colonial’s vice president of

operations and transmitted, through the operations team leader, to all shift supervisors and,

through them, to all controllers and relief controllers.

As determined from SCADA records, however, controllers did not always maintain

both the prescribed 100-psig suction pressure and the 5,000-hp limits at Simpsonville. The

shift supervisor informed the operations team leader that the power optimization program

showed that, with a flow rate of 34,000 bph, 7,000 was the recommended horsepower for

Simpsonville, and he asked the operations team leader if the 5,000-hp restriction remained in

effect. The operations team leader, without consulting higher management or the hydraulics

engineer, told the shift supervisor that the 5,000-hp restriction at Simpsonville could be

removed.

Apparently, the operations team leader did not recognize that, if the hydraulic

engineer’s calculations were correct, running 7,000 hp at Simpsonville could subject the
Analysis 24

corroded pipe to overpressure in the event of a shutdown and subsequent line blockage at the

Simpsonville station. This potential safety problem, which went unnoticed so long as the

pipeline operated normally, became critical during the abnormal operations on the night of

the accident. 

The accident sequence began with the shutdown of fuel oil delivery to the Atlanta

terminal at 11:45:30 on June 26, 1996. To handle the increased volume of fuel oil now

moving through the pipeline, the controller began sequentially increasing pumping power at

downstream pumping stations. He increased operating horsepower at Smyrna and proceeded

through Dacula, Danielsville, Anderson, and Simpsonville. Because the horsepower

restriction had been lifted at Simpsonville and pressure was building upstream, the controller

increased pumping power at Simpsonville to 7,000 hp. At that point, the overpressure

protection that had been devised for the Reedy River crossing was no longer in place.

After increasing pumping power at Simpsonville and Gaffney, the controller moved

to Gastonia, where he made the mistake that would lead, a few minutes later, to the pipeline

rupture. The controller commanded a 5,000-hp pumping unit to start at Gastonia. Without

checking the SCADA pressures to confirm that the pump had, in fact, started, he moved, a

few seconds later, to shut down the 2,000-hp unit that had been running at Gastonia until that

time. The 5,000-hp unit had not started, and shutting down the smaller unit left no pumps on

line at Gastonia, which created a pressure surge that traveled back upstream.

Unaware that a dangerous pressure surge was moving toward Gaffney, the controller

directed his attention to the Kannapolis station, where he attempted to start additional pumps

to compensate for the shutdown of deliveries to the Charlotte terminal. Only after the

controller had turned his attention to the Kannapolis station did he notice that no pumps were

operating at Gastonia. At that point, if he had fully understood the critical nature of the

situation, he may have chosen to shut down the pipeline. In fact, Colonial policy in the event

of a shutdown of a pumping station during high-pressure operations was to immediately shut

down the first upstream station, then initiate a multiple station shutdown. Instead, the

controller attempted to bring pumps back on line at Gastonia. By then, however, the surge

was already approaching Gaffney and was within a few seconds of shutting down the pumps

there. The shutdown of Gaffney would start another surge back toward Simpsonville and the

Reedy River, and nothing the controller could do at Gastonia could alleviate the rapidly

developing hazardous situation upstream.

Because of the pressure surge from Gaffney, the station pumps at Simpsonville shut

down. Within seconds, the pressure surge from Simpsonville reached the Reedy River

where, because the operational limitations that were intended to protect the river crossing

had not been observed, the pipe was subjected to pressures beyond its calculated operating

limit. The pipe ruptured, releasing fuel oil into the river.

