Oral Testimony as presented:
Good morning, Mr. Chairman and Members of the Subcommittee. I appreciate the opportunity to appear on behalf of the National Transportation Safety Board, and to report on our investigation into the pipeline rupture and fatal fire in Bellingham, Washington this past June.
Last August, I viewed the damage and discussed the accident with family members, city officials, and Olympic representatives. Accidents are devastating to the victims, their families, and the community. Most are preventable, but not without a dedicated and persistent effort by industry and regulators to set and enforce high standards.
You have been given a packet of visual aids that will help clarify my remarks. The first is a map of the Olympic Pipe Line system in the Northwest. Preliminary data indicate that, shortly before the rupture, a pump at the Woodinville Station did not start when commanded. A relief valve at Bayview Station should have worked to relieve upstream over pressure, and, failing this, a block valve at Bayview should have closed, as we believe it did. Product was pumped into the line at Cherry Point, and the closure of the Bayview block valve would likely have sent a pressure wave back towards Ferndale and Cherry Point.
The rupture occurred about midway between Cherry Point and Bayview at the Bellingham water treatment plant, near Whatcom Creek. The photograph shows graphically the destruction over the path of the creek as it approached the more heavily developed points along its run.
Preliminary data also show that the rupture occurred well above normal operating pressures, but substantially below full yield strength for pipe of this design and size, and even below the maximum allowable surge pressure permitted by regulatory standards. It took several weeks to excavate the ruptured segment, largely because the rupture occurred beneath an area of extensive water piping. Your packet also contains a diagram of the water treatment plant and a picture of the pipe section as initially uncovered.
Preliminary inspection of the ruptured segment indicates external damage to the pipe where the failure is believed to have begun, and additional damage to the area. You can see from these pictures that there is some evidence of both external and internal deformities, although I need to caution everyone that our understanding of these matters is preliminary, and intensive testing is required before we can be confident about our opinions.
NTSB investigators are pursuing several lines of inquiry that warrant further evaluation. We plan to meticulously test the ruptured pipe segment, to determine whether external, pre-existing damage may have contributed to the rupture and to understand the consequences of repeated, seemingly abnormal, closures of the Bayview Station block valve. Records indicate that the valve may have closed 50 or more times in the six months after it was installed the previous December. We will examine the reasons for these closures, and their possible impact on the upstream pipe's durability.
We are also interested in the functioning of the relief valve at Bayview. This valve needs to be tested to determine if it was capable of operating within specifications. The design and construction of the Bayview facility also need close attention, to determine if the valve would have been permitted to function correctly in this application.
Given the extensive overlay of water piping and what appears to be pre-existing external damage on the ruptured fragment, we also suspect excavation damage. NTSB will attempt to carefully document and analyze the construction work done to complete the water treatment facility and Olympic's work to evaluate information developed from internal, "smart pig" inspections.
We also want to document and analyze the data available to controllers at the time of the accident, and to understand their actions during the accident sequence. They seem to have been unaware of the rupture for an extended period. And, restarting a pipeline after a rupture suggests a significant performance failure. We don't yet know whether this can be traced to training, qualifications, equipment malfunctions, poor design in the computer-based control system, or some other undetermined culprit.
The NTSB wants the answers to all of these questions, and we need to know them as soon as feasible. But, my investigators have been stymied by the prospect of criminal prosecutions. As you can see from the chart, a number of our investigative activities have been suspended because most of the central players will not talk to us. And, prosecutors have asked that we not test the valve or the pipeline until their concerns regarding evidence preservation can be allayed.
