Pipeline Investigation Report P01H0049

At 0836 mountain standard time on 29 September 2001, a rupture occurred on the Enbridge Pipelines Inc. 508-millimetreoutside diameter Line 10 at Mile Post 1885.64, near Binbrook, Ontario. Line 10 transports crude oil from Westover, Ontario, to Buffalo, New York, United States. The rupture occurred in an agricultural field planted with soybeans. Within eight minutes of the rupture, the control centre operator in Edmonton, Alberta, shut the line down and began to sectionalize it. Remedial action response teams contained the spill to two general areas, a natural swale running perpendicular to the pipeline and the pipeline trench. Approximately 95 cubic metres of crude oil were released, affecting a 0.67-hectaresection of land.

At approximately 0700 mountain standard time (MST),^{Footnote 1} communications failed between the programmable logic controller (PLC) and the remote terminal unit (RTU) at the Tonawanda Pump Station (Tonawanda) in the United States, making it impossible for the Edmonton Control Centre to communicate with that station. The control centre operator (CCO) in Edmonton, Alberta, responsible for Line 10 operations did not receive a PLC communications failure alarm through the supervisory control and data acquisition (SCADA) system, since Tonawanda had not been configured to generate such an alarm. The CCO first became aware that he could not communicate with Tonawanda at 0810, when the commands he sent to that station were not acknowledged. An electrician was immediately sent to Tonawanda to investigate the problem.

At 0836, the CCO noticed a pressure drop at the pressure transmitter at mile post (MP) 1896, 17 kilometres (km) downstream of the rupture location. Within eight minutes of the failure, the CCO had issued "stop" commands to the pump units at the Westover Pump Station (Westover) and Tonawanda, the stations upstream and downstream, respectively, of MP 1896, and had begun sectionalizing the line between those stations. At 0854, the CCO noticed that the sectionalizing valve at MP 1896 was stuck in travel and requested that the on-call maintenance person check the status of that valve. The on-call maintenance person investigated the pressure abnormalities at Westover and closed hand-operated valves, beginning at Westover. At 1003, the Westover area supervisor located the rupture at MP 1885.64 and took measures to secure the site. The on-call maintenance person was asked to assist with securing the failure site before continuing on to MP 1896. The valve at MP 1896 was handcranked closed at 1117. MP 1896 and locations further downstream are generally at lower elevations than the rupture site, which allowed some draining of the line fill while the valve at MP 1896 remained open. Appendix A shows a schematic of Line 10.

When the material balance system (MBS) model detects a possible leak situation, audible and visual alarms are generated and transmitted to the SCADA system to assist the CCO in identifying such situations. On the date of the occurrence, the MBS model generated the first alarm six minutes after the rupture had occurred. This alarm was not transmitted through to the SCADA system, since the program allowing that transmission had been inadvertently overwritten following recent programming changes to the MBS model.

Following the rupture, Enbridge Pipelines Inc. (Enbridge) voluntarily restricted the operating pressure on Line 10 to 4043 kilopascals (kPa), 80 per cent of the pressure at which the line failed. Approximately 35 m of pipe, which included the failed joint of pipe, was replaced. The failed joint of pipe was sent to the Fleet Technology Ltd. (Fleet) laboratory in Kanata, Ontario, for analysis.

Remediation of the area included: recovery of loose oil by vacuum truck (approximately 35 cubic metres); replacement of contaminated soil with clean soil; and bioremediation of residual contaminated soil in place in accordance with a plan accepted by the provincial Ministry of the Environment.

