The Accident

About 11:15 a.m. central daylight time 1 on October 27, 2004, an 8-inch-diameter pipeline owned by Magellan Midstream Partners, L.P., (Magellan) and operated by Enterprise Products Operating L.P. (Enterprise) ruptured near Kingman, Kansas, and released approximately 4,858 barrels (204,000 gallons) of anhydrous ammonia. 2 Nobody was killed or injured due to the release. The anhydrous ammonia leaked into a creek and killed more than 25,000 fish including some from threatened species. The cost of the accident was $680,715, including $459,415 for environmental remediation.

Accident Narrative

On October 27, 2004, a pipeline controller in the Enterprise control center in Houston, Texas, was operating an 8-inch-diameter anhydrous ammonia pipeline owned by Magellan. The ammonia pipeline runs from Borger, Texas, to Mankato, Minnesota. The Enid Lateral segment of the ammonia pipeline originates at the Koch Enid production facility in Enid, Oklahoma, runs through Harper Station (Kansas), and ties in to the mainline at Partridge Station. (See figure 1.)

Figure 1. Map of Magellan ammonia pipeline showing rupture location on 8-inch Enid Lateral.

 

When the pipeline controller returned to his console after getting his lunch, he noticed two rate-of-change alarms 3 that had been displayed on the alarm screen for the ammonia pipeline less than a minute earlier. The supervisory control and data acquisition (SCADA) event log indicated negative rate-of-change alarms for suction pressure at both Harper Station (at 11:15:43 a.m.) and Conway Station (at 11:16:27 a.m.).

About 11:18 a.m., an off-duty volunteer firefighter traveling on Highway 54 called 911 to report a huge vapor cloud on the north side of the highway that he believed was a pipeline release. (See figure 2.) The 911 center in Kingman County, Kansas, is in the county sheriff’s office. The Kingman County Fire Department was dispatched to the rupture site about 11:20 a.m. Because the rupture site was in an agricultural area that is home to several threatened and endangered species of fish and wildlife, it was designated by Enterprise as a high-consequence area. 4 The vapor cloud moved northwest from the rupture and affected vegetation in an area approximately 1/2 mile wide and 1 1/2 miles long. The release entered an unnamed tributary stream that was approximately 36 feet from the pipeline failure. The tributary stream enters Smoots Creek approximately 1 1/2 miles downstream of the rupture.

Figure 2. Ammonia vapor cloud moving northwest from pipeline rupture.

Between 11:19:34 a.m. and 11:19:55 a.m., four more alarms from Conway Station were displayed at the controller’s console, including low suction pressure, 5 low-low suction pressure, 6 an uncommanded pump shutdown, and a rate-of-change alarm that was followed by a low suction pressure alarm from Partridge Station. Then two additional rate-of-change alarms were displayed, at 11:20:31 a.m. from Conway and at 11:21:26 a.m. from Partridge. In the 13 seconds between 11:27:33 a.m. and 11:27:46 a.m., five additional alarms were displayed, including low flow and the uncommanded shutdown of Abilene Station. At 11:27:50 a.m., the controller increased the flow rate set point on the flow control valve at Enid Station from approximately 450 barrels per hour to 550 barrels per hour. At 11:27:51 a.m., a second low-low suction pressure alarm from Conway Station was displayed.

The controller knew that Enterprise maintenance personnel were working at Conway Station. In a telephone call to Conway Station at 11:28 a.m., he asked why the pump had shut down. By 11:30 a.m., Conway Station personnel had told the controller that they had not caused the pump to shut down. At 11:34:05 a.m., the SCADA system displayed a low suction pressure rate-of-change alarm downstream at Linn Station followed by a low-low suction pressure alarm at 11:34:30 a.m.

On the basis of the 911 call at 11:18 a.m., the Kingman County sheriff’s office had responded to the site and started telephoning residents in 35 houses; four families were evacuated; no residents were home at 28 houses. By about 11:40 a.m., the sheriff’s office and the fire department had blocked roads that could be affected by the vapor cloud.

