PB96-917002

NTSB/SIR-96/02

NATIONAL

TRANSPORTATION

SAFETY

BOARD

WASHINGTON, D.C. 20594

PIPELINE SPECIAL INVESTIGATION

REPORT

EVALUATION OF ACCIDENT DATA AND FEDERAL

OVERSIGHT OF PETROLEUM PRODUCT PIPELINES

//’”

./”

//.../”

6641

)
Abstract: Between December 1991 and March 1993, the Colonial Pipeline Company had two

petroleum product pipeline ruptures. Because the accidents raised safety issues applicable to the

entire pipeline system, the National Transportation Safety Board conducted a special

investigation on petroleum product pipelines. This report reviews the efforts of the U.S.

Department of Transportation’s Research and Special Programs Administration (RSPA) to

implement Safety Board recommendations concerning the safety of petroleum product pipelines.

The report also examines RSPA accident data for such pipelines. The safety issues examined are:

RSPA's responsiveness to implement previous safety recommendations addressing the

prevention of excavation damage, the control of corrosion damage, the inspection and testing of

pipelines, and methods to more rapidly detect, locate, and shut down failed sections of a pipeline;

RSPA's collection and analysis of accident data for petroleum product pipelines to identify

accident trends and evaluate operator performance; and the safety performance of the Colonial

Pipeline Company. As a result of the investigation, the Safety Board issued one recommendation

to RSPA.

The National Transportation Safety Board is an independent Federal agency dedicated to

promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety.

Established in 1967, the agency is mandated by Congress through the Independent Safety Board

Act of 1974 to investigate transportation accidents, determine the probable causes of the

accidents, issue safety recommendations, study transportation safety issues, and evaluate the

safety effectiveness of government agencies involved in transportation. The Safety Board makes

public its actions and decisions through accident reports, safety studies, special investigation

reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L’Enfant Plaza East, S.W.

Washington, D.C. 20594

(202) 382-6735

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(703) 487-4600
EVALUATION OF ACCIDENT DATA AND

FEDERAL OVERSIGHT OF

PETROLEUM PRODUCT PIPELINES

PIPELINE SPECIAL INVESTIGATION REPORT

Adopted: January 23, 1996

Notation 6641

National

Transportation

Safety Board

Washington, DC 20594
This page intentionally left blank
iii

CONTENTS

EXECUTIVE SUMMARY........................................................................................................... v

INTRODUCTION......................................................................................................................... 1

Background ..................................................................................................................................... 1

The Investigation............................................................................................................................. 3

OVERVIEW OF ACCIDENTS ................................................................................................... 5

Colonial Pipeline Company ............................................................................................................ 5

General System Information................................................................................................ 5

Fountain Inn, South Carolina .............................................................................................. 6

Reston, Virginia .................................................................................................................. 7

Other Colonial Accidents.................................................................................................... 9

RSPA Oversight of Colonial............................................................................................. 11

Other Safety Board Investigations................................................................................................. 12

Los Angeles, California..................................................................................................... 12

Bayamon, Puerto Rico....................................................................................................... 13

Long Beach, California ..................................................................................................... 13

Kaycee, Wyoming ............................................................................................................. 14

Mounds View, Minnesota ................................................................................................. 14

San Bernardino, California................................................................................................ 14

Freeport, Pennsylvania ...................................................................................................... 15

Other Safety Board Reports............................................................................................... 15

Evaluation of RSPA Accident Data .............................................................................................. 16

Methodology and General Results .................................................................................... 16

Outside Force Damage ...................................................................................................... 17

Corrosion-Caused Accidents............................................................................................. 21

Accidents with a Reported Cause of “Other”.................................................................... 22

Identification of Accident Trends...................................................................................... 22

Comparison of Operator Accident Rates........................................................................... 24

Evaluation of Accident and Release Rates for Colonial Pipeline Company..................... 28

FEDERAL OVERSIGHT........................................................................................................... 29

Introduction ................................................................................................................................... 29

RSPA Initiatives on Previous Safety Issues .................................................................................. 29

Minimizing Excavation Caused Damages ........................................................................ 29

Controlling External Corrosion Damage........................................................................... 33

Inspection and Testing....................................................................................................... 34

Limiting Product Release from Failed Pipe ...................................................................... 36
iv

Accident Data Collection and Analysis......................................................................................... 39

Accident Reporting Requirements .................................................................................... 39

Accident Data Base Information ....................................................................................... 40

Use of Accident Data ........................................................................................................ 41

Effects on Program Management ...................................................................................... 42

Evaluation and Recommendations.................................................................................... 43

CONCLUSIONS ......................................................................................................................... 46

RECOMMENDATIONS............................................................................................................ 48

APPENDIXES

Appendix A--Previously Issued Safety Recommendations to the Department

of Transportation Relating to Petroleum Product and Hazardous

Liquid Pipelines........................................................................................... 51

Appendix B--U.S. Department of Transportation Liquid Pipeline Accident

Report Form No. 7000-1 and Instructions for Preparation......................... 61

Appendix C--U.S. Department of Transportation Annual Report Forms for Gas

Pipeline Systems.......................................................................................... 65
v

EXECUTIVE SUMMARY

Within a 15-month period, the Colonial Pipeline Company (Colonial) experienced the

rupture of two of its petroleum product pipelines, which resulted in large releases of diesel fuel that

affected major water supplies. In both accidents, the ruptured section of pipeline had been

mechanically damaged during previous excavation work.

The first accident occurred on December 19, 1991, when Colonial’s Line 2, a 36-inchdiameter pipeline, ruptured about 2.8 miles northeast of Colonial's Simpsonville, South Carolina,

pump station.1

 The rupture allowed more than 500,000 gallons (13,100 barrels) of diesel fuel to

flow into Durbin Creek, causing environmental pollution that affected 26 miles of waterways,

including the Enoree River, which flows through Sumter National Forest. The spill also forced

Clinton and Whitmire, South Carolina, to use alternative water supplies.

On March 28, 1993, Colonial's Line 3, a 36-inch-diameter petroleum products pipeline,

ruptured at 1800 Town Center Parkway, in Reston, Virginia, about 10.4 miles downstream of the

company's Chantilly, Virginia, station.2

 The rupture allowed about 407,700 gallons (9,700 barrels)

of diesel fuel to flow into Sugarland Run Creek (a tributary to the Potomac River), causing

environmental pollution that threatened the water supply of areas in Virginia, Maryland, and the

District of Columbia.

Because of the magnitude of the releases following the accidents in Fountain Inn, South

Carolina, and Reston, Virginia, the Safety Board focused on the risks to public safety and the

environment posed by the operation of petroleum product pipelines. Pipelines transport about 57

percent of the crude petroleum and petroleum products moved within the United States. The

potential threat to public safety from such releases has become more severe in recent years, as

residential and commercial development adjacent to all types of pipelines has accelerated. Further,

there has been growing Congressional, State, and local concern about the environmental

consequences of releases from pipeline systems, particularly those transporting crude petroleum and

petroleum products, which potentially pose the greatest risk to the environment.

In response to these concerns, the Safety Board conducted a special investigation to review

Research and Special Programs Administration (RSPA) efforts to implement previous Safety Board

safety recommendations that apply to petroleum product pipelines. In particular, the Safety Board

reviewed those recommendations that address the prevention of excavation damage, the control of

corrosion damage, the inspection and testing of pipelines, and methods to more rapidly detect,

locate, and shut down failed sections of pipeline. The Safety Board also analyzed petroleum product

pipeline accident data compiled by RSPA to assess accident trends and causes. In its analysis of the

accident data, the Safety Board used pipeline system data compiled by the Federal

 1

National Transportation Safety Board, Pipeline Accident Brief No. DCA92FP001, March 2, 1994.

2

National Transportation Safety Board, Pipeline Accident Brief No. DCA93MP007, March 2, 1994.
vi

 Energy Regulatory Commission (FERC) to compare Colonial's accident and product release rates

with 13 other petroleum product pipeline companies. The Safety Board also evaluated RSPA

procedures for collecting and analyzing accident data to identify safety problems and compare the

safety performance of individual pipeline companies.

The safety issues addressed in this report are:

• RSPA's responsiveness to implement previous safety recommendations addressing the

prevention of excavation damage, the control of corrosion damage, the inspection and

testing of pipelines, and methods to more rapidly detect, locate, and shut down failed

sections of a pipeline.

• RSPA's collection and analysis of accident data for petroleum product pipelines to

identify accident trends and compare operator performance.

• The safety performance of Colonial Pipeline Company.

As a result of its investigation, the Safety Board makes one safety recommendation to the

Research and Special Programs Administration and reiterates three previously issued safety

recommendations to the Research and Special Programs Administration.
INTRODUCTION

Background

Between December 1991 and March 1993, two Colonial Pipeline Company (Colonial)

petroleum product pipelines ruptured and released a total of nearly 1 million gallons of fuel oil. On

December 19, 1991, Colonial's Line 2, a 36-inch-diameter pipeline, ruptured about 2.8 miles

northeast of Colonial's Simpsonville, South Carolina, pump station. The rupture allowed more than

500,000 gallons (13,100 barrels) of diesel fuel to flow into Durbin Creek, causing environmental

damage that affected 26 miles of waterways and the water supplies for the local communities.

On March 28, 1993, Colonial's Line 3, also a 36-inch-diameter pipeline, ruptured at 1800

Town Center Parkway in Reston, Virginia, about 10.4 miles downstream of the company's

Chantilly, Virginia, station. The rupture allowed about 407,700 gallons (9,700 barrels) of diesel fuel

to flow into Sugarland Run Creek (a tributary to the Potomac River), causing environmental

damage that threatened the water supply of areas in Virginia, Maryland, and the District of

Columbia.

Accident data compiled by the Office of Pipeline Safety (OPS) in the U.S. Department of

Transportation’s (DOT’s) Research and Special Programs Administration (RSPA) indicate that the

number of reported accidents involving petroleum product pipelines and all other hazardous

liquids3 pipelines from 1986 through 1994 generally remained stable. (See figure 1.) (Accident rates

are not available through the accident data base.)

The potential threat to public safety from such releases has become more severe in recent

years, as residential and commercial development adjacent to both natural gas and hazardous liquid

pipelines has accelerated. State and local concerns about the safety of water supplies and the

environment have increased following product releases not only from Colonial, but also from other

petroleum and petroleum product pipeline operators. Congressional concern led to enactment of the

Pipeline Safety Act of 1992 (Public Law 102-508) in October 1992. The act placed increased

emphasis on environmental protection as an objective when establishing minimum Federal safety

standards for all pipeline systems.

 3

Hazardous liquids are defined in Title 49 Code of Federal Regulations (CFR) 195.2 as petroleum, petroleum

products, and anhydrous ammonia. Petroleum includes crude oil, condensate, natural gasoline, and liquefied petroleum

gas. Petroleum products are flammable or corrosive products obtained from distilling and processing of crude oil,

unfinished oils, natural gas liquids, blend stocks, and other miscellaneous hydrocarbon compounds.

3

Pipelines transport the majority of petroleum and petroleum products within the United

States. According to the Association of Oil Pipe Lines, petroleum and petroleum products carried in

domestic transportation in 1993 totaled 1,035 billion ton-miles. Of this total, 57 percent was

transported by pipelines, 38 percent by water carriers, 3 percent by motor carriers, and 2 percent by

railroads.

The Investigation

Because of the concerns about the safety of Colonial's pipeline system and the operation of

petroleum and petroleum product pipelines in general, the Safety Board conducted a special

investigation to examine Colonial’s specific accident history, the overall accident rate for petroleum

product pipelines, and RSPA's oversight of these pipeline systems. The Safety Board elected to

concentrate its investigation on petroleum product pipelines, rather than petroleum and other

hazardous liquid pipelines. Petroleum products (diesel fuel, fuel oil, gasoline, gasoline and fuel oil

mixtures, jet fuel, kerosene, oil and gasoline mixtures, turbine fuel, toluene, xylene, and benzene)

most closely match the products transported through Colonial's pipeline system, thereby facilitating

comparison of Colonial's accident history with those of other companies. Further, pipelines

transporting these products are typically onshore pipeline systems that are subject to RSPA

regulations in 49 CFR 195 (Transportation of Hazardous Liquids by Pipeline). Many pipelines that

transport materials defined as “petroleum,” such as crude oil, condensate, and natural gas liquids,

include gathering lines that are not subject to these regulations or are offshore pipelines that present

very different operating conditions. Highly volatile liquids, such as natural gas liquids, liquefied

petroleum gas, ethylene, and anhydrous ammonia, were not considered because these products form

vapor clouds when released and pose uniquely different risks to the public and the environment.

Also, highly volatile liquids are not transported within Colonial's pipeline system. In its review of

accident histories, the Safety Board considered failures that occurred anywhere within the pipeline

system.

To initiate its investigation, the Safety Board reviewed its past investigations of accidents

involving Colonial. The Safety Board also reviewed RSPA’s inspections and accident

investigations of Colonial. In addition, the Safety Board considered past investigations of petroleum

product pipeline accidents involving other pipeline companies, as well as relevant safety

recommendations issued to RSPA and to pipeline industry organizations, such as the American

Petroleum Institute. Since the 1970s, the Safety Board has issued 106 safety recommendations that

relate to petroleum product pipelines -- 37 to RSPA, and 69 to industry organizations.

Because the Safety Board's primary concern is with Federal oversight of pipeline safety, this

special investigation addresses RSPA's lack of effective action to implement the Safety Board's

safety recommendations. (See appendix A.) Many of the Safety Board's past recommendations to

RSPA have addressed the following safety issues: prevention of excavation damage; control of

corrosion damage; inspection and testing of pipelines to detect damage and defects before failure;

rapid leak detection and shutdown to limit the release of product from failed pipe; and analysis of

accident report data to improve program management. In its report on the rupture of a natural gas
4

transmission pipeline in Edison, New Jersey,4

 the Safety Board provided a detailed history of

actions taken by RSPA to address the issues of minimizing excavation-caused damages, inspecting

and testing pipelines, and limiting product releases from a failed segment of pipeline. For those

issues already addressed by the Safety Board in the Edison report, this special investigation report

updates actions taken by RSPA to address these safety issues since the adoption of the Edison

report. RSPA efforts to act on the remaining safety issues are evaluated later in the report.

The Fountain Inn and Reston accidents also prompted the Safety Board to analyze RSPA

accident data in an effort to assess trends and causes of petroleum product pipeline accidents. In its

evaluation of the accident data, the Safety Board attempted to compare the safety performance of

Colonial with other petroleum product pipeline operators. While conducting its analysis of the

RSPA accident data, the Safety Board noted those deficiencies and limitations of the accident data

base that preclude effective analysis of accident trends and operator performance.

