So much pipeline safety information!

Did you know we recently updated our briefing papers and added papers on three additional topics? These papers are a great source of ‘Pipeline Safety 101′ information – they are short and each focused on a single topic. They do not need to be read in order, though some basic understanding is helpful before reading about the more technical issues. Check them out if you haven’t already! Here is the full list:

 

Another pipeline incident anniversary – have things changed since 2009?

Question of the weekI think it was around this time in 2009 that a gas pipeline blew up in Palm City, Florida near a school. What really happened then, and have things gotten safer in the past 6 years?

On May 4, 2009, an 18-inch Florida Gas Transmission Company interstate pipeline ruptured about 6 miles south of Palm City, Florida, releasing about 36 million cubic feet of natural gas and causing three minor injuries in Martin County. The community was fortunate: the gas did not find a source of ignition and catch fire, nor did two other large gas lines buried parallel to the one that ruptured sustain any damage, though 106 feet (over 5,000 pounds) of buried pipeline was blown into the air and landed in the right-of-way between two major highways. The pipeline segment that failed was between two automatic shutoff valves, but only one closed in response to the pressure drop on the pipeline. A Supervisory Control and Data Acquisition (SCADA) system was in use by the pipeline operator at its control center in Houston, TX to remotely monitor and control the movement of gas through the pipeline. The SCADA system also failed to recognize the rupture or trigger any alarms.NTSB: Location next to I-95 and high school, in Rupture of Florida Gas Transmission Pipeline and Release of Natural Gas 20090504

The National Transportation Safety Board (NTSB) issued a pipeline accident brief on this incident, which found the cause of the accident to be the operator’s failure to detect cracking of the pipeline beneath protective coating. The NTSB also found that the operator failed to correctly identify the pipe as being within a high consequence area even though it was near a school.

As with most pipeline incidents, there were many contributing factors to this incident. The operator subsequently changed operations and procedures related to this pipeline in response to a PHMSA corrective action order as reported by the NTSB. But here, in response to the question about whether things have gotten safer in the past 6 years, we will focus on the issue of high consequence area (HCA) identification.

If the pipeline segment had been correctly identified as being within a high consequence area, then it would have been included in the pipeline operator’s integrity management program. There are specific rules in the federal regulations requiring the implementation of integrity management in high consequence areas, and these include specific inspection, analysis, maintenance and repair criteria designed to detect problems such as those that caused this 2009 incident.

As to whether these same mistakes could be happening today, the answer is yes. Are things safer? It’s hard to say. The same rules that allowed the identity and location of HCA’s to be kept secret from the public in 2009 are still in place. The public can’t know, until after an incident, whether an operator has accurately identified the HCAs along its route.  

A fundamental problem is that PHMSA essentially leaves the designation of high consequence area (HCA) boundaries up to the pipeline operators, and entrusts them to update the boundaries when any changes take place that would trigger a new inclusion in the HCA. There is no way for an average citizen to know about the details of these HCA boundaries, to know if PHMSA is enforcing the designation of those areas, and no way to help ensure operators encapsulate what needs to be included within those boundaries according to the regulations.

For example, on a gas transmission line like the one in Florida that ruptured in 2009, the presence of certain populated areas would trigger the HCA designation. There is a complicated way for gas pipeline operators to choose their method of designation and draw their boundaries (see 49 CFR §192.903). Put generally, any area near a pipeline with a high population (for gas pipelines, that means 20 or more homes), or with a populated activity center (e.g. school, office, assisted living, recreation area, campground, etc.; referred to as “designated sites” in the gas regulations), would be considered part of an HCA. Just how near to the gas pipeline these homes and activities need to be to trigger the HCA designation depends on how big the pipeline is, and the pressure inside it.

So what if a community is building a new school? Or what if a development goes in within a half-mile of an existing pipeline? In the case of a hazardous liquid (e.g. crude oil or petroleum) pipeline, nearby town water intakes or environmentally sensitive areas also trigger the HCA designation – what if a town changes their water intake or an agency recognizes a new critical habitat area? These types of changes and development happen all across the country, but only a very few communities have practices or rules in place that facilitate active dialogue between a pipeline operator and developer, or between an emergency management team and pipeline operator, to the degree that these types of changes are promptly reflected in a pipeline operator’s integrity management program.

In fact, PHMSA rules allow over 10 years – yes, TEN YEARS – from the time a natural gas pipeline operator identifies HCA changes to when that information must be part of a completed baseline assessment of the pipeline in the newly identified HCA. And PHMSA rules allow over 6 years from the time a hazardous liquid pipeline operator identifies an area of high population or sensitivity, to when that information must have been incorporated into its completed pipeline assessment. And the time between the actual on-the-ground change and the identification of that change by the pipeline operator adds even more time – a vague amount of time as this type of information analysis is only required by the operator ‘periodically.’