The controller did not immediately recognize that a leak had occurred, even though

the SCADA alarms and alarm messages that would signal a leak were activated, and he

quickly acknowledged them. As a result of the delay in recognizing that a leak had occurred,

several minutes elapsed from the time of the rupture until the first actions were taken to shut

down the pipeline.21 This delay resulted in additional product being released into the river.
Analysis 25

Colonial Actions With Regard to the Reedy River Crossing

Pipe Thickness Measurements

On April 4, 1996, a Colonial project engineer took pipe-thickness measurements at

the corroded section of pipe across the Reedy River. The pipe wall thickness measured from

0.180 to 0.200 inch. The engineer’s measurements were made under difficult conditions,

with the pipe segment submerged, but they clearly indicated the presence of substantial

corrosion. Based on this information, Colonial immediately began to plan a temporary

repair, to be followed by replacement of the pipe section. In the meantime, however, the

company planned to keep the affected section of pipe in service, with operating restrictions. 

As determined by postaccident inspection of the ruptured pipeline, pipe thickness at

the point of rupture was 0.069 inch, or less than one-half the thinnest measurement that was

taken by the project engineer and that became the basis for the operating restrictions placed

on this segment of the pipeline. The Safety Board concludes that the efforts of Colonial’s

project engineer to measure pipe thickness at the Reedy River crossing were insufficient and

did not accurately reveal the full extent of the corrosion damage and thus did not provide the

company with accurate data on which to base corrective measures.

Operational Restrictions

Colonial, once it became aware of the corrosion damage at the Reedy River crossing,

immediately made plans to replace the defective pipe. The replacement, however, would be

a major construction project that was expected to take up to 3 months to complete. During

the interim, the company placed operating restrictions (consisting of altered pressure valve

and switch settings and a 100-psig suction pressure/5,000-hp limit at Simpsonville) on line

No. 2 that were intended to protect the corrosion-weakened section of pipe by limiting the

maximum pressure to which it might be subjected during an abnormal condition. The

restrictions were approved by the vice president of operations and transmitted through

official company channels to all affected employees. The Safety Board investigation

determined that all controllers and shift supervisors responsible for operating line No. 2 were

aware of the restrictions.

Less than 1 month after the restrictions were put in place, the operations team leader

authorized raising the 5,000-hp limit at Simpsonville to 7,000. The Safety Board is

concerned about this change and the manner in which it was made. The recommendations of

the hydraulics engineer had specified both a suction pressure limit and a horsepower limit at

Simpsonville. If horsepower were to be increased beyond the specified 5,000, other changes

may have been necessary to keep the combined pressure and throughput at a level that, in a

worst-case scenario, would not result in a pipe failure at Reedy River. No such reevaluation

was made, however. Nor was evidence found to indicate that those involved in this decision

to run 7,000 hp had brought the issue to the attention of higher level management so that

ways other than increasing operating horsepower might be found to maintain safe operating

conditions at Simpsonville. 

21 Even then, the pipeline was not being shut down because of the leak (which was not confirmed until

more than 30 minutes later) but because of high pressures elsewhere in the line.
Analysis 26

The original restrictions had been approved by the vice president of operations, but

that individual was not involved in the decision to alter them. Instead, the operations team

leader removed the horsepower restriction without the knowledge of the vice president of

operations and without benefit of a thorough analysis of the change or its implications for

safe operation of the pipeline. The Safety Board concludes that technical input was not

sought and the appropriate levels of management were not involved in the decision to

disregard the 5,000-hp limit at the Simpsonville pumping station, with the result that

safeguards designed to protect the corroded section of pipeline were bypassed.

For almost 2 months before the accident, Colonial operations management allowed

line No. 2 to be operated without the 5,000-hp restriction at Simpsonville. Further, in the 2

weeks preceding the accident, suction pressure at Simpsonville was allowed to exceed 100

psig about 10 percent of the time. Absent an abnormal shutdown of the Simpsonville station

or another station downstream of the Reedy River crossing, the pipeline could be operated

without incident. During the period when the restrictions for Simpsonville were not being

observed, however, any shutdown of the Simpsonville station during abnormal conditions

could have precipitated the failure of the pipe at the Reedy River. 