 4

Pipeline Accident Report--Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and

Fire, Edison, New Jersey, March 23, 1994 (NTSB/PAR-95/01).
5

OVERVIEW OF ACCIDENTS

Colonial Pipeline Company

General System Information — Colonial Pipeline Company was incorporated in 1962, as

a joint venture of American Oil Co., Cities Services Co., Continental Oil Co., Gulf Oil Co., Phillips

Petroleum Co., Pure Oil Co., Sinclair Petroleum Co., Socony Mobil Oil Co., and Texaco, Inc.

These oil companies financed the construction of a pipeline system designed to transport refined

petroleum products from Houston, Texas, to New York, New York.

Colonial, which has corporate offices in Atlanta, Georgia, owns and operates 5,317 miles of

petroleum product pipeline in Texas, Louisiana, Mississippi, Alabama, Georgia, South Carolina,

North Carolina, Virginia, Maryland, Pennsylvania, Delaware, New Jersey, New York, and the

District of Columbia. The pipeline sections in the system range in size from 40 inches to 6 inches in

diameter. Pipeline sections with diameters between 30 inches and 40 inches total 2,887 miles, or 54

percent of the entire system.5 Colonial reported to the Department of Energy’s Federal Energy

Regulatory Commission (FERC) that over 697 million barrels of petroleum products moved

through its pipeline system in 1994.

To compare Colonial's performance history with those of other petroleum product pipeline

companies, the Safety Board obtained system data from FERC on 13 other pipeline companies that

own and operate petroleum product pipelines. (These 13 companies, with Colonial, accounted for

approximately two-thirds of the releases of petroleum products that took place from 1986 through

1994.) Comparison of Colonial's pipeline system with these other pipeline systems showed that

only one company operated more miles of pipeline than Colonial. However, this company had no

pipeline section greater than 16 inches in diameter, and its annual product throughput was only 29

percent of Colonial's. Of three other pipeline companies reporting pipeline mileages between 3,100

miles and 3,700 miles, none had pipelines greater than 30 inches in diameter. In terms of annual

product throughput, Colonial reported the highest throughput of any of the 14 operators -- 697

million barrels. The next highest reported product throughputs were in the 300- to 350-million

barrel range.

Employees (controllers) at Colonial's Atlanta, Georgia, control center monitor the firm’s

computerized supervisory control and data acquisition (SCADA) system 24 hours a day. The

SCADA screens continually display operational data, such as product pressure and flow rates for

pump stations and other locations throughout the pipeline system. The SCADA system uses a

satellite communications system for receiving status messages from and sending commands to

manned pump stations along the pipeline right-of-way. Dedicated telephone lines serve as a backup

 5

A 1-mile length of a 40-inch-diameter pipeline would contain about 343,600 gallons (8,180 barrels) of

product, a 30-inch-diameter pipeline about 193,500 gallons (4,600 barrels), and a 6-inch-diameter pipeline about 7,900

gallons (190 barrels).
6

for the SCADA system. Each pump station has programmable logic controllers (PLCs) that work in

concert with pressure switches to shut down individual pumps or entire pumping stations when the

PLC senses abnormal pressure levels. The system then displays the information on SCADA

monitors. Controllers can remotely stop pumps and close valves at pump stations by transmitting

commands on the SCADA computer. However, Colonial's SCADA system does not contain

detection devices that sense and transmit the proximate location of a pipeline break. The

capabilities of Colonial's SCADA system are typical of most large pipeline companies.6

Fountain Inn, South Carolina — At 9:51 p.m. on December 19, 1991, Colonial's Line 2, a

36-inch-diameter petroleum products pipeline, ruptured about 2.8 miles downstream of the

company's Simpsonville, South Carolina, pump station.7 The rupture allowed more than 500,000

gallons (13,100 barrels) of diesel fuel to flow into Durbin Creek, causing environmental damage

that affected 26 miles of waterways, including the Enoree River, which flows through Sumter

National Forest. The spill also forced Clinton and Whitmire, South Carolina, to use alternative

water supplies.

The rupture was detected when a controller in Colonial's Atlanta, Georgia, control center

observed a sharp drop in pressure readings for Line 2 at both the Simpsonville station and the

Spartanburg, South Carolina, tank farm, which is 25.6 miles downstream from the Simpsonville

station. The controller immediately closed the remotely operated block valve at the Anderson,

South Carolina, pump station, which is 32.6 miles upstream of the Simpsonville station. At 10:03

p.m., the controller closed the remotely operated block valves at the Simpsonville station and the

Gaffney, South Carolina, pump station, which is 38.4 miles downstream of the Simpsonville

station. With the closure of the valve at the Gaffney station, the 71-mile section of the pipeline

between Anderson and Gaffney was isolated. The remotely operated block valve at the Spartanburg

tank farm was also closed at an unrecorded time, thereby isolating the 25.6 miles of pipeline

between Simpsonville and Spartanburg that contained the rupture.

To locate the leak, maintenance personnel reported that they drove along the pipeline rightof-way and sniffed the air for the smell of diesel fuel. Pipeline employees did not find the rupture

point until 1:37 a.m. on December 20, 1991, almost 4 hours after the controller initially observed

the sharp drop in pressure readings. The leak was about 2.8 miles downstream of the Simpsonville

station (22.8 miles upstream of the Spartanburg tank farm and 35.6 miles upstream from the

Gaffney pump station).

After contractors exposed the pipeline, Safety Board investigators found that the piping

showed visible evidence of mechanical damage from an outside force and that the pipe had suffered

 6

Under 49 CFR 195.402 and 195.408, for facilities that are not designed to fail safe, pipeline operators must

provide for the detection of abnormal operating conditions by monitoring appropriate operational data and transmitting

the data to an attended location. The SCADA system typically satisfies these monitoring requirements.

7

Pipeline Accident Brief No. DCA92FP001.
7

a 47-inch rupture. A 32-foot, 9-inch section of the pipe was sent to Battelle Laboratories in

Columbus, Ohio, for metallurgical examination, which revealed that the rupture originated at one of

several gouge marks on the outer surface of the pipe. Below nine of the gouged areas on the pipe's

outer surface were corresponding creases and dents on the inner surface. The fracture surface along

the gouge that ruptured showed evidence of plastic deformation typical of tensile shear overstress.8

Colonial is a member of the Palmetto Utility Protection Service (PUPS) “one-call” damage

prevention system of South Carolina. PUPS encourages prospective excavators to notify pipeline

and other operators of underground utilities of their intentions by reporting proposed activities near

buried pipelines to the PUPS notification center. In 1989, responding to an increase in residential

development next to the Carolina Springs Golf and Country Club in Fountain Inn, Colonial signed

an encroachment agreement with the country club that stipulated that the club was to notify

Colonial before commencing any digging or work within the pipeline right-of-way. Colonial's vice

president of operations indicated to the Safety Board that Colonial typically signs encroachment

agreements with all landowners along their pipeline right-of-ways.

On July 1, 1991, the country club hired a backhoe operator to remove silt from the golf

course's water pump intake at a dam on Durbin Creek. Country club personnel did not notify

Colonial or PUPS about the proposed work. Although the backhoe operator observed a pipeline

marker across the creek from where he would be working, he stated that he neither called nor was

aware that he was supposed to call Colonial or PUPS to have the pipeline located before beginning

excavation.

On July 2, 1991, Colonial's routine contract aerial patrol observed a backhoe parked in the

pipeline right-of-way and reported their observations to the Spartanburg Tank Farm operator for

investigation. The operator stated that because he had not been notified of any planned excavation

and he knew that the country club had an encroachment agreement with Colonial, he did not check

the site until the next morning. At that time, he found only equipment track marks. He took no

further action.

The Safety Board determined that the probable cause of the pipeline rupture and release was

the failure by the Carolina Springs Golf Course owners and the backhoe operator to notify Colonial

and/or PUPS in order to determine the pipeline location before excavating, which resulted in the

backhoe operator damaging the pipeline.

Reston, Virginia — At 8:48 a.m. on March 28, 1993, Colonial's Line 3, a 36-inch-diameter

pipeline, ruptured at 1800 Town Center Parkway in Reston, Virginia, about 10.4 miles downstream

of the Chantilly, Virginia, station.9 More than 407,700 gallons (9,700 barrels) of diesel fuel were

 8

Failure of a metal or material that is subjected to forces exceeding the strength of the material.

9

Pipeline Accident Brief No. DCA93MP007.
8

released and entered Sugarland Creek, a tributary to the Potomac River. The release caused

significant environmental damage and threatened the water supply for areas of Virginia, Maryland,

and the District of Columbia.

The controller who was monitoring the SCADA screen for the Line 3 pipeline at the Atlanta

control center responded to a low suction pressure alarm at 8:48 a.m. from the Dorsey Junction,

Maryland, station, which is about 35 miles downstream from the point of rupture. The controller

next saw a sudden drop in pressure at the Chantilly, Virginia, station, which is about 10.4 miles

upstream of the rupture site. Surmising that a line break had occurred within the 45 miles of the

pipeline between the two stations, he typed commands on the SCADA system to shut down the

pumps at the Chantilly station and to close the valves and shut down pump units at upstream

stations, to prevent the flow of additional diesel fuel toward the rupture and to minimize pressure

surges in other sections of the pipeline. To pull diesel fuel away from the rupture, the controller

continued to run the pumps at the Dorsey station until they automatically shut down at 8:50 a.m.,

due to low suction pressure. By 8:52 a.m., the controller remotely closed the discharge and block

valves at the Chantilly station. At 8:53 a.m., the controller telephoned the Dorsey Junction operator

and told him to close the pump suction valve. The controller also remotely closed the block valve at

the Dorsey Junction station at this time. By 8:55 a.m., the entire pipeline, from Greensboro

Junction, North Carolina, to Dorsey Junction, Maryland, had been shut down. The controller also

dispatched local Colonial employees to close the two manual/hydraulic-actuated block valves on

each side of the Potomac River, downstream of the rupture. The block valve on the Virginia side of

the river was closed about 9:30 a.m. and the valve on the Maryland side about 10:22 a.m.

When the pipeline was excavated for repairs on March 30, workers found large boulders

and rocks on, around, and under the pipeline. During the on-scene investigation, Safety Board

investigators found a 42-inch-long rupture in the body of the pipe near the top, at the 11:30 o'clock

position. The widest point of the rupture was about 5 inches. Investigators also found evidence of

mechanical damage near the rupture, including a dent in the pipe and two longitudinal scrapes,

which had a combined length of 14 feet. The Safety Board requested that Colonial remove an 18-

foot, 4-inch-long segment of pipe for further examination by the Board's materials laboratory.

While excavating the pipeline, workers also found a large dent in the 6 o'clock position,

where a sewer line buried 3 feet above the pipeline had crossed it at a point about 28 feet north of

the rupture. The Safety Board asked that an 18-inch section containing this dent be removed for

further examination.

Metallurgical examination of the 18-foot, 4-inch-long segment of pipe revealed a 5

1/4-inch-long progressive crack, two dents in the pipeline, mechanical damage in a longitudinal

direction along the top of the pipeline, and traces of foreign metal (steel containing chromium and

silicon) deposited on the pipe surface. The composition of the foreign metal is typical of steels used

in excavation equipment. The 5 1/4-inch-long progressive crack initiated from a longitudinal

dent/gouge and extended to a maximum of one-third of the depth of the pipe wall. Metallurgical

examination of the 18-inch pipe segment revealed several metal folds up to 0.004 inch deep near
9

the center of the dent. Analysis of a transverse cross-section of the dent revealed several small metal

folds, the deepest of which was 0.004 inch deep.

The Safety Board examined all available records documenting construction at or around a

physician's complex adjacent to the Reston accident site from 1986, when the complex was

constructed, until the date of the accident. According to these records, more than 200 contractors

and organizations had performed work in the area during the 6-year period. The Safety Board was

unable to determine definitively which organizations had used heavy construction equipment in the

vicinity of the damaged pipe. The Safety Board determined that the probable cause of the rupture

was fatigue failure at a crack initiated by mechanical damage from excavation equipment at an

undetermined time.

Other Colonial Accidents — In addition to the Fountain Inn, South Carolina, and the

Reston, Virginia, accidents, the Safety Board investigated three other accidents involving Colonial

that took place between 1970 and 1987.

Early on September 2, 1970, residents of Jacksonville, Maryland, detected gasoline odors

and noticed gasoline in a small creek flowing beneath a nearby road. Because fumes were still

present in the late afternoon of September 2, a resident notified Colonial at 6:19 p.m. about the

situation. Colonial, which had a 30-inch-diameter pipeline situated about 1,700 feet east of the

point where the creek passed under the road, shut down the Dorsey Junction, Maryland, pump

station (the initial pump station for this section of the pipeline) at 6:34 p.m. Within 20 minutes, the

other pump stations downstream automatically shut down because of low suction pressure.

Manually operated block valves located about 4.1 miles apart were closed by 7:20 p.m. to isolate

the ruptured length of pipeline. 10

About 12 hours later, on the morning of September 3, an explosion and fire occurred in a

ditch in which contractor personnel for Colonial were manually digging to further expose the

pipeline and catch gasoline trickling from the ground. Five persons were injured, none fatally.

The location of the leak was found 4 days later, at a point about 280 feet north (upstream) of

the explosion site. The leak was about 0.32 mile and 3.79 miles, respectively, from the upstream

and downstream block valves used to isolate the rupture. The failure resulted in a release of 30,186

gallons (718 barrels) of gasoline and kerosene. The Safety Board determined that the pipe failed at a

flaw of undetermined origin in the pipe wall, after a period of constantly fluctuating pumping

pressures.

 10Pipeline Accident Report--Colonial Pipeline Company Petroleum Products Pipeline, Jacksonville,

Maryland, September 3, 1970 (NTSB/PAR-71/02).
10

On March 6, 1980, a 32-inch-diameter Colonial pipeline ruptured in two locations

simultaneously.11 In the case of the first rupture, which occurred near Manassas, Virginia, the pipe

wall had been thinned by corrosion in a casing under a road, causing the pipe to break and release

336,000 gallons (8,000 barrels) of aviation-grade kerosene. Before the kerosene could be fully

contained, it flowed into Bull Run River and entered the Occoquan Reservoir, a source of drinking

water for several northern Virginia communities. In the second rupture, which occurred near Locust

Grove, Virginia, a rural area in Orange County, near Fredericksburg, a crack in the pipe wall

propagated to failure, releasing approximately 92,000 gallons (2,190 barrels) of fuel oil. Before the

fuel oil could be fully contained, it flowed into the Rapidan River and then into the Rappahannock

River, a source of drinking water for the city of Fredericksburg.

