[Federal Register Volume 79, Number 87 (Tuesday, May 6, 2014)]
[Pages 25990-25994]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2014-10248]



Pipeline and Hazardous Materials Safety Administration

[Docket No. PHMSA-2014-0020]

Pipeline Safety: Lessons Learned From the Release at Marshall, 

AGENCY: Pipeline and Hazardous Materials Safety Administration (PHMSA); 

ACTION: Notice; issuance of advisory bulletin.


SUMMARY: PHMSA is issuing an advisory bulletin to inform all pipeline 
owners and operators of the deficiencies identified in Enbridge's 
integrity management (IM) program that contributed to the release of 
hazardous liquid near Marshall, Michigan, on July 25, 2010. Pipeline 
owners and operators are encouraged to review their own IM programs for 
similar deficiencies and to take corrective action. Operators should 
also consider training their control room staff as teams to recognize 
and respond to emergencies or unexpected conditions. Further, the 
advisory encourages operators to evaluate their leak detection 
capabilities to ensure adequate leak detection coverage during 
transient operations and assess the performance of their leak detection 
systems following a product release to identify and implement 
improvements as appropriate. Additionally, operators are encouraged to 
review the effectiveness of their public awareness programs and whether 
local emergency response teams are adequately prepared to identify and 
respond to early indications of ruptures. Finally, this advisory 
reminds all pipeline owners and operators to review National 
Transportation Safety Board recommendations following accident 
investigations. Owners and operators should evaluate and implement 
recommendations that are applicable to their programs.

FOR FURTHER INFORMATION CONTACT: Linda Daugherty by phone at 816-329-
3821 or by email at [email protected]. Information about PHMSA 
may be found at http://phmsa.dot.gov.


I. Background

    On July 25, 2010, at 5:58 p.m. eastern daylight time, a segment of 
a 30-inch-

[[Page 25991]]

diameter pipeline (Line 6B), owned and operated by Enbridge 
Incorporated (Enbridge), ruptured in a wetland near Marshall, Michigan. 
The rupture was not discovered or addressed for over 17 hours. During 
that time period, Enbridge twice pumped additional oil (81 percent of 
the total release) into Line 6B during two startups. The total release 
was estimated to be 843,444 gallons of crude oil. The oil saturated the 
surrounding wetlands and flowed into Talmadge Creek and the Kalamazoo 
River. Local residents self-evacuated from their homes, and serious 
environmental damage required long-term remediation. About 320 people 
reported symptoms consistent with crude oil exposure. No fatalities 
were reported. Cleanup and remediation continues, and costs have 
exceeded $1 billion.
    The National Transportation Safety Board (NTSB) determined that the 
probable cause of the pipeline rupture was stress corrosion cracking 
that grew and coalesced from crack and corrosion defects under 
disbonded polyethylene tape coating. The NTSB also determined the 
rupture and prolonged release were caused by pervasive organizational 
failures at Enbridge that included: (1) Deficient integrity management 
(IM) procedures, which allowed well-documented crack defects in 
corroded areas to propagate until the pipeline failed; (2) inadequate 
training of control center personnel, which resulted in Enbridge's 
failure to recognize the rupture for 17 hours and through two re-starts 
of the pipeline; and (3) insufficient public awareness and education, 
which allowed the release to continue for nearly 14 hours after the 
first notification of an odor to local emergency response agencies.