Colonial management, after issuing directives to address the potential hazard at the

river crossing, did not effectively monitor pipeline operations to determine if the directives

were practicable or were being observed. The Safety Board therefore concludes that

Colonial management failed to take the necessary measures to ensure that its line No. 2 was

operated in a manner consistent with the restrictions placed on the line to prevent a failure in

the corrosion-damaged pipe segment across the Reedy River. 

The ease with which operating restrictions on the Simpsonville station were

removed indicates that a more methodical decisionmaking process that is firmly based on

an analysis of operating parameters should be institutionalized within Colonial. The

Safety Board therefore believes that Colonial should develop and implement management

procedures requiring that proper engineering or hydraulic evaluation and analysis be

performed before changes are made to line operating parameters that have been set by

company management.

Controller’s Actions During the Accident Sequence

The first pressure surge was created when the controller shut down the 2,000-hp

pump at Gastonia, leaving that station with no pumps on line. Had the controller used

available SCADA data, he would have known that his attempt to start a 5,000-hp pumping

unit at that station had failed, and he would not have shut down the only operating unit.

With the 2,000-hp unit still running, he could have started one of the other pumps

available at Gastonia, or he could have initiated a shutdown of the pipeline. In either case,

a critical pressure surge would not have been sent upstream, and the pipeline across the

Reedy River probably would not have ruptured. 

In this accident, the controller had strip charts displayed on his upper monitors, but

he did not have the RTN displayed on any monitor. Because of its configuration, the RTN

display screen is more likely than the strip chart screen to alert the controller to unusual or
Analysis 27

unexpected pressure changes in the pipeline. Colonial apparently believes the RTN screen

is an essential tool for the controller, because the company, since the accident, has

mandated that the RTN screen be displayed on one of the control console monitors at all

times. 

Even had it been displayed, the RTN screen may not have benefited the controller

during the accident, because during his initial responses to the shutdown of deliveries to

the Atlanta terminal, he was focusing almost exclusively on the button box display he was

using to control pumps. Pressure readings on the button box itself should have alerted the

controller that the pump he had attempted to start at Gastonia had not started, but the

controller did not note the pressure readings before he shut down the only operating

Gastonia pump and moved to the next downstream station. The Safety Board therefore

concludes that sufficient information was available to the controller to make him aware of

the equipment failure at the Gastonia station, and if the controller had made use of the data

and responded appropriately, the accident may have been prevented. 

The Safety Board acknowledges that the operating conditions along line No. 2 at

the time of the accident, in combination with the corroded Reedy River crossing, left little

margin for controller error. When deliveries to the Atlanta terminal were closed out, the

controller had to perform a series of operations in a certain sequence and within a brief

period of time to prevent an over-pressure condition from occurring somewhere

downstream of Atlanta. Because of the weakened pipe at Reedy River and the pressures

that were being run in the system, any error in operating the pipeline could have serious

consequences. Such an error was the inadvertent shutdown of the Gastonia station. 

When the controller became aware that the Gastonia station was down, he

immediately attempted to start a pump there. The action specified in Colonial’s operations

manual for such an event would have been to immediately begin shutting down the line

using the multiple station shutdown procedures. This action may not have prevented the

accident; however, at the very least, shutting down the pipeline at that time may have

reduced the amount of product that was eventually released, thereby reducing the amount

of environmental damage. 

Even after the Gaffney and Simpsonville stations shut down automatically because

of high discharge pressure, the controller did not initiate a shutdown of the pipeline. At the

direction of the shift supervisor, who issued the order because of high pressures upstream of

the Anderson station, the controller started a pump at Anderson, which delivered even more

fuel to the ruptured section of pipe. A pipeline shutdown was not initiated until after the

relief controller had notified the shift supervisor of problems on the line and the two men had

discussed the situation. The shutdown was not initiated until about 3 1/2 minutes after the

rupture. The Safety Board concludes that the controller’s failure to independently effect an

earlier shutdown of the pipeline contributed to the amount of product lost from the ruptured