About 11:48 a.m., the dispatcher called Enterprise’s control room to report the release that had been reported to 911. Another controller, who was sitting at the console adjacent to the ammonia pipeline controller’s console, answered the phone and handled the call. The ammonia pipeline controller told investigators that when he heard the telephone ring he immediately realized that there was a leak on the ammonia pipeline. He started to shut down the pipeline at 11:48:20 a.m. by remotely stopping the pumps at Enid, Verdigris, Wellsford, and Borger Stations, 7 in that order. The last one, Borger, was shut down at 11:52:57 a.m. From his console, he remotely closed the block valve at Harper Station, and at 11:54:24 a.m., he closed the block valve at Partridge Station. These closures isolated a 50.85-mile-long segment of pipeline in which the rupture had occurred. At 12:08 p.m., he dispatched Enterprise personnel to close manual block valves at milepost markers 21 and 32 to further isolate the leaking pipeline segment. At 12:56 p.m. and 1:09 p.m., respectively, those valves were closed. These valve closures reduced the isolated segment of pipeline in which the rupture had occurred to 11 miles.

Controller’s Actions

The controller told investigators after the rupture that he had been viewing the tabular screen and knew the alarms indicated a potential problem with the pipeline. To evaluate the alarms from the pipeline, he used the tabular data screen in the SCADA system. This screen listed the pipeline facilities and displayed current data for the entire pipeline system, including pump station suction and discharge pressures, pump status, tank levels, flow rates, valve status, and set points. Alarm information that was displayed on the alarm screen also flashed and changed color on the tabular screen. The controller’s assessment was that he was delivering more ammonia from the pipeline than was being added to the pipeline and that this condition had decreased the pressure. This assessment led him to increase the flow rate at 11:27:50. He later said that he thought that within 10 or 15 minutes the pressure readings would increase. Therefore, he planned to wait for a few minutes, and, if the pressure readings for the pipeline did not increase, he would reevaluate and delve deeper into the situation.

The SCADA system can display a trend screen that shows pressure and flow trend data graphically, and the controller told investigators that looking at a trend screen would have been helpful in the analytical stage. However, he did not use trend screens in evaluating the incoming data. He said that his training did not specify which screens to use to analyze and evaluate the SCADA data. He stated that from 11:15 a.m. to 11:48 a.m. an unusually high number of alarms and status events were displayed for the pipeline. 8 During this 33-minute period, the SCADA system displayed 119 alarms and status events. The controller said that he felt that he had full authority to shut down the pipeline and that he did not believe there would be consequences from Enterprise if he shut down a pipeline and it was subsequently determined that there was no leak.

The operations control supervisor stated in an interview that he expects pipeline controllers to use the tabular screen as the main screen, or “front page.” He said that controllers are taught to access and display a trend screen, or “second page,” to further investigate an alarm and the condition that caused it. The supervisor said that pressure and flow changes are the primary parameters used to detect leaks. He stated that at the time of the accident, rate-of-change alarms were displayed in blue and immediate response alarms were displayed in red. He indicated that he believes the controller had enough information between 11:20 a.m. and 11:25 a.m. to lead him to shut down the ammonia pipeline.

Telephonic Reporting of Release

The Federal pipeline safety regulation for telephonic reporting of hazardous liquid pipeline accidents (49 CFR 195.52) requires telephonic notification to the National Response Center when the pipeline accident has caused a death or injury requiring hospitalization; has resulted in either an unintentional fire or explosion; has caused estimated property damage (including cleanup and recovery costs and the value of the lost product) exceeding $50,000; has resulted in pollution of streams, rivers, reservoirs, or other similar bodies of water; or, in the judgment of the operator, is significant even though the accident does not meet the other specified criteria. The regulation further requires an operator to include in the telephonic notification not only the basic details, such as the identity of the operator, the location and time of the accident, and the number of fatalities and injuries, but also “all other significant facts known by the operator that are relevant to the cause of the failure or extent of the damages.”

On August 30, 2002, the Pipeline and Hazardous Materials Safety Administration (PHMSA) 9 published a Federal Register notice issuing a safety advisory bulletin 10 to operators of gas and hazardous liquid pipelines and liquefied natural gas facilities about telephonic reporting. In the notice, PHMSA stated that it is critical for an operator to provide accurate information on the extent of the incident and that PHMSA expects an operator to provide significant updated information during the emergency response phase. The bulletin stated that if additional information leads to a significant change in the estimated quantity of product released, the estimated number of fatalities and injuries, the extent of environmental damage, or the extent of property damage, the operator should make an additional telephonic report to the National Response Center. PHMSA considered “significant change” to include an increase or decrease of previously reported fatalities or injuries and a revised estimate of product released or property damage that is at least 10 times greater than the previous estimates. Regarding release estimates, the bulletin also stated that if the operator does not provide an estimate, the National Response Center will record a default estimate of 1,000 barrels (42,000 gallons). In February 2005, PHMSA informed the Safety Board that rather than the National Response Center entering the 1,000-barrel default estimate, PHMSA will consider telephonic reports made without a spill estimate to have the same priority as reports with spill estimates of 1,000 barrels. The National Response Center confirmed in March 2005 that it will not enter the 1,000-barrel default value if the operator does not provide a spill estimate.