|Tear Down and Testing
|Analyzing Design and Construction
of Bayview Station
|Company Records and Personnel
||In Question |
|Analyzing Design of
Computer Control System
|SCADA Software and
Olympic Backup Tapes
|In Process |
|Analyzing Actual Control Center
|Olympic Control Room Personnel and
|Partially Suspended |
|Documenting Training and Qualifications
||Olympic Company Records and
|In Process |
Internal Pipe Inspection Activities
|Olympic Company Records and
|Documenting Emergency Response
||State, Local, and Company Officials
||In Process |
|Documenting Regulatory Oversight
||Federal and State Records and Officials
We are hopeful that steps can be taken to clear up the concerns of needed witnesses and the U.S. Attorney's Office. But, for now, we simply do not know all we need to know about the pipeline's operations and its level of safety. In the end, it is OPS that must assure itself and the citizens of Bellingham of the reliability of Olympic's facilities and its personnel. Even so, their options are limited. They are rightfully constrained by the potential dangers to people and the environment. But, the realities of the demand for fuel are overwhelming and alternatives are uncertain.
Ultimately, RSPA and OPS are answerable for the regulatory context in which this pipeline company operates and in which this accident occurred. NTSB has, for many years, argued that periodic verification of pipeline integrity must be a requirement of service. Internal inspections done in the Bellingham pipe identified anomalies in the area that ultimately failed. But, that inspection data produced no change and the regulatory processes did not require a correction. OPS's response to our 1987 recommendation is in an "unacceptable" status. Mandatory internal detection programs are needed to protect the public and industry alike and federal action is long over due.
The same is true of employee qualification standards. NTSB has had little success in convincing OPS that training and qualification are areas for federal oversight and, again, their response to our recommendations has been unacceptable.
We must ask why OPS has consistently required greater actions by pipeline operators than are required by regulation, but are loathe to incorporate those same requirement into its regulations, even though several Safety Board recommendations have called for such actions.
Mr. Chairman, that concludes my statement and I would be happy to answer the Subcommittee's questions.
Written testimony for the record:
Good morning, Mr. Chairman and Members of the Committee. I appreciate the opportunity to appear before you on behalf of the National Transportation Safety Board to discuss our ongoing investigation into the pipeline rupture and subsequent fire that occurred in Bellingham, Washington, on June 10, 1999.
As you are aware, the National Transportation Safety Board (NTSB) has been investigating pipeline accidents since 1967, and as a result of those investigations, we have issued 1,127 safety recommendations that we believe would prevent a recurrence of similar accidents. The steel pipeline that runs through Bellingham, Washington, is just a small part of the over 160,000 miles of pipelines transporting hazardous liquids nationwide. In 1997, approximately 616.5 billion ton-miles of oil and refined petroleum products were shipped via pipeline, accounting for 64.5% of the oil and refined petroleum products moved throughout the U.S. annually.
On June 10, 1999, at about 3:30 p.m. Pacific Daylight Time (PDT), a 16-inch diameter pipeline owned by Olympic Pipe Line Company ruptured, and gasoline leaked into the Hanna and Whatcom Creeks in Whatcom Falls Park within the City of Bellingham, Washington. About 5:02 p.m., the gasoline ignited, resulting in a fireball that traveled approximately 1-1/2 miles downstream from the pipeline failure location. Two 10-year-old boys and an 18-year-old young man lost their lives as a result of this tragic accident. Eight additional injuries were documented, along with significant property damage to a single-family residence and the City of Bellingham's water treatment plant. The release of approximately ¼ million gallons of gasoline caused substantial environmental damage to the waterways.
Shortly after being notified of the accident, the National Transportation Safety Board launched a team of investigators to the scene. Safety Board personnel were on scene for approximately 5 weeks.
Mr. Chairman, before providing you with background on the pipeline system and details of the Board's investigation, I would first like to address the considerations the Safety Board must deal with in this investigation. As you may be aware, pipeline company personnel have refused to respond to Safety Board questions, exercising their Fifth Amendment rights. In addition, the Board has been served with a Department of Justice (DOJ) subpoena, placing a hold on destructive testing of the sections of pipe which are in the Board's possession.
Before relating the progress of our investigation, let me give you some necessary background on this pipeline system.