pipe.
Analysis 28

Shift Supervisor’s Actions During the Accident Sequence

The shift supervisor arrived at the controller’s SCADA console shortly after the

Simpsonville station had shut down and about the time the rupture occurred. The shift

supervisor had not been monitoring activities along the line and was not aware of the various

pumping station shutdowns that had already occurred downstream of Simpsonville. His first

indication of the nature of the controller’s problems was the controller’s statement that he

was not able to bring pump units on line at Simpsonville. After a quick assessment of the

situation, in particular the high pressures in the pipeline, the shift supervisor and the

controller initiated a shutdown of the pipeline. About the same time, the shift supervisor

noticed the high pressures upstream of the Anderson station. Concerned about a possible

pipeline failure upstream of Anderson, he directed that the controller start a pump at the

Anderson station. He was not aware that the rupture had already occurred at the Reedy River

and that turning on pumps at Anderson would add to the amount of product released. 

While the controller was shutting down the pipeline, the shift supervisor focused on

the Simpsonville station. He said he believed a power failure had occurred there. He said he

came to this conclusion because he believed that the SCADA system was not showing the

correct status for the Simpsonville station. Also, he was initially unable to establish backup

telephone data communication with the station, which he said would also indicate a power

failure. Even though suction pressure readings at Simpsonville were registering negative

numbers, which could have indicated a leak, he did not believe the numbers were valid

because of the perceived power failure. Only after he successfully established backup data

communication did he realize that the readings he had been receiving had been correct. 

The shift supervisor was aware that the negative suction pressure readings at

Simpsonville—now confirmed to be correct—could indicate a leak in the pipeline. In fact,

according to Colonial’s Emergency Response Manual, a sudden loss of pressure is to be

considered “conclusive evidence” of a leak. The shift supervisor was also aware of the

corroded section of pipeline at the Reedy River crossing. Yet he did not immediately block

the line in the location of the possible leak. Instead, he called out a technician to physically

check the Simpsonville station. When the technician reported from the station that power

had not failed and that the pumps were drawing a vacuum, the shift supervisor said he

“pretty much knew” that a leak had occurred. Still, he did not attempt to isolate the most

likely rupture location, electing instead to send the technician to check the pipeline at the

Reedy River crossing. Only when the technician called to confirm that oil was indeed

escaping from the pipeline did the shift supervisor initiate action to block the line and to

activate Colonial’s spill response plan. This delay in blocking the pipeline section after

shutdown increased the amount of product that escaped.

The Safety Board is concerned that the shift supervisor did not act immediately to

isolate the section of pipeline upstream of Simpsonville when he noted the negative suction

pressure at that station. Instead of assuming that a leak had occurred, which the company

emergency procedures required, he took several time-consuming steps to positively confirm

the leak before he took action. The Safety Board concludes that neither the relief controller

nor the shift supervisor acted in accordance with established company procedures in dealing
Analysis 29

with the emergency at the Reedy River and that, had they done so, the consequences of the

accident would have been less severe.

Controller Training for Emergency Situations

According to Colonial, prior to the accident, controllers learned to recognize and

handle abnormal conditions or emergency situations by reading the training guide and

having discussions with other controllers. Actual experience with such an event (for

example, a leak or high pressure in the pipeline) would only occur coincidentally, if an

associate or relief controller happened to be working on the involved line at the time of the

event. Yet the job descriptions for both regular and relief controllers at Colonial state that

the employee:

monitors pressures and responds to alarms caused by abnormal situations.

Must know [“learn,” for associate controller] the correct response and

quickly execute to prevent emergency situations.

None of Colonial’s controllers, unless they had had the occasion to recognize,

analyze, and respond to an actual abnormal condition or a leak, would have gained the

experience necessary to ensure that they could respond appropriately to subsequent

emergency situations. Although this relief controller had previously experienced a leak,

pressure surges, and pumps that failed to operate while he was operating line No. 1, he did

not react properly to the conditions on line No. 2 on the night of the accident. In this

incident, he mistakenly shut down the Gastonia station, then attempted to keep the line

running even while high pressures were being recorded at many locations, relief valves

were opening, and numerous alarms were being reported by the SCADA system. 