The section of Line 10 in which the rupture occurred had been manufactured by the Steel Company of Canada Limited according to pipe standard CSA Z245.2-1971, using the submerged arc weld process. This section of line had been constructed in 1972 and hydrostatically tested to a minimum pressure of 8335 kPa. The maximum allowable operating pressure (MAOP) of the pipe at the rupture location was 6667 kPa. The pipe had been coated with spiral-wrapped polyethylene tape. The rupture occurred approximately 0.43 m downstream of a mainline sectionalizing valve. The valve and Line 10 upstream of the valve had been constructed in 1971 and were operational during the 1972 construction. The joint of pipe that ruptured was the final tie-in location between the valve and the newly constructed section of Line 10. Some wooden skids, possibly used to support the pipe during construction, were found in the ditch at the failure site.

Fleet determined that the pipe ruptured due to a combination of localized corrosion and through wall cracking at the base of the deepest metal loss area. The corroded area extended approximately 1.4 m axially and between the 4:00 and 8:30 o'clock positions circumferentially. The fracture path occurred between the 5:30 and 6:00 o'clock positions. The remaining wall thickness along the fracture path was approximately 16 per cent of the nominal wall thickness. The calculated pressure at the time of failure was 5054 kPa. Fleet determined that the pipe met the requirements to which it had been manufactured.

No unusual operating conditions, other than the inability to communicate with Tonawanda, were noted prior to the rupture or on 28 September 2001 during a helicopter patrol of the pipeline route. Operating pressures did not exceed the licensed MAOP prior to the rupture. Before the rupture, Enbridge had not received any complaints by residents in the area.

The line has been cathodically protected by an impressed current system since 1972. In the late fall of 1993, Enbridge took measures to enhance the cathodic protection (CP) system so that CP levels would be restored at several locations that had been identified in early 1992 as having low potentials. Since 1994, annual CP surveys have indicated that pipe-to-soil readings are within industry standards.

The 508 mm section of Line 10 had been inspected for metal loss in 1990 using a magnetic flux leakage (MFL) in-line inspection (ILI) tool. The 1990 vendor's ILI report did not reveal any metal loss defects at the rupture site but did identify three other sites that required excavation. External corrosion was found at two of those sites; internal corrosion was found at the third. Based on these ILI results, previous field excavations and leak history of Line 10, Enbridge set the ILI interval for metal loss at 10 years.

The 508 mm section of Line 10 was again inspected for metal loss in December 2000, this time using an ultrasonic wall measurement ILI tool and PII (Canada) Ltd. (PII) as the inspection company. PII had not been part of the 1990 ILI inspection work. In February 2001, Enbridge received a preliminary report from PII identifying 336 features, the majority of which were identified as internal defects, and ranking them according to severity based on a rupture pressure ratio calculation. The majority of the features were identified as having "echo loss." When associated with internal corrosion defects, echo loss indicates that the actual wall thickness measurements were not accurately measured. When associated with deep external corrosion, echo loss indicates that actual wall thickness measurements have not been recorded. In this report, the defect at MP 1885.64 had been ranked number 59 in severity and was identified as having echo loss.

PII's ultrasonic wall measurement ILI tool uses ultrasound echo time technique to measure pipe wall thickness. With this technique, wall thickness is calculated based on the time interval between the reflection of the ultrasound signal from the inside pipe wall surface (entry echo) and the outer pipe wall surface (rear wall echo). The entry echo can be accompanied by minor noise pulses that, if measured, may be mistakenly interpreted as rear wall echos and provide invalid wall thickness measurements. To avoid this, PII programs the ultrasonic wall measurement ILI tool before each inspection, so that only pulses within a specified time interval are measured and recorded. Minor noise pulses from the entry echo should fall outside this interval and would therefore not be recorded. However, for deep external corrosion, where the rear wall echo falls outside the measurement interval and is not recorded, an accurate wall thickness measurement cannot be calculated and the defect is flagged as having been subjected to echo loss. Wall thickness measurements of internal corrosion may also be affected if sediment has been deposited in those cavities. Because sediments disperse the ultrasonic beam and shield the beam from the pipe wall, the depth of internal corrosion cannot be accurately measured and the defect is also flagged as having been subjected to echo loss. PII has recognized that echo loss affects wall thickness measurements of deep exterior corrosion and interior corrosion with sedimentation.