Contrary to some who think pipeline information needs to be less accessible, we think the secrecy surrounding pipeline operator’s designations of high consequence areas (HCAs) and other withheld information leads to more risky pipelines. If communities could access this type of information easily, it would be easy for planners, emergency responders, and concerned citizens to inform pipeline operators when a change is needed – thereby leading to SAFER pipelines, not more risky ones. Our experience is that those most impacted by pipelines – those who live in close proximity to them, are the ones with most at stake and most interested in keeping the pipelines and their community safe. Withholding information from these stakeholders disregards critical allies in our collective efforts toward safer pipelines.

Despite the lack of a transparent playing field in this area, there are some things you can do.

Communities with active Local Emergency Planning Committees (LEPC) often have regular open meetings, and the committee itself should include representation from community groups as well as emergency response professionals, elected officials, professional staff, and facility and pipeline operators. The emergency responders who participate in these meetings have the ability to access information from pipeline operators that the general public cannot access. Pipeline operators are required to share their emergency response plans with local first responders, and to maintain liaison with appropriate fire, police, and other public officials. Citizens can participate with the LEPC and request the committee work on accurate identification of HCAs in partnership with the pipeline operator. The LEPC topic is addressed in more detail in chapter 5 of our Local Government Guide to Pipelines.

PHMSA maintains a web-based National Pipeline Mapping System (NPMS), which is viewable on a county-level and depicts the location of hazardous liquid and natural gas pipelines, along with population areas and other information. While the population areas may give some indication of where a high consequence area is likely to be designated, there is not a direct link between the NPMS information and what the operators currently use to designate their HCAs. The PHMSA information is not up to date, and does not include the level of detail or environmental information needed to truly assess HCA boundaries. This is a problem. There are periodic opportunities for the public to comment on this issue, as the Trust did in December 2014 and October 2013 (comments of the Trust on a variety of pipeline safety topics are viewable here). The public needs to be able to view information and data gathered from pipeline companies on NPMS that depicts pipeline locations within an HCA with a high level of accuracy. There is in fact a statutory requirement that HCAs be incorporated as part of NPMS and updated biennially.[1]

Lastly, the Palm City, Florida incident was one of the incidents the NTSB highlighted in their recent safety study published earlier this year entitled “Integrity Management of Gas Transmission Pipelines in High Consequence Areas” and discussed in our January 30 Smart Pig blog post. This study included a number of additional changes needed to help make pipelines safer over time.

[1] Pipeline Safety Regulatory Certainty, and Job Creation Act of 2011; Section 6 made part of 49 USC 60132.

Another Spill into the Yellowstone – Are we learning anything?

 

Many rivers to cross
But I can’t seem to find my way over

                                                ~Jimmy Cliff

 

Dear Readers: An unfortunate deja-vu-all-over-again moment occurred recently: another pipeline ruptured at a crossing of the Yellowstone River in eastern Montana.

First, there was the Silvertip spill….

You may remember that after the ExxonMobil Co.’s Silvertip Pipeline ruptured and spilled 1,500 barrels of oil into the Yellowstone River in 2011, I got a letter from my friend King Fisher of Riparian Ranch asking about the rules that govern pipelines crossing rivers. It was clear by then that the Silvertip spill was caused by the pipeline being damaged by riverbed scour and debris and he was understandably confused about the existing rule requiring operators to bury their pipelines a minimum of only four feet when they construct pipelines across rivers of at least 100 feet in width. He wondered whether there were other rules, and what they might be. 

I answered that letter in the Trust’s newsletter in January of 2013 (at pages 4-6). Here are the highlights of that response:

  • The current rules require pipelines crossing rivers that are wider than 100 feet to be buried at least 4 feet at the time of construction. A separate rule requires lines that cross navigable rivers to be checked at least every 5 years “to determine the condition of the crossing”. There is no rule requiring any specific depth of cover to be maintained after installation, unless the pipeline is one where a spill could affect a “high consequence area,” say, for example, the drinking water supply of a small city that takes its water directly from, say, the Yellowstone River.
  • The 2011 amendments to the Pipeline Safety Act included a directive to PHMSA to undertake a study of liquid pipeline incidents at river crossings to determine if depth of cover was a factor, and to make recommendations for any legislative action to improve the safety of buried pipelines at river crossings. No regulatory action was required of PHMSA.
  • PHMSA produced its report describing its data management challenges (it doesn’t have a database, geographic or otherwise that shows the crossings that are subject to the 100 foot crossing/4 feet deep rule); and describing the pipeline failures at crossings in the last 20 or so years (well, at least some of them). In an NTSB document not cited in PHMSA’s report to Congress, a chart shows that 6 of Exxon’s pipelines in the San Jacinto floodplain ruptured or were undermined for up to 120 feet in the 1994 flood event; most of these were not included in the PHMSA analysis.