The U.S. Environmental Protection Agency (EPA) requires that an anhydrous ammonia release equal to or greater than 100 pounds of ammonia (equivalent to approximately 20 gallons) be reported within 15 minutes of discovery.

About 12:15 p.m. on October 27, the controller notified Enterprise’s central region operations manager of the release. Because field personnel were too busy to make the call, the manager called the controller back to tell him to report the accident to Enterprise’s accident reporting contractor. 11 In the controller’s phone conversation with the accident reporting contractor at 12:23 p.m., the controller reported that a large quantity of anhydrous ammonia had been released and had formed an ammonia vapor cloud, but he stated that he did not know the amount of anhydrous ammonia that had been released. When the contractor responded that without an estimate of a specific quantity the National Response Center would enter a 1,000-barrel estimate in its incident report, the controller told the contractor that a 1,000-barrel estimate would be fine. The contractor asked whether the amount released was at least 20 gallons. 12 The controller confirmed that it was. Later, when the contractor asked for a damage estimate, the controller said that he had no idea. When the contractor asked him to choose one of several ranges of dollar values from less than $5,000 to exceeding $50,000 as an estimate of the damage caused by the release, the controller chose the less-than-$5,000 range.

At 1:08 p.m., Enterprise’s reporting contractor reported the release to the National Response Center. The National Response Center report of the incident stated that the release was a vapor cloud over the pipeline due to unknown causes. The contractor reported the estimated quantity of the release as 20 gallons and told the National Response Center that Enterprise would calculate the amount released when it got a chance. An updated release amount was not reported to the National Response Center.

A PHMSA inspector arrived on site at 7:00 a.m. the next morning, October 28. About 8:00 a.m., the inspector learned from Enterprise operations employees that at that time, the estimated amount of anhydrous ammonia released was at least 3,000 barrels (126,000 gallons). 13 This estimate of the release volume was based on an approximation of the amount of product normally contained in the pipeline between the two valves that had been manually closed. The final estimate of the release volume was later calculated by Enterprise to be 4,858 barrels (204,000 gallons).

The EPA had received the initial report of a 20-gallon release from the National Response Center on October 27 about 2:42 p.m. EPA representatives indicated that the EPA had not responded to the accident site because the reported release volume was so small. The next morning, during a review of the previous day’s National Response Center reports, the EPA duty officer noticed that a vapor cloud had been reported, and he called Enterprise at 9:30 a.m. to ask why a vapor cloud was associated with a 20-gallon release. The Enterprise representative told the duty officer that the amount of ammonia released was much greater than the reported quantity, and he estimated the release to be at least 2,000 barrels (84,000 gallons). Following the phone call, two EPA on-scene coordinators were dispatched to the site to investigate.

The EPA on-scene coordinators arrived at the site at 5:00 p.m. and discussed with Apex Environmental, Inc. (Apex), Magellan’s environmental contractor, the need for sparging 14 at Smoots Creek to lower the pH levels in the creek. Apex began sparging about 9:00 p.m. Sparging continued for several weeks following the rupture. Later, the Kansas Department of Health and Environment authorized the spreading of 3,500 cubic yards of nitrogen-rich soil, which had been excavated from the rupture location, over a cultivated area to fertilize the ground.

Pipe Specification and Operating Conditions

The 8.625-inch nominal outside diameter carbon steel pipe at the rupture location was specified as American Petroleum Institute Specification 5LX, grade X46, 0.156-inch nominal wall thickness with an electric resistance welded seam. After Mid-America Pipeline Company completed construction, the pipeline segment at the rupture location was hydrotested to 1,580 pounds per square inch gauge (psig) on December 11, 1973. At the rupture location, the pipeline had a maximum operating pressure of 1,198 psig. The calculated pipeline operating pressure at the rupture site at the time of the release was 981 psig, and records of the operating conditions immediately before the accident do not indicate that the maximum operating pressure had been exceeded. The exterior surface of the pipe was coated with tar tape primer and spirally wrapped with a continuous overlap of tar tape. At the location of the rupture, the pipe was 4 feet 5 inches underground and was cathodically protected to control external corrosion.