During a pipeline emergency, only minutes—in some cases, much less time—are

available for the controller to make the right decision and take the appropriate actions.

Ensuring that controllers and, sometimes, supervisors respond appropriately in this

high-stress environment requires intense training reinforced by frequent drills or

exercises. Because Colonial’s controller training program prior to this accident did not

included such training and drills, the Safety Board concludes that the training provided by

Colonial to its shift supervisors and pipeline controllers before the accident was

inadequate to prepare them to respond properly and in a timely fashion to abnormal

conditions and pipeline emergencies.

The Safety Board notes that, since the accident, Colonial provided information to

indicate that it has improved operations training and emergency procedures training for its

controllers and has purchased a simulator to better prepare controllers to respond to

abnormal and emergency conditions along the pipeline.

Relief Controller Training and Experience on Line No. 2

The relief controller had been working as a controller for approximately 15 years

prior to the accident. His pipeline operations experience included more than 7 years

operating less complex and demanding stub lines. After being promoted, he operated a

main line (line No. 1) for 8 years. Line No. 1 has fewer pumping stations and different
Analysis 30

operating characteristics than line No. 2. Although the controller said he had experienced

both failed pumps and pressure surges in the operation of line No. 1, his operation of that

line and his training in general apparently did not adequately prepare him for the operation

of line No. 2. Adding a further complication to the operation of that line was the

corrosion-weakened section of pipe at the Reedy River. 

Colonial has recognized the need for increased training for all of its controllers

and, since the accident, has increased required training on each line to 80 hours.

Employee Training in the Pipeline Industry

The Safety Board has long been concerned about the issue of training in all

transportation modes, including pipelines, and has made numerous training-related

recommendations to pipeline operators. Additionally, as a result of its investigation of a

November 1996 fatal pipeline accident in San Juan, Puerto Rico,22 the Safety Board made

the following safety recommendation to the Research and Special Programs Administration

(RSPA):

P-97-7

Complete a final rule on employee qualification, training, and testing standards within 1 year. Require [pipeline] operators to test employees on the

safety procedures they are expected to follow and to demonstrate that they

can correctly perform the work.

In a July 8, 1998, letter, RSPA responded that it had established a negotiated

rulemaking committee, composed of persons who represent the interests affected by the

qualification rule, to develop a new notice of proposed rulemaking (NPRM) on operator

personnel qualifications. RSPA also reported that, under the proposed new regulation,

pipeline operators will be required to prepare a written qualification plan, to identify

covered operations and maintenance tasks, and to ensure that employees are fully

qualified to perform safety-related activities on liquid pipelines. 

On October 27, 1998, RSPA issued the NPRM with the stated intent of ensuring a

qualified workforce and to reduce the probability and consequence of incidents caused by

human error. If implemented as described, the new rule will address many of the training

issues that were identified in this and previous pipeline accidents investigated by the

Safety Board. The Safety Board is reviewing the NPRM and will provide comments as

appropriate.

Controller Fatigue

The relief controller’s work shifts on the day before and the day of the accident

represent an “inverted schedule” that may cause circadian rhythm desynchronization. His

work shift on the day of the accident was 12 hours out of phase with the shift he had

worked the day before and with the sleep/wake cycle he had been accustomed to for the

22 Pipeline Accident Report—San Juan Gas Company, Inc./Enron Corp. Propane Gas Explosion in San

Juan, Puerto Rico, on November 21, 1996 (NTSB/PAR-97/01).
31

previous 5 days. The day before the accident, the relief controller’s work day ended at 7

p.m. On the day of the accident, his shift began at that time and was scheduled to end at 7

a.m. the following day. Such a dramatic change of work shift is likely to cause fatigue.

