Pipeline Safety: Better Data and Guidance Needed to Improve Pipeline Operator Incident Response
Released: 2013-01-23T00:00:00

Letter

Background

Three main types of pipelines carry hazardous liquid and natural gas from producing wells to end users (residences and businesses) and are managed by about 2,500 operators:

Gathering pipelines collect hazardous liquid and natural gas from production areas and transport the products to processing facilities, which in turn refine and send the products to transmission pipelines. These pipelines tend to be located in rural areas but can also be located in urban areas. PHMSA estimates there are 200,000 miles of natural gas gathering pipelines and 30,000 to 40,000 miles of hazardous liquid gathering pipelines.

Transmission pipelines carry hazardous liquid or natural gas, sometimes over hundreds of miles, to communities and large-volume users, such as factories. Transmission pipelines tend to have the largest diameters and operate at the highest pressures of any type of pipeline. PHMSA has estimated there are more than 400,000 miles of hazardous liquid and natural gas transmission pipelines across the United States. (See fig. 1.)

Distribution pipelines then split off from transmission pipelines to transport natural gas to end users—residential, commercial, and industrial customers. There are no hazardous liquid distribution pipelines. PHMSA has estimated there are roughly 2 million miles of natural gas distribution pipelines, most of which are intrastate pipelines.

PHMSA administers the national regulatory program to ensure the safe transportation of hazardous liquid and natural gas by pipeline, including developing safety requirements that all pipeline operators regulated by PHMSA must meet. In 2012, the agency’s budget was $201 million, which was used, in part, to employ over 200 staff in its pipeline safety program. About half of the pipeline safety program staff inspects hazardous liquid and gas pipelines for compliance with safety regulations. Besides PHMSA, over 300 state inspectors help oversee pipelines and ensure safety. State and federal officials may also investigate specific pipeline incidents to determine the reason for the pipeline failure and to take enforcement actions, when necessary.

PHMSA enforces two general sets of pipeline safety requirements. The first are minimum safety standards that cover specifications for the design, construction, testing, inspection, operation, and maintenance of pipelines. The second set of safety requirements are part of a supplemental risk-based regulatory program termed “integrity management.” Under transmission pipeline integrity management programs, operators are required to systematically identify and mitigate risks to pipeline segments—discrete sections of the pipeline system separated by valves that can stop the flow of product—that are located in high-consequence areas where an incident would have greater consequences for public safety or the environment. To ensure operators comply with minimum safety standards and integrity management requirements, PHMSA conducts inspections in partnership with state pipeline safety agencies. Inspections may focus on specific pipeline segments or aspects of an operator’s safety program, or both. According to PHMSA, officials conduct an inspection for each operator at least once every 5 to 7 years, but may conduct additional inspections based on safety risk or at the discretion of PHMSA or state officials. PHMSA is authorized to take enforcement actions against operators, including issuing warning letters, notices of probable violation, notices of amendment, notices of proposed safety order, corrective action orders, and imposing civil penalties.

Transporting hazardous liquids and natural gas by pipelines is associated with far fewer fatalities and injuries than other modes of transportation. From 2007 to 2011, there was an average of about 14 fatalities per year for all pipeline incidents reported to PHMSA, including an average of about 2 fatalities per year resulting from incidents on hazardous liquid and natural gas transmission pipelines. In comparison, in 2010, 3,675 fatalities resulted from incidents involving large trucks and 730 additional fatalities resulted from railroad incidents. Yet risks to pipelines exist, such as corrosion and third party excavation, which can damage a pipeline’s integrity and result in leaks and ruptures. A leak is a slow release of a product over a relatively small area. A rupture is a breach in the pipeline that may occur suddenly; the product may then ignite resulting in an explosion. According to pipeline operators we met with, of the two types of pipeline incidents, leaks are more common but generally cause less damage. Ruptures are relatively rare but can have much higher consequences because of the damage that can be caused by an associated explosion.

According to PHMSA, industry, and state officials, responding to either a hazardous liquid or natural gas pipeline incident typically includes steps such as detecting that an incident has occurred, coordinating with emergency responders, and shutting down the affected pipeline segment. (See fig. 2.) Under PHMSA’s minimum safety standards, operators are required to have a plan that covers these steps for all of their pipeline segments and to follow that plan during an incident. Officials from PHMSA and state pipeline safety offices perform relatively minor roles during an incident, as they rely on operators and emergency responders to take actions to mitigate the consequences of such events. Following an incident, operators must report incidents that meet certain thresholds— including incidents that involve a fatality or injury, excessive property damage or product release, or an emergency shutdown—to the federal National Response Center, as well as conduct an investigation to identify the root cause and lessons learned. Federal and state authorities may also use their discretion to investigate some incidents, which can involve working with operators to determine the cause of the incident. If necessary, authorities will take steps to correct deficiencies in operator safety programs, including taking enforcement actions.

While prior research shows that most of the fatalities and damage from an incident occur in the first few minutes following a pipeline rupture, operators can reduce some of the consequences by taking actions that include closing valves that are spaced along the pipeline to isolate segments. The amount of time it takes to close a valve depends upon the equipment installed on the pipeline. For example, valves with manual controls (referred to as “manual valves”) require a person to arrive on site and either turn a wheel crank or activate a push-button actuator. Valves that can be closed without a person located at the valve location (referred to as “automated valves”) include both remote-control valves, which can be closed via a command from a control room, and automatic-shutoff valves, which can close without human intervention based on sensor readings. (See fig. 3.) Automated valves generally take less time to close than manual valves. PHMSA’s minimum safety standards dictate the spacing of all valves, regardless of type of equipment installed to close them, while integrity management regulations require that transmission pipeline operators conduct a risk assessment for high- consequence areas that includes the consideration of automated valves.