Materials Laboratory Examination and Tests

The pipe segment that ruptured was removed and sent to the Safety Board’s Materials Laboratory for examination and testing. The segment had four external gouges. The approximately 11.7-inch-long rupture occurred at one of the gouges. (See figure 3.) Over most of the rupture length, the gouge penetrated 0.019 inch (approximately 12.2 percent of the pipe wall thickness) into the pipe wall. Within the gouge, shear cracks penetrated the metal. From the base of the shear crack that led to the rupture, a fatigue crack propagated toward the interior of the pipe. The fatigue crack extended approximately 0.080 inch below the shear crack with no external corrosion that resulted in a loss of material thickness. A detailed examination showed that the fatigue region had five bands, each with a different shade of gray, consistent with crack arrest marks. The area below the fatigue crack had a shear lip created during the sudden and final rupture of the pipe.

Figure 3. Ruptured 8-inch Enid Lateral anhydrous ammonia pipeline showing four gouges and rupture.

The results of chemical analysis, dimensional measurements, and tensile strength testing were in accordance with the American Petroleum Institute specification for 5LX-X46 pipe. An examination of a cross section of the gouge at the fracture origin area showed that metal of a different composition had transferred to the wall of the pipe. Elemental analysis of a metal tooth from the backhoe bucket owned by the property owner did not provide a unique signature when compared to the transferred metal in the gouges. The examination of the cross section revealed no manufacturing defects (such as laminations, voids, or porosity) in the pipe material. The examination of the inside surface of the pipe showed no corrosion degradation or additional cracking.

Construction and Excavation Activity

To identify any construction and excavation activities in the area of the rupture, investigators examined all available maintenance records, aerial patrol records, and aerial photographs that covered the period from construction of the pipeline in 1973 to the present, but identified no excavation activities immediately over the rupture site. The 1973 construction specifications for the pipeline required that any coating damage be repaired before backfilling the pipeline. The trench for the pipeline was excavated with a trenching machine, and backfilling was done with an auger-type backfill machine or a bulldozer. According to the construction specifications, where these machines could not be used to backfill, the site inspector would approve the method of backfilling before it began. The pipeline tie-in inspector for the Enid Lateral construction did not recall what occurred at the accident location, and no construction inspection records exist. He indicated that a backhoe was not likely to be used in the pipe rupture area during construction because the unnamed stream was not a major stream crossing that required the use of a backhoe.

According to the current owner (since 1989), the area where the pipe ruptured had not been cultivated. Between 1990 and 1992, he had used his backhoe to grade the unnamed stream’s banks to create a vehicle ramp that was approximately 100 feet north of the pipe rupture. He told investigators that no excavation had been performed at the location of the rupture.

The four gouges located longitudinally along the top half of the pipeline are consistent in shape and location with the type of mechanical damage caused by excavation equipment such as a backhoe. Since a unique metallurgical signature was not found in the analysis of metal deposits within the gouges, the Safety Board could not determine whether the landowner’s backhoe bucket was the source of the deposits. The pipeline tie-in inspector stated that on this pipeline construction project a backhoe typically would not have been used for crossing a stream of this size. However, the Safety Board could not rule out damage to the pipeline during construction. Available information and records covering the time from when the pipeline was constructed in 1973 to the present did not indicate any excavation activity by the pipeline operator near the location of the rupture. However, the possibility of unknown excavation activities could not be eliminated. The Safety Board concludes that heavy equipment damage to the pipeline during construction or subsequent excavation activity created a pipe gouge that initiated metal fatigue cracking and led to the eventual rupture of the pipeline.

Enterprise’s Policies and Procedures

Procedures for Abnormal Operating Conditions

Enterprise’s procedure manual defined an abnormal operating condition as “any condition that may cause, create, or contribute to a situation which exceeds the design or normal operating parameters of the pipeline.” The manual instructed controllers to treat an unexplained variation in pressure or flow as an abnormal operating condition. It also instructed controllers to continue to monitor pipeline operations and follow specific steps that include checking “with others involved with the operations to determine the cause of the variation” and to be “especially attentive for any sign that an emergency condition may follow.”

To investigate a variation in pressure or flow, control room personnel were to notify on-call field personnel or supervisors; review flow data; check instantaneous line balance by comparing simultaneous meter readings at point of origin, destination, and intermediate locations; and contact customers for possible explanation of the pressure or flow variation. If a