PHMSA IM Regulations

    Subpart O of 49 CFR part 192 and Sec.  195.452, also known as the 
IM regulations, require operators of gas transmission and hazardous 
liquid pipelines to institute a continual process for evaluation of 
pipeline integrity (see also: Guidance in Advisory Bulletin ADB-2012-
10, ``Using Meaningful Metrics in Conducting Integrity Management 
Program Evaluations,'' 77 FR 72435, December 5, 2012). Specifically, 
Sec. Sec.  192.937 and 195.453(j) require that an operator have a 
continual process for the evaluation of pipeline integrity. The 
evaluation must consider the results of integrity assessments, data 
collection and integration, remediation, and preventative and 
mitigative actions in evaluating pipeline integrity. The operator must 
use the results from this evaluation to identify the threats specific 
to each pipeline segment that could impact a High Consequence Area 
(HCA) and the risk represented by those threats. The operator must 
perform assessments that are specific to those threats and then 
identify and implement appropriate remedial, preventative and 
mitigative measures. Sections 192.945 and 195.452(k) require that an 
operator have methods to measure the effectiveness of their integrity 
management programs.
    An operator's IM program must include the results of past and 
present integrity assessments, risk assessment information and data 
integrated from throughout the pipeline system. This information and 
its analysis must be taken into account when making decisions about 
remediation, preventive and mitigative actions.
    The ability to integrate and analyze threat and integrity related 
data from many sources is essential for sustaining and continually 
improving safety performance and a proactive IM program. Operators must 
use the results from this integrated evaluation to identify the threats 
specific to each pipeline segment that could impact a HCA. The operator 
must then perform assessments that are specific to the identified 
threats and implement remedial, preventive and mitigative measures, as 
    The IM regulations supplement PHMSA's prescriptive safety 
regulations with requirements that are more performance-based and 
process-oriented. One of the fundamental tenets of the IM program is 
that each individual pipeline has a unique risk profile that is 
dependent on factors including the pipeline's physical attributes, its 
geographical location, its design, its operating environment and the 
commodity it transports. Pipeline operators use this risk profile to 
identify appropriate assessment tools, set the schedule for performing 
integrity assessments and identify the need for additional preventive 
and mitigative measures such as lowering operating pressures, 
installing automatic or remote control shut-off valves and installing 
additional right-of-way markers, among other safety measures. If this 
risk profile information is unknown, unknowable, or uncertain, the 
pipeline should be operated more conservatively.
Deficiencies Found in Enbridge's IM Program
    The following facts illustrate the ways in which Enbridge failed to 
institute and maintain an adequate IM program:
    In 2007, Enbridge experienced a release on its Line 3 in Glenavon, 
Saskatchewan. Following the Transportation Safety Board of Canada's 
investigation and issuance of a report, Enbridge changed its assessment 
process to account for tool tolerances when performing engineering 
assessments. However, Enbridge did not retroactively apply these 
changes to the 2005 in-line inspection (ILI) data assessments performed 
on the line that ruptured near Marshall, Michigan. In its investigation 
of this incident, the NTSB found that Enbridge's IM program did not 
incorporate a process of continuous reassessment to all pipeline 
engineering assessments, and it neglected to apply the revised crack 
assessment methods to Line 6B. The NTSB also found a lack of data 
integration was a significant contributor to the consequences of the 
Marshall, Michigan incident.
    The NTSB further concluded:
     Enbridge's response to past IM-related accidents focused 
only on the proximate cause, without a systematic examination of 
company actions, policies and procedures.
     Enbridge's IM program consistently chose a less-than-
conservative approach to pipeline safety margins for crack features.
     In preparing the risk analysis, Enbridge failed to 
consider all relevant risk factors associated with the determination of 
the amount of product that could be released from a rupture on Line 6B.
     The results of multiple ILI assessments on Line 6B were 
evaluated independently and the information from these assessments was 
not properly integrated to assure pipeline integrity.
     Enbridge used a lower safety margin when evaluating crack 
defects versus corrosion defects. Enbridge's criterion for excavating 
and remediating a crack defect was when the predicted failure pressure 
was less than the hydrostatic test pressure (1.25 times maximum 
operating pressure). Enbridge's criterion for excavating and 
remediating a corrosion defect was when the predicted failure pressure 
was less than the specified minimum yield strength (1.39 times maximum 
operating pressure).
     Enbridge used the maximum depth reported in a 2005 
UltraScan Crack Detection (USCD) ILI tool run without accounting for 
tool accuracy or performance specifications. Further, Enbridge did not 
compare the 2005 USCD-reported wall thickness to a 2004 UltraScan Wall 
Measurement tool run that measured local wall thicknesses. Enbridge 
used the thicker, incorrect measurement in determining the predicted 
failure pressure and crack growth calculations.