Performance-Based Approach Offers Opportunity to Improve Incident Response, but Better Data Are Needed

The ability of transmission pipeline operators to respond to incidents, such as leaks and ruptures, is affected by a number of variables—some of which are under operators’ control—resulting in variances in response time; for a given incident, that time can range from minutes to days. Several states and industry organizations have developed performance- based requirements for operators to meet in responding to incidents. PHMSA has some performance-based requirements, but its current performance goal related to incident response is not well defined. More precise performance measures and targets could lead to improved response times and less damage from incidents in some cases. However, PHMSA would need better data on incidents to determine the feasibility of such an approach.

Incident Response Time Depends on Multiple Variables, Some of Which Operators Can Control

According to PHMSA officials, pipeline safety officials, and industry stakeholders and operators, multiple variables—some controllable by transmission pipeline operators—can influence the ability of operators to respond quickly to an incident. Ensuring a quick response is important because according to pipeline operators and industry stakeholders, reducing the amount of time it takes to respond to an incident can also reduce the amount of property and environmental damage stemming from an incident and, in some cases, the number of fatalities and injuries. For example, several natural gas pipeline operators noted that a faster incident response time could reduce the amount of property damage from secondary fires (after an initial pipeline rupture) by allowing fire departments to extinguish the fires sooner. In addition, hazardous liquid pipeline operators told us that a faster incident response time could result in lower costs for environmental remediation efforts and less product lost. We identified five variables that can influence incident response time and that are within an operator’s control:

Leak detection capabilities. How quickly a leak is detected affects how soon an operator can initiate a response. Pipeline operators must perform a variety of leak detection activities to monitor their systems and identify leaks. These activities commonly include periodic external monitoring, such as aerial patrols of the pipeline, as well as continuous internal monitoring, such as measuring the intake and outtake volumes or pressure flows on the pipeline. In addition, pipeline operators must conduct public awareness programs for those living near pipeline facilities about how to recognize, respond to, and report pipeline emergencies; these programs can influence how quickly an operator becomes aware of an incident. Attempting to confirm an incident can also affect response time. Pipeline operators may prefer to have two sources of information to confirm an incident, such as data from a pipeline sensor and a visual confirmation, especially if shutting down the system is a likely response to the incident. Natural gas pipeline operators in particular generally seek to confirm an incident before a shutdown, as shutdowns interrupt the gas flow and can cut off service to their customers.

Location of qualified operator response personnel. The proximity of the operator’s response personnel to a facility or shutoff valve can affect the response time. Response personnel who have a greater distance to travel to the facility or valve site can take longer to establish an incident command center or to close manual valves. Along with proximity, incident response time depends on whether qualified operator response personnel—those who are trained and are authorized to take necessary action, such as closing manual valves— are dispatched.

Type of valves. The type of valve an operator has installed on a pipeline segment can affect how quickly the segment can be isolated. Automated valves, which can be closed automatically or remotely, can shorten incident response time compared to manual valves, which require that personnel travel to the valve site and turn a wheel crank or activate a push-button actuator to close the valve. However, if affected valves happen to be located at or close to facilities where personnel are permanently stationed, the type of valve could be less critical in influencing incident response time.

Control room management. Clear operating policies and shutdown protocols for control room personnel can influence response time to incidents. For example, incident response time might be reduced if control room personnel have the authority to shut down a pipeline or facility if a leak is suspected, and are encouraged to do so. A few of the operators we met with told us that while in the past it was a common practice in the industry to avoid shutdowns unless absolutely necessary, the practice now for these operators is to shut down the line if there is any doubt about safety. An official from one natural gas pipeline operator told us that his company instructs control room personnel that they will not suffer repercussions from shutting down a line for safety reasons. Another official from a hazardous liquid pipeline operator told us that the authority to shut down is at the control room level and that even personnel in the field can make the call to shut down a line.

Relationships with local first responders. Operators that have already established effective communications with local first responders— such as fire and police departments—may respond more quickly during emergencies. For example, one natural gas pipeline operator told us that during one incident, the local first responders had turned to the operator personnel for direction on how to respond to a rupture. As a result, the operator said that one of the lessons learned was that the company needed to conduct more emergency response exercises, such as mock drills, with the local first responders so the responders would know their roles and responsibilities.

We identified four other variables that influence a pipeline operator’s ability to respond to an incident, but are beyond an operator’s control:

Type of release. The type of release—leak or rupture—can influence how quickly an operator responds to an incident. Leaks are generally a slow release of product over a small area, which can go undetected for long periods. Once a leak is detected, it can take additional time to confirm the exact location. Ruptures, which usually produce more significant changes in the external or internal conditions of the pipeline, are typically easier to detect and locate.

Time of day. The time of day when an incident occurs can affect incident response time. The operator’s response personnel may be delayed in reaching facilities in urban or suburban areas during peak traffic times. Conversely, if an incident occurs during the evening or on a weekend, the operator’s response personnel could be able to reach the facility more quickly, because of lighter traffic. For example, one natural gas pipeline operator told us about an incident that occurred on a Saturday afternoon, which meant that traffic did not delay response personnel traveling to the scene.

Weather conditions. Weather conditions can affect how quickly an operator can respond to an incident. For example, one natural gas pipeline operator described an incident caused by a hurricane’s storm surge that pushed debris into the pipeline at a facility, and flooding prevented the response personnel from reaching the site for several days, during which time the pipe continued to leak gas. Winter conditions can also make it more difficult for the operator’s response personnel to reach a facility or to access valve sites in remote areas. As another example, windy conditions can disperse natural gas and make it hard to detect a leak.

Other operators’ pipeline in the same area. If two or more operators own pipeline in a shared right of way, determining whose system is affected can increase incident response time. Operators may delay responding if they have not confirmed that the incident is on their pipeline. For example, one natural gas pipeline operator told us about an incident that took 2 days to repair because when their personnel first detected a leak, the personnel initially contacted another operator, whose line crossed over theirs, to make sure the leak was not the other operator’s.