Fatigue may also have been exacerbated by the relief controller’s having been awake for

almost 17 hours at the time the accident occurred.23 In any case, the relief controller could

have been suffering from fatigue despite the 8 to 9 hours of sleep he said he got the night

before. As noted previously, during the 5 nights prior to the accident, the relief controller

had been asleep at the time of day that the accident occurred. The Safety Board therefore

concludes that fatigue resulting from the relief controller’s inverted work schedule may

have affected his alertness, vigilance, and responsiveness during the accident sequence.

The Safety Board is also concerned about the potential for fatigue with the rotating

schedules for pipeline controllers. In an operating environment that demands prolonged

periods of continuous vigilance, the potential impact of fatigue on controllers must be

carefully assessed. Circadian clocks can be reset to accommodate work shift changes, but

the necessary physiological adjustment does not occur quickly. The adaptation may take

from days to weeks; some research indicates an adaptation rate of about 1 hour per day.24

Studies have shown that shift workers who rotate schedules that include night

shifts are especially prone to fatigue on both the first and second nights of the work week.

The slow adaptation process highlights the importance of addressing circadian rhythms in

scheduling for 24-hour operations. An employer’s schedule for changing shifts must

incorporate sufficient time for the employee to adapt the circadian rhythms. 

In the view of the Safety Board, a comprehensive assessment has not been made of

the potential safety risks posed by rotating shifts for pipeline controllers. Because such

shift schedules are common in the pipeline industry, the Safety Board believes that RSPA

should assess the potential safety risks associated with rotating pipeline controller shifts

and establish industry guidelines for the development and implementation of pipeline

controller work schedules that reduce the likelihood of accidents due to controller fatigue.

This assessment should incorporate the extensive body of scientific knowledge that exists

concerning fatigue, sleep, and circadian physiology as they relate to work/rest schedules. 

One indication that Colonial had not adequately considered the potential for

fatigue to adversely affect safety was the company’s job description that stated that the

operations team leader must be able to work “extended periods of time (18-36 hrs)

continuously while being able to think and write clearly.” Such a requirement is not

scientifically valid. The Safety Board believes that Colonial should assess the potential

safety risks associated with the company’s controller and relief controller rest/work

schedules and modify, as necessary, those schedules to ensure that controller performance

is not compromised by fatigue. 

23 Determining the relief controller’s prior wakefulness was problematic because he could not recall

whether he had napped before going to work on June 26.

24 Wever, R., “Phase Shifts of Human Circadian Rhythms Due to Shifts of Artificial Zeitgebars,” Chronobiologia 7, 1980, pp. 303-327.
Analysis 32

Postaccident Drug and Alcohol Testing

The relief controller was the only employee toxicologically tested after the

accident. At the direction of the operations team leader, through the shift supervisor, the

relief controller was tested for drugs, but not for alcohol. The operations team leader said

that breath or blood samples (for alcohol testing) were not obtained because he believed

that such testing would be part of the regular drug test and thus did not specifically request

it. The drug and alcohol test checklist provided by Colonial clearly indicated that drug

testing and alcohol testing were considered by the company to be separate tests. The form

also indicated that both tests were to be performed after a pipeline accident. 

The investigation of this accident found no evidence that the relief controller may

have been impaired by alcohol on the night of the accident, and the controller told

investigators that he had not consumed any alcohol before reporting to work. Nonetheless,

because Colonial officials did not follow established company procedures and conduct

postaccident alcohol testing, neither the Safety Board nor Colonial could empirically

determine that alcohol did not play a role in the accident or in the response to it. The

Safety Board concludes that the failure of Colonial to perform postaccident alcohol testing

indicates that the company did not effectively communicate to all its operating personnel

and managers that postaccident tests must include testing for drugs and alcohol and that

both tests must be specified. 

