Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release

Marshall, Michigan
July 25, 2010

NTSB Number: PAR-12-01
NTIS Number: PB2012-916501
Adopted: July 10, 2012
PDF

Executive Summary

On Sunday, July 25, 2010, at 5:58 p.m., eastern daylight time, a segment of a 30-inch-diameter pipeline (Line 6B), owned and operated by Enbridge Incorporated (Enbridge) ruptured in a wetland in Marshall, Michigan. The rupture occurred during the last stages of a planned shutdown and was not discovered or addressed for over 17 hours. During the time lapse, Enbridge twice pumped additional oil (81 percent of the total release) into Line 6B during two startups; the total release was estimated to be 843,444 gallons of crude oil. The oil saturated the surrounding wetlands and flowed into the Talmadge Creek and the Kalamazoo River. Local residents self-evacuated from their houses, and the environment was negatively affected. Cleanup efforts continue as of the adoption date of this report, with continuing costs exceeding $767 million. About 320 people reported symptoms consistent with crude oil exposure. No fatalities were reported.

Probable Cause

The National Transportation Safety Board (NTSB) determines that the probable cause of the pipeline rupture was corrosion fatigue cracks that grew and coalesced from crack and corrosion defects under disbonded polyethylene tape coating, producing a substantial crude oil release that went undetected by the control center for over 17 hours. The rupture and prolonged release were made possible by pervasive organizational failures at Enbridge Incorporated (Enbridge) that included the following:

• Deficient integrity management procedures, which allowed well-documented crack defects in corroded areas to propagate until the pipeline failed.
• Inadequate training of control center personnel, which allowed the rupture to remain undetected for 17 hours and through two startups of the pipeline.
• Insufficient public awareness and education, which allowed the release to continue for nearly 14 hours after the first notification of an odor to local emergency response agencies.

Contributing to the accident was the Pipeline and Hazardous Materials Safety Administration's (PHMSA) weak regulation for assessing and repairing crack indications, as well as PHMSA's ineffective oversight of pipeline integrity management programs, control center procedures, and public awareness.

Contributing to the severity of the environmental consequences were (1) Enbridge's failure to identify and ensure the availability of well-trained emergency responders with sufficient response resources, (2) PHMSA's lack of regulatory guidance for pipeline facility response planning, and (3) PHMSA's limited oversight of pipeline emergency preparedness that led to the approval of a deficient facility response plan.

Safety issues identified during this accident investigation include the following:

• The inadequacy of Enbridge's integrity management program to accurately assess and remediate crack defects. Enbridge's crack management program relied on a single in-line inspection technology to identify and estimate crack sizes. Enbridge used the resulting inspection reports to perform engineering assessments without accounting for uncertainties associated with the data, tool, or interactions between cracks and corrosion. A 2005 Enbridge engineering assessment and the company's criteria for excavation and repair showed that six crack-like defects ranging in length from 9.3 to 51.6 inches were left in the pipeline, unrepaired, until the July 2010 rupture.
• The failure of Enbridge's control center staff to recognize abnormal conditions related to ruptures. Enbridge's leak detection and supervisory control and data acquisition systems generated alarms consistent with a ruptured pipeline on July 25 and July 26, 2010; however, the control center staff failed to recognize that the pipeline had ruptured until notified by an outside caller more than 17 hours later. During the July 25 shutdown, the control center staff attributed the alarms to the shutdown and interpreted them as indications of an incompletely filled pipeline (known as column separation). On July 26, the control center staff pumped additional oil into the rupture pipeline for about 1.5 hours during two startups. The control center staff received many more leak detection alarms and noted large differences between the amount of oil being pumped into the pipeline and the amount being delivered, but the staff continued to attribute these conditions to column separation. An Enbridge supervisor had granted the control center staff permission to start up the pipeline for a third time just before they were notified about the release.
• The inadequacy of Enbridge's facility response plan to ensure adequate training of the first responders and sufficient emergency response resources allocated to respond to a worst-case release. The first responders to the oil spill were four Enbridge employees from a local pipeline maintenance shop in Marshall, Michigan. Their efforts were focused downstream along the Talmadge Creek rather than near the immediate area of the rupture. The first responders neglected to use the culverts along the Talmadge Creek as underflow dams to minimize the spread of oil, and they deployed booms unsuitable for the fast-flowing waters. Further, the oil spill response contractors, identified in Enbridge's facility response plan, were unable to immediately deploy to the rupture site and were over 10 hours away.
• Inadequate regulatory requirements and oversight of crack defects in pipelines. Title 49 Code of Federal Regulations (CFR) 195.452(h) fails to provide clear requirements for performing an engineering assessment and remediation of crack-like defects on a pipeline. In the absence of prescriptive regulatory requirements, Enbridge applied its own methodology and margins of safety. Enbridge chose to use a lower margin of safety for cracks than for corrosion when assessing crack defects. PHMSA expects pipeline operators to excavate all crack features; however, PHMSA did not issue any findings about the methods used by Enbridge in previous inspections.
• Inadequate regulatory requirements for facility response plans under 49 CFR 194.115, which do not mandate the amount of resources or recovery capacity required for a worst-case discharge. In the absence of such requirements, Enbridge interpreted the level of oil response resources required under PHMSA's three-tier response time frame, resulting in a lack of adequate oil spill recovery equipment and resources in the early hours of the first response. By contrast, the U.S. Coast Guard (Coast Guard) and the U.S. Environmental Protection Agency (EPA) regulations specify effective daily response capability for each of the three tiers for oil spill response planning.
• PHMSA's inadequate review and approval of Enbridge's facility response plan that failed to verify that the plan content was accurate and timely for an estimated worst-case discharge of 1,111,152 gallons. PHMSA's facility response program oversaw 450 facility response plans with 1.5 full-time employees, which is a lower staffing commitment than comparable response plan review programs carried out by the EPA and the Coast Guard. PHMSA and other Federal agencies receive funding from the Oil Spill Liability Trust Fund to cover operational, personnel, enforcement, and other related program costs.

As a result of this investigation, the NTSB makes safety recommendations to the U.S. Secretary of Transportation, PHMSA, Enbridge, the American Petroleum Institute, the Pipeline Research Council International, the International Association of Fire Chiefs, and the National Emergency Number Association. The NTSB also reiterates a previous recommendation to PHMSA.

Recommendations

New Recommendations

To the U.S. Secretary of Transportation:

Audit the Pipeline and Hazardous Materials Safety Administration's onshore pipeline facility response plan program's business practices, including reviews of response plans and drill programs, and take appropriate action to correct deficiencies. (P-12-1)

Allocate sufficient resources as necessary to ensure that the Pipeline and Hazardous Materials Safety Administration's onshore pipeline facility response plan program meets all of the requirements of the Oil Pollution Act of 1990. (P-12-2)

To the Pipeline and Hazardous Materials Safety Administration:

Revise Title 49 Code of Federal Regulations 195.452 to clearly state (1) when an engineering assessment of crack defects, including environmentally assisted cracks, must be performed; (2) the acceptable methods for performing these engineering assessments, including the assessment of cracks coinciding with corrosion with a safety factor that considers the uncertainties associated with sizing of crack defects; (3) criteria for determining when a probable crack defect in a pipeline segment must be excavated and time limits for completing those excavations; (4) pressure restriction limits for crack defects that are not excavated by the required date; and (5) acceptable methods for determining crack growth for any cracks allowed to remain in the pipe, including growth caused by fatigue, corrosion fatigue, or stress corrosion cracking as applicable. (P-12-3)

Revise Title 49 Code of Federal Regulations 195.452(h)(2), the "discovery of condition," to require, in cases where a determination about pipeline threats has not been obtained within 180 days following the date of inspection, that pipeline operators notify the Pipeline and Hazardous Materials Safety Administration and provide an expected date when adequate information will become available. (P-12-4)

Conduct a comprehensive inspection of Enbridge Incorporated's integrity management program after it is revised in accordance with Safety Recommendation P-12-11. (P-12-5)