Operators we spoke with stated that the amount of time it takes to respond to an incident can depend on all of the variables listed above and can range from several minutes to days (see table 1).

We and others have recommended that the federal government move toward performance-based regulatory approaches to allow those being regulated to determine the most appropriate way to achieve desired, measurable outcomes. For example, Executive Order 13563 calls for improvements to the nation’s regulatory system, including the use of the best, most innovative and least burdensome tools for achieving regulatory ends. We have also previously reported on the benefits of a performance-based framework, which helps agencies focus on achieving outcomes. Such a framework should include: 1) national goals; 2) performance measures that are linked to those national goals; and 3) appropriate performance targets that promote accountability and allow organizations to track their progress towards goals.

PHMSA has included these three elements of a performance-based framework in some aspects of its pipeline safety program, but not for incident response times. For example, PHMSA has set national goals intended to reduce the number of pipeline incidents involving fatality or major injury and the number of hazardous liquid pipeline spills with environmental consequences. Each of these national goals has associated performance measures (i.e., the number of such incidents) and specific targets (such as reducing the number of incidents involving a fatality or major injury from 39 to less than 28 per year by 2016) that allow PHMSA to track its progress toward the goals. However, while PHMSA has established a national goal for incident response times, it has not linked performance measures or targets to this goal. Specifically, PHMSA directs operators to respond to certain incidents–emergencies that require an immediate response–in a “prompt and effective” manner, but neither PHMSA’s regulations nor its guidance describe ways to measure progress toward meeting this goal. Without a performance measure and target for a prompt and effective incident response, PHMSA cannot quantitatively determine whether an operator meets this goal. PHMSA officials told us that because each incident presents unique circumstances, its inspectors must determine whether an operator’s incident response was prompt and effective on a case-by-case basis. According to PHMSA, in making this determination, inspectors must use their professional judgment to balance any challenges the operator faced in responding with the operator’s obligation to the public’s safety.

Other organizations in the pipeline industry, including some state regulatory agencies, have developed methods for measuring the performance of operators responding to incidents by using specific incident response times. According to the National Association of Pipeline Safety Representatives, several state pipeline safety offices have initiatives that require natural gas pipeline operators to respond within a specified time frame to reports of pipeline leaks. For example, the New Hampshire Public Utilities Commission has established incident response time standards—ranging from 30 to 60 minutes, with performance targets—for natural gas distribution companies to meet when responding to reports of a leak. In addition, members of the Interstate Natural Gas Association of America have committed to achieving a 1-hour incident response time for large diameter (greater than 12 inches) natural gas pipelines in highly populated areas. To meet this goal, operators are planning changes to their systems, such as relocating response personnel and automating over 1,800 valves throughout the United States.

According to PHMSA officials, pipeline incidents often have unique characteristics, so developing a performance measure and associated target for incident response time similar to those used by other pipeline organizations would be difficult. In particular, it would be challenging to establish a performance measure using incident response time in a way that would always lead to the desired outcome of a prompt and effective response. Officials stated that the intention behind requiring operators to respond promptly and effectively is to make the area safe as quickly as possible. In some instances, an operator can accomplish this outcome in the time it takes to close valves and isolate pipeline segments, while in other instances, an operator might need to completely vent or drain the product from the pipeline. Likewise, it would be difficult to identify a specific target for incident response time, as pipeline operators likely should respond to some incidents more quickly than others. For example, industry officials noted that while most fatalities and injuries caused by a pipeline explosion occur in the initial blast, a faster incident response time could help reduce fatalities and injuries in cases where there are sites nearby whose occupants have limited mobility (e.g., prisons, hospitals). In these situations, operators told us they want to ensure their incident response time is faster than for more remote locations where an explosion would have less of an impact on people, property, and the environment.

Although defining performance measures and targets for incident response can be challenging, one way for PHMSA to move toward a more quantifiable, performance-based approach would be to develop strategies to improve incident response based on nationwide data. For example, performing an analysis of nationwide incident data—similar to PHMSA’s current analyses of fatality and injury data—could help PHMSA determine response times for different types of pipelines (based on characteristics such as location, operating pressure, and diameter); identify trends; and develop strategies to improve incident response. Furthermore, as part of this analysis of response times for various types of pipelines, PHMSA could explore the feasibility of integrating incident response performance measures and targets for individual pipelines into its integrity management program. For example, PHMSA might identify performance measures that are appropriate for various types of pipelines and allow operators to determine which measures and targets best apply to their individual pipeline segments, based on the characteristics of those segments. Such an approach would be consistent with our prior work on performance measurement, as it would allow operators the flexibility to meet response time targets in several ways, including changes to their leak detection methods, moving personnel closer to the valve location, or installing automated valves. PHMSA would then review an operator’s selection of measures and targets as part of ongoing integrity management inspections; this process is similar to how inspectors review other provisions in the integrity management program.

PHMSA Data on Incident Response Time Are Limited

PHMSA would need reliable national data to implement a performance- based framework for incident response times to ensure operators are responding in a prompt and effective manner. However, the data currently collected by PHMSA do not enable them to accurately determine incident response times for all recent incidents for two reasons: 1) operators are not required to fill out certain time-related fields in the PHMSA incident-reporting form and 2) when operators do provide these data, they are interpreting the intended content of the data fields in different ways. Specifically, PHMSA requires operators to report the date and time when the incident occurred. Operators are not required to report the dates and times when: the operator identified the incident; the operator’s resources (personnel or equipment) arrived on site; and the operator shut down and restarted a pipeline or facility.

As a result, our analysis determined that hazardous liquid pipeline operators did not report the date and time for two of these variables— when the incident was identified and when operator resources arrived on site—for 26 percent (178 out of 674) of incidents that occurred in 2010 and 2011. Also, these operators did not identify whether a shutdown took place in 16 percent (108 out 674) of incidents over the same time period. In comparison, natural gas pipeline operators reported more complete data; these operators did not report data for when the operator identified the incident and resources arrived on site in only 3 percent (6 out of 191) of incidents that occurred in 2010 and 2011. Also, these operators did not identify whether a shutdown took place in only about 2 percent (3 out of 191) of incidents over the same period. PHMSA officials told us that because they have not used the time-related data to identify safety trends, the omissions have not been a problem for them, although in the future they may decide to make some of these data fields mandatory.