Thousands of fish and some small animals and waterfowl died as a result of the two spills.

The water supply to Fredericksburg was contaminated, and the Governor of Virginia declared a

state of emergency. Cleanup of streams and riverbanks continued for months after the accidents.

Cleanup costs were estimated at more than $1 million.

The Safety Board determined that the probable cause of the ruptures was a pressure surge

initiated by the automatic shutdown of a pump station, caused by the controller's delay in getting it

started, followed by his attempt to relieve the surge pressure into a stub-line connection instead of

following the company procedure of shutting down all of the pumps on the line. The Safety Board

also determined that the pipeline failed at two undetected and preexisting defects: one where the

pipe had been thinned by corrosion and the other where a crack propagated to failure. The Safety

Board concluded that the fatigue cracking had initiated during rail shipment of the individual pipe

sections before construction of the pipeline.

On June 11, 1987, in Centreville, Virginia, a Caterpillar tractor using a “rock ripper”

attachment for breaking up buried rocks punctured Colonial's 32-inch-diameter pipeline. The tractor

had been clearing rocks for a sidewalk that was under construction and crossed the pipeline rightof-way. 12 Gasoline sprayed from the ruptured pipeline, affecting six townhouses under construction

and a wooded area, and ultimately entered nearby storm drains. A Colonial inspector, who

happened to be at another location on the construction site, saw the spraying gasoline and instructed

all operators to shut off their machinery and evacuate the area. Colonial and the local fire

department were then notified. The pipeline was shut down about 6 minutes after the rupture

occurred. Within an hour, pressure in the pipeline had decreased sufficiently that gasoline was only

bubbling out of the 4-inch by 4-inch puncture hole in the pipeline. Firefighters kept a foam spray

over the gasoline on two siltation ponds and the puncture site. Although gasoline had drenched the

area, no ignition occurred. Colonial estimated that more than 15,500 gallons (370 barrels) of

 11Pipeline Accident Report--Colonial Pipeline Company Petroleum Products Pipeline Failures, Manassas and

Locust Grove, Virginia, March 6, 1980 (NTSB/PAR-81/02).

12National Transportation Safety Board, Pipeline Accident Brief No. DCA87FP011, July 29, 1987.
11

gasoline were released from the pipeline. The gasoline damaged trees, shrubbery, lawns, and some

vehicles. Thirteen emergency response personnel suffered from exposure to the gasoline fumes.

The tractor had been operated by a subcontractor to a general contractor that had been given

authorization by Colonial in January 1987 to work in the vicinity of this and a second Colonial

pipeline. Diagrams showing the locations of the pipelines were given to the general contractor, and

permanent and temporary pipeline markers were located in the work area. The general contractor

was to have notified Colonial before beginning work in the right-of-way of either pipeline, but did

not do so. Colonial's aerial patrol on June 8 (3 days before the rupture) did not report any

construction activities in the area.

The Safety Board determined that the probable cause of the accident was operator error for

using the excavation equipment in a known and marked pipeline location, failure of the general

contractor to use a one-call system or alert Colonial before using the equipment, and damage to the

pipeline from excavation equipment.

According to the RSPA accident data base, Colonial reported 74 accidents from 1986

through 1994.13 Of the 74 reported accidents, 44 (about 60 percent) occurred in the 3-year period

from 1992 through 1994. Of these 74 accidents, 11 were attributed to corrosion, 19 to outside force

damage, 5 to incorrect operation by the operator, 2 to failed welds, 1 to a failed pipe, and 36 to

“other” causes. Of the 19 accidents attributed to outside force damage, 14 were reported to have

been caused by excavation damage. For the remaining 5 accidents, either the cause of the accident

was not specified or the accident was caused by factors other than excavation damage. Colonial's

accident rate in comparison to other operators’ is addressed later in this report.

RSPA Oversight of Colonial — From 1990 through November 1995, RSPA issued four

warning letters (in lieu of civil penalties) to Colonial for probable violations noted during safety

inspections at various facilities. The probable violations cited by RSPA at these facilities involved

failure to: inspect and test safety relief valves in accordance with company procedures, protect

components in the system from atmospheric corrosion, maintain inspection records for the required

interval, update the company's operations manual, maintain adequate liaison with local emergency

response officials, and determine the adequacy of cathodic protection measures. During this period,

RSPA also issued two findings of violations against Colonial following RSPA safety inspections.

Both violations cited Colonial for failure to inspect its pipelines crossing under navigable

waterways within a 5-year interval, as required by 49 CFR 195.412(b).

Following the accidents in Fountain Inn, South Carolina, and Reston, Virginia, RSPA

issued hazardous facility orders (dated December 20, 1991, and March 30, 1993, respectively) to

Colonial that restricted the operating pressures for the two pipelines involved in those accidents to

 13The accidents investigated by the Safety Board met RSPA accident reporting requirements and would be

included in those accidents reported to RSPA.
12

80 percent of each pipeline's maximum allowable operating pressure. The hazardous facility order

issued subsequent to the Fountain Inn accident also required Colonial to submit a plan for

metallurgical examination of the excised pipeline. The order issued subsequent to the Reston

accident required Colonial to expose and inspect the top of the pipeline in the vicinity of the rupture

and to repair any dents or gouges in accordance with industry standards. RSPA amended the March

1993 order on April 5, 1993, and further required Colonial to submit a plan for internal

instrumented inspection and repair of the 36-inch-diameter pipeline between Chantilly, Virginia,

and Dorsey Junction, Maryland. The amended order imposed the additional restriction that the

pipeline’s operating pressure not exceed 50 percent of the maximum allowable operating pressure.

As a result of the inspections mandated under the amended order, Colonial took the following

actions: installed 11 sleeves; cut out and replaced 1 section; performed 89 coating repairs; and

repaired 7 sections with dents, buckles, and rock damage to the bottom of the pipeline.

RSPA issued a consent order on August 14, 1995, that requires Colonial, by October 2000,

to either hydrostatically test or use instrumented internal inspection devices (“pigs”) on its 32-inchdiameter and 36-inch-diameter pipelines between Greensboro, North Carolina, and Dorsey

Junction, Maryland, a distance of about 288 miles. Through December 1995, Colonial, under the

stipulations of the consent order, had installed 27 permanent sleeves on the 36-inch-diameter

pipeline and 17 permanent sleeves on the 32-inch-diameter pipeline. Colonial also cut out 7

sections and replaced 685 feet of its 32-inch-diameter pipeline. RSPA will continue to evaluate

future tests and inspections. 

Other Safety Board Investigations

Since the 1970s, the Safety Board has conducted several investigations and other safety

studies addressing safety issues applicable to all types of pipelines. As a result, the Safety Board

issued numerous safety recommendations to RSPA that apply to petroleum product pipelines and

other hazardous liquid pipelines. (See appendix A.) Many of these recommendations addressed the

following safety issues: prevention of excavation damage, control of corrosion damage, inspection

and testing of pipelines to detect damage and defects before failure, rapid leak detection and

shutdown to limit the release of product from failed pipe, and analysis of accident report data to

improve program management. RSPA efforts to address these safety issues are discussed later in

this report. The following section summarizes those investigations and studies that apply

specifically to petroleum product pipelines.

Los Angeles, California — On June 16, 1976, an 8-inch-diameter pipeline owned by the

Standard Oil Company of California was struck and ruptured by excavation equipment that was

being used on a road-widening project.14 Gasoline sprayed from the rupture and drenched nearby

buildings. Ninety seconds later, the gasoline ignited. The ensuing fire killed 9 persons, injured 14

persons, and caused extensive property damage.

 14Pipeline Accident Report--Standard Oil Company of California Pipeline Rupture, Los Angeles, California,

June 16, 1976 (NTSB/PAR-76/08).
13

The Safety Board determined that the probable cause of the accident was the rupture of the

pipeline by excavation equipment, whose operator was unaware of the pipeline's precise depth and

location. Although the pipeline was known to exist, its precise depth and location were not known

by the pipeline operator, the construction contractor, the subcontractor, or the California

Department of Transportation.

Bayamon, Puerto Rico — On January 30, 1980, an 8-inch-diameter refined petroleum

products pipeline owned by The Pipelines of Puerto Rico, Inc., and operated by the Shell Oil

Company (Puerto Rico) Ltd. was struck and ruptured by a bulldozer during maintenance work on a

nearby waterline in Bayamon, Puerto Rico, about 10 miles southwest of San Juan.15 Gasoline from

the rupture sprayed downhill and ran off into a small creek. About 1 1/2 hours later, the gasoline

vapors were ignited by an undetermined source; the subsequent fire killed one person and

extensively damaged 25 houses and other property.

The Safety Board determined that the probable cause of the accident was the rupture of the

pipeline by a bulldozer, whose operator was unaware of the pipeline's precise depth and location,

and the failure of the Aqueduct and Sewer Authority and the Highway Authority personnel at the

accident site to ascertain the exact location of the pipeline and to take proper precautions.

Contributing factors in the accident were the lack of visible above-ground temporary markers to

show the exact location where the pipeline crossed under the waterline and the use of heavy

construction equipment near the pipeline while the pipeline company inspector was absent.

Long Beach, California — On December 1, 1980, a pipeline transporting naphtha ruptured

under a highway intersection in Long Beach, California.16 Escaping product under high pressure

blew a hole through the pavement and sprayed naphtha 20 feet into the air. The naphtha flowed into

the gutters and was ignited moments later by an undetermined source. The ensuing flames reached a

height of approximately 70 feet. Five persons were injured, 12 homes were destroyed or damaged,

and 11 motor vehicles were destroyed.

The Safety Board determined that the probable cause of the accident was the overpressure

of the pipeline and its rupture at a point where the pipe wall had been thinned by internal corrosion.

The overpressure occurred because valves were closed against the pipeline stream at two delivery

locations while the pumps at the origin points continued to operate. Contributing to the accident

was the lack of communication and instrumentation to enable the controllers in the pipeline control

center to effectively monitor the pipeline's operation. Delay in identifying the failed pipeline and

further delay in closing valves to stop the flow of naphtha fueling the fire prolonged the fire and

hampered the firefighters' efforts.

 15Pipeline Accident Report--The Pipelines of Puerto Rico, Inc., Petroleum Products Rupture and Fire,

Bayamon, Puerto Rico, January 30, 1980 (NTSB/PAR-80/06).

16Pipeline Accident Report--Four Corners Pipe Line Company Pipeline Rupture and Fire, Long Beach,

California, December 1, 1980 (NTSB/PAR-81/04).
14

Kaycee, Wyoming — On July 23, 1985, about 8 miles south of Kaycee, Wyoming, a girth

weld cracked during a pipeline recoating project on an 8-inch-diameter pipeline owned by the

Continental Pipe Line Company.17 Aircraft turbine fuel was released and ignited. One person was

fatally injured, and six others were less seriously injured. Damage, including the destruction of

construction equipment, was estimated at more than $128,000.

The Safety Board determined that the probable cause of the rupture was the failure by

Continental to identify the substandard girth weld when the pipeline was constructed in 1963 and

again when the girth weld was exposed during the recoating project in 1985. Contributing to the

accident was the failure by the company to develop written instructions or guidelines for recoating

projects and to select and train its inspectors and contract employees specifically concerning the

inherent hazards involved in raising and recoating operating pipelines under pressure.

Mounds View, Minnesota — On July 8, 1986, an 8-inch-diameter petroleum products

pipeline operated by Williams Pipe Line Company ruptured in Mounds View, Minnesota.18

Unleaded gasoline spewed from a 7 1/2-foot-long opening along the longitudinal seam of the pipe.

Vaporized gasoline combined with the air, and liquid gasoline flowed along neighborhood streets.

About 20 minutes later, the gasoline vapor was ignited when an automobile entered the area. Two

persons were burned severely and later died, and one person suffered serious burns. There was

substantial property damage and soil and water pollution.

The Safety Board determined that the probable cause of the rupture was the failure of

Williams to correct known deficiencies in the corrosion protection system for the first 10 miles of

the pipeline. Contributing to the failure of the pipeline was the susceptibility of the low frequency,

electric resistance welded pipe to weld seam corrosion and the DOT's ineffective inspection and

enforcement program. Contributing to the extent of the damages was the failure of the pipeline

company to provide adequate direction, through its procedures and training, for its employees to

effectively respond to emergencies involving failures of its pipeline, and the nonavailability of

remotely operated valves or automatic shutdown capability on the pipeline.

San Bernardino, California — On May 12, 1989, a Southern Pacific Transportation

Company freight train derailed in San Bernardino, California.19 Local officials evacuated homes in

the surrounding area because of a concern that a 14-inch-diameter pipeline owned by the Calnev

 17Pipeline Accident Report--Continental Pipe Line Company Pipeline Rupture and Fire, Kaycee, Wyoming,

July 23, 1985 (NTSB/PAR-86/01).

18Pipeline Accident Report--Williams Pipe Line Company Liquid Pipeline Rupture and Fire, Mounds View,

Minnesota, July 8, 1986 (NTSB/PAR-87/02).

19Railroad Accident Report--Derailment of Southern Pacific Transportation Company Freight Train on May

12, 1989, and Subsequent Rupture of Calnev Petroleum Pipeline on May 25, 1989, San Bernardino, California

(NTSB/RAR-90/02).
15

Pipe Line Company, which was transporting gasoline and was located under the wreckage, might

have been damaged during the derailment, or was susceptible to being damaged during wreckageclearing operations. Residents were allowed to return to their homes within 24 hours.

On May 25, 1989, 13 days after the derailment, the pipeline ruptured at the site of the

derailment. The release and ignition of gasoline resulted in 2 fatalities, 3 serious injuries, and 16

minor injuries. Eleven homes in the adjacent neighborhood were destroyed, and 6 others received

fire and/or smoke damage. In addition, 21 motor vehicles were destroyed. Residents within a 4-

block area of the rupture were evacuated by local officials.

The Safety Board determined that the probable cause of the pipeline rupture was the

inadequate testing and inspection of the pipeline following the derailment that failed to detect

damage to the pipe by earth-moving equipment used during the cleanup of the derailment.

Contributing to the cause of the pipeline rupture was the severity of the train derailment that

resulted in extensive wreckage and commodity removal operations. Contributing to the severity of

the damage resulting from the substantial product release was Calnev's failure to inspect and test

check valves to determine that they functioned properly, particularly after the train derailment.