[[Page 25992]]

     Enbridge did not account for the interaction between 
corrosion and cracking. Assessments for corrosion in 2004 and for 
cracks in 2005 showed areas of overlap. Using the crack depth 
measurements alone likely resulted in an underestimation of the total 
wall loss.
     The ILI vendor's junior analyst classified certain 
features from the 2005 USCD ILI tool run as ``crack-field'' features, 
but the ILI vendor supervisor re-classified them as ``crack-like'' 
features in the report to Enbridge. Enbridge policies allowed longer 
``crack-like'' features to persist without further evaluation than 
``crack-field'' features. The post-accident investigation determined 
that the features were in fact ``crack-field'' features. Although the 
excavation threshold for ``crack-field'' features was 2.5 inches, the 
misclassified features measured 3.5 inches and were not examined 
     The Enbridge crack management group used a fatigue-crack 
growth model to predict the remaining life of the pipeline. In 2011, an 
independent consultant determined that the ``environmentally assisted 
cracking mechanism that is most prevalent along Enbridge's liquid 
pipeline system is either near-neutral pH SCC (stress corrosion 
cracking) or corrosion fatigue.'' The growth rates of environmentally 
assisted cracks can be exponentially greater than nominal fatigue-crack 
growth rates.

PHMSA Control Center Operations and Training Regulations

    Sections 192.631 and 195.446 contain the requirements for gas 
transmission and hazardous liquid control room management, 
respectively, which establish roles and responsibilities, tools and 
procedures that allow operators to perform their duties, alarm 
management and training. The requirements address many of the 
deficiencies NTSB noted that led to the prolonged release of crude oil 
in Marshall, Michigan (see also: Guidance in Advisory Bulletins ADB-
2005-06; ``Countermeasures to Prevent Human Fatigue in the Control 
Room;'' 70 FR 46917; August 11, 2005, and ADB-2010-01; ``Leak Detection 
on Hazardous Liquid Pipelines;'' 75 FR 4134; January 26, 2010).
Deficiencies Found in Enbridge's Control Center Operations and Training
    With respect to Enbridge's control center operations and training, 
the NTSB concluded:
     Due to the rapid growth of Enbridge's pipeline system, 
Enbridge hired additional control center staff without objectively 
assessing whether that growth in personnel would affect safe 
     The leak detection process was prone to misinterpretation, 
and control center analysts and operators were not adequately trained 
in how to recognize or address leaks, especially during startup and 
shutdown. Therefore, low-pressure alarms, material balance system 
alarms and sudden and complete loss of pump station discharge pressure 
were mistakenly attributed to column separation rather than a pipeline 
rupture. Furthermore, the control center ignored warnings from field 
and operations personnel that there was a possible leak. In post-
accident interviews, control center personnel attributed its 
disinclination to believe a rupture had occurred to the absence of 
external leak detection notifications, despite known limitations of the 
leak detection system.
     Control room personnel did not follow the established 
procedure to shut the pipeline down if column separation couldn't be 
resolved within 10 minutes.
     Enbridge failed to train the control center staff in team 
performance, which resulted in poor communication and lack of 

PHMSA's Public Awareness/Public Education Regulations

    Sections 192.616 and 195.440 contain the requirements for gas 
transmission and hazardous liquid operators' public awareness programs 
(PAP), respectively. These regulations incorporate the American 
Petroleum Institute's (API) Recommended Practice (RP) 1162, ``Public 
Awareness Programs for Pipeline Operators,'' and require that operators 
notify affected municipalities, school districts, businesses and 
residents of the location of pipelines and pipeline facilities (see 
also: guidance in ADB-2010-08; ``Emergency Preparedness 
Communications;'' 75 FR 67807; November 3, 2010, and ADB-2012-09; 
``Communication During Emergency Situations;'' 77 FR 61826; October 11, 
2012). Section 8 of API RP 1162 contains guidance for communicating 
with emergency responders, periodic evaluation of an operator's PAP, 
and measuring the effectiveness of an operator's PAP (see also: 
guidance in ADB-2003-04; ``Pipeline Industry Implementation of 
Effective Public Awareness Programs;'' 68 FR 52816; September 5, 2003, 
and ADB-2003-08; ``Self-Assessment of Pipeline Operator Public 
Education Programs;'' 68 FR 66155; November 25, 2003).
Deficiencies Found in Enbridge's Public Awareness/Public Education 
    The NTSB identified several deficiencies in Enbridge's PAP, 
     Enbridge's PAP failed to effectively inform the affected 
public, including citizens and emergency response agencies about the 
location of the pipeline, how to identify a pipeline release and how to 
report suspected product releases.
     Enbridge's review of its public awareness program was 
ineffective in identifying and correcting deficiencies.
     An effective public awareness program would have better 
prepared local emergency response agencies to identify and respond to 
early indications of a rupture, which, once communicated to Enbridge, 
would have prevented the restart of the line.

