Pipeline Investigation Report P95H0036

At 0542 eastern standard time (EST), on 29 July 1995, an initial rupture and a fire occurred on the TransCanada PipeLines Limited (TCPL) 1,067-mm (42-inch) natural gas pipeline at Kilometre Post Main Line Valve 30-4 + 0.220 km near Rapid City, Manitoba. At 0634 EST, a second rupture and a fire occurred on the 914-mm (36-inch) natural gas pipeline at Kilometre Post Main Line Valve 30-3 + 0.245 km, adjacent to the first rupture, at the same location. The 1,219-mm (48-inch) natural gas pipeline at Kilometre Post Main Line Valve 30-5 + 0.347 km, passing under the location of the first and second pipeline ruptures, was exposed to the fire but did not rupture.

The Board determined that the initial rupture was caused by a ductile overload fracture as a result of external stress corrosion cracking and that the secondary rupture was the result of heat overload from the initial fire and the delay in shutting down Line 100-4.

1.1 The accident

On 29 July 1995, at 0542^{Footnote 1}, the TransCanada PipeLines Limited (TCPL) 1,067-mm outside diameter (nominal pipe size (NPS) 42 inches) main natural gas pipeline, designated as Line 100-4, suddenly experienced a simultaneous loss of operating pressure and increase in natural gas flow rates downstream of Station 30 near Rapid City, Manitoba, at Main Line Valve (MLV) 30-4. The Regional Operations Controller (ROC), located at MLV 39, near Winnipeg, Manitoba, approximately 204 km (127 miles) away, remotely operates Station 30, 24 hours a day. Station 30 is a staffed facility during normal working hours.

At 0544, the operator on duty at Station 30 attempted to notify the ROC regarding an explosion and a fire at the station and also to indicate that he had experienced minor injuries, but he was unsuccessful. Due to the proximity of the fire, the operator then proceeded to exit the station yard and went to the emergency phone outside the station yard, but was unable to call from there. The operator proceeded back to the station gate and then completed his emergency call to the Winnipeg ROC using a cellular phone provided to him by a bystander. While exiting, the operator tried to initiate a local emergency shut-down (ESD) of the station by depressing the "Station ESD" button in the ESD shut-down box located near the main entry gates. Even though the operator had depressed the ESD button several times to initiate a local ESD, it was later determined that, in the excitement of the situation, the operator had not depressed the ESD button sufficiently to initiate the local ESD.

At the same time, the Winnipeg ROC also initiated a station ESD from the Winnipeg console. This action should have shut down all station compressor units and closed all plant valves in the station; however, the console screen did not indicate that this command had been successfully executed. The ROC then initiated an "Isolate-All" command to Station 30 which closes and locks out all MLVs for the six pipelines in the area, all associated side valves, upstream tie-over valves and downstream tie-over valves at the station. The console screen indicated that the "Isolate-All" command had been successfully sent to Station 30, but was not executed. The ROC attempted at this time to initiate an "Isolate-All" command at Station 30 and on several occasions after this time without success.

Having failed to receive confirmation of the closure and lock-out of all the valves at Station 30 from the Supervisory Control and Data Acquisition (SCADA) system, the ROC issued an "Isolate-All" command to Station 25, located at Moosomin, Saskatchewan, approximately 110.96 km upstream of Station 30. At 0604, the console screen provided confirmation of a successful execution of this command.

At 0604, the ROC issued an "Isolate-All" command to Station 34 located at Portage La Prairie, Manitoba, approximately 108.8 km downstream of Station 30. The console screen provided confirmation of a successful execution of this command. With the successful isolation of the pipeline system between stations 25 and 34, additional volumes of natural gas were restricted from moving into the accident section.

Between 0606 and 0635, the ROC initiated individual "close" commands to specific valves at Station 30. While the "close" command for MLVs at the compressor station was used to isolate the line break, it did not automatically lock out any closed valve. The valve will remain closed for a timed period of 15 minutes after initiation of the "close" command. If a differential pressure does not exist across the valve, it will automatically open. The ROC had to repeat the "close" command on several occasions to the various MLVs that were unaffected by the explosion and fire in the vicinity of the accident. While these activities were underway, a four-person survey crew, consisting of one TCPL employee and three contractors, arrived at Station 30, but were stopped at the station gate by the Royal Canadian Mounted Police (RCMP). The survey crew was scheduled to continue with their topographical survey of the compressor station yard at Station 30.