PII's initial report in February 2001 did not provide above-ground marker information to allow Enbridge to do field locates. By the middle of March 2001, Enbridge had received the above-ground information and selected sites for calibration digs based on PII's severity ranking. However, Enbridge was unable to access the sites due to poor weather conditions. Based on the preliminary data, the defect at MP 1885.64 had not been selected as part of the calibration dig program. In April 2001, PII submitted a final uncalibrated report to Enbridge. The defect at MP 1885.64 was identified in the April 2001 report as external corrosion with echo loss. It was ranked number 44 in severity as a pit on its own, but when clustered with adjacent corrosion, it was ranked number 14 in severity. It was not selected as one of the initial six sites to be investigated for calibration purposes.

Enbridge conducted calibration digs in June 2001. Only internal corrosion was found at those dig sites. Based on field measurements from the sites, Enbridge concluded that the ILI provided conservative estimates regarding corrosion depths.

Following the failure on 29 September 2001, Enbridge had the 1990 ILI logs re-analyzed by a third party. This re-analysis confirmed the presence of a defect at the failure site and suggested that the metal loss in 1990 was approximately 40 to 45 per cent through wall.

Since the failed joint of pipe had been the final tie-in location between the valve at MP 1885.64 and the newly constructed section of Line 10, the tape coating had been hand applied and may not have been applied as tightly or as uniformly as that applied by mechanized line travel equipment. The hand-applied tape coating may therefore have been more susceptible to disbondment. The skids under the pipe may have exacerbated this disbondment. The disbonded tape coating would have provided a channel into which groundwater could seep as well as shielded the pipe from the cathodic protection current. Groundwater provided a corrosive environment that contacted the pipe steel and allowed a corrosion cell to be set up. The pipe wall corroded until the remaining wall could no longer support the stresses due to internal operating pressures.

Through its ILI program for metal loss on Line 10, Enbridge had made an effort to ensure that defects such as corrosion were detected, evaluated and repaired. However, the effectiveness of an in-line inspection program depends on many factors including data analysis, defect selection and inspection interval. Regarding the corrosion defect at MP 1885.64, the 1990 ILI was not as effective as it could have been. The defect had not been identified in the 1990 ILI vendor's final report to Enbridge and was therefore not investigated at the time, although it was severe enough to have warranted further evaluation. Because the defect had not been identified in 1990 and the inspection interval had been set for 10 years, the metal loss continued until the failure occurred.

Data analysis is an iterative process, combining information from various sources, including excavations, to better evaluate raw data and to further refine the assessment and selection process. Factors such as echo loss, which affect the data, must be well understood and taken into consideration when developing the excavation program and when using that information to further analyze the data. Enbridge may not have been aware that measurements of external corrosion subjected to echo loss are less conservative than those of internal corrosion with sedimentation subjected to echo loss. Since only internal corrosion was found at the excavations conducted in 2001, Enbridge may have concluded that all defects flagged as being subjected to echo loss, whether internal or external, would be less severe than estimated by the ILI ultrasonic tool.

There was no evidence to indicate that the PLC communications failure at Tonawanda contributed to the failure of Line 10. The PLC communications failure, however, did make it impossible for the CCO to access information from Tonawanda to assist in assessing the reason for the pressure drop at MP 1896.

Findings as to causes and contributing factors

1. The tape coating disbonded in the vicinity of the failure, possibly exacerbated by the presence of wooden skids under the pipe.
2. The disbonded coating shielded the pipe from the cathodic protection current and allowed a corrosive environment to contact the pipe metal.
3. In 1990, the corrosion defect at MP 1885.64 was probably 40 to 45 per cent through wall but was not identified in the 1990 in-line inspection (ILI) vendor's final report and was therefore not repaired at the time.
4. During the subsequent 11 years, corrosion continued until the wall had thinned to 16 per cent of its original thickness and the pipe wall could no longer support the stresses associated with the internal operating pressure.
5. Because Enbridge had not fully appreciated the effect of echo loss in interpreting metal loss due to external corrosion, Enbridge did not select the failure site following the 2000 metal loss ILI as one requiring immediate attention.