II. Advisory Bulletin (ADB-2014-02)

    To: Owners and Operators of Natural Gas and Hazardous Liquid 
Pipeline Systems.
    Subject: Integrity Management Lessons Learned from the Marshall, 
Michigan, Release.
    Advisory: To strengthen the Department's safety efforts, PHMSA is 
issuing this advisory bulletin to notify pipeline owners and operators 
they should evaluate their safety programs and implement any changes to 
eliminate deficiencies similar to the ones the National Transportation 
Safety Board (NTSB) found when it investigated Enbridge's July 25, 
2010, crude oil release in Marshall, Michigan. Specifically, the NTSB 
investigation into the circumstances leading up to and following the 
release identified specific deficiencies in three Enbridge programs: 
integrity management (IM), control center operations and public 
awareness. Had existing regulations, guidance, advisories and 
recommendations regarding these programs been properly acted upon, the 
consequences of that incident could have been prevented, or at the very 
least, mitigated.

Integrity Management

    A fundamental tenet of the IM program is that pipeline operators 
must be aware of the physical attributes of their pipelines, the 
threats and risks posed by and to their pipelines, and the environments 
which their pipelines transverse. Operator IM programs should reflect 
the recognition that each pipeline is unique and has its own specific 
risk profile that is dependent upon the pipeline's attributes, 
geographical location, design, operating

[[Page 25993]]

environment, and commodity it transports, among other factors. It is 
vital for operators to compile and integrate this information into 
their IM programs to effectively identify and evaluate risk. If this 
information is unknown, unknowable or uncertain, operators need to take 
a more conservative approach to operations.
    As part of a robust IM program, an operator will match and use the 
right tools for the threats being investigated, set the proper schedule 
for pipeline segment integrity assessments and identify the need for 
additional preventative and mitigative measures that protect pipeline 
integrity, including lower operating pressures, automatic shutoff or 
remotely controlled valves and additional right-of-way markers.
    However, an operator's IM program must go beyond simply assessing 
pipeline segments and repairing defects--in fact, American Petroleum 
Institute (API) Standard 1160, ``Managing System Integrity for 
Hazardous Liquid Pipelines,'' defines pipeline risk assessment as a 
continuous process and defines risk analysis as a continuous 
reassessment process. Continual improvement of IM programs (including 
improvements in the analytical processes involved in analyzing 
assessment results, identifying threats, responding to risks, the 
application and implementation of assessments and the development of 
preventative and mitigative measures) is a key aspect and critical 
objective of an effective IM program.
    Occasionally, accident investigations or other events cause changes 
in how operators analyze assessment data, including analytical 
procedures, algorithms, software, acceptance criteria or how anomalies 
are classified. For instance, a change in how an anomaly is classified 
could impact remediation time frames, assessment intervals, decisions 
regarding preventative and mitigative measures and the overall 
perception of the integrity of the pipeline. The NTSB noted that 
Enbridge accounted for changed tool tolerances when re-analyzing its 
Line 3 data after an incident, but this change in tool tolerances was 
not applied to the assessments performed on Line 6B. Operators should 
evaluate any changes in how assessment data is analyzed to determine if 
those changes will alter the results of any previously performed 
integrity assessments. If so, operators should apply those changes to 
any previously performed integrity assessments as appropriate.
    To assist in evaluating possible assessment data analysis changes, 
operators should ensure that in-line inspection (ILI) vendors 
communicate any changes in their analytical processes that might 
require previous assessments to be re-analyzed. Improvements to vendor 
analytical processes may change anomaly classifications in previous 
assessments, and while vendors typically apply these changes to future 
assessments, it is rare for vendors to re-analyze previously performed 
assessments. Re-analyzing integrity assessments when analytical changes 
occur is critical for ensuring safety based on the best available data 
and expertise.
    The ability to analyze and integrate threat- and integrity-related 
data from many sources is essential for operators to continually 
improve and sustain safety performance and proactive IM programs. 
However, some operators are not sufficiently aware of their pipeline 
attributes, are not adequately or consistently assessing threats and 
risks and are not effectively integrating data as a part of their IM 
programs. A lack of data integration was a significant contributor to 
the incident at Marshall, MI.
    When performing self-assessments of IM programs, operators should 
compare their performance measures and program evaluations against the 
guidance of ADB-2012-10, ``Using Meaningful Metrics in Conducting 
Integrity Management Program Evaluations'' (77 FR 72435, December 5, 

