Pipeline Accident Brief [PDF version]

Pipeline Accident Number: DCA-97-FP-002
Type of System: Hazardous liquid petroleum products
Accident Type: Overpressure rupture
Location: Murfreesboro, Tennessee
Date and Time: November 5, 1996, about 9:36 a.m. EST
Owner/Operator: Colonial Pipeline Company
Fatalities/Injuries: None
Property Damage: $5.7 million
Material Released: Diesel fuel
Quantity Released: About 84,700 gallons (about 2,017 barrels)
Pipeline Pressure: Approximately 1,820 psig
Component Affected: 8-inch diameter, Grade X-42, 0.188 inch wall thickness, Electric Resistance Weld (ERW) steel pipe

The Accident

On the morning of November 5, 1996, Colonial Pipeline Company (Colonial) was preparing to perform a maintenance operation that required that a section of pipeline be isolated and purged of product, which in this case was diesel fuel. The pipeline involved was 8-inch-diameter steel pipe used to transport hazardous liquid petroleum products from Colonial's Atlanta Junction in Georgia to its Nashville, Tennessee, delivery facility. (See figure 1.)

The affected section of the pipeline was between the Murfreesboro, Tennessee, pump station and the Nashville delivery facility. Colonial planned to begin the operation by blocking the line at the Murfreesboro station and allowing product to drain into the Nashville facility. With pressure and product volume decreased in the line, the company planned to introduce into the pipeline section a mechanical device called a pipeline pig that, propelled by pressurized nitrogen gas introduced in the pipeline behind it, would move down the pipeline and displace the remaining product.

A member of the project team at Murfreesboro called Colonial's pipeline controller in its Atlanta control center just before 9:00 a.m. eastern standard time to start the project. The controller first shut down some pumps and opened a valve to divert product into its Lookout Mountain delivery facility. At 9:12:17 a.m., he closed the remotely controlled, electric-motor-operated mainline block valve at Murfreesboro.

Shortly after the block valve was closed at Murfreesboro, the controller's shift supervisor in Atlanta informed the controller that the plan had changed. Members of the project team had decided to restart the delivery to Nashville long enough to complete delivery of the product batch to the terminal that was currently on line there.

The controller did not reopen the electric block valve at Murfreesboro before resuming pumping product through the pipeline. Instead, at 9:19:08 a.m., he began starting pipeline pumps upstream of Murfreesboro, at Chattanooga, Signal Mountain, and Coalmont. He also slowed the delivery flow rate at Lookout Mountain. Contrary to procedures contained in Colonial's operating manual, the controller had started product flow in a blocked pipeline.

The increased pipeline pressure was registered at the Coalmont pump station, the first station upstream of Murfreesboro, but the overpressure shutdown set points at the station allowed the pipeline to be overpressured before the protective device activated to shut the pump station down automatically.

With the pipeline continuing to operate, pressure was increasing at Murfreesboro. The controller did not note the overpressure condition that had developed at Murfreesboro, because the pressure transmitter for the station was downstream of the closed mainline block valve. (See figure 2a.) The controller was not aware of the actual pressure transmitter location because the supervisory control and data acquisition (SCADA) system¹ schematic for the Murfreesboro station erroneously depicted the pressure transmitter as located upstream of the electric block valve, as it was at most other stations on the pipeline. (See figure 2b.)

The controller attempted to reopen the electric block valve at Murfreesboro for the first time at 9:35:02 a.m. Although the controller saw no indication of high pressure at the station because of the location of the pressure transmitter, pressure data evaluated since the accident indicated that a high differential pressure, at least 1,700 psig, existed across the valve at that time. This pressure exceeded the design limits (1,440 psi) of the motor used to remotely operate the valve, and the valve did not open.

Colonial's operating manual regarding abnormal operations requires that the controller shut down the pipeline immediately in the event of a blocked line. The controller did not attempt to shut down the line. Instead, during the next minute, he twice more sent commands to try to open the valve at Murfreesboro. He then called the station to request that a technician check the valve. A technician did check the valve and control equipment and found no problems.

Next, the controller turned off pumps at the Coalmont and Signal Mountain stations and increased the flow rate at the Lookout Mountain delivery station, which would lower the pipeline pressure so the electric block valve could be opened. The valve opened on the controller's fourth attempt, made at 9:39:07 a.m. Unknown to the controller, the pipeline had already ruptured at approximately 9:36:21 a.m.