Freeport, Pennsylvania — At 10:12 p.m. on March 30, 1990, Buckeye Pipe Line

Company's Line 703, a 10-inch-diameter pipeline, ruptured from overstress due to a landslide,

resulting in the release of approximately 1,300 barrels (54,600 gallons) of mixed petroleum

products.20 Spilled petroleum products entered Knapp's Run, a small creek emptying into the

Allegheny River and, eventually, the Ohio River. The product release resulted in extensive ground

and water pollution and interrupted the use of the Allegheny River as a water supply for several

communities. Damage to the pipeline and environmental cleanup and restoration costs exceeded

$12 million.

The Safety Board determined that the probable cause of the failure of the pipeline and the

release of the petroleum products was the excessive stress imposed on the pipeline by a landslide.

Contributing to the delay in determining that products had been released from the pipeline was the

inability of Buckeye's pipeline monitoring system to promptly alert the controller that a release had

occurred. Buckeye's failure to promptly report the suspected release and to provide accurate

information on the release location (once confirmed) unnecessarily delayed Federal and State

agencies in taking remedial environmental response measures.

Other Safety Board Reports — In addition to these accident investigations, the Safety

Board has conducted two special safety studies since 1970 to evaluate the safety of hazardous liquid

pipelines, including petroleum product pipelines.

 20National Transportation Safety Board, Pipeline Accident Brief No. DCA90FP009, May 9, 1994.
16

The Safety Board completed a special study in June 1973 that addressed damage to gas and

liquid pipelines caused by excavation and construction activities.21 The Safety Board stated that

effective damage-prevention programs have fostered communication and cooperation between local

groups, including operators of any underground system, local government officials, contractor

associations, planners, and developers. The Board also stated that regulatory measures should

require notification of excavation work and be sufficiently flexible to permit the operators of

underground systems to establish convenient methods of receiving notification.

In October 1978, the Safety Board adopted a safety study on the safe service life for liquid

petroleum pipelines.22 In it, the Safety Board analyzed accident data for liquid pipelines over a 9-

year period (1968 to 1976) to determine if a model could be developed to help determine when a

liquid pipeline becomes so hazardous that its operation should be modified or terminated. The

Safety Board's analysis also highlighted trends from the causes of leaks and accidents. The Safety

Board concluded from its study:

• Corrosion was the leading cause of liquid pipeline accidents from 1968 through 1973.

• Equipment-caused pipeline ruptures were the second leading cause of accidents from

1968 through 1973.

• Instructions for completing the DOT accident form for liquid pipeline accidents were

not adequate to ensure consistency and thoroughness. Also, accident reports were not

audited to ensure the completeness and accuracy of each report.

• There was no means to predict the safe service life of a liquid pipeline using the

currently available accident data.

Evaluation of RSPA Accident Data

Although the Safety Board addressed the previously noted safety issues in past

investigations and safety recommendations, the recent ruptures of the Colonial pipelines in

Fountain Inn, South Carolina, and Reston, Virginia, prompted the Safety Board to analyze RSPA

accident data to reassess trends and causes of petroleum product pipeline accidents. In its evaluation

of the accident data, the Safety Board also attempted to compare the performance of Colonial with

other petroleum product pipeline operators.

Methodology and General Results — Because of changes in RSPA accident reporting

requirements for hazardous liquid pipelines that became effective in October 1985, the Safety

Board considered only those accidents that were reported from 1986 through 1994. As previously

 21Pipeline Special Study--Prevention of Damage to Pipelines (NTSB/PSS-73/01).

22Pipeline Special Study--Safe Service Life for Liquid Petroleum Pipelines (NTSB/PSS-78/01).
17

noted, the Safety Board included in its analysis only those accidents involving releases of petroleum

products.

The Safety Board analyzed the accident data as reported to RSPA by the individual pipeline

operators on DOT form 7000-1, Accident Report-Hazardous Liquid Pipeline. (See appendix B.)

The number of accidents resulting in the release of the selected products was tabulated by year and

by cause, according to RSPA's designated categories of cause (part D of form 7000-1). Cumulative

product losses were also tabulated per year for each defined cause to quantify the magnitude of the

reported releases by cause.

Of the 742 accidents involving petroleum product pipelines that were reported from 1986

through 1994, the three leading reported causes, based on the number of accidents reported, were

outside force damage (211 accidents or 28 percent), “other” (193 accidents or 26 percent), and

corrosion (169 accidents or 23 percent). All other designated categories of cause (failed weld,

incorrect operation, failed pipe, and malfunction of control/relief equipment) accounted for the

remaining 169 accidents (23 percent). (See figure 2.) On the basis of total barrels of product

released for the same period, outside force damage (196,960 barrels or 37.4 percent), “other”

(148,624 barrels or 28.2 percent) and corrosion (70,975 barrels or 13.5 percent) again were the

leading reported causes of failure. (See figure 3.)

When the total barrels and the number of accidents were combined to calculate the average

number of barrels released per accident, failed pipe (1,017 barrels per accident), outside force

damage (933 barrels per accident), and “other” (770 barrels per accident) were the three leading

causes. (See figure 4.) The average number of barrels released per accident for corrosion failures

(420 barrels per accident) was next to the lowest for the seven designated categories for cause.

These data indicate that accidents attributed to failed pipe, outside force damage, and “other” are

more likely to include catastrophic failures resulting in large releases, whereas corrosion-caused

accidents tend to result in smaller releases that occur over time. However, because the number of

accidents and total quantity of products released in accidents attributed to corrosion exceed those

for failed pipe, the impact of corrosion accidents on pipeline safety is greater than that of accidents

caused by failed pipe. Consequently, the Safety Board examined the data for outside force damage,

corrosion, and “other” causes in greater detail.

Outside Force Damage — For accidents attributed to outside force damage, the form

7000-1 accident report provides 12 categories for outside force damage (part J), including “damage

by the operator or its contractor” and “damage by others.” Outside force damage “by operator or its

contractor” and “by others” includes, but is not limited to, damage from excavation activities to

buried pipelines. These two categories of outside force damage also include damage to any

component of the pipeline system incurred from vandalism or other nonexcavation activities.

The number of accidents in each of these two categories was tabulated separately. Because

excavation damage should be reported as either damage “by the operator or its contractor” or

damage “by others,” the Safety Board also examined the data fields indicating whether damage



21

prevention programs and/or one-call systems were in effect, whether the excavator notified the

pipeline operator or the one-call system, and whether the pipeline had been temporarily marked

when these two categories of outside force damage were reported. The number of accidents

attributed to the remaining types of outside force damage (natural forces, other acts of nature, ship

anchor, and fishing operations) was collectively tabulated. A separate tabulation was performed for

a generic category labeled “other.” Again, the cumulative product losses for each grouping of the

types of outside force damage were also obtained.

Of the 211 petroleum product pipeline accidents attributed to outside force damage, damage

by the pipeline operator or its contractor was indicated in 27 accidents (13 percent), and damage by

others in 151 accidents (72 percent). These two categories account for 178 (85 percent) of all of the

accidents caused by outside force damage. Of the remaining 33 accidents, 17 (8 percent) were

collectively attributed to natural forces (landslides, subsidence, washout, frostheave, mudslide, and

earthquake) and marine activities (ship anchor or fishing operations); 9 (4 percent) were attributed

to “other”; and the type of outside force damage was not indicated in the 7 remaining accidents (3

percent).

 Damage prevention programs were in effect in 135 of the 151 accidents (89 percent) for

outside force damage caused by “others,” and in 19 of the 27 accidents (70 percent) for outside

force damage caused by the “operator or its contractor.” The most commonly reported damage

prevention program was the one-call system. For accidents caused by outside force damage caused

by “others,” the excavator did not call or notify the pipeline operator in 68 percent of the reported

accidents. Further, the location of the pipeline was not marked in 62 percent of those accidents

attributed to damage by “others.”

Of the 27 accidents in which the outside force damage was caused by the pipeline operator

or its contractor, the excavator notified the pipeline operator in 12 accidents (44 percent), and the

location of the pipeline was marked in 13 accidents (48 percent). However, in a nearly equal

number of accidents for each of these conditions, the accident report did not specify if the excavator

contacted the pipeline operator or if the pipeline was marked.

Corrosion-Caused Accidents — The Safety Board separately tabulated the number of

accidents reported to have been caused by internal and external corrosion from 1986 through 1994.

Of the 169 accidents attributed to corrosion in this period, 17 (10 percent) were attributed to

internal corrosion, and 147 (87 percent) to external corrosion. The type of corrosion was not

specified in the remaining 5 accidents (3 percent). No data are available to indicate factors or

conditions that affect the rate of accidents due to internal corrosion. Because of the lack of data and

the low percentage of accidents attributed to this cause, the Safety Board did not further evaluate

the data for internal corrosion.

For the 147 accidents reported as external corrosion failures, the Safety Board examined

which pipelines were coated and/or under cathodic protection. Nearly 71 percent of the external

corrosion failures occurred on coated and cathodically protected pipelines, while only 8 percent of
22

the failures occurred on noncoated and noncathodically protected pipelines. Because the number of

miles of hazardous liquid pipelines that are either coated or cathodically protected is not reported to

RSPA, the incidence of external corrosion failures on coated and/or cathodically protected pipelines

could not be normalized and further evaluated.

Accidents with a Reported Cause of “Other” — On the basis of the number of accidents

and barrels of product released, “other” was the second leading reported accident cause from 1986

through 1994 for petroleum product pipeline systems. Of the 193 accidents attributed to the cause

of “other” during this period, 94 (49 percent) were reported to have occurred in 1992, 1993, and

1994. Of these 94 accident reports, 89 had narrative sections.

To determine whether the category of “other” was being properly used by those filling out

part D of form 7000-1 to indicate a cause that did not fall within one of the designated categories,

three investigators from the Safety Board's Pipeline and Hazardous Materials Division

independently reviewed the 89 narrative reports and identified those accidents for which the cause

could reasonably be reclassified to a designated category, should remain classified as “other,” or

was unknown. The assessments of the three investigators varied widely. Two of the investigators

found, however, that the cause for over 50 percent of the accidents was unknown, because the

information provided in the narratives was insufficient to make a causal determination.

Identification of Accident Trends — The high number of accidents with a reported cause

of “other” (the second-leading reported cause) raises concerns about the sensitivity of RSPA’s

accident data to accurately and reliably identify accident trends and link them to system or

regulatory deficiencies. Ideally, this category should serve as a generic category for a small

percentage of accidents that do not fit within the other designated categories for cause.

The fact that a high percentage of accidents is attributed to the generic category “other”

indicates that the defined categories for cause (part D of form 7000-1) are not adequate to identify

most accident causes. The Safety Board noted that the designated categories for cause on form

7000-1 did not account for construction or maintenance-related failures, such as the replacement of

pipeline sections or the recoating of existing pipelines. When supplied with a form that provides

only inadequately defined categories for cause, a pipeline operator is forced to make his own

interpretation of what types of failures should be included under the existing categories for cause.

As demonstrated by the results of the independent review of form 7000-1 narrative sections for

accident reports with a reported cause of “other” conducted by the three Safety Board investigators,

widely differing interpretations are currently possible. Because the existing categories for cause are

imprecise, poorly defined, and do not account for certain types of failures, the specific causes of

reportable accidents do not provide consistent and reliable data. This finding reinforces Safety

Board concerns expressed in previous reports about the reliability of RSPA’s pipeline accident data.

A discussion of these reports and the Safety Board's actions is provided later in this report.

Based on the number of reported accidents, outside force damage has been and remains the

leading cause of accidents for petroleum product pipelines. Safety Board analysis of data for other
23

pipelines suggests that this is true for all pipelines. Of the types of outside force damage listed on

form 7000-1, “damage by others” was indicated in nearly 72 percent of the outside force damagecaused accidents, and “damage by operator or its contractor” in about 13 percent of these accidents.

Because the number of accidents in the other categories of outside force damage individually did

not constitute a large percentage of accidents, the Safety Board made no further evaluation

regarding trends.

Outside force damage caused by the “operator or its contractor” and by “others” includes,

but does not exclusively apply to, excavation-caused damages. RSPA has indicated that excavation

damage is the leading cause of pipeline accidents. From the 7000-1 accident form, however, the

only way to determine whether the accident was caused by excavation is to read the narrative

section. Because the level of detail provided in the narrative section varies, depending upon the

individual filing the report, the narrative section may or may not indicate whether excavation

damages caused the failure.

The Safety Board computed percentages for damage prevention programs, one-call systems,

notifications by excavators, and marking of the pipeline when the outside force damage was caused

by the operator or others. The data elements on form 7000-1 indicating the existence of damage

prevention programs, use of one-call systems, notification by excavators, and temporary marking of

the pipeline are to be completed when outside force damage is caused by the operator or its

contractor or by others. However, damage prevention programs, one-call systems, notification by

excavators, and temporary marking of the pipeline are relevant only in the case of those accidents

caused by excavation activities. Without a specific and separate outside force damage data element

identifying excavation damage on the accident form, the effectiveness of damage prevention

programs, one-call systems, excavator notifications, and marking of the pipeline cannot be

determined from the accident data.

Most external corrosion failures occur in pipes that are both coated and cathodically

protected. This may be due to one or more factors. Because the number of miles of coated and

cathodically protected pipe may be far greater than the number of miles of noncoated and/or

noncathodically protected pipe, the exposure of coated and cathodically protected pipe to conditions

conducive to corrosion may also be greater and result in a higher incidence of external corrosion

failure. External corrosion failures may also occur because coatings have been damaged or for other

reasons not readily apparent. It is also possible that the high number of failures for coated and

cathodically protected pipe may suggest that different types of coatings and/or methods of cathodic

protection are not as effective as had been presumed. However, form 7000-1 does not request the

operator to provide data about types of coatings or cathodic protection systems, damage to coatings,

or exposure conditions that would enable RSPA to analyze the causes for external corrosion

failures.

The Safety Board concludes that, although RSPA's data on hazardous liquid pipeline

accidents can be analyzed to determine some general trends and conclusions, the data on hazardous
24

liquid pipelines, as they are currently collected and reported, are not sufficient for RSPA to perform

an effective accident trend analysis or to properly evaluate operator performance.

Comparison of Operator Accident Rates — To compare the reported accident rates for

Colonial with other petroleum product pipeline operators, the number of accidents per operator per

year was tabulated from 1986 through 1994. The accidents considered involved releases of

petroleum products and considered failures of any component within the pipeline system, including

line pipe, pump stations, and tank farms. Of the 95 operators that reported at least one accident

during this period, 14 operators, including Colonial, accounted for 487 of the 742 reported

accidents (66 percent). Because these numbers do not indicate relative factors such as annual

throughput, miles of pipeline operated, size of the pipeline, or volume of products released, the

Safety Board attempted to normalize the RSPA accident data and develop more comparable

indicators of accident rates and quantities of product released for this group of operators.