In addition to omitting certain incident data fields, several officials from pipeline operators told us that they interpret what to include in the time- related, incident data fields differently. For example, according to one official from a natural gas operator, some operators interpret the time when an operator identified the incident as the time when operator personnel first received a call about a potential leak, while others may interpret the time when an operator identified an incident as the time when operator personnel received an on-site confirmation of a leak. These differing interpretations occur even though guidance on PHMSA’s website instructs operators how to complete the reporting forms, including the time-related data fields.

Improved Information Sharing about Evaluating Automated Valve Advantages and Disadvantages Could Inform Operators’ Decisions

The primary advantage of installing automated valves is reducing the time to shut down and isolate a pipeline segment after a leak or rupture occurs, while disadvantages include the potential for accidental closures and monetary cost. Because these advantages and disadvantages vary among valve locations, operators should make decisions about whether to install automated valves—as opposed to other safety measures—on a case-by-case basis. PHMSA has several opportunities to assist operators in making these evaluations, including communicating guidance and sharing information on some methods operators use to make these decisions.

Improved Response Times, Potential for Accidental Closures, and Costs Should be Evaluated on a Case-by-Case Basis

Research and industry stakeholders indicate that the primary advantage of installing automated valves is related to the time it takes to respond to an incident. Although automated valves cannot mitigate the fatalities, injuries, and damage that occur in the initial blast, quickly isolating the pipeline segment through automated valves can significantly reduce subsequent damage by reducing the amount of hazardous liquid and natural gas released. For example, NTSB found that automated valves would have reduced the amount of time taken to stop the flow of natural gas in the San Bruno incident and, therefore, reduced the severity of property damage and life-threatening risks to residents and emergency responders. According to research and industry stakeholders, automated valves will only decrease the number of fatalities and injuries in those cases when people cannot easily evacuate the area, such as cases involving hospital patients or prison inmates.

Research and industry stakeholders identified several disadvantages operators should consider when determining whether to install automated valves, related to potential accidental closures and the monetary costs of purchasing and installing the equipment. Specifically, automated valves can lead to accidental closures, which can have severe, unintended consequences, including loss of service to residences and businesses. For example, according to a pipeline operator, an accidental closure on a natural gas pipeline in New Jersey resulted in significant disruption and downstream curtailments to customers in New York City during high winter demand. In addition, the monetary costs of installing automated valves can range from tens of thousands to a million dollars per valve, which may be significant expenditures for some pipeline operators. (See table 2.)

Research and industry stakeholders also indicate the importance of determining whether to install valves on a case-by-case basis because the advantages and disadvantages can vary considerably based on factors specific to a unique valve location. These sources indicated that the location of the valve, existing shutdown capabilities, proximity of personnel to the valve location, the likelihood of an ignition, type of product being transported, operating pressure, topography and pipeline diameter, among others, all play a role in determining the extent to which an automated valve would be advantageous.

Operators Have Developed Approaches to Evaluate Advantages and Disadvantages of Installing Automated Valves

Operators we met with are using a variety of methods for determining whether to install automated valves. One of the eight operators we met with had decided to install automatic-shutoff valves across its pipeline system, regardless of risk, to eliminate the need for control room staff to make judgment calls on whether or not to close valves to isolate pipeline segments. However, seven of the eight operators we met with developed their own risk-based approach for considering potential advantages and disadvantages when making these decisions on a case-by-case basis. For example, two natural gas pipeline operators told us that they applied a decision tree analysis to all pipeline segments in highly populated and frequented areas. They used the decision tree to guide a variety of yes- or-no questions on whether installing an automated valve would improve response time to less than an hour and provide advantages for locations where people might have difficulty evacuating quickly in the event of a pipeline incident. Other operators said they used computer-based spill modeling to determine whether the amount of product release would be significantly reduced by installing an automated valve. These seven operators told us that their approaches for making decisions about whether to install automated valves considered the advantages and the disadvantages we identified above.

Improved response time. Most operators we spoke with considered whether automated valves would lead to a faster response time. For example, the primary criterion used by two of the natural gas pipeline operators was the amount of time it would take to shut down the pipeline and isolate the segment and population along the segment. In one instance, an operator decided to install a remote-control valve in a location that would take pipeline personnel 2.5 hours to reach and 30 minutes more to close the valve. Installing the automated valve is expected to reduce the total response time to under an hour, including detecting the incident and making the decision to isolate the pipeline segment. In addition, several hazardous liquid pipeline operators used spill modeling to determine whether an automated valve would result in a reduced amount of damage from product release at individual locations. This spill modeling typically considered topography, operating pressure, and placement of existing valves. For example, one hazardous liquid pipeline operator used spill modeling to make the decision to install a remote-control valve on a pipeline segment with a large elevation change after evaluating the spill volume reduction.

Accidental closures. Operators indicated that installing automated valves, especially automatic-shutoff valves, could have unintended consequences, which they considered as part of their decisions to install automated valves. For example, two natural gas pipeline operators considered whether there is the potential for accidentally cutting off service when assessing individual locations for the possible installation of an automatic-shutoff valve. As noted, one natural gas pipeline operator has made the decision to install automatic-shutoff valves across its pipeline system. The operator stated that in the past, there were concerns with relying on automatic-shutoff valves because of the possibility for accidental closures, but the operator believes it has developed a process that effectively adapts to pressure and flow change and minimizes or eliminates the risk of the valve accidentally closing. Other natural gas pipeline operators stated that relying on pressure sensing systems can be dangerous because “tuning” the pressure activation in an effort to avoid accidental closures can result in situations where the valve will not automatically close during an actual emergency. For hazardous liquid, all operators we spoke with stated that they either do not consider or do not typically install automatic-shutoff valves because an accidental closure has the potential to lead to an incident. Specifically, operators stated that an unexpected valve closure can result in decompression waves in the pipeline system, which might cause the pipeline to rupture if operators cannot reduce the flow of product promptly.