At 0630, the section of Line 100-4 containing the accident site, between MLV 30-4 and MLV 31-4, was effectively isolated by the actions of the ROC.

At 0634, the TCPL 914-mm (NPS 36 inches) main natural gas pipeline, designated as Line 100-3, ruptured and burst into flames downstream of MLV 30-3 and immediately adjacent to the initial pipeline rupture on Line 100-4.

At 0635, the section of Line 100-3 containing the second pipeline rupture, between MLV 30-3 and MLV 31-3, was effectively isolated by the actions of the ROC, local operations personnel and the low pressure MLV closure devices at MLV 31-3.

At 0742, approximately two hours after the initial explosion and fire on Line 100-4, the flow of natural gas from the remainder of the system was effectively isolated with the closure of MLV 30 and MLV 31 on Lines 100-3 and 100-4 and the fire self-extinguished at the rupture site. However, minor fires at the ends of the ruptured pipelines continued to burn for several hours.

At 1230, approximately six hours after the initial explosion and fire, the minor fires at the accident site had self-extinguished.

At 1845 on 01 August 1995, Line 100-5 was returned to service.

At 0655 on 02 August 1995, Line 100-3 was returned to service.

At 1746 on 12 August 1995, Line 100-4 was returned to service.

1.2 Injuries

A TCPL employee suffered minor cuts and bruises.

1.3 Damage to equipment - Product lost

Damage to Line 100-4 consisted of 10.50 m (approximately 34.5 feet) of ruptured pipe which had split open in the longitudinal direction and was blown out of the pipeline system. Damage to Line 100-3 consisted of 8.5 m (approximately 27.9 feet) of ruptured pipe which had also split open in the longitudinal direction and was blown out of the pipeline system. Line 100-5, which passes approximately 100 cm directly under Lines 100-3 and 100-4 at the rupture site, was exposed to the fire, resulting in minor coating damage. Therefore, 22.44 m (approximately 73.6 feet) of Line 100-5 was replaced.

The ruptures of Lines 100-3 and 100-4 produced four pipe fragments, which were found within a 90-m (approximately 295.3-foot) radius of the crater. The ruptures created a crater approximately 23 m wide by 51 m long and roughly 5 m deep, with a crater area of approximately 725 m². The fire burned an area around the pipeline system of approximately 19.62 hectares (ha) (48.48 acres) with a combined burned and heat-affected area of approximately 80 ha (197.68 acres). (Refer to Appendices A and B for a drawing of the line break area.)

An estimated 19,600,000 m³ (692,163,700 cubic feet) of natural gas was consumed by the fire. This estimate of natural gas loss also includes an estimate of the volumes lost as a result of the blow-down for isolation and safety reasons.

Since sections of damaged and undamaged pipeline were removed upstream and downstream of the occurrence site, the repair of Line 100-4 was completed using pipe of a length of 131.82 m (approximately 432.5 feet). The repairs of Line 100-3 and Line 100-5 were completed using pipe of a length of 42.44 m (approximately 139.2 feet) and 22.44 m (approximately 73.6 feet) respectively.

Damage to Compressor Station 30 was extensive. The control building, the exterior of the four compressor plants, the above-ground operators of the main line and associated valves, the control wiring to specific valves and various elements of piping related to facilities in the station were either bent and twisted from the radiant heat or burned and blown away by the fire and explosion. The area surrounding the fire and explosion suffered slight to extensive damage to such items as pipe insulation, sidings of buildings, roofs of buildings, sight glasses, lighting poles, wiring harnesses, electrical cables and fences. The repair of these items was completed around 15 August 1995.

One TCPL truck and one private vehicle received substantial fire damage. The inside of the "D" Plant control room was slightly damaged by the thermal radiant heat wave from the explosion and fire.