Olympic Pipe Line Company is a partnership consisting of Atlantic Richfield Company, Equilon Pipeline LLC (Equilon), and GATX Terminal Corporation, with Equilon acting as the managing partner. Olympic's system extends from refineries in the extreme northwestern corner of Washington State to Portland, Oregon.
The entire pipeline system is remotely operated from a central control center located in Renton, Washington. From this centralized location, pipeline controllers can monitor key variables, such as pressures and flow rates throughout the entire system. The controllers can also monitor and operate mechanical components, such as pumps and motor-operated valves.
The accident section of pipeline, which was originally installed in 1965, ran from a pumping station near Ferndale, Washington, approximately 37.4 miles southward to Olympic's Bayview and Allen pumping and storage stations near Allen, Washington. This steel pipeline was constructed of pipe with a wall thickness of 0.312 inches manufactured by Lone Star. In 1966, approximately 725 feet of the pipeline, including the specific section that failed on June 10, 1999, was rerouted to permit construction of a water treatment plant by the City of Bellingham. This new short section of steel pipe had the same specified minimum strength and wall thickness as the original, but was manufactured by U.S. Steel.
In 1993 and 1994, a contractor working on behalf of the City of Bellingham installed a 72-inch water line across Olympic's pipeline, approximately 20 feet south of the rupture. A new 24-inch diameter water line was also installed and connected to an existing water line 10 feet south of the rupture. In addition, the water treatment plant was being modified, a water pump station and additional smaller crossings were being constructed.
According to personnel involved in the design and installation of the water treatment plant modifications, Olympic was notified of the water plant modifications and associated water pipeline installations, and assisted the design firm with determining the exact elevations of its pipeline during the design phase of the water plant modifications. Olympic personnel were also on site during portions of the water pipeline construction project. Documentation provided to the Safety Board by Olympic includes reports Olympic generated as a result of the water piping installations.
Although Federal regulations do not require internal pipeline inspections, in 1991, Olympic inspected its pipeline from the Ferndale to Allen Stations with a magnetic flux internal inspection tool, or "smart pig." Although anomalies were reported on various segments of the pipeline, no anomalies in the immediate vicinity of the rupture were found during this inspection.
In 1996, Olympic conducted another internal inspection of its pipeline with a similar magnetic flux internal inspection tool. As a result of this inspection, three anomalies were reported in the vicinity of the rupture. While our investigation continues to develop information, preliminary indications are that one of these anomalies, reported by the inspection company as a "possible wrinkle bend," was located in the immediate vicinity of the subsequent rupture. The other two anomalies were located approximately 1.5 feet south of the first girth weld, approximately 10 feet downstream of the rupture.
In 1997, under an administrative order from Washington State's Department of Ecology, Olympic contracted for another internal inspection with a caliper tool specifically to search for pipeline buckles. An anomaly at the same location as the two located south of the first girth weld downstream of the rupture was found as a result of this inspection. In May 1997, Olympic submitted correspondence to the Department of Ecology that indicated it intended to further evaluate this anomaly.
Olympic documents indicate that the company analyzed 1996 and 1997 anomalies mentioned above; however, they elected not to excavate and visually inspect or repair any of the anomalies located in the area of the water treatment plant. Olympic has indicated that these anomalies did not meet the applicable criteria for further action; the Safety Board is currently looking into what criteria were used. Olympic personnel with direct knowledge of the decision-making process have declined to be questioned by the Safety Board, exercising their Fifth Amendment rights.
I would now like to highlight factual information developed from our investigation. I would stress, however, that the Board's investigation is ongoing, and that the following information is only preliminary; it may be refined and changed as the investigation proceeds.
The Safety Board uses a "party" system whereby companies and individuals who have information and technical expertise specifically needed for the accident investigations are invited to participate, subject to certain conditions. We have included as Attachment 1 to our testimony an explanation of our investigation process, including a discussion of the party system.