Monetary costs. According to operators and other industry stakeholders, considering monetary costs is important when making decisions to install automated valves because resources spent for this purpose can take away from other pipeline safety efforts. Specifically, operators and industry stakeholders told us they often would rather focus their resources on incident prevention to minimize the risk of an incident instead of focusing resources on incident response. PHMSA stated that it generally supports the idea that pipeline operators should be given flexibility to target compliance dollars where they will have the most safety benefit when it is possible to do so. Operators we spoke with stated that they considered costs associated with purchasing and installing equipment. For example, four operators indicated that they will consider the costs related to communications equipment when determining whether to install automated valves. In addition, three operators stated that decisions to install automated valves are affected by whether the operator has or can gain access to the pipeline right of way. Other cost considerations mentioned by at least one operator included local construction costs and possible changes to leak detection systems. Finally, two natural gas pipeline operators stated that monetary cost plays a role in determining what steps they plan to take to meet a one-hour response time goal for pipelines in highly populated areas. For example, the operator might choose to move personnel closer to valves rather than installing automated valves, if that is the more cost-effective option.

Opportunities Exist for PHMSA to Better Communicate Guidance and Share Best Practices Operators Use to Determine Whether to Install Automated Valves

PHMSA has developed guidance to help operators understand current regulations on what operators must consider when deciding to install automated valves, but not all operators are aware of the guidance. PHMSA includes on its primary website two types of guidance that can be useful for operators in determining whether to install automated valves on transmission pipelines. First, PHMSA has developed inspection protocols for both the hazardous liquid and natural gas integrity management program. Second, PHMSA has developed guidance on the enforcement actions inspectors will take—such as a notice of proposed violation and warning letter, among others—should PHMSA discover a violation. Both of these pieces of guidance provide additional detail—not included in regulation—on the steps operators might take in considering whether to install automated valves. For example, PHMSA’s inspection protocol for natural gas operators describes several studies on the generic costs and benefits of automated valves and indicates that operators may use this research as long as they document the reasons why the study is applicable to the specific pipeline segment. However, operators we spoke with were unaware of existing guidance to varying degrees. Specifically, of the eight operators we met with, three were unaware of both the inspection and enforcement guidance, and the remaining five operators were unaware of the enforcement guidance. Operators we spoke with, including those that were unaware of the guidance, told us that having this information would be helpful in making decisions to install automated valves. According to PHMSA, the agency provides this guidance to operators to ensure operators follow it as they make decisions on whether to install automated valves, but does not re-distribute the guidance at regular intervals (e.g., annually).

According to PHMSA, inspectors see examples of how operators make decisions to install automated valves during integrity management inspections, but the inspectors do not formally collect this information or share it with other operators. Current regulations give operators a large degree of flexibility in making decisions in deciding to install automated valves. As mentioned earlier, we spoke with operators that are using a variety of risk-based methods for making decisions about automated valves. For example, some used basic yes-or-no criteria, while others applied commercially available computer software to model potential incident outcomes. According to PHMSA, officials do not formally share what they view as good methods for determining whether to install automated valves. Officials stated they do not believe it is appropriate for PHMSA to publicly share decision-making approaches from a single operator, as doing so might be seen as an endorsement of that approach. However, according to PHMSA, its inspectors may informally discuss methods used by operators for making decisions to install automated valves and suggest these approaches to other operators during inspections. While the operators we spoke with represent roughly 18 percent of the overall hazardous liquid and natural gas transmission pipelines in high-consequence areas in 2010, there are over 650 additional pipeline operators we did not speak with that may be using other methods for determining whether to install automated valves. As such, we believe that both operators and inspectors could benefit from exposure to some of the methods used by other operators to make decisions on whether to install automated valves.

We have previously reported on the value of organizations reporting and sharing information and recommended that PHMSA develop methods to share information on practices that can help ensure pipeline safety. PHMSA already conducts a variety of information-sharing activities that could be used to ensure operators are aware of both existing guidance and of approaches used by other operators for making decisions to install valves. While, according to PHMSA officials, the agency will not endorse a particular operator’s approach or practice, it can and does facilitate the exchange of information among operators and other stakeholders. For example, PHMSA issues advisory alerts in the Federal Register on emerging safety issues, including identified mechanical defects on pipelines, incidents that occurred under special circumstances, and reminders to correctly implement safety programs (e.g., drug and alcohol screening). In addition, PHMSA administers a website different from its primary website that, according to officials, is intended to ensure communication with pipeline safety stakeholders, including the public, emergency officials, pipeline safety advocates, regulators, and pipeline operators. PHMSA also periodically conducts public workshops with pipeline stakeholders on a wide variety of topics, including one in March 2012 on automated valves.

Conclusions

While PHMSA currently requires operators to respond to incidents in a “prompt and effective manner,” the agency does not define these terms or collect reliable data on incident response times to evaluate an operator’s ability to respond to incidents. A more specific response time goal may not be appropriate for all pipelines. However, some organizations in the pipeline industry believe that such a performance-based goal can allow operators to identify actions that could improve their ability to respond to incidents in a timelier manner, and are taking steps to implement a performance-based approach. A performance-based goal that is more specific than “prompt and effective” could allow operators to examine the numerous variables under their control within the context of an established time frame to understand their current ability to respond and identify the most effective changes to improve response times, if needed, on individual pipeline segments. Reliable data would improve PHMSA’s ability to measure incident response and assist the agency in exploring the feasibility of developing a performance-based approach for improving operator response to pipeline incidents.