Other than pipeline mileage, which is reported as part of its user fee assessment program,

RSPA does not collect or maintain data that can be used to normalize the accident data for all

hazardous liquid pipelines. However, data pertaining to annual product throughput, miles of

pipeline operated, and size of pipeline, which can be used to normalize the RSPA accident data, are

reported on the FERC form number 6: Annual Report of Oil Pipeline Companies. The form 6 report

is designed to collect financial and operational information from the operators of petroleum and

petroleum product pipelines. Form 6 distinguishes “crude oil” (oil in its natural state, not altered,

refined, or prepared by any process) from “products” (oils that have been refined, altered, or

processed for use, such as fuel oil and gasoline). FERC's definitions are comparable to the

definitions of 49 CFR 195.2 for “petroleum” (crude oil, condensate, natural gasoline, natural gas

liquids, and liquefied petroleum gas) and “petroleum product” (flammable, toxic, or corrosive

products obtained from distilling and processing of crude oil, unfinished oils, natural gas liquids,

blend stocks, and other miscellaneous hydrocarbon compounds). The data in form 6 for pipeline

mileage and size are provided for crude oil gathering pipelines, crude oil trunk pipelines, and

product trunk pipelines.

However, form 6 reports are not submitted or stored in an electronic format for easy

retrieval. Given these practical considerations, the Safety Board obtained form 6 reports only for the

period from 1992 through 1994 to demonstrate the type of data analysis that can be performed to

develop normalized indicators of an individual operator's accident history and product release rate.

The normalized indicators could then be used to compare the safety record of one operator relative

to other operators.

The Safety Board compared data for Colonial and the 13 other petroleum product pipeline

operators that collectively filed the majority of the accident reports for the 3-year period from 1992

through 1994. The Safety Board combined the FERC data for annual product throughput and

pipeline mileage with the available RSPA accident data to compute the number of accidents per

1,000 miles of pipeline and the number of barrels of product released per 1 million barrels

transported. (See tables 1, 2, and 3.)
25

Table 1. -- Pipeline mileage and product throughput for operators

1992 1993 1994

Miles of

Pipeline

Annual

Throughput

(Million

barrels)

Miles of

Pipeline

Annual

Throughput

(Million

barrels)

Miles of

Pipeline

Annual

Throughput

(Million

barrels)

PIPELINE

OPERATOR

Colonial 5,315 676 5,317 706 5,317 698

A 2,298 157 1,924 158 1,924 155

B 2,078 92 2,095 79 548 53

C not avail. not avail. 3,140 298 3,044 308

D 3,291 228 3,291 214 3,645 215

E 2,143 72 2,112 76 2,104 83

F 2,600 100 2,619 110 2,631 130

G 1,470 255 1,495 296 1,494 282

H 1,566 112 1,350 112 1,321 112

I 3,162 178 3,144 174 3,144 186

J 3,339 323 3,338 333 3,340 350

K 1,643 106 1,754 130 1,849 122

L 4,199 151 4,299 152 4,332 173

M 6,646 161 7,206 182 7,389 202
26

Table 2.--Accidents per 1,000 miles of pipeline

1992 1993 1994

PIPELINE

OPERATOR

Colonial 3.38 2.44 2.44

A 2.61 0.52 0.52

B 3.36 4.29 10.95

C 1.59* 1.91 0.66

D 0.91 0.00 0.27

E 2.34 0.47 1.43

F 0.38 1.15 0.38

G 2.04 1.33 3.33

H 0.00 0.74 0.76

I 3.16 3.18 1.27

J 4.19 2.99 2.10

K 1.22 2.86 1.62

L 0.71 0.95 0.69

M 1.05 0.69 0.95

* Because this operator did not report on form 6 the miles of pipeline operated in 1992, this value

is based on the miles of pipeline reported on form 6 in 1993. The value was not used to calculate the

mean or median values.
27

Table 3.--Barrels released per 1 million barrels transported

1992 1993 1994

PIPELINE

OPERATOR

Colonial 19.60 14.27 44.07

A 14.52 2.46 0.27

B 21.52 32.37 130.25

C 3.89* 3.36 1.02

D 1.61 0.00 0.43

E 39.76 2.64 5.13

F 0.01 0.83 2.19

G 0.74 6.17 0.02

H 0.00 2.67 0.03

I 8.55 5.46 2.89

J 3.91 8.78 7.77

K 12.63 11.49 23.94

L 21.46 50.17 50.82

M 63.76 10.58 3.59

* Because this operator did not report on form 6 the total barrels of product transported in 1992,

this value is based on the total barrels of product reported on form 6 in 1993. The value was not used to

calculate the mean or median values.
28

According to these data, Colonial had 3.38 accidents per 1,000 miles of pipeline in 1992,

and 2.44 accidents per 1,000 miles of pipeline in 1993 and 1994. The mean and median values of

accidents per 1,000 miles of pipeline for Colonial and the other 13 operators during this 3-year

period were, respectively, 1.86 and 1.27 accidents per 1,000 miles of pipeline. The number of

barrels released per 1 million barrels transported for Colonial was 19.60 in 1992, 14.27 in 1993, and

44.07 in 1994. For the same 3-year period, the mean and median values of the barrels released per 1

million barrels transported for this group of operators, including Colonial, were 15.41 and 5.46,

respectively.

Evaluation of Accident and Release Rates for Colonial Pipeline Company —

Although the accident and product release rates computed by the Safety Board have limited value

because of the short time period (1992-1994) and the small number of pipeline operators considered

(14), these computed rates do permit a comparison of the normalized accident rates and the

incidence of product releases for the pipeline operators considered. When the accident rate

(accidents per 1,000 miles of pipeline) and the product release rate (barrels released per 1 million

barrels transported) are normalized in this way, both Colonial's accident and product release rates

for all 3 years exceeded the respective mean and median values for the group of 14 operators. The

Safety Board concludes that, based on the limited analyses of accidents for 14 liquid pipeline

operators for the period 1992 through 1994, the rates for accidents per pipeline mile and for product

volume released per volume transported were greater for the Colonial Pipeline Company than the

average and median rates for the group.

The Safety Board recognizes that other methods may be used to normalize and compare

operator performance. For example, the FERC reports also include data on pipeline size that could

be used with mileage data to normalize accident and product release rates on the basis of an

equivalent pipe size. Nevertheless, the Safety Board's analysis demonstrates that such an evaluation

and analysis can be done and that a more extensive analysis could be routinely performed with

existing computer systems and data retrieval systems. RSPA should perform this type of analysis to

evaluate the safety performance of all hazardous liquid pipeline operators.
29

FEDERAL OVERSIGHT

Introduction

RSPA, through the OPS, is responsible for developing and enforcing Federal safety

standards for the transportation of gas and hazardous liquids by pipeline. In its report of the Edison,

New Jersey, accident,23 the Safety Board provided a detailed history of RSPA actions to address the

issues of minimizing excavation-caused damages, inspection and testing of pipelines, and measures

to limit product release from a failed segment of pipeline. These safety issues were also factors in

most of those accidents that were discussed earlier in this report. Excavation damages caused the

cited pipeline ruptures in: Los Angeles and San Bernardino, California; Bayamon, Puerto Rico;

and, more recently, Fountain Inn, South Carolina; and Reston, Virginia. Effective inspections and

testing for excavation damage, external corrosion, and defective welds were factors in the San

Bernardino and Long Beach, California; Mounds View, Minnesota; Kaycee, Wyoming; and

Manassas and Locust Grove, Virginia; accidents. Efforts to limit product release by rapid leak

detection and shutdown and valve spacing were factors in the Long Beach, California; Mounds

View, Minnesota; and Freeport, Pennsylvania; accidents.

Because these safety issues apply to all pipelines, the following section of this report

updates RSPA initiatives to address these safety issues since the adoption of the Edison report. The

section also summarizes RSPA initiatives regarding the control of corrosion damage. Because the

Safety Board's evaluation of RSPA’s accident data for petroleum product pipelines indicated

significant areas of concern, this section discusses accident data collection and analysis and their

use by RSPA in establishing program priorities.

RSPA Initiatives on Previous Safety Issues

Minimizing Excavation Caused Damages — As noted in the Edison accident report, the

Safety Board recommended in 1973 that RSPA:

 P-73-12

Amend 49 CFR 192 and 49 CFR 195 to require each pipeline operator to establish a

program for the prevention of excavation-type damage to its underground facilities.

 23See NTSB/PAR-95/01.
30

On June 23, 1980, the Safety Board urged RSPA to:

P-80-54

Expedite final action on rulemaking Docket No. PS-59, concerning damageprevention programs.

As a result of the Bayamon, Puerto Rico, accident, the Safety Board on February 26, 1981,

urged RSPA to:

P-80-89

Amend 49 CFR 195 to include a section similar to proposed 49 CFR 192.614,

Damage Prevention Program, to require that all liquid pipeline operators develop,

implement, and monitor the effectiveness of an excavation damage prevention

program.

In 1982, RSPA published requirements (49 CFR 192.614) for gas pipeline operators to

implement excavation damage prevention programs. (Minor revisions were made in 1987.) The

regulations required gas pipeline operators to have a written damage prevention plan that: (1)

identified the persons who normally engage in excavation activities around buried pipelines; (2)

included procedures to inform the public and excavators about the damage prevention program and

the need to locate buried pipelines before excavation activities begin; (3) provided a means of

receiving and recording notifications of planned excavation activities; (4) specified procedures to

temporarily mark pipelines before excavation begins and advise the excavator about the markings

and how they can be identified; and (5) directed inspection of the pipeline during and after

excavation activities to ensure the integrity of the pipeline. These regulations also allowed operators

to comply with portions of these regulatory requirements by participating in one-call notification

systems.

Because of this regulatory action, Safety Recommendation P-80-54 was classified

“Closed--Acceptable Action” on September 16, 1986. On September 3, 1985, Safety

Recommendation P-80-89 was classified “Closed--Superseded” because Safety Recommendation

P-84-26, which had been issued following the Safety Board's investigation of the rupture of a

liquefied petroleum gas pipeline in West Odessa, Texas,24 also dealt with hazardous liquids and

incorporated the cited action under Safety Recommendation P-80-89. The recommendation urged

RSPA to:

 24Pipeline Accident Report--Mid-America Pipeline System Liquefied Petroleum Gas Pipeline Rupture, West

Odessa, Texas, March 15, 1983 (NTSB/PAR-84/01).
31

P-84-26

Amend Federal regulations governing pipelines that transport highly volatile liquids

to require a level of safety for the public comparable to that now required for natural

gas pipelines.

On February 11, 1994, RSPA published new regulations25 that require the operations and

maintenance procedures for natural gas and hazardous liquid pipelines to be more consistent. On

April 22, 1994, the Safety Board advised RSPA that, although these regulations partially satisfied

the objective of Safety Recommendation P-84-26, similar actions were needed in many other areas,

such as establishing criteria for the performance of systems used to monitor the operation of

pipelines. The recommendation was left in an “Open--Acceptable Response” status.

RSPA amended 49 CFR Parts 192 and 195 on March 20, 1995, to require excavation

damage prevention programs for previously exempted gas pipelines in rural areas and operators to

implement damage prevention programs for hazardous liquid and carbon dioxide pipelines.26 RSPA

added a new section, 49 CFR 195.442, requiring operators of hazardous liquid pipelines and carbon

dioxide pipelines to establish written damage prevention programs by September 20, 1995. The

elements of the damage prevention programs now required under 49 CFR 195.442 for hazardous

liquid pipelines parallel those of 49 CFR 192.614 for gas pipelines. Under section 195.442, an

operator could comply with the requirements for a damage prevention program through

participation in a public service program, such as a one-call system. However, an operator's

participation in a public service program does not “relieve the operator of responsibility for

compliance” (section 195.442).

In conjunction with these amendments, RSPA also published a notice of proposed

rulemaking (NPRM) for mandatory participation in one-call notification systems.27 Under the

proposed revisions to 49 CFR 192.614 for gas pipelines and 49 CFR 195.442 for hazardous liquid

pipelines, a pipeline operator would be required to participate in a one-call system meeting the

standards specified in 49 CFR 198.37 (State One-Call Damage Prevention Program) and 198.39

(Qualifications for Operation of One-call Notification System) to provide a means of receiving and

recording notifications of planned excavation activities.

 25Operations and Maintenance Procedures for Pipelines, Docket PS-113 (59 Federal Register (FR) 6579) on

February 11, 1994.

26Excavation Damage Prevention Programs for Gas and Liquid and Carbon Dioxide Pipelines, Docket PS101 (60 FR 14646) on March 20, 1995.

27Mandatory Participation in Qualified One-Call Systems by Pipeline Operators, Docket PS-101A (60 FR

14714) on March 20, 1995.
32

The Safety Board notes that RSPA is enhancing the standards for damage prevention

programs in Part 192 for gas pipelines and implementing parallel standards in Part 195 for

hazardous liquid pipelines. As a result of these new regulations, the objectives of Safety

Recommendation P-84-26 are closer to realization, but not yet attained. Because inconsistencies

remain between the requirements in Part 192 and Part 195, Safety Recommendation P-84-26

remains classified “Open--Acceptable Response.”

In addition to these regulatory initiatives, RSPA drafted legislation that would provide

grants to the States as an incentive to develop and implement one-call systems. A RSPA staff

member indicated to Safety Board representatives that the proposed legislation is currently awaiting

approval by the Office of Management and Budget. Key provisions of the proposed legislation are:

• All underground facility operators must be members of the one-call system.

• All excavators must use the one-call system before excavation work begins.

• States would implement timely administrative enforcement.

• The DOT, through RSPA, would produce a model one-call system for States to follow.

• RSPA would provide grants to the States to enhance their one-call systems.

RSPA is also promoting a public education campaign to provide industry training of

employees responsible for one-call systems, training of excavators about safe digging practices, and

education of the general public. Through the State grant programs, RSPA provides financial

support ($750,000 in fiscal year 1995) to the States to implement and enhance their one-call

systems, including the use of quick and effective administrative enforcement of penalties for onecall violations.

The Safety Board and RSPA/DOT also jointly sponsored an excavation damage prevention

workshop on September 8 and 9, 1994, that was attended by more than 375 government and

industry representatives. The workshop provided a forum for participants to identify and recommend potential ways to enhance excavation damage prevention programs.28

 28The Safety Board published the Proceedings of the Excavation Damage Prevention Workshop (NTSB/RP95/01) from the workshop in September 1995 and is now analyzing the workshop panels' findings, together with

previous Board reports on excavation damage accidents, comments by interested parties, and other related documents, to

develop recommendations for actions necessary to further enhance excavation damage prevention programs nationwide.
33

Through its regulatory and other initiatives, RSPA is taking positive action to minimize

pipeline accidents caused by excavation damage. The Safety Board supports RSPA's efforts to

address this safety issue not only through regulatory action, but also through public education,

training, enhancement of one-call systems, and more timely enforcement against one-call system

violations.