Control Center Operations

    Sections 192.631 and 195.446 contain the requirements for gas 
transmission and hazardous liquid control room management, 
respectively. These requirements address many of the deficiencies the 
NTSB noted during their investigation of the incident at Marshall, MI.
    PHMSA advises operators to regularly train their control room teams 
and consider establishing a program to train control center staff as 
teams in the recognition of and response to emergency and unexpected 
conditions that include supervisory control and data acquisition 
indications and leak detection software. Operators should perform 
periodic evaluations of their leak detection capabilities to ensure 
that adequate leak detection coverage is maintained during transient 
operations, including pipeline shutdown, pipeline startup and column 
separation. PHMSA previously issued ADB 10-01, ``Leak Detection on 
Hazardous Liquid Pipelines,'' (75 FR 4134; January 26, 2010) to provide 
guidance on this issue. If an operator suffers an unexplained loss of 
product, the operator should shut down the affected pipeline until the 
problem is resolved. Operators should additionally assess the 
performance of their leak detection system following a product release 
and identify and implement improvements as appropriate.
    Pipeline owners and operators are also reminded to evaluate their 
control room personnel scheduling policies and practices against the 
guidance of ADB 05-06, ``Countermeasures to Prevent Human Fatigue in 
the Control Room'' (70 FR 46917; August 11, 2005).

Public Awareness Programs

    PHMSA advises operators to analyze and evaluate the effectiveness 
of their public awareness programs and whether local emergency response 
agencies are prepared to identify and respond to early indications of a 
rupture. Strong public awareness and education programs can help 
shorten incident response times and improve overall incident response.
    Pipeline owners and operators should perform periodic self-
assessments of their public awareness programs against their written 
public awareness program plans and API Recommended Practice 1162. PHMSA 
previously issued guidance for these self-assessments under ADB 03-04, 
``Pipeline Industry Implementation of Effective Public Awareness 
Programs'' (68 FR 52816; September 5, 2003) and ADB 03-08, ``Self-
Assessment of Pipeline Operator Public Education Programs'' (68 FR 
66155; November 25, 2003). Further, operators are encouraged to review 
their procedures for communicating during emergency situations to 
ensure compliance with the guidance previously issued in ADB 10-08, 
``Emergency Preparedness Communications'' (75 FR 67807; November 3, 
2010) and ADB 12-09, ``Communication During Emergency Situations'' (77 
FR 61826; October 11, 2012).

Proactive Self-Assessment

    PHMSA strongly encourages operators to review past and future NTSB 
recommendations that the NTSB provides to pipeline operators following 
incident investigations. Operators should proactively implement 
improvements to their pipeline safety programs based on these 
observations and recommendations so that the entire industry can 
benefit from the mistakes of one operator.

    Authority:  49 U.S.C. chapter 601: 49 CFR 1.53.

[[Page 25994]]

    Issued in Washington, DC on April 30, 2014.
Jeffrey D. Wiese,
Associate Administrator for Pipeline Safety.
[FR Doc. 2014-10248 Filed 5-5-14; 8:45 am]