One of the methods operators could choose to meet a performance- based approach to incident response is installing automated valves, a measure some operators are already taking to reduce risk. Given the different characteristics among valve locations, it is important for operators to carefully weigh the potential for improved incident response times against any disadvantages, such as the potential for accidental closure and monetary costs, in deciding whether to install automated valves as opposed to other safety measures. However, not all operators we spoke with were aware of existing PHMSA guidance and PHMSA does not formally collect or share evaluation approaches used by other operators to make decisions about whether to install automated valves. Such information could assist operators in evaluating the advantages and disadvantages of these valves and help them determine whether automated valves are the best option for meeting a performance-based incident response goal.

Recommendations for Executive Action

We recommend that the Secretary of Transportation direct the PHMSA Administrator to take the following two actions:

To improve operators’ incident response times, improve the reliability of incident response data and use these data to evaluate whether to implement a performance-based framework for incident response times.

To assist operators in determining whether to install automated valves, use PHMSA’s existing information-sharing mechanisms to alert all pipeline operators of inspection and enforcement guidance that provides additional information on how to interpret regulations on automated valves, and to share approaches used by operators for making decisions on whether to install automated valves.

Agency Comments

We provided the Department of Transportation with a draft of this report for review and comment. The department had no comments and agreed to consider our recommendations.

We are sending copies of this report to relevant congressional committees, the Secretary of Transportation, and other interested parties. In addition, this report will also be available at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-3824 or flemings@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the opportunities that exist to improve the ability of transmission pipeline operators to respond to incidents and (2) the advantages and disadvantages of installing automated valves in high-consequence areas and ways that the Pipeline and Hazardous Materials and Safety Administration (PHMSA) can assist operators in deciding whether to install valves in these areas.

To address our objectives, we reviewed regulations, National Transportation Safety Board (NTSB) incident reports, and PHMSA guidance and data on enforcement actions, pipeline operators, and incidents, related to onshore natural gas transmission and hazardous liquid pipelines. We also attended industry conferences and interviewed officials at PHMSA headquarters and regional offices (Eastern, Southwestern, and Western), state pipeline safety agencies, pipeline safety groups, and industry associations. Specifically, we interviewed officials from the American Gas Association, American Petroleum Institute, Arizona Office of Pipeline Safety, Association of Oil Pipelines, Interstate Natural Gas Association of America, National Association of Pipeline Safety Representatives, NTSB, Pipeline Research Council International, Public Utilities Commission of Ohio, and West Virginia Public Service Commission.

To address both objectives, we also conducted case studies on eight hazardous liquid and natural gas pipeline operators. We selected these operators based on our review of PHMSA data on the operators’ onshore pipeline mileage, product type and prior incidents, recommendations from industry associations and PHMSA, and to ensure geographic diversity. We selected six hazardous liquid and natural gas pipeline operators with a large amount of pipeline miles in high-consequence areas that also reported recent incidents (i.e., one or more incident(s) reported from 2007 through 2011) with a range of characteristics, such as: affected a high- consequence area; resulted in an ignition/explosion; or involved an automated valve. We also selected one natural gas pipeline operator and one hazardous liquid pipeline operator with a small number of pipeline miles in high-consequence areas, to obtain the perspective of smaller pipeline operators. Specifically, we interviewed officials from:

Belle Fourche Pipelines (Casper, Wyoming)—Hazardous Liquids;

Buckeye Partners (Breinigsville, Pennsylvania)—Hazardous Liquids;

Enterprise Products (Houston, Texas)—Hazardous Liquids and

Granite State Gas Transmission (Portsmouth, New Hampshire)—

Kinder Morgan-Natural Gas Pipeline Company (Houston, Texas)—

Phillips 66 (Houston, Texas)—Hazardous Liquids;

Northwest Pipeline GP (Salt Lake City, Utah)—Natural Gas; and

Williams-Transco (Houston, Texas)—Natural Gas.

To determine what opportunities exist to improve the ability of transmission pipeline operators to respond to incidents, we identified several factors that influence pipeline operators’ incident response capabilities. To do so, we discussed prior incidents, incident response times, and federal oversight of the pipeline industry with officials from PHMSA, state pipeline safety offices, industry associations, and safety groups. We also spoke with operators about their prior incidents and the factors that influenced their ability to respond. We also examined 2007 to 2011 PHMSA incident data, including data on total number of incidents, type of incident (leak or rupture), type of pipeline where the incident occurred, and the date and time when: an incident occurred; an operator identified the incident; operator resources (personnel and equipment) arrived on site; and an operator shut down a pipeline or facility. We assessed the reliability of these data through discussions with PHMSA officials and selected operators. We determined that data elements related to numbers of incidents, types of releases, and types of pipeline where incidents occurred were reliable for the purpose of providing context, but that data elements related to response time were not sufficiently reliable for the purpose of conducting a detailed analysis of relationships between response time and other factors. We also reviewed federal requirements, prior GAO reports, and industry and government performance standards related to emergency response within the pipeline industry.

To determine the advantages and disadvantages of installing automated valves in high-consequence areas and the ways that PHMSA can assist operators in deciding whether to install these valves, we identified the key factors that should be used in deciding whether to install automated valves in high-consequence areas. We used two categories of sources to identify the key factors: (1) Literature review. We conducted a literature review of previous research on pipeline incidents. Specifically, we used online research software to search through databases of scholarly and peer-reviewed materials—including articles, journals, reports, studies, and conferences dating back to 1995—which identified over 200 sources. (2) Interviews with industry stakeholders. During our interviews with officials from industry associations and pipeline safety groups, we discussed the advantages and disadvantages of installing these valves.