Controlling External Corrosion Damage — The Safety Board concluded, in its

investigation of the pipeline rupture in Mounds View, Minnesota, that the pipe failed in an area that

had been severely weakened by external corrosion and that Federal requirements for cathodic

protection of pipelines transporting hazardous liquids provided no guidance other than requiring

that a cathodic protection program exist. Consequently, the Safety Board recommended in 1987 that

RSPA:

P-87-24

Revise 49 CFR Part 195 to include criteria, similar to those found in Part 192, for

liquid pipeline operators to evaluate their cathodic protection systems.

RSPA indicated in May 1988 that it would review the criteria set forth in a revised industry

standard established by the National Association of Corrosion Engineers and propose comparable

standards for both gas and hazardous liquid pipeline operators. On the basis of this response, Safety

Recommendation P-87-24 was classified “Open--Acceptable Response.”

Although the requirements in 49 CFR 195.414 for cathodic protection were amended in

1991 and 199429 and the requirements in 195.416 for external corrosion control were amended in

1994,30 the standards for cathodic protection and external corrosion control were not significantly

changed and still do not include criteria similar to those in 49 CFR Part 192. RSPA officials

verbally confirmed in September 1995 that no regulatory project is planned to revise the cathodic

protection requirements of Part 195 because RSPA has given other projects higher priority. Also,

the DOT's semiannual regulatory agenda, published on November 28, 1995,31 did not list any

existing or proposed regulatory project to revise the cathodic protection requirements of 49 CFR

Part 195.

As indicated by the Safety Board's evaluation of RSPA's accident data, external corrosion

failures continue to account for nearly 20 percent of the accidents involving petroleum product

pipelines. In the 8 years that have elapsed since Safety Recommendation P-87-24 was issued,

RSPA has not taken any meaningful action to address this issue. Further, there is no indication from

 29At 56 FR 26926 on June 12, 1991, and 59 FR 35471 on July 12, 1994.

30At 59 FR 33397 on June 28, 1994.

31At 60 FR 60296 on November 28, 1995.
34

the DOT regulatory agenda that RSPA intends to act on this recommendation. Because of RSPA's

inaction, the Safety Board classifies Safety Recommendation P-87-24 “Closed--Unacceptable

Action.”

Inspection and Testing — The Safety Board issued Safety Recommendations P-87-4

through -7 on internal inspection of pipelines following its investigation of two pipeline ruptures

that took place in Beaumont and Lancaster, Kentucky.32 The four safety recommendations urged

that RSPA:

P-87-4

Require operators of both gas and liquid transmission pipelines to periodically

determine the adequacy of their pipelines to operate at established maximum

allowable operating pressures by performing inspections or tests capable of

identifying corrosion-caused and other time-dependent damages that may be

detrimental to the continued safe operation of these pipelines and require necessary

remedial action.

P-87-5

Establish criteria for use by operators of pipelines in determining the frequency for

performing inspections and tests conducted to determine the appropriateness of

established maximum allowable operating pressures.

P-87-6

Require existing natural gas transmission and liquid petroleum pipeline operators,

when repairing or modifying their systems, to install facilities to incorporate the use

of in-line [internal] inspection equipment.

P-87-7

Require that all new gas and liquid transmission pipelines be constructed to

facilitate the use of in-line [internal] instrument inspection equipment.

On November 20, 1992, RSPA issued an NPRM on the internal inspection of pipelines. In

the final rule, published on April 12, 1994, RSPA required that new and replacement gas

transmission and hazardous liquid pipelines be designed to accommodate internal inspection

 32Pipeline Accident Report--Texas Eastern Gas Pipeline Company Ruptures and Fires in Beaumont, Kentucky,

on April 27, 1985 and Lancaster, Kentucky, on February 21, 1986 (NTSB/PAR-87/01).
35

devices.33 Because the new regulations required that new and most refitted gas and hazardous liquid

pipelines accommodate the passage of internal inspection devices, the Safety Board classified

Safety Recommendations P-87-6 and -7 “Closed--Acceptable Action” on February 7, 1995. RSPA

also indicated that it was planning to issue an NPRM proposing that internal inspection devices or

other equivalent inspection methods be required on gas pipelines in highly populated areas and on

hazardous liquid pipelines in highly populated areas, environmentally sensitive areas, and navigable

waterways.

The Safety Board reaffirmed in the Edison report the need for periodic inspections of highpressure pipelines, especially in urban and environmentally sensitive areas, to assess their fitness for

continued safe operation. The Board also reaffirmed that RSPA should take:

Complete regulatory action to require that internal inspection technology be used to

periodically assess the condition of pipelines, and to establish criteria for operators

to use in determining how often pipelines should be internally inspected to ensure

unsafe conditions are detected before a pipe fails.

The Safety Board affirmed the “Open--Acceptable Response” classification of Safety

Recommendation P-87-4, reiterated the recommendation, and urged RSPA to complete action on

this issue in 1995.

On October 18, 1995, RSPA conducted a public workshop to discuss issues “relevant” to

the development of regulations requiring increased inspection of certain gas and hazardous liquid

pipelines.34 The purpose of the workshop was to “enable government and industry representatives

to reach a better understanding of the problem and potential solutions before proposed rules are

issued.” The issues addressed in the workshop included the: (1) adequacy of current DOT safety

regulations that require periodic inspection of pipelines for corrosion and leaks; (2) circumstances

in which the regulations should require the use of instrumented internal inspection devices; (3)

types of defects that should be required to be detected by internal inspection devices; (4) alternative

inspection methods to the use of instrumented internal inspection devices; (5) definitions for “highdensity population,” “environmentally sensitive areas,” and “navigable waterways;” and (6) costs of

inspections with internal inspection devices. In an update of its regulatory agenda that was

published on November 28, 1995, RSPA projected that an NPRM would be published by April

1996.35

 33Passage of Internal Inspection Devices, Docket PS-126-1 at 57 FR 54745 on November 20, 1992, and 59 FR

17275 on April 12, 1994.

34At 60 FR 44821 on August 29, 1995.

35At 60 FR 60436 on November 28, 1995.
36

Although 8 years have past since the Safety Board issued Safety Recommendation P-87-4,

RSPA has yet to complete action on this recommendation. By conducting the workshop in October

1995, RSPA prolonged the regulatory process and will not publish an NPRM before April 1996,

despite the Safety Board's reiteration of the recommendation and strong urging in the Edison report

to complete action on this issue in 1995.

The Safety Board recognizes that RSPA’s need to coordinate with industry about the

problems and potential solutions for the inspection and testing of pipelines is valid, but much of the

coordination could and should have been accomplished much earlier. Although coordination with

industry is likely to be an ongoing process, RSPA could and should have proceeded with the

regulatory process in those areas in which there was a consensus by industry and government.

Consequently, the Safety Board believes that RSPA has not been responsive to this issue and

therefore classifies Safety Recommendation P-87-4 “Open--Unacceptable Response.”

Further, the establishment of criteria for determining the frequency of inspections and tests

as called for in Safety Recommendation P-87-5 cannot be addressed in a meaningful way until the

action needed to implement Safety Recommendation P-87-4 has been completed. Consequently, the

Safety Board also classifies Safety Recommendation P-87-5 “Open--Unacceptable Response.”

Because of the importance of this issue, the Safety Board reiterates Safety Recommendations P-87-

4 and -5.

Limiting Product Release from Failed Pipe — In the Edison report, the Safety Board

also addressed pipeline monitoring and leak detection and the use of remotely operated or

automatic valves as methods to achieve a rapid shutdown of failed pipeline segments, to isolate the

failed pipeline segments, and to limit the release of product from the pipeline. In Safety

Recommendation P-91-1, which was issued in the North Blenheim, New York, accident report,36

the Safety Board recommended that RSPA:

P-91-1

Define the operating parameters that must be monitored by pipeline operators to

detect abnormal operations and establish performance standards that must be met to

detect and locate leaks.

In response to this recommendation, RSPA committed to undertake a 2-year study to

determine whether SCADA systems and SCADA-based leak detection systems should be required

on gas and hazardous liquid pipelines. In May 1992, RSPA contracted with the Volpe National

Transportation Systems Center (Volpe) to analyze SCADA systems and computer-generated leak

detection systems to determine (1) the feasibility and costs of requiring operators to use SCADA

 36Pipeline Accident Report--Liquid Propane Pipeline Rupture and Fire, Texas Eastern Products Pipeline

Company, North Blenheim, New York, March 3, 1990 (NTSB/PAR-91/01).
37

systems with a leak detection subsystem and (2) existing impediments or needed improvements to

minimize the time that SCADA systems require to detect and locate leaks. The study was also to

recommend resolutions for identified difficulties. The study, which was completed in September

1995,37 indicated that a SCADA or leak detection system “can be found to suit most pipeline

environments.” It further stated, “Field instruments coupled with a telephone line and a personal

computer can, in most cases, provide the pipeline operator with reliable status information on the

pipeline. Implementation of a system, including dispatcher training, can allow almost any pipeline

operator to conduct effective rupture detection.”

As noted in the Edison report, the Safety Board began in 1970 to address the need for rapid

shutdown of failed pipe segments, and subsequently identified the need to require automatic control

valves and/or remote control valves to facilitate rapid shutdown of failed pipelines in five other

accident investigations dating back to 1970.38 As a result of its investigation of the Mounds View,

Minnesota, accident, the Safety Board recommended in 1987 that RSPA:

P-87-22

Require the installation of remote-operated valves on pipelines that transport

hazardous liquids, and base the spacing of remote-operated valves on the population

at risk.

Between 1987 and 1992, RSPA conducted research studies and published several proposed

rules in response to Safety Board recommendations and Congressional proposals, as previously

described in the Edison report. Despite these initial actions, RSPA has not implemented any

requirements for automatic control valves or remote control valves as means of achieving rapid

shutdown of failed pipeline segments.

On September 2, 1992, RSPA advised the Safety Board that the Pipeline Safety Act of 1992

(Public Law 102-508) mandated that RSPA complete a study on emergency flow restricting devices

for hazardous liquid pipelines by October 1994 and issue a final rule by October 1996. Under this

act, RSPA's study was to assess the effectiveness of emergency flow restricting devices

 37Sherry Smith Borener, et al. Remote Control Spill Reduction Technology: A Survey and Analysis of

Applications for Liquid Pipeline Systems, U.S. Department of Transportation (Cambridge, Massachusetts: Volpe

National Transportation Systems Center, 1995).

38Pipeline Accident Report--Phillips Pipe Line Company Propane Gas Explosion, Franklin County, Missouri,

December 9, 1970 (NTSB/PAR-72/01); Pipeline Accident Report--Mid America Pipeline System Liquefied Petroleum

Gas Pipeline Rupture, West Odessa, Texas, March 15, 1983 (NTSB/PAR-84/01); Pipeline Accident Report--Williams

Pipe Line Company, Liquid Pipeline Rupture and Fire, Mounds View, Minnesota, July 8, 1986 (NTSB/PAR-87/01);

Railroad Accident Report, Derailment of Southern Pacific Freight Train on May 12, 1989, and Subsequent Rupture of

Calnev Petroleum Pipeline on May 25, 1989, San Bernardino, California (NTSB/RAR-90/02); Pipeline Accident

Report--Liquid Propane Pipeline Rupture and Fire, Texas Eastern Products Pipeline Company, North Blenheim, New

York, March 13, 1990 (NTSB/PAR-91/01).
38

(including remote control valves and check valves) and equipment used to detect and locate

pipeline ruptures and minimize product releases from pipeline facilities.

On January 19, 1994, RSPA issued an advance notice of proposed rulemaking (ANPRM)

(Docket No. PS-133, 59 FR 2802) soliciting comments on a series of questions on emergency flow

restricting devices and leak detection systems to assist it in developing requirements. RSPA stated

that responses received by April 19, 1994, would be used in developing a rulemaking proposal.

RSPA further stated that it had been concerned for some time with rapid leak detection on

hazardous liquid pipelines and the optimum placement of emergency flow restricting devices. In the

ANPRM, RSPA reviewed its actions on this issue since 1978, including its publication of a March

1991 study entitled the Emergency Flow Restricting Devices Study. RSPA further indicated that it

was soliciting information and data by posing a series of questions, rather than conducting a

traditional research survey of a selected number of respondents, so that it could obtain a broader

base of data and accelerate the regulatory process.

In the Edison report, the Safety Board stated its belief that RSPA's 1991 study report on

emergency flow restricting devices was seriously flawed and caused the Congress, in Public Law

102-508, to inappropriately limit considerations of emergency flow restricting devices to hazardous

liquid pipelines. The Safety Board also noted that its review of RSPA's 1991 study and the Edison

accident clearly demonstrated that RSPA needed to reconsider its actions on using remote control

valves and automatic control valves as main line valves to promptly limit the flow of natural gas to

failed pipeline segments, especially in urban or environmentally sensitive areas. To that end, the

Board classified Safety Recommendation P-87-22 “Closed--Unacceptable Action/Superseded” and

recommended that RSPA:

P-95-1

Expedite requirements for installing automatic- or remote-operated mainline valves

on high pressure pipelines in urban and environmentally sensitive areas to provide

for rapid shutdown of failed pipeline segments.

In a May 12, 1995, response to Safety Recommendation P-95-1, RSPA stated that it

intended to publish an NPRM in fall 1995 that would specify those circumstances under which

operators of hazardous liquid pipelines would be required to use emergency flow restricting

devices. The Safety Board classified the recommendation “Open--Acceptable Response” on 

July 17, 1995.

On October 19, 1995, RSPA held a public workshop on emergency flow restricting

devices.39 RSPA stated that it held the workshop in part because RSPA had received only limited

data in response to the 1994 ANPRM. RSPA also stated that the purpose of the workshop was “to

 39See docket PS-133 at 60 FR 44822 on August 29, 1995..
39

enable government and industry to reach a better understanding of the problem and the potential

solutions before proposed rules are issued.” Placement of emergency flow restricting devices, leak

detection sensitivity, requirements for a leak detection system, and use of emergency flow

restricting devices at pump stations and breakout tanks were addressed at the workshop. According

to the semiannual DOT regulatory plan published on November 28, 1995,40 an NPRM proposing

requirements for the use of emergency flow restricting devices and other procedures, systems, and

equipment to detect and locate pipeline ruptures was scheduled to be published in December 1995.

Subsequently, a RSPA staff member advised a Safety Board investigator that, as of December 20,

1995, RSPA is projecting publication of the NPRM in the first quarter of 1996.