Upon the NTSB's arrival in Bellingham on the morning of June 11, 1999, several parties that had information critical to understanding the accident were immediately identified; later, others were invited to participate as the investigation unfolded. Parties to the Bellingham, Washington, pipeline investigation include the U.S. Department of Transportation's Office of Pipeline Safety (OPS), the Washington State Department of Ecology, the Washington State Fire Marshal's Office, the City of Bellingham, Olympic Pipe Line Company (Olympic), the Environmental Protection Agency (EPA), Teledyne-Brown Engineering, Fisher-Rosemount Petroleum, and IMCO General Construction, Inc. Party representatives, led in each case by Board staff, were then assigned to various groups to develop the facts of, and issues raised by, this tragedy.
The Safety Board did not excavate the ruptured pipe until about two weeks after the accident because the water lines were still in service. If we had excavated immediately, water service would have been jeopardized to approximately 25,000 customers. Sections of the pipe were carefully excavated under the Safety Board's supervision as soon as a new, temporary pump station was placed in service. The segments were then transported to our laboratory facilities in Washington D.C.
During the excavation process, the water lines that had been installed across Olympic's pipeline in the vicinity of the rupture were exposed, and indications of external damage to the pipeline were observed. Safety Board investigators have interviewed personnel from the City of Bellingham, the firm that designed the water plant modifications and managed the construction activities on behalf of the City of Bellingham, as well as the contractor who installed the water piping. However, Olympic employees who were assigned to inspect the construction activity have also declined to speak with Safety Board investigators.
Safety Board personnel have conducted a thorough visual examination of the ruptured pipeline segment and an adjacent segment that was also removed from the scene. Each of these segments is approximately 10 feet long. Preliminary visual examination of the ruptured pipeline segment has shown that the fracture originated at a gouge mark on the surface of the pipe and that the gouge at the failure origin was oriented longitudinally along the axis of the pipe. The wall thickness of the pipe at the origin measured between 0.24 and 0.25 inches, a reduction of approximately 20 percent from the original 0.312 inch nominal wall thickness. The overall rupture measured 27 inches longitudinally (see Attachment 2). Additional gouge marks and dents were found on the exterior surface of the ruptured pipe segment, and inward protrusions were noted on the inside of the pipe that appeared to correspond to some of the external gouge marks. The external coating on this pipe segment appears to be the original spiral wrap material.
Examination of the second pipe segment noted two dents at the 3:30 and 4:00 positions on the pipe, located 18" and 22" respectively south of a girth weld on this segment. No coating repairs over any of the damage have been noted, and no corrosion damage was observed on the interior of the pipe surfaces or the bare areas of the external pipe surfaces.
Microscopic examination of the fracture face is still necessary to determine whether there are any indications of fatigue near the point of origin. Additional tests are also necessary to determine the microstructure and hardness of the pipe material. These tests will be completed when details have been worked out with the Department of Justice.
Based upon a review of Olympic's computer pressure data automatically recorded during the accident sequence, our investigators also began to examine the functioning of valves at a newly-constructed pumping and storage facility near Bayview, Washington (the Bayview Products Terminal). Testing was then performed at the request of the Safety Board to determine whether a relief valve at the station had functioned properly. The field testing was inconclusive, and the valve was removed from the pipeline and returned to the Safety Board's facilities for further evaluation.
Preliminary information indicates that pressure began to build within Olympic's Bayview Station as a result of delivery changes underway further down the pipeline system. A relief valve had been installed when the station was built in 1998 to protect the piping from overpressurization. This valve is intended to divert product into a storage tank to reduce the pressure within the facility.
Based upon a preliminary review of pressure information recorded at the Bayview Station, although the relief valve began to function, pressure within the station continued to build, triggering a block valve on the pipeline coming into the station to close. According to information provided by Olympic, when the block valve closed, the pressure on the pipeline upstream of Bayview increased to about 1500 pounds per square inch gauge (psig), and the pipeline ruptured. Information provided by Olympic indicates that the maximum allowable operating pressure was 1370 psig on this pipeline segment. Federal regulations allow pressure surges to 1507 psig. The pipeline theoretically should withstand internal pressure of approximately 2000 psig. The pressure is believed to have reached about 1422 psig at the point of the rupture. After the accident, Olympic recalculated the maximum operating pressure to be 1456 psig at the rupture location.