To ensure that the literature review included just those documents that were relevant to our purpose, two analysts independently reviewed abstracts from the 200 sources identified to determine whether they were within the scope of our review. Each source had to meet specific criteria, including mentioning automated valves, pipeline incidents, and operator emergency response. We excluded sources that were overly technical for the purposes of our review. To ensure these analysts were making similar judgments, they separately examined a random sampling of each other’s sources. The analysts then added sources suggested by industry stakeholders during our interviews and reviewed them using the same criteria. After excluding documents that were not publicly available, one analyst reviewed these sources to identify advantages and disadvantages operators should consider when making decisions to install automated valves. A second analyst reviewed the analysis and performed a spot check on identified advantages and disadvantages. Specifically, the second analyst picked four of the sources at random to review and compared the advantages and disadvantages he identified to those of the first analyst. As part of our case studies, we discussed these advantages and disadvantages with operators. We also collected information from operators on their methods for deciding whether to install automated valves, as well as specific pipeline segments and valve locations where operators made such decisions (see app. II). We contacted vendors (manufacturers and installers) of automated valves to identify the range of costs for purchasing and installing these valves. We also discussed the regulations with officials from PHMSA headquarters and regional offices, state pipeline safety offices, and pipeline operators to determine what, if any, additional guidance would help operators apply the current regulations on installing automated valves.

We conducted this performance audit from March 2012 to January 2013 in accordance with generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: How Select Operators Determined Whether to Install Automated Valves

We conducted site visits to eight hazardous liquid and natural gas pipeline operators with different amounts of pipeline miles in or affecting high-consequence areas. Seven of the eight operators we visited told us they use approaches that consider both the advantages and disadvantages of installing automated valves on a case-by-case basis as opposed to other safety measures; the eighth operator stated that it follows a corporate strategy of installing automated valves in all high- consequence areas. A brief description of the approach used by each of the eight operators, based on our discussions with them, follows.

Pipeline operator: Belle Fourche Product type: Hazardous liquid Number of pipeline miles: 460 (total); 135 (could affect high- consequence areas)

Decision-making approach: The operator assesses each pipeline segment using spill-modeling software to determine the amount of product release and extent of damage that would occur in the event of an incident. The software considers flow rates, pressure, terrain, product type, and whether the segment is located over land or a waterway. Monetary costs are considered as part of the decision-making process, including the cost of installing communications equipment and gaining access to the valve location when the operator does not own the right of way. The operator stated that installing a remote-control valve costs between $100,000 and $500,000. Automatic-shutoff valves are not considered as the operator believes an accidental closure could lead to pipeline ruptures.

Results to date: According to Belle Fourche officials, this approach has not resulted in any decisions to install automated valves because the advantages have not outweighed the disadvantages on any of the pipeline segments assessed.

Pipeline operator: Buckeye Partners Product type: Hazardous liquid Number of pipeline miles: 6,400 (total); 4,179 (could affect high- consequence areas)

Decision-making approach: The operator assesses each pipeline segment using spill-modeling software to determine the amount of product release and extent of damage that would occur in the event of an incident. The operator considers installation of an automated valve when this modeling shows such a valve would 1) reduce the size of the incident by 50 percent or more and 2) significantly reduce the consequences of an incident. The operator conducts additional analysis to determine the location where the automated valve would lead to the largest reduction in spill volume and overall consequences of an incident. Monetary costs are considered as part of the decision-making process, including costs for gaining access to pipeline when the operator does already not own the right of way. The operator stated that installing a remote-control valve costs between $35,000 and $325,000. Automatic-shutoff valves are considered, but not typically installed, as the operator believes an accidental closure could lead to a pipeline rupture.

Results to date: According to Buckeye Partners officials, this approach has resulted in additional analysis of the possible installation of 25 remote-control valves along 75 pipeline segments assessed.

Pipeline operator: Phillips 66 Product type: Hazardous liquid Number of pipeline miles: 11,290 (total); 3,851 (could affect high- consequence areas)

Decision-making approach: The operator assesses every 100 feet of pipeline (which covers all pipeline segments) using spill-modeling software to determine the amount of product release and extent of damage that would occur in the event of a complete rupture. The operator also uses a relative consequence index for individual pipeline segments that considers the impact to high-consequence areas. Automated valve projects are further evaluated if 1) the potential drain volume is greater than 1,000 barrels, 2) the pipeline segment exceeds a certain threshold on the consequence index, or 3) the existing automated valves are greater than 7.5 miles apart. Monetary costs are considered as part of the decision-making process, including the cost of installing communications equipment, access to power, gaining access to the valve’s location when the operator does not own the right of way, and local construction costs. The operator stated that installing an automated valve costs between $250,000 and $500,000. Automatic-shutoff valves are not considered as the operator believes an accidental closure could lead to pipeline ruptures.

Results to date: According to the Phillips 66 officials, this approach has resulted in decisions to install 71 automated valves in the 508 high- consequence area locations assessed.

Pipeline operator: Enterprise Products Product type: Hazardous liquid and natural gas Number of pipeline miles: 23,012 (total); 8,783 (could affect or in high- consequence areas)

Decision-making approach: The operator assesses each pipeline segment using spill-modeling software to determine the amount of product release and extent of damage that would occur in the event of an incident. The software considers factors such as topography and the placement of existing valves. The operator also uses a risk algorithm to identify threats to individual pipeline segments. The operator told us that it does not have specific criteria for guiding decisions to install automated valves; rather, officials make judgment calls based on the results of spill modeling and the application of the risk algorithm. Monetary costs are considered as part of the decision-making process, including the cost of installing communications equipment and the amount of necessary infrastructure work. The operator stated that installing a remote-control valve costs between $250,000 and $500,000. Pipelines carrying gas or highly volatile liquids—which are in gas form when released into the atmosphere—are excluded from consideration, according to the operator, because industry studies have shown that automated valves do not significantly improve incident outcomes for these product types.

Results to date: According to Enterprise Products officials, this approach has not resulted in any decisions to install automated valves because the advantages have not outweighed the disadvantages on any of the pipeline segments assessed.