Many of the topics discussed at the workshop were also considered in the Volpe

Transportation Center study. Because it scheduled the workshop as a prelude to the development of

proposed rules, RSPA could not meet its commitment to issue an NPRM in fall 1995 and is now

predicting an additional delay of 3-6 months. As is the case with the inspection and testing of

pipelines, RSPA has performed studies, conducted research, and sought industry input, but has

failed to carry through and develop requirements for leak detection and rapid shutdown of failed

pipelines. The Safety Board acknowledges the complexity of SCADA and leak detection systems

that would indicate the proximate location of leaks. However, as noted in the Volpe study, less

complex equipment can now be effectively used to enhance an operator's leak detection capability.

Rapid shutdown can be achieved through appropriate use and spacing of remotely operated valves,

automatic valves, and other emergency flow restriction devices. Consequently, the Safety Board

believes that RSPA has not been sufficiently responsive to this issue and reiterates Safety

Recommendation P-95-1. The recommendation remains classified “Open--Acceptable Response.”

In light of all of these considerations, the Safety Board concludes that although RSPA has

taken regulatory action and undertaken other initiatives to minimize excavation damage, RSPA has

failed to take effective and timely action to address corrosion control, inspection and testing of

pipelines, and methods to limit the release of product from failed pipelines.

Accident Data Collection and Analysis

Accident Reporting Requirements — The requirements and criteria for reporting

hazardous liquid pipeline accidents are found in 49 CFR 195.50 and 195.54. The operator of a

hazardous liquid pipeline must file an accident report on DOT form 7000-1 within 30 days after the

discovery of the accident. The operator is also required to file a supplemental report on form 7000-1

within 30 days after receiving any change of information or additional information to the original

report. Under the provisions of 49 CFR 195.50, a “reportable accident” is a failure in the pipeline

system in which a release of hazardous liquid results in any of the following: (1) unintentional fire

or explosion; (2) loss of 50 or more barrels of the hazardous liquid; (3) escape to the atmosphere of

 40At 60 FR 59633 on November 28, 1995.
40

more than 5 barrels a day of a highly volatile liquid; (4) a fatality; (5) injuries resulting in loss of

consciousness, medical treatment, or disability; and (6) property damage exceeding $50,000.

Part D of form 7000-1 has six specific categories (corrosion, failed weld, incorrect operation

by operator, failed pipe, outside force damage, and malfunction of control or relief equipment) and

one generic category (other) to record the cause of an accident. Additional data are collected for

accidents caused by corrosion and outside force damage in parts I and J of the form, respectively. In

part I, there are codes to specify whether the corrosion was internal or external, whether the

pipeline/facility was coated and/or under cathodic protection, and the type of corrosion. The 12

codes in part J include one generic category, “other,” to identify the type of outside force damage,

as well as codes to indicate whether a damage prevention program was in effect, whether such a

program was a one-call system, whether the excavator notified the pipeline operator, and whether

the pipeline location was temporarily marked.

RSPA provides a one-page set of instructions for completing and submitting the hazardous

liquid pipeline accident report form. (See appendix B.) The instructions do not define the causes

listed in part D or the categories of outside force damage in part J, nor do they provide any guidance

regarding the classification of different types of failures. For example, there is no guidance as to

what distinguishes “damage by natural forces” from landslides, subsidence, washouts, frostheaves,

and earthquakes as categories of outside force damage.

“Damage by others” includes excavation damage, acts of vandalism, and unintentional

damage caused by activities other than excavation. The data codes for damage prevention

programs, one-call systems, notification by the excavator, and temporary marking of the pipeline

are meaningful only for excavation activities. Because these four data elements are not associated

with excavation damages only, the effectiveness of these measures cannot be ascertained from the

accident data.

Accident Data Base Information — RSPA maintains the accident data reported by both

gas and hazardous liquid pipeline operators in the Integrated Pipeline Information System (IPIS).

According to RSPA, the IPIS provides the operational and statistical information necessary to

perform failure and cost-benefit analyses and various other studies in support of rulemaking,

enforcement, and research activities. The IPIS comprises eight subsystems:

• annual report data for gas distribution and transmission operators;

• incident/accident data for gas transmission and distribution operators and hazardous

liquid operators;

• telephonic notification data base maintained by the National Response Center (NRC)

and the Volpe National Transportation Center;

• safety-related conditions data;

• operator inspections data (OPINS);
41

• enforcement data;

• user fee data; and

• State grant data.

A member of RSPA's data analysis staff acknowledged that reliable accident data are

critical to support regulatory development, compliance activities, trend analysis, and strategic

planning. The RSPA staff member also stated that, in response to the DOT 1989 Safety Review

Task Force and other studies, RSPA has made a concerted effort to improve the quality of its

accident data. In 1993, RSPA implemented a number of computer routines to validate accident

data, such as flagging suspect data, ensuring that mandatory data elements (operator name, product,

date, and so forth) are provided, verifying that appropriate subdata elements (such as those for

corrosion and outside force damage) have been entered for the accident cause, and searching for

duplicate reports. RSPA also manually screens all accident reports with an attributed cause of

“other” to ensure that the actual cause does not meet one of the form’s other specific accident

causes. In October 1994, RSPA began to use contractors to review and validate each data element

and to determine whether there was any correlation among the data elements.

Use of Accident Data — RSPA stated that it analyzes accident data to identify accident

trends and cited, as an example, its analysis that prompted RSPA to initiate a national campaign for

the States to adopt one-call notification systems to locate and mark underground utilities,

specifically gas and hazardous liquid pipelines. RSPA also uses the accident data to calculate the

economic impact of accidents by preparing cost-benefit justifications for rulemakings, as well as

risk assessments. Using the reported data for injuries, fatalities, and quantities of product spilled,

and the DOT-determined dollar-equivalent amounts for each of these events, RSPA computes the

economic impact of each event. The dollar-equivalent amounts are then combined with reported

property losses to arrive at the estimated costs of a pipeline accident. Environmental costs, which

often exceed those of property damage, are included under property damage, rather than reported

separately.

RSPA also uses the pipeline accident data to support its pipeline operator inspection

program. At the request of Congress in the mid-1980s, RSPA began to develop a prioritized

inspection plan for pipeline operators. A computer program, known as the Pipeline Inspection

Priority Program (PIPP) was first used in 1987 to assist in assigning inspection priorities for 1988.

By 1991, restructuring of the computer program resulted in the development of a second program,

PIPP II. The original program, which was redesignated PIPP I, computes a risk assessment of each

pipeline operator nationwide. PIPP II uses data from the enforcement data base and the OPINS data

base to calculate factors that are totaled to provide a risk assessment based on regional inspection

and compliance data.

To compute a risk assessment, PIPP I uses the accident/incident data, the annual reports

submitted by natural gas transmission and distribution pipeline operators, and the pipeline mileage

reported by hazardous liquid pipeline operators. PIPP I uses a point system to assign a risk level in
42

various categories for different types of pipeline systems, such that the increasing point values

correspond to increasing risk. The risk assessment for an individual operator is the sum of the

points from each category. For hazardous liquid pipelines, the categories include the number of

accidents reported per mile of pipeline, the number of accidents due to each of the specific causes

on the accident report form, the total barrels of product spilled, and the total injuries and deaths not

caused by outside force. The risk categories for gas pipelines are more extensive because the annual

reports for gas pipeline systems contain more detailed data about the type of pipe and its size,

mileage, coating, and cathodic protection. (See appendix C.) RSPA reviews both PIPP I and II

annually to help set inspection priorities for the coming year.

Effects on Program Management — RSPA, through the OPS, is working to implement a

risk management program for its pipeline safety program. In a June 1995 report,41 a joint

government and industry task group evaluating the use of risk management by RSPA and within the

hazardous liquid pipeline industry noted that a risk management program would enable RSPA to

focus its regulatory and oversight efforts on the most important risk issues, by developing a

regulatory framework that would allow a pipeline operator to use its resources to improve safety

performance in the most efficient manner possible.

The report also noted that RSPA employs elements of risk management through its PIPP

programs for prioritizing inspections of pipeline operators and the Risk Assessment Prioritization

(RAP) program, which RSPA began to develop in 1991. The objective of the RAP program is to

assist RSPA management in allocating and dedicating personnel and resources to those areas in

which the greatest safety benefits can be realized in the most cost-effective manner. The basic steps

of the RAP process are: identification of safety and environmental issues; identification of proposed

solutions; evaluation and prioritization of proposed solutions; identification and allocation of

available RSPA resources; and production of an annual activity plan. The RAP process is

dependent on the use of risk reduction matrices that are submitted by various evaluators, including

RSPA field engineers and inspectors, industry representatives, and technical and advisory

committee members. The evaluators assign a point value to assess the relative significance of

problems, solutions, and the reduction of risk from various solutions. RSPA recently completed its

first activity plan based on the RAP process. The previously cited joint government and industry

task group described the RAP program as the most important initiative underway to employ risk

management techniques for RSPA's pipeline safety program.

The task group also noted that improvements in the quality of pipeline failure data can

benefit risk management. It stated that, while the available data can support the rankings of general

failure causes, the data do not allow relationships to be established between pipeline failure

 41The Joint Government/Industry Risk Assessment Quality Team, Risk Management within the Liquid Pipeline

Industry, sponsored by the Office of Pipeline Safety, Research and Special Programs Administration, and the American

Petroleum Institute, June 20, 1995.
43

frequency and design, operational, maintenance, or inspection practices. The task group further

stated in its June 1995 report:

These data, applied with care, can provide meaningful insights into the current

sources of risk and useful guidance for allocating resources to the most important

problems. However, the industry failure database needs to be significantly enhanced

if the full benefits of risk management are to be realized. A joint

industry/government effort is recommended to significantly enhance the amount and

quality of the data available to support risk management. Of particular importance is

enhancing the data that correlates operational and maintenance (O&M) practices to

the failure rates of pipes and other equipment.

Evaluation and Recommendations — By using computer programs to screen the

accident data for certain discrepancies and manually screening all reports with a reported cause of

“other,” RSPA has taken some actions to improve the consistency of the accident data reported for

gas and hazardous liquid pipelines. RSPA uses the accident data to develop cost-benefit studies to

justify regulatory proposals and to perform limited accident trend analyses. The most effective use

of the accident data is its application to the PIPP program to help develop priorities for inspecting

individual pipeline operators each year.

In its analysis of the accident data for petroleum product pipelines, the Safety Board found

that the deficiencies of RSPA’s accident data base for hazardous liquid pipelines limited the

Board’s ability to identify any factors affecting accident trends. These deficiencies greatly

undermine the usefulness of the existing accident data base for hazardous liquid pipelines. An

accident data base can be a powerful tool for more effective management of the pipeline safety

program -- particularly for cost-benefit analyses to justify regulatory changes -- and can help to

identify safety issues, accident trends, and operators with marginal safety records or increased

accident rates. An effective accident data base, as acknowledged in the June 1995 joint government

and industry task force report on hazardous liquid pipelines, is also essential for successful

implementation of a risk management system. RSPA has also acknowledged that a complete and

viable accident data base is essential for successful implementation of a risk management system.

However, to achieve these objectives, it is critical that the accident data base used provide

complete data in sufficient detail to show not only the cause of an accident, but also the related

factors that could increase or decrease the likelihood of occurrence. For example, RSPA and the

industry consider excavation damage to be the leading cause of pipeline accidents. Yet, excavation

damage is not specifically indicated on RSPA’s accident form in a separate data element. The

purpose of damage prevention programs, one-call systems, notifications by excavators, and marking

of the pipeline is to prevent excavation accidents. For these data entries to be meaningful, therefore,

they must be linked to excavation accidents only. Similarly, more detail about pipe coatings and

cathodic protection systems would help identify why external corrosion failures occur. The accident

data base must also indicate the consequences of accidents. The environmental impact should be

reported separately, apart from property damage. The depth of the pipeline and the
44

location of the accident (urban versus rural locations) are other factors that have a strong bearing on

the consequences of an accident. Data on factors that minimize the consequences of an accident,

such as remotely controlled valves, leak detection systems, and emergency flow restricting devices,

should also be reported to help assess their effectiveness.

The Safety Board previously addressed many of these same deficiencies in its 1978 report

on the safe service life for liquid petroleum pipelines, as described earlier in this report. Because of

these deficiencies and the unreliability of the accident data for hazardous liquid pipelines, the Safety

Board issued Safety Recommendations P-78-58 through -62, which urged RSPA to:

P-78-58

Publish a plan that describes how the OPSO will use accident report data to

formulate safety regulations and to develop a safe service life model for pipelines.

P-78-59

Redesign the Liquid Pipeline Accident Reporting System to include data similar to

that collected in the Natural Gas Accident Reporting System.

P-78-60

Provide clear instructions and definitions to insure the accuracy and consistency of

the data recorded on the liquid pipeline accident report forms.

P-78-61

Computerize the redesigned Liquid Pipeline Accident Report System. Include the

capability to: compute the historical accident/leak rate-per-mile of pipe for each

carrier as well as the nationwide rate; make periodic comparisons of each carrier's

accident/leak rate against the nationwide accident/leak rate; compute and plot

selective accident/leak rates based on pipeline parameters such as age, specified

yield strength, depth of cover, product transported, etc.; selectively retrieve and

summarize accident/leak data pertaining to any given accident or classification of

accidents; and produce summarized reports reflecting the above-listed information.

P-78-62

Conduct audits of the completed liquid pipeline accident reports to insure that

mandatory data is provided.

Safety Recommendation P-78-58 was classified “Closed--Superseded” on September 9,

1987. Safety Recommendations P-78-59 through -61 were classified “Closed--Unacceptable
45

Action” on September 29, 1988, because of RSPA's inaction. In response to Safety

Recommendation P-78-62, RSPA began to validate the accident data before entering it into the

accident data base. Therefore, the recommendation was classified “Closed--Acceptable Action” on

April 4, 1979.

In 1980, the Safety Board issued a report evaluating the effectiveness of RSPA's accident

data system for gas pipelines.42 The Safety Board concluded that: (1) the data collected were often

inaccurate and not validated; (2) the data system was used to fill external requests for information;

(3) RSPA did not have a pipeline data analysis plan, which was necessary to use the data system as

a management tool; and (4) the development of a data analysis plan must precede the revision of

reporting requirements and data forms to guide the selection and use of the data collected.

Consequently, the Safety Board recommended that RSPA:

P-80-61

Develop and publish for public comment a formal data analysis plan for the pipeline

data system.

P-80-62

Expedite the proposed creation of an Office of Regulatory Planning and Analysis

and define responsibilities for development and management of a pipeline data

analysis plan.