Preliminary information indicates that the block valve on the pipeline entering Bayview Station had closed over 50 times since the facility began operating on December 16, 1998. On many of these occasions, the valve closure was triggered by a similar pressure buildup within Bayview Station. Our investigators are still evaluating these events to determine the pressures involved and the functioning of the relief valve.
The relief valve was originally ordered with an internal spring set to relieve the pressure at 100 psig. The original Bayview Station design documents called for a set pressure of 740 psig. Olympic subsequently reduced the intended set pressure to 650 psig. In order to modify the valve's set pressure from 100 psig to 650 psig, Olympic ordered that a different spring be installed within the valve's pilot operator. Olympic may not, however, have replaced a piston and a cap as recommended by the valve's manufacturer.
The Safety Board will be examining the valve to evaluate its performance. Since valves of this type or those with a similar design are commonly used throughout the liquid pipeline industry, it is extremely important fully to understand what occurred. Once again, these tests will be completed following discussions with the Department of Justice.
We also know that the pipeline system design plan for a control valve located upstream of the relief valve intended the valve to be capable of closing completely. The valve, however, had an internal stop that prevented it from being capable of stopping the flow of product into the Bayview Station. What effect this might have had on the events that occurred June 10, 1999, is still under investigation.
Shortly after the accident, our investigators also began to evaluate the actions of Olympic's personnel who were operating the pipeline from the Renton, Washington, control center. A preliminary reconstruction of the accident sequence is being performed from a printed summary events recorded within the supervisory control and data acquisition (SCADA) system. A preliminary time line of key events is included at Attachment 3 for your information.
Based on the event logs, we know that flow within the pipeline was restarted at approximately 4:16 p.m. This was approximately 45 minutes after the rupture occurred. The pipeline was then operated for approximately 17 minutes until pumps shut down.
Olympic initially reported that a "slowdown" of the computer systems occurred during the accident sequence that affected the ability of the pipeline controllers to change settings on the pipeline system. Olympic further stated that one of its employees may have modified software settings prior to the accident, and may have been working on the computers at the time of the event. A report prepared by Olympic, in response to an OPS corrective action order, acknowledges that the alleged SCADA system slowdown could not be verified or reproduced.
The Safety Board is continuing its analysis of the computer system tapes. Indeed, our preliminary review has not identified that a slowdown actually occurred on the computer system the day of the accident. Although Olympic has reported to OPS that it has improved its SCADA system by upgrading hardware and balancing workloads between the computer systems since the accident occurred, until we fully understand what happened during the accident sequence, the impact of these changes on future system operations cannot be fully evaluated.
The Board's investigative staff are reviewing substantial documentation provided by Olympic, such as pressure data, design information, construction records, telephone logs and e-mail records, along with the applicable company policies and procedures related to pipeline operations and maintenance, as part of our investigation. However, we will never know what happened within the control center around the time of the accident unless we are able to interview the individuals operating the pipeline when the accident occurred. There are at least four key individuals who may have direct knowledge of the events that occurred in the control room during the accident sequence. Those individuals include two controllers who were on duty at the time of the accident, their supervisor, and a former controller now responsible for maintaining the SCADA system and acting as a relief controller. He was reportedly performing modifications to the computer programming. These individuals are also critical to our investigation into human performance issues, such as training, fatigue, and ergonomics, that may be relevant with this accident. As I have mentioned, these individuals and others have declined to talk with us.
Mr. Chairman, several of the issues being looked into as a result of the Bellingham accident -- excavation damage, pipeline integrity, training of personnel -- have been concerns of the Safety Board for many years. Excavation damage is the leading cause of pipeline accidents, and the prevention of excavation damage is an issue on the Board's "Most Wanted" list. Recommendations regarding excavation damage were first issued by the Safety Board in 1973, and we are currently investigating three other recent accidents in which excavation damage may have played a role.