Then there was the Bridger spill – Another spill into the Yellowstone River last month

The Bridger pipeline failed at its crossing of the Yellowstone River, spilling approximately 1,000 barrels of crude into the river. Complicating response, investigation and recovery is that the river is entirely frozen over, but with ice of varying thickness from day to day, creating safety concerns for responders and physical limitations on recovery operations.

Initial reports were that the pipeline was buried at least 8 feet under the bed of the river. Then we learned that was an assessment from 2011. Then we learned that sonar showed much of the pipeline crossing the river was exposed on the riverbed, and some of it was suspended above the bed, entirely exposed. Although we do not yet know the reason for the pipe’s failure, clearly the lessons of the Silvertip (and a USGS study showing parts of the Missouri River scouring to depths of up to 40 feet) had not been learned – that rivers change all the time and quickly, that riverbeds move a lot of sediment, and quickly.

My 2013 reply to King Fisher was written before PHMSA had fulfilled its second obligation under the 2011 Act: to determine whether the depth of cover requirements are inadequate and if so, to make legislative recommendations. I suggested staying tuned to find out what PHMSA would do, and raised concerns about some of the options open to it:

The risk is that PHMSA either: a) decides to change the depth of cover at installation rule, creating a political sideshow that exhausts safety advocates’ energy arguing over the number of feet or inches it should be raised, completely ignoring the fact that the installation rule makes very little difference over time if there are no maintenance of cover rules or viable, enforceable integrity management rules to require operators to manage for the risk of riverbed scour; or b) decides to argue that the operator’s obligations under integrity management rules to identify and mitigate the risks of riverbed scouring are sufficient, regardless of the 4-foot depth of cover at installation requirement, and therefore the depth of cover rules don’t need to be changed. 

Unless PHMSA opts for: c) an enforceable and enforced maintenance of cover rule for all crossings that is based on a study of the specific location and characteristics of each crossing; and d) actually enforcing integrity management obligations of operators to design for and mitigate against the risk of riverbed scour before an incident occurs, this smart pig is not optimistic about improving the safety of crossings at rivers.

So, how did PHMSA do?

Well, to some extent it remains to be seen, but there is recent reason to hope for improvement.

When PHMSA reported to Congress with the second half of its homework assignment – do you have legislative recommendations? – PHMSA reported that it believed that its existing legislative authority was adequate to protect pipelines at river crossings. PHMSA has yet to publish ANY substantive proposed changes to its safety regulations since the 2011 reauthorization, and until those major proposed rulemakings are released, we won’t know whether PHMSA intends to change the depth-of-cover-at-construction rule or to propose any new rules requiring maintenance of cover to some depth.

But just last week, in the midst of the awful news about the Bridger spill into the Yellowstone, PHMSA released its Final Order on ExxonMobil’s appeal of the fine imposed for its Silvertip spill. In the order, PHMSA responded to the operator’s (EMPCo’s) arguments that they had complied with the regulations relating to adequate risk assessments and integrity management measures to manage the identified risks:

The fact that flooding had not previously caused an integrity issue for Respondent’s pipeline does not mean future flooding could never cause a failure. One of the purposes of the integrity management regulations is to anticipate the possible threats to the pipeline in the future. Given that flooding is a threat in general and that flooding had caused integrity issues for other pipelines at the same location, it was not reasonable for EMPCo to assume seasonal flooding would never impact its own pipeline. At a minimum, the Operator had a duty to evaluate the likelihood of a pipeline release occurring from flooding. [Order at page 9.]

The order continues by analyzing the documents in the record to determine if such a risk analysis had been made, notes that the 2010 Preventive and Mitigative Measures Analysis identified only three risks to the line — third-party damage, manufacturing, and external corrosion — in spite of the fact that the entire line had been identified as one which could affect a high consequence area, and further noting that the presence of the Yellowstone River or the risk of a failure at its crossing was never mentioned.