The Safety Board believes that Colonial should review its drug and alcohol testing

program and ensure that all operating employees and managers are familiar with the

program and program requirements, to include the distinction between tests for alcohol

and tests for other drugs.
33

Conclusions

Findings

1. The efforts of Colonial’s project engineer to measure pipe thickness at the Reedy River

crossing were insufficient and did not accurately reveal the full extent of the corrosion

damage and thus did not provide the company with accurate data on which to base corrective measures.

2. Technical input was not sought and the appropriate levels of management were not

involved in the decision to disregard the 5,000-hp limit at the Simpsonville pumping station, with the result that safeguards designed to protect the corroded section of pipeline

were bypassed.

3. Colonial management failed to take the necessary measures to ensure that its line

No. 2 was operated in a manner consistent with the restrictions placed on the line to prevent a failure in the corrosion-damaged pipe segment across the Reedy River.

4. Sufficient information was available to the controller to make him aware of the equipment failure at the Gastonia station, and if the controller had made use of the data and

responded appropriately, the accident may have been prevented.

5. The failure of the controller operating line No. 2 to independently effect an earlier

shutdown of the pipeline contributed to the amount of product lost from the ruptured

pipe.

6. Neither the relief controller nor the shift supervisor acted in accordance with established

company procedures in dealing with the emergency at the Reedy River and, had they

done so, the consequences of the accident would have been less severe.

7. The training provided by Colonial to its pipeline controllers and shift supervisors

before the accident was inadequate to prepare them to respond properly and in a timely

fashion to abnormal conditions and pipeline emergencies.

8. The failure of Colonial to perform postaccident alcohol tests indicates that the company did not effectively communicate to all its operating personnel and managers that

postaccident tests must include testing for drugs and alcohol and that both tests must

be specified.

9. Fatigue resulting from the relief controller’s inverted work schedule may have

affected his alertness, vigilance, and responsiveness during the accident sequence.

Probable Cause

The National Transportation Safety Board determines that the probable cause of

the rupture of the corrosion-weakened pipeline at the Reedy River crossing was the failure
Conclusions 34

of Colonial Pipeline Company (1) to have adequate management controls in place to

protect the corroded pipeline at the Reedy River crossing; and (2) to ensure that pipeline

controllers were adequately trained to both recognize and respond properly to operational

emergencies, abnormal conditions, and pipeline leaks. 
35

Recommendations

As a result of its investigation of this accident, the National Transportation Safety

Board makes safety recommendations as follows:

to the Research and Special Programs Administration:

Assess the potential safety risks associated with rotating pipeline controller

shifts and establish industry guidelines for the development and implementation of pipeline controller work schedules that reduce the likelihood of

accidents attributable to controller fatigue. (P-98-30)

to Colonial Pipeline Company:

Develop and implement management procedures requiring that proper

engineering or hydraulic evaluation and analysis be performed before

changes are made to line operating parameters that have been set by company management. (P-98-31)

Assess the potential safety risks associated with your controller and relief

controller rest/work schedules and modify, as necessary, those schedules to

ensure that controller performance is not compromised by fatigue.

(P-98-32)

Review your drug and alcohol testing program and ensure that all operating

employees and managers are familiar with the program and program

requirements, to include the distinction between tests for alcohol and tests

for other drugs. (P-98-33)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALL

Chairman

JOHN A. HAMMERSCHMIDT

Member

ROBERT T. FRANCIS II

Vice Chairman

JOHN J. GOGLIA

Member

GEORGE W. BLACK, JR.

Member

Adopted: November 4, 1998

37

Appendix A

Investigation

Colonial Pipeline Company notified the National Transportation Safety Board on

June 27, 1996, that a Colonial pipeline had ruptured in the Reedy River at Fork Shoals,

South Carolina. The Safety Board dispatched a pipeline operations investigative team to

the accident site and to Colonial’s pipeline control center in Atlanta, Georgia.