Findings as to risk

1. A better understanding is needed by the pipeline industry of the effect that echo loss has on wall thickness measurements for internal corrosion with sedimentation and deep external corrosion.

Other findings

1. The programmable logic controller communications failure at Tonawanda did not contribute to the rupture at MP 1885.64 but did make it impossible for the control centre operator to know the status of that station during the initial response to the leak situation.

Safety Action Taken

Immediately following the rupture, Enbridge requested that PII complete an in-depth evaluation of the data from the December 2000 in-line inspection (ILI). No further defects similar to that which failed were identified. Enbridge continued with its field investigation program by selecting six additional sites for further analysis. Since the results of that analysis were inconsistent with the ultrasonic ILI report, Enbridge commissioned an inspection of Line 10 in October 2001, using a magnetic flux leakage (MFL) ILI tool to calibrate the ultrasonic ILI data and to provide more accurate depth measurements where echo loss issues existed. In November 2001, Enbridge received the reports from the MFL ILI and the calibrated ultrasonic ILI. Enbridge concluded that the ultrasonic data that had been calibrated using information from the MFL ILI provided the most accurate information for assessing defects on Line 10.

Enbridge removed the pressure restrictions for Line 10 on 29 July 2002, after determining that there was sufficient evidence to confirm that there were no other defects similar to that which failed at MP 1885.64.

Regarding the absence of the programmable logic controller (PLC) communications failure alarm and the material balance system (MBS) leak alarm at the control centre operator's supervisory control and data acquisition (SCADA) workstation, Enbridge indicated that it has

• begun a program to add PLC communications failure alarms at those stations not yet configured to generate such alarms;
• initiated a study regarding PLC failure alarms; and
• developed a comprehensive program of improvements to the MBS capabilities to monitor the health of the MBS and to ensure that alarms generated by the MBS model function as intended.

In addition, Enbridge is

• discussing the issue of anomaly identification related to the 1990 ILI with the vendor;
• continuing the excavation program on Line 10, based on the results of the ultrasonic and MFL ILIs;
• enhancing the selection process for calibrating the ultrasonic wall measurement ILI tool by including internal, external and echo loss defects;
• reviewing other technologies for inspecting tape-coated lines where sedimentation may exist;
• considering an internal corrosion mitigation program for Line 10;
• refining the ILI schedule for Line 10 based on corrosion growth calculations as a result of the analysis of the data from the ILIs and the excavation program; and
• continuing to improve software management and leak detection performance testing.

PII has reviewed its records of previous ultrasonic wall measurement ILI reports and has not identified any cases where echo loss has been associated with external corrosion. It has initiated a client representation demonstration to ensure that future clients fully understand the issue of echo loss associated with external corrosion. PII also indicated that it is researching enhancements to the ultrasonic ILI to eliminate echo loss issues.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 06 December 2002.

Appendix A - Line 10 pipeline schematic

Image

Appendix B - Glossary

CCO

control centre operator

CP

cathodic protection

CSA

Canadian Standards Association

Enbridge

Enbridge Pipelines Inc.

Fleet

Fleet Technology Ltd.

ILI

in-line inspection

km

kilometre

kPa

kilopascal

m

metre

MBS

material balance system

MFL

magnetic flux leakage

mm

millimetre

MAOP

maximum allowable operating pressure

MP

mile post

MST

mountain standard time

PII PII

(Canada) Ltd.

PLC

programmable logic controller

RTU

remote terminal unit

SCADA

supervisory control and data acquisition

TSB

Transportation Safety Board of Canada

UTC

Coordinated Universal Time

′

inch