The good news

The Conclusion of the PHMSA order on this violation is this:

Given the history of flooding and impact to other pipelines at this location, the threat of flooding was relevant to the likelihood of a release occurring on Respondent’s pipeline. Respondent did not evaluate the likelihood of a release caused by flooding of the Yellowstone River and failed to consider risk factors relevant to flooding. Accordingly, PHMSA finds Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis of the Silvertip Pipeline that considered all risk factors relevant to the likelihood of a release on the Silvertip Pipeline and potential consequences affecting the Yellowstone River. [Order at page 12.]

This suggests that PHMSA may, in fact, be choosing Option D from my response to my friend King Fisher: d) actually enforcing integrity management obligations of operators to design for and mitigate against the risk of riverbed scour before an incident occurs.

Well, okay, technically, they haven’t yet enforced those obligations before an incident occurs as far as we know, but this is at least a start. Most importantly, it should certainly put every other operator on notice, whether they’ve had a flooding/riverbed scour/earth movement failure or not, that PHMSA will enforce the operators’ obligation to adequately assess those risks and to integrate sufficient preventive and mitigative measures into their integrity management programs to protect against failures. Unfortunately, PHMSA didn’t do that when they inspected the Silvertip a year or so before the Yellowstone rupture. When regulators enforce those obligations in routine inspections of integrity management programs independent of (and hopefully before) any incidents, that will indeed be good news.

NTSB’s recent study on systemic weaknesses in gas pipeline safety

News media recently reported that the National Transportation Safety Board (NTSB) found continuing systemic weaknesses in gas pipeline safety. What does the NTSB have to say about where improvements are needed?

The NTSB and the gas pipeline integrity management rules

The NTSB is a congressionally-mandated transportation agency that operates independently to conduct objective accident investigations and safety studies, and advocates for implementation of safety recommendations. The NTSB does not conduct investigations of all pipeline incidents; it investigates those in which there is a fatality, substantial property damage, or significant environmental impact. In the past five years, the NTSB investigated three major gas transmission pipeline accidents in which operator and PHMSA oversight deficiencies were identified as concerns, occurring in Palm City, FL (2009), San Bruno, CA (2010), and Sissonville, WV (2012). These three accidents resulted in 8 deaths, over 50 injuries, and 41 homes destroyed with many more damaged.

The five-member NTSB Board held a meeting on Tuesday and soon after released an abstract of their recommendations. [The full study is now available here.] The study focuses on gas transmission pipelines within High Consequence Areas – basically, areas with higher population – and therefore must have in place an integrity management program. Only about 7% of the nearly 300,000 miles of gas transmission pipelines nationwide are required to have an integrity management program, though the industry says many more miles are inspected under integrity management than what the rules require.

The Pipeline and Hazardous Materials Safety Administration (PHMSA) gas pipeline integrity management program rules took effect in 2004. They require, among other things, that the pipeline operators inspect their gas pipelines at least every seven years, and have a program in place to assess risk and ensure their pipelines are safe and reliable. Integrity management rules are performance-based rather than prescriptive, and rely on the operator to have good and complete data that is continually evaluated. Pipeline operator integrity management programs are periodically inspected by PHMSA and/or state regulators to assess compliance. Theoretically, using integrity management, gas pipeline operators should be finding and addressing potential problems before they result in accidents. Clearly, that is not working as evidenced by the accidents mentioned, leading the NTSB to embark on their study.

The NTSB Study

The study highlights shortcomings of the gas transmission integrity management system, and underscores issues the Trust has been bringing up for years. [See our 2012 comments submitted to PHMSA on gas transmission line safety and our 2014 comments to PHMSA on improving the national pipeline mapping system.] The abstract from NTSB states, “there is no evidence that the overall occurrence of gas transmission pipeline incidents in HCA pipelines has declined.” The complexity of the integrity management programs require expertise in multiple technical disciplines from both operator personnel and pipeline inspectors, and PHMSA does not have the resources for guiding them. The thirty-three findings of the study are published in the abstract and are followed by twenty-eight recommendations.

In brief, many things need improvement, including much better geographic information so that inspectors and operators clearly know where pipelines and high consequence areas are, and all data is better integrated; better communication between state inspections lead by the National Association of Pipeline Safety Representatives and PHMSA; better use of in-line inspection tools and improved operation of the same; better threat identification and assessment methods, with PHMSA acting as a guide for pipeline operators and inspectors in this area; and generally stronger, clearer standards and criteria for both operator and inspector programs and personnel to raise the safety bar higher.

We sincerely hope that 2015 will be remembered not for more terrible pipeline accidents, but for safety improvements that are made in part when studies and recommendations like the NTSB’s are heeded.