Hearings and Depositions

The Safety Board did not conduct a public hearing for this accident. Depositions

were taken by Safety Board staff on March 18-20, 1997.
this page intentionally left blank
39

Appendix B

Excerpts from General Physics Postaccident Report on Colonial’s Supervisory Control and Data Acquisition (SCADA) System

The U.S Department of Transportation’s Office of Pipeline Safety contracted with

General Physics Corporation to assess the effectiveness and operation of the SCADA system

in use at Colonial Pipeline Company. The study identified a number of concerns:

[T]he graphical display of the RTN model does provide a good display of

system pressures which if used would assist in early recognition of a pipeline rupture.

Some screens are better suited for use under specific operating conditions.

Controllers may or may not be selecting optimal screens for monitoring the

system, a consideration which becomes critical in an emergency.

In some cases, the controller may use multiple screens to perform one

action, which complicates the interface process.... Rather than simply

reproducing historical physical equipment (e.g., Strip Chart Recorders and

Button Box) as a SCADA display, it may be possible to better organize

data for controller use.

Actual information transmitted in training is not documented beyond references to the Operating Guidelines, the Hydraulic Manual, etc. Without

more documented structure, actual training received may tend to differ in

terms of scope and quality depending on the OJT trainer: individual likes

and dislikes regarding SCADA screens, individual perception of system

operation and how to evaluate SCADA data, etc. All can vary.

Little emphasis is given to emergency training. Training in evaluating data

on the SCADA screen, including evaluating SCADA displays under abnormal conditions - a key factor in the Reedy River incident - is not called out

specifically in the OJT checklist. How training in abnormal conditions and

emergency response is handled is not clear from training documentation.

Colonial Pipeline is probably above average in training. However, general

industry standards are inadequate. Colonial Pipeline’s training and qualification, especially with regard to emergency operation, were inadequate to

ensure that personnel involved in the Reedy River incident could successfully respond to the event.

Manuals to supplement OJT lack specific discussion of what can go wrong,

why it can go wrong, and how abnormal conditions would be recognized.

For example, Hydraulics & Pumps discusses the basic “facts” such as how

pumps operate and the definition of water hammer. The manual does not

bring the facts together, however, in terms of what the information means

in dynamic operations or under emergency conditions in Colonial Pipeline’s system. This must be inferred.
Appendix B 40

Training does not systematically incorporate ‘lessons learned.’ After an

emergency occurs on the system, controllers may gather informally to discuss it or view a replay. However, discussion is confined to those who happen to be present at the time.

The events leading to the Reedy River incident began when the controller

closed out the Atlanta delivery and...pressures [began increasing] downstream.

Had more data points on the SCADA display been examined at key points

in the course of the event - looking more closely at changes in pressures at

surrounding pump stations - the loss of pressure at Simpsonville may have

been detected. In addition, had the Controller chosen to display the

SCADA RTN screen, the rupture may have been more evident.

The SCADA displays used were not optimal for recognizing, assessing,

and responding to abnormal conditions.

Critical human issues involved in this event include:

Focusing on a few parameters instead of using the SCADA displays to

accurately interpret and assess equipment and system conditions via multiple data points.

Failing to recognize the point at which the line should be shut down.

The controller continued to try to save the line through manipulation of

pumps.

Attributing indications of a leak to other problems. Colonial Pipeline’s

Operating Guidelines state that a sudden, unexpected decrease in line

pressure is indicative of a leak and must be handled accordingly. However, in the Reedy River incident, the Controller and the Shift Supervisor attributed the pressure loss to AC power loss/station

communication loss with Simpsonville.

It should be noted that fatigue may possibly have contributed to the incident. The controller had worked the day before the incident and was starting the midnight shift at the time of the incident.

A review of the operating pressure data provided by Colonial Pipeline

Company showed that during a 15 day period preceding the incident several Controllers (including the controller on duty during the incident) routinely violated the 100 psig maximum suction pressure limit at the

Simpsonville Station. Operation was conducted above the 100 psig limit

for long periods of time (one period was 10 hours and 38 minutes) and at

pressures as high as 175 psig. The periods of operation above 100 psig

account for more than 10% of the total operating time.