Issue an advisory bulletin to all hazardous liquid and natural gas pipeline operators describing the circumstances of the accident in Marshall, Michigan—including the deficiencies observed in Enbridge Incorporated's integrity management program—and ask them to take appropriate action to eliminate similar deficiencies. (P-12-6)

Develop requirements for team training of control center staff involved in pipeline operations similar to those used in other transportation modes. (P-12-7)

Extend operator qualification requirements in Title 49 Code of Federal Regulations Part 195 Subpart G to all hazardous liquid and gas transmission control center staff involved in pipeline operational decisions. (P-12-8)

Amend Title 49 Code of Federal Regulations Part 194 to harmonize onshore oil pipeline response planning requirements with those of the U.S. Coast Guard and the U.S. Environmental Protection Agency for facilities that handle and transport oil and petroleum products to ensure that pipeline operators have adequate resources available to respond to worst-case discharges. (P-12-9)

Issue an advisory bulletin to notify pipeline operators (1) of the circumstances of the Marshall, Michigan, pipeline accident, and (2) of the need to identify deficiencies in facility response plans and to update these plans as necessary to conform with the nonmandatory guidance for determining and evaluating required response resources as provided in Appendix A of Title 49 Code of Federal Regulations Part 194, "Guidelines for the Preparation of Response Plans." (P-12-10)

To Enbridge Incorporated:

Revise your integrity management program to ensure the integrity of your hazardous liquid pipelines as follows: (1) implement, as part of the excavation selection process, a safety margin that conservatively takes into account the uncertainties associated with the sizing of crack defects from in-line inspections; (2) implement procedures that apply a continuous reassessment approach to immediately incorporate any new relevant information as it becomes available and reevaluate the integrity of all pipelines within the program; (3) develop and implement a methodology that includes local corrosion wall loss in addition to the crack depth when performing engineering assessments of crack defects coincident with areas of corrosion; and (4) develop and implement a corrosion fatigue model for pipelines under cyclic loading that estimates growth rates for cracks that coincide with areas of corrosion when determining reinspection intervals. (P-12-11)

Establish a program to train control center staff as teams, semiannually, in the recognition of and response to emergency and unexpected conditions that includes supervisory control and data acquisition system indications and Material Balance System software. (P-12-12)

Incorporate changes to your leak detection processes to ensure that accurate leak detection coverage is maintained during transient operations, including pipeline shutdown, pipeline startup, and column separation. (P-12-13)

Provide additional training to first responders to ensure that they (1) are aware of the best response practices and the potential consequences of oil releases and (2) receive practical training in the use of appropriate oil-containment and -recovery methods for all potential environmental conditions in the response zones. (P-12-14)

Review and update your oil pipeline emergency response procedures and equipment resources to ensure that appropriate containment equipment and methods are available to respond to all environments and at all locations along the pipeline to minimize the spread of oil from a pipeline rupture. (P-12-15)

Update your facility response plan to identify adequate resources to respond to and mitigate a worst-case discharge for all weather conditions and for all your pipeline locations before the required resubmittal in 2015. (P-12-16)

To the American Petroleum Institute:

Facilitate the development of a safety management system standard specific to the pipeline industry that is similar in scope to your Recommended Practice 750, Management of Process Hazards. The development should follow established American National Standards Institute requirements for standard development. (P-12-17)

To the Pipeline Research Council International:

Conduct a review of various in-line inspection tools and technologies—including, but not limited to, tool tolerance, the probability of detection, and the probability of identification—and provide a model with detailed step-by-step procedures to pipeline operators for evaluating the effect of interacting corrosion and crack threats on the integrity of pipelines. (P-12-18)

To the International Association of Fire Chiefs and the National Emergency Number Association:

Inform your members about the circumstances of the Marshall, Michigan, pipeline accident and urge your members to aggressively and diligently gather from pipeline operators system-specific information about the pipeline systems in their communities and jurisdictions. (P-12-19)

Reiterated Recommendation

As a result of this accident investigation, the National Transportation Safety Board reiterates the following previously issued safety recommendation:

Require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. (P-11-8)