Our concerns regarding pipeline integrity go back to 1987. As a result of investigations into three pipeline accidents, the Safety Board recommended that the Research and Special Programs Administration (RSPA) require pipeline operators to periodically determine the adequacy of their pipelines to operate by performing inspections or tests capable of identifying corrosion, mechanical damage, or other time-dependent defects that could be detrimental to the safe operation of pipelines. Yet 12 years after our initial recommendation was issued, there are no regulations that require pipeline operators to perform periodic inspections or tests to locate and assess whether this type of damage exists on other pipelines. OPS has indicated that it intends to enhance enforcement efforts to ensure that pipeline operators who perform internal inspections more aggressively evaluate the results and make appropriate repairs.
The Safety Board is concerned that, although the objective is laudable, the efforts may be counterproductive if companies that perform voluntary internal inspections are penalized, thus discouraging them from performing such inspections. It is essential that OPS mandate and enforce a pipeline integrity inspection program for all pipeline operators. The Board's recommendation regarding pipeline integrity was placed in an open-unacceptable status in June 1999.
The need for adequate training was also the subject of safety recommendations issued in 1987. The Safety Board recommended that RSPA require operators to develop training programs for pipeline personnel. In October 1998, RSPA published a Notice of Proposed Rulemaking (NPRM) to require pipeline operators to develop a written qualification program for individuals operating pipelines. However, the NPRM did not establish training requirements for personnel, and it allowed companies to evaluate an individual's ability to perform tasks using methods such as oral examinations or observations of job performance. In comments on the rulemaking submitted in January 1999, the Board urged RSPA to amend the rule to include strong training and testing requirements to ensure that employees can properly perform their jobs. We were disappointed that the final rule published in August 1999 was substantially unchanged from the NPRM.
Before closing, I want to take this opportunity to bring a related matter to your attention. As you are aware, state pipeline safety programs are important to help ensure that pipeline system operators comply with minimum safety standards. In fact, state pipeline inspectors who conduct daily inspection activities represent more than 90 percent of the safety inspection workforce. Yet Federal matching funds provided to States have consistently been below the 50 percent level authorized by the Natural Gas Pipeline Safety Act. I am told by representatives of several states that funds have not kept pace with demand, and that inadequate funds threaten the infrastructure of the nation's pipeline safety program.
Additionally, I am concerned that while states have many more inspectors than OPS, that OPS is prohibiting states from inspecting interstate pipelines. State officials tell me that OPS, while previously encouraging states to act as interstate agents, are now having their applications denied.
For example, in Virginia approximately 2 million gallons of petroleum products have spilled from pipelines since 1974. In fact one major accident happened in nearby Reston, Virginia in 1993. In that accident, more than 407,000 gallons of diesel fuel spilled from a pipeline into Sugarland Creek, a tributary of the Potomac River. Because of the liquid pipeline accidents that have occurred in Virginia, the General Assembly passed legislation in 1994 authorizing the State Corporation Commission to seek interstate agent status from OPS, to allow state inspectors to inspect interstate pipelines. State officials tell me that OPS had supported this legislation, and for several years had encouraged the Commission to pursue interstate agent status. However, when the Virginia Commission was ready to accept agent status, OPS denied their application. In fact, states tell me that OPS has effectively halted this program.
Effective oversight is needed to ensure that pipeline operators are meeting minimum safety standards. I believe that Congress needs to take a long, hard look at how the states are utilized, funded, and evaluated by OPS, and that the Chairman of this committee may want to hold a future hearing on this issue.
Mr. Chairman, as stated earlier, the Board's investigation of the Bellingham tragedy is ongoing; we will keep the Committee advised of developments as they occur. That completes my testimony, and I will be happy to respond to any questions you may have.