PIPELINE SAFETY ADVISORY BULLETIN
ADVISORY BULLETIN: ADB-99-03
Date: July 7, 1999

To: Owners and Operators of Hazardous Liquid and Natural Gas Pipeline Facilities

Subject: Potential Service Interruptions in Supervisory Control and Data Acquisition Systems

Purpose: Inform pipeline system owners and operators of potential operational limitations associated with Supervisory Control and Data Acquisition (SCADA) systems and the possibility of those problems leading to or aggravating pipeline releases.

Advisory: Each pipeline operator should review the capacity of its SCADA system to ensure that the system has resources to accommodate normal and abnormal operations on its pipeline system. In addition, SCADA configuration and operating parameters should be periodically reviewed, and adjusted if necessary, to assure that the SCADA computers are functioning as intended. Further, operators should assure system modifications do not adversely affect overall performance of the SCADA system. We recommend that the operator consult with the original system designer.

Background: During an Office of Pipeline Safety (OPS) investigation of a recent pipeline incident, OPS inspectors identified inadequate SCADA performance as an operational safety concern. Immediately prior to and during the incident, the SCADA system exhibited poor performance that inhibited the pipeline controllers from seeing and reacting to the development of an abnormal pipeline operation.

Preliminary review of the SCADA system indicates that the processor load (a measure of computer performance utilization) was at 65 to 70 percent during normal operations. Immediately prior to an upset condition occurring on the pipeline, the SCADA encountered an internal database error. The system attempted to reconcile the problem at the expense of other processing tasks. The database error, coupled with the increased data processing burden of the upset condition, hampered controller operations. In fact, key operator command functions were unable to be processed immediately prior to and during the abnormal operation. It is possible that post installation modifications may have hampered the system's ability to function appropriately.

The combination of the database error, the inadequate reserve capacity of the SCADA processor, and the unusually dynamic changes that occurred during the upset condition, appear to have combined and temporarily overburdened the SCADA computer system. This may have prevented the pipeline controllers from reacting and controlling the upset condition on their pipeline as promptly as would have been expected. For further information, contact Chris Hoidal, Director, OPS Western Region at 303-231-5701.