P-80-63

Postpone promulgation of proposed, revised pipeline data forms until development

of a data analysis plan and coordination of the forms with the plan.

P-80-64

Develop explicit directions for completion of the present data forms to improve the

quality of the information collected on these forms. Assure that terms not

universally accepted across the pipeline industry are defined.

P-80-65

Train existing personnel to more effectively validate incoming leak report forms.

 42Safety Effectiveness Evaluation--Safety Effectiveness Evaluation of the Materials Transportation Bureau's

Pipeline Data System (NTSB/SEE-80/04).
46

Safety Recommendations P-80-61 and -63 were classified “Closed--Unacceptable Action”

on January 4, 1990, and May 12, 1986, respectively, because RSPA failed to implement the

recommendations. Safety Recommendation P-80-62 was classified “Closed--Acceptable Action”

on October 7, 1981, following RSPA's establishment of an Office of Regulatory Planning and

Analysis. Safety Recommendation P-80-64 was classified “Closed--Reconsidered” on October 7,

1981, upon the Safety Board's concurrence that RSPA should not divert resources from data system

activities to develop explicit instructions for completing existing forms. Safety Recommendation P80-65 was classified “Closed--Acceptable Alternate Action” on May 12, 1986, after RSPA

developed validation procedures that were provided to its regional offices and State agents.

The deficiencies in RSPA’s data reporting system identified in this report are identical to

those identified by the Safety Board in 1978 and parallel the Safety Board's 1980 findings regarding

the gas pipeline data system. Consequently, the Safety Board concludes that RSPA's failure to fully

implement the Safety Board's original 1978 safety recommendations to evaluate and analyze its

accident data reporting needs has hampered RSPA's oversight of pipeline safety.

As RSPA works to implement a risk management program, the need for accurate and

consistent accident data becomes more critical to identify risks and those factors that either mitigate

or increase risk. As noted by the 1995 joint government and industry task group, successful

implementation of a true risk management approach necessitates a reliable and complete accident

data base. The Safety Board supports RSPA in its effort to implement a risk management approach

for its pipeline safety program. However, the Safety Board concludes that, with the deficiencies of

the current accident data base for hazardous liquid pipelines, RSPA will find it exceedingly difficult

to fully implement an effective risk management program.

To address these problems, the Safety Board believes that RSPA should develop within 1

year and implement within 2 years a comprehensive plan for the collection and use of gas and

hazardous liquid pipeline accident data that details the type and extent of data to be collected, to

provide RSPA with the capability to perform methodologically sound accident trend analyses and

evaluations of pipeline operator performance using normalized accident data.

CONCLUSIONS

1. Based on the limited analyses of accidents for 14 liquid pipeline operators for the period 1992

through 1994, the rates for accidents per pipeline mile and for product volume released per

volume transported were greater for the Colonial Pipeline Company than the average and

median rates for the group.

2. Although RSPA's data on hazardous liquid pipeline accidents can be analyzed to determine

some general trends and conclusions, the data on hazardous liquid pipelines, as they are

currently collected and reported, are not sufficient for RSPA to perform an effective accident

trend analysis or to properly evaluate operator performance.
47

3. Although RSPA has taken regulatory action and undertaken other initiatives to minimize

excavation damage, RSPA has failed to take effective and timely action to address corrosion

control, inspection and testing of pipelines, and methods to limit the release of product from

failed pipelines.

4. RSPA's failure to fully implement the Safety Board's original 1978 safety recommendations

to evaluate and analyze its accident data reporting needs has hampered RSPA's oversight of

pipeline safety.

5. With the deficiencies of the current accident data base for hazardous liquid pipelines, RSPA

will find it exceedingly difficult to fully implement an effective risk management program.
48

RECOMMENDATIONS

As a result of this special investigation, the National Transportation Safety Board makes the

following safety recommendation:

-- to the Research and Special Programs Administration:

Develop within 1 year and implement within 2 years a comprehensive plan for the

collection and use of gas and hazardous liquid pipeline accident data that details the

type and extent of data to be collected, to provide the Research and Special

Programs Administration with the capability to perform methodologically sound

accident trend analyses and evaluations of pipeline operator performance using

normalized accident data. (Class II, Priority Action) (P-96-1)

Also, as a result of this special investigation, the National Transportation Safety Board

reiterates the following safety recommendations to the Research and Special Programs

Administration:

P-87-4

Require operators of both gas and liquid transmission pipelines to periodically

determine the adequacy of their pipelines to operate at established maximum

allowable operating pressures by performing inspections or tests capable of

identifying corrosion-caused and other time-dependent damages that may be

detrimental to the continued safe operation of these pipelines and require necessary

remedial action.

P-87-5

Establish criteria for use by operators of pipelines in determining the frequency for

performing inspections and tests conducted to determine the appropriateness of

established maximum allowable operating pressures.
49

P-95-1

Expedite requirements for installing automatic- or remote-operated mainline valves

on high pressure pipelines in urban and environmentally sensitive areas to provide

for rapid shutdown of failed pipeline segments.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALL

Chairman

ROBERT T. FRANCIS II

Vice Chairman

JOHN A. HAMMERSCHMIDT

Member

JOHN J. GOGLIA

Member

January 23, 1996
This page intentionally left blank
51

APPENDIXES

APPENDIX A

Previously Issued Safety Recommendations

to the Department of Transportation

Relating to Petroleum Product and Hazardous Liquid Pipelines

P-71-1

Conduct a study to develop standards for the rapid shutdown of failed natural gas

pipelines and work in conjunction with the Federal Railroad Administration to

develop similar standards for liquid pipelines.

Status: Closed--Acceptable Action 1/18/95

P-72-10

Conduct a study, in cooperation with source[s] of qualified pipeline expertise,

concerning minimum valve spacing standards and the use of remotely operated

valves, automatically operated valves, and check valves on all liquefied petroleum

pipelines. As an adjunct to this, the Safety Board invites attention to a

recommendation made in its special study of Effects of Delay in Shutting Down

Failed Pipeline Systems and Methods of Providing Rapid Shutdown.

Status: Closed--Acceptable Action 3/18/81

P-73-12

Amend 49 CFR 192 and 49 CFR 195 to require each pipeline operator to establish a

program for the prevention of excavation-type damage to its underground facilities.

Status: Closed--Superseded 8/19/85
APPENDIX A

52

P-73-13

Revise its methods of summarizing the reports of individual gas pipeline leaks and

failures to show clearly those accidents resulting from excavation activities.

Status: Closed--Acceptable Action 5/31/89

P-73-14

Amend 49 CFR 192 and 49 CFR 195 to require that consideration be given during

the design of pipelines to prevention of damage to them in the future, especially in

locations where later excavation might be expected.

Status: Closed--Reconsidered 10/21/76

P-74-50

In its upcoming rulemaking action for the transportation of highly volatile, toxic, or

corrosive liquids, include anhydrous ammonia pipeline systems, particular emphasis

should be placed on a reduction of the maximum allowable pressure for NH3

systems, more closely spaced valves, and more remotely or automatically operated

valves.

Status: Closed--Unacceptable Action 1/21/75

P-76-20

Review all pertinent data such as leak and failure reports submitted by liquid

pipeline carriers to determine if longitudinal weld failures constitute a recurrent

safety problem and take appropriate regulatory action if they do.

Status: Closed--Acceptable Action 6/13/77
APPENDIX A

53

P-76-21

Request all pipeline companies which have installed ERW pipe manufactured by the

Jones and Laughlin Steel Corporation to review their records on longitudinal seam

failures and determine if the number of such failures is abnormally high. After DOT

reviews these data, it should take necessary corrective actions.

Status: Closed--No Longer Applicable 5/24/82

P-78-58

Publish a plan that describes how the OPSO will use accident report data to

formulate safety regulations and to develop a safe service life model for pipelines.

Status: Closed--Superseded (by P-87-23) 9/9/87

P-78-59

Redesign the Liquid Pipeline Accident Reporting System to include data similar to

that collected in the Natural Gas Accident Reporting System.

Status: Closed--Unacceptable Action 9/29/88

P-78-60

Provide clear instructions and definitions to insure the accuracy and consistency of

the data recorded on the liquid pipeline accident report forms.

Status: Closed--Unacceptable Action 9/29/88

P-78-61

Computerize the redesigned Liquid Pipeline Accident Report System. Include the

capability to:
APPENDIX A

54

a) compute the historical accident/leak rate-per-mile of pipe for each

carrier as well as the nationwide rate;

b) make periodic comparisons of each carrier's accident/leak rate against

the nationwide accident/leak rate;

c) compute and plot selective accident/leak rates based on pipeline

parameters such as age, specified yield strength, depth of cover,

product transported, etc.;

d) selectively retrieve and summarize accident/leak data pertaining to any

given accident or classification of accidents; and

e) produce summarized reports reflecting the above-listed information.

Status: Closed--Unacceptable Action 9/29/88

P-78-62

Conduct audits of the completed liquid pipeline accident reports to insure that

mandatory data is provided.

Status: Closed--Acceptable Action 4/4/79

P-78-63

Expedite the completion of the rulemaking to strengthen the Federal regulations

concerning LPG pipelines.

Status: Closed--Unacceptable Action 4/4/90

P-80-54

Expedite final action on rulemaking Docket No. PS-59, concerning damageprevention programs.

Status: Closed--Acceptable Action 9/16/86
APPENDIX A

55

P-80-89

Amend 49 CFR 195 to include a section similar to proposed 49 CFR 192.614,

Damage Prevention Program, to require that all liquid pipeline operators develop,

implement, and monitor the effectiveness of an excavation damage prevention

program.

Status: Closed--Superseded (by P-84-26) 9/3/85

P-80-90

Amend 49 CFR 195 to include a section similar to 49 CFR 192.615, Emergency

Plans, that will require operators to establish written procedures to minimize the

hazards resulting from a liquid pipeline emergency.

Status: Closed--Superseded (by P-84-26) 9/3/85

P-84-26

Amend Federal regulations governing pipelines that transport highly volatile liquids

to require a level of safety for the public comparable to that now required for natural

gas pipelines.

Status: Open--Acceptable Response 4/22/94

P-87-4

Require operators of both gas and liquid transmission pipelines to periodically

determine the adequacy of their pipelines to operate at established maximum

allowable operating pressures by performing inspections or tests capable of

identifying corrosion-caused and other time-dependent damages that may be

detrimental to the continued safe operation of these pipelines and require necessary

remedial action.

Status: Open--Unacceptable Response 1/23/96
APPENDIX A

56

P-87-5

Establish criteria for use by operators of pipelines in determining the frequency for

performing inspections and tests conducted to determine the appropriateness of

established maximum allowable operating pressures.

Status: Open--Unacceptable Response 1/23/96

P-87-6

Require existing natural gas transmission and liquid petroleum pipeline operators,

when repairing or modifying their systems, to install facilities to incorporate the use

of in-line [internal] inspection equipment.

Status: Closed--Acceptable Action 2/7/95

P-87-7

Require that all new gas and liquid transmission pipelines be constructed to

facilitate the use of in-line [internal] instrument inspection equipment.

Status: Closed--Acceptable Action 2/7/95

P-87-22

Require the installation of remote-operated valves on pipelines that transport

hazardous liquids, and base the spacing of remote-operated valves on the population

at risk.

Status: Closed--Unacceptable Action/Superseded (by P-95-1) 2/7/95

P-87-23

Revise 49 CFR Parts 192 and 195 to include operational based criteria for

determining safe service intervals for pipelines between hydrostatic retests.

Status: Open--Unacceptable Response 8/31/92
APPENDIX A

57

P-87-24

Revise 49 CFR Part 195 to include criteria, similar to those found in Part 192, for

liquid pipeline operators to evaluate their cathodic protection systems.

Status: Closed--Unacceptable Action 1/23/96

P-87-26

Obtain sufficient data on low frequency, electric resistance welded pipe and

determine if its continued use presents an unreasonable hazard to public safety, and

take appropriate regulatory action for identified deficiencies.

Status: Open--Unacceptable Response 3/8/93

P-89-6

Establish inspection, maintenance, and test requirements to demonstrate and

maintain the proper functioning of check valves installed in pipeline systems.

Status: Open--Acceptable Response 3/8/93

P-90-24

Address, in the ongoing study to determine the feasibility of establishing inspection,

maintenance, and test requirements for check valves, the lack of definitions for the

various terms used for valves in the pipeline safety regulations.

Status: Open--Acceptable Response 3/8/93
APPENDIX A

58

P-90-25

Require, in conjunction with the Federal Railroad Administration, operators of

pipelines located on or adjacent to railroad rights-of-way to coordinate with the

railroad operators the development of plans for handling transportation emergencies

that may impact both the rail and pipeline systems and then to discuss the plan with

affected State and local emergency response agencies.

Status: Closed--Acceptable Alternate Action 3/27/95

P-91-1

Define the operating parameters that must be monitored by pipeline operators to

detect abnormal operations and establish performance standards that must be met to

detect and locate leaks.

Status: Open--Acceptable Response 8/31/92

P-91-2

Require pipeline operators to conduct analyses, before moving pressurized

pipelines, to determine:

• the extent to which the pipe may be safely moved,

• the specific procedures required for the safe movement of the pipe,

and,

• the actions to be taken for protection of the public.

Status: Open--Acceptable Response 2/20/91

P-91-3

Require operators of pipelines that transport highly volatile liquids to extend their

public education program to include persons who reside at elevations lower than and

within 1 mile of the pipeline.

Status: Closed--Acceptable Action 6/22/92
APPENDIX A

59

P-91-4

Require pipeline operators to extend their emergency preparedness programs to

include liaison with all community response agencies adjacent to their pipelines.

Status: Closed--Acceptable Action 10/20/92

P-95-1

Expedite requirements for installing automatic- or remote-operated mainline valves

on high pressure pipelines in urban and environmentally sensitive areas to provide

for rapid shutdown of failed pipeline segments.

Status: Open--Acceptable Response 5/12/95

P-95-2

Develop toughness standards for new pipe installed in gas and hazardous liquid

pipelines, especially in urban areas.

Status: Open--Acceptable Response 7/17/95

P-95-3

Eliminate the exception for marking pipelines in Class 3 and 4 locations from

existing standards and establish standards for permanent markings that identify the

location of high-pressure natural gas and hazardous liquid pipelines in urban,

industrial, and commercial areas, where marking is feasible.

Status: Closed--Acceptable Action 6/23/95
APPENDIX A

60

P-95-4

Expedite the completion of the study on methods to reduce public safety risks in the

siting and proximity of pipelines, modify that study to include consideration of

building standards, and make the completed study widely available to local and

State governments.

Status: Open--Awaiting Response 7/17/95



This page intentionally left blank