Pipeline operator: Granite State Gas Transmission Product type: Natural gas Number of pipeline miles: 86 (total); 11 (high-consequence areas)

Decision-making approach: The operator assesses individual pipeline segments in high-consequence areas using risk analysis software that considers the operator’s response time to an incident, population in the area, and pipeline diameter, among other variables. Monetary costs are considered as part of the decision-making process, including the cost of installing communications equipment and costs to change or improve the existing leak detection system. The operator stated that installing an automated valve costs between $40,000 and $50,000. Automatic-shutoff valves are not considered, as officials believe that they could lead to unintended consequences, such as accidental closures.

Results to date: According to Granite State Gas Transmission officials, this approach has resulted in decisions to install remote-control valves in 30 of the 30 locations assessed.

Pipeline operator: Kinder Morgan-Natural Gas Pipeline Company of America (NGPL)

Product type: Natural gas Number of pipeline miles: 9,800 (total); 569 (high-consequence areas)

Decision-making approach: The operator follows a long-term corporate risk management strategy for NGPL, developed in the 1960s, that calls for installing automatic-shutoff valves across its pipeline system regardless of advantages and disadvantages for individual pipeline segments. The operators told us that automatic-shutoff valves, as opposed to remote-control valves, were chosen because they reduce the potential for human error when making decisions to close valves. Officials stated that the biggest concern of using automatic-shutoff valves is the potential for accidental closures, but they believe they have developed a procedure for managing the pressure sensing system that effectively adapts to pressure and flow change and minimizes or eliminates these types of closures. Monetary costs are not considered as part of the decision-making process. The operator stated that installing automatic- shutoff valve on an existing manual valve costs between $48,000 and $100,000.

Results to date: According to Kinder Morgan officials, this approach has resulted in the installation of automated valves at 683 out of 832 locations across the pipeline system. Officials plan to automate the remaining valves over the next several years.

Pipeline operator: Northwest Pipeline GP Product type: Natural gas Number of pipeline miles: 3,900 (total); 170 (high-consequence areas)

Decision-making approach: The operator uses a decision tree to assess individual pipeline segments based on several criteria, including the location of the valve (e.g., high-consequence area), diameter of the pipe, and the amount of time it takes for an operator to respond upon notification of an incident. The operator will install an automated valve in any high-consequence, class 3, or class 4 areas on large diameter pipe (i.e., above 12 inches) where personnel cannot reach and close the valve in under an hour. Monetary costs are considered as part of the decision- making process for the purposes of determining the most cost-effective way to ensure the operator can respond within one hour to incidents in high-consequence areas. The operator stated that installing an automated valve costs between $37,000 and $240,000. Automatic-shutoff valves are not installed in areas where an accidental closure could lead to customers losing service (i.e., in places where there is a single line feed servicing the entire area) or where pressure fluctuations may inadvertently activate the valve.

Results to date: According to Northwest Pipeline GP officials, this approach has resulted in decisions to install automated valves at 59 of the 730 locations assessed.

Pipeline operator: Williams Gas Pipeline-Transco Product type: Natural gas Number of pipeline miles: 11,000 (total); 1,192 (high-consequence areas)

Description of decision-making method: The operator uses a decision tree to assess individual pipeline segments based on several criteria, including the location of the valve (e.g., high-consequence area), diameter of the pipe, and the amount of time it takes for an operator to respond upon notification of an incident. The operator will install an automated valve in any high-consequence, class 3, or class 4 areas on large diameter pipe (i.e., above 12 inches) where personnel cannot reach and close the valve in under an hour. Monetary costs are considered as part of the decision-making process for the purposes of determining the most cost-effective way to ensure the operator can respond within one hour to incidents in high-consequence areas. The operator stated that installing an automated valve costs between $75,000 and $500,000. Automatic-shutoff valves are not installed in areas where an accidental closure could lead to customers losing service (i.e., in places where there is a single line feed servicing the entire area) or where pressure fluctuations may inadvertently activate the valve.

Results to date: According to Williams Gas Pipeline-Transco officials, this approach has resulted in decisions to install automated valves at 56 of the 2,461 locations assessed.

Appendix III: Automated Valve Costs

The eight operators we spoke with provided a range of cost estimates for installing automated valves—from as low as $35,000 to as high as $500,000 depending on the location and size of the pipeline, and the type of equipment being installed, among other things. While both hazardous liquid and natural gas transmission pipeline operators estimated a similar cost range from about $35,000 to $500,000, hazardous liquid pipeline operators tended to estimate higher costs. Specifically, two of the three operators that exclusively transport hazardous liquids estimated that the minimum costs of installing an automated valve was $100,000 or higher and the maximum was $500,000. In contrast, pipeline operators that exclusively transport natural gas all estimated that the minimum cost was $75,000 or lower and three of the four operators estimated that maximum costs would be $240,000 or lower.

We also spoke with five equipment vendors and six contractors that install valves to gather additional perspective on the cost of purchasing and installing automated valve equipment. According to estimates provided by these businesses, the combined equipment and labor costs range between $40,000 and $380,000. Specifically, equipment costs range from $10,000 to $75,000 while labor costs range from $30,000 to $315,000. (See table 3.) Vendors stated that the cost of installing an automated valve depends primarily on the functionality of the equipment (for example, additional controls would increase the cost), while contractors stated that these costs depend on the diameter and location of the pipeline. Vendors and contractors had varying opinions on whether the costs were greater to install an automated valve on hazardous liquid or natural gas pipeline.

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Susan Fleming, (202) 512-3824 or flemings@gao.gov.

Staff Acknowledgments

In addition to the contact above, Sara Vermillion (Assistant Director), Sarah Arnett, Melissa Bodeau, Russ Burnett, Matthew Cook, Colin Fallon, Robert Heilman, David Hooper, Mary Koenen, Grant Mallie, Josh Ormond, Daniel Paepke, Anne Stevens, and Adam Yu made key contributions to this report.