The pipeline ruptured at a longitudinal seam weld. The rupture occurred in a rural area about 46.2 miles downstream of the Coalmont station and about 10.9 miles upstream of the Murfreesboro station. The SCADA system indicated a sudden pressure drop of 416 psi at Coalmont station at 9:37:35 a.m.; however no SCADA alarms were generated as a result of the pressure drop. From this data, Colonial later calculated that the pressure had reached approximately 1,820 psig at the rupture site before the failure.² The rupture depressurization wave was calculated to have taken 74 seconds to travel from the rupture site to Coalmont. From this data, the time of the failure is estimated to be approximately 9:36:21a.m.

Although the pipeline had ruptured approximately 3 minutes before the Murfreesboro electric block valve was opened, the controller did not recognize that the leak had occurred. He restarted the Signal Mountain and Coalmont stations and continued to pump diesel fuel out of the ruptured pipeline for approximately 1 hour. When he realized that the expected pressure rise on the line was not occurring, he initiated pipeline shutdown procedures at 10:35:32 a.m.

The line section containing the leak was isolated at 10:39:44 a.m. Colonial activated its emergency procedures and began to search for a possible leak. Colonial crews were dispatched from the Murfreesboro station to examine the pipeline right-of-way, and a helicopter was used to fly over the pipeline route. At 11:20 a.m., Colonial notified the Tennessee Emergency Management Agency. After checking the SCADA overfill and shortage report to confirm the likelihood of a leak, Colonial personnel telephoned a leak report to the National Response Center at 12:23 p.m. Personnel in a helicopter discovered the site of the leak at 2:00 p.m..

Colonial reported a release of approximately 84,700 gallons (2,017 bbl.) of diesel fuel. No fatalities or injuries were reported. The accident did not cause a fire or explosion. Colonial's low initial product recovery of 24 percent was influenced by geologic formations in the leak area. Most of the product entered sink holes or small caverns, and no signs of product were evident immediately after the leak. Colonial has conducted ground water remediation and product recovery under the oversight of the Tennessee Department of Environment and Conservation.

Total diesel fuel recovered through October 1998 was about 36,500 gallons (867 bbl, or 43 percent of the total estimated spill). Diesel fuel recovery efforts are ongoing, and the company continues to incur costs related to the spill. Cumulative accident-related expenditures by Colonial as of December 1998 totaled about $5.7 million, which includes property damages, cleanup and recovery costs, and the value of lost product.

After the accident, Colonial took disciplinary action against the controller operating the pipeline during the accident. The controller was also retrained in the procedures he had violated. Since the accident, Colonial has provided additional training to its controllers and is making improvements in its controller training program, including instituting initial, refresher, and "train the trainer" programs. Colonial has purchased a simulator and has implemented training to better prepare controllers to respond to abnormal and emergency conditions along the pipeline. All controllers are required to respond to an average of one tabletop training scenario per month regarding critical pipeline events.

Following the accident, Colonial changed the location of the pressure transmitter at Murfreesboro so the upstream pressure can be observed when the remotely operated mainline block valve is closed. Colonial evaluated the hydraulic conditions for its entire pipeline system and then corrected overpressure protection set points to help prevent an overpressure condition in the future. Colonial has also reviewed and updated the SCADA schematic displays for its pipeline system to eliminate inaccuracies.

Probable Cause

The National Transportation Safety Board determines that the probable cause of this accident was (1) the failure of the pipeline operator to follow company procedures for operating the pipeline and (2) the failure of the pipeline control and monitoring system to inform the operator of unsafe conditions prior to the rupture. Contributing to the severity of the accident was the delay in recognizing that a leak had occurred, which delayed shutting down the pipeline and isolating the rupture.

Approved: April 29, 1999

1 Pipeline controllers use the SCADA system to remotely control movement of product through the pipeline. Controllers can monitor flow rates and pressures along the lines and control valves and mainline pumps to adjust the flow and make product deliveries.

2 Title 49 Code of Federal Regulations Part 195.406(b) states that no operator may permit the pressure in a pipeline during surges or other variations from normal operating conditions to exceed 110 percent of the maximum operating pressure (MOP). For this pipeline, 110 percent of the MOP (1,318 psig) is 1,449 psig.