1.4 Weather

The weather conditions on the morning of the rupture were clear with a temperature of 6.8 degrees Celsius, clear skies and calm to gentle winds. The barometric pressure was at 101.89 kilopascals (kPa), the dew point at 5.2, and the humidity at 87 per cent.

1.5 Particulars of the pipeline

The nominal wall thickness of Line 100-3 is 8.74 mm (0.344 inches). The pipe was manufactured in 1968 by Canadian Phoenix with a double-submerged arc-welded (DSAW) longitudinal seam weld and a specified minimum yield strength (SMYS) of 414 megapascals (MPa) (American Petroleum Institute (API) pipe grade X-60). The section of Line 100-3 that ruptured was constructed in 1968 and was externally coated at that time with a mastic primer, a hot-applied asphalt enamel coating, and an asbestos and kraft paper outer wrap.

The nominal wall thickness of Line 100-4 is 9.42 mm (0.371 inches). The pipe was manufactured in 1973 by the Stelco pipe mill in Camrose, Alberta, in accordance with Canadian Standards Association (CSA) standard Z245.2, with a DSAW longitudinal seam weld and a SMYS of 448 MPa (pipe grade X-65). When the section of Line 100-4 that ruptured was constructed in 1973, the pipeline was tied in to the heavy wall pipe section of Line 100-4 at Station 30 by means of a 3.41-m-long (11.19-foot-long) transition piece of pipe. Referred to as a "pup", this transition piece had a nominal outside diameter of 1,067 mm (42 inches), a nominal wall thickness of 9.42 mm (0.371 inches), a SMYS of 448 MPa (pipe grade X-65) and was manufactured in 1973 by Stelco in accordance with CSA standard Z245.2. The station piping for Line 100-4 has a nominal outside diameter of 1,067 mm (NPS 42 inches), a nominal wall thickness of 11.3 mm (0.445 inches), a SMYS of 448 MPa (pipe grade X-65), and was manufactured in accordance with standard CSA Z245.2. At the time of construction, this section of Line 100-4 was externally coated with a mastic primer, a hot-applied asphalt enamel coating, and an asbestos and kraft paper outer wrap. The 3.41-m (11.19-foot) transition piece, together with a small portion of the pipeline upstream and downstream of the transition piece, was coated using a hand-applied tape primer and polyethylene tape.

The section of Line 100-3 which ruptured had been hydrostatically tested in 1968 to a minimum test pressure of 8,487 kPa (1,231 pounds per square inch gauge (psig)). The National Energy Board (NEB) had issued a "Leave to Open" to the TCPL on 28 November 1968 at a maximum allowable operating pressure (MAOP) of 6,068 kPa (880 psig) which corresponded to 77 per cent of the SMYS. Although Line 100-3 had been re-tested in 1990 as part of the Pipeline Maintenance Program (PMP), the section that failed had not been included in the re-test, since the test head had been placed approximately 500 m (1,640 feet) downstream of the accident site.

The section of Line 100-4 which ruptured had been hydrostatically tested in 1973 to a minimum test pressure of 7,585 kPa (1,100 psig). The NEB had issued a "Leave to Open" to the TCPL on 30 August 1973 at a MAOP of 6,068 kPa which corresponded to 77 per cent of the SMYS. Since its original construction, this section of Line 100-4 had not been hydrostatically re-tested.

There was no history of prior repairs in the section of Lines 100-3, 100-4 and 100-5 from MLV 30 to MLV 31. This western portion of the pipeline system had been inspected for stress corrosion cracking (SCC) in 1987, 1988, 1990 and 1994, but no further work had been carried out. Before the Rapid City occurrence, additional SCC work had been scheduled for 1996, 1997 and 1998 in Western Canada.

The failure of Lines 100-3 and 100-4 caused surface damage to Line 100-5 and did not cause any damage to Lines 100-1, 100-2 and 100-6. The last aerial patrol conducted over this portion of the pipeline system before the occurrence had been during the afternoon of 28 July 1995, with no concerns being reported.

As part of its ongoing operational activities, TCPL personnel performs annual natural gas leak surveys of its pipeline system by walking the right-of-way with hand-held gas detectors.

The last leak survey over the pipeline right-of-way between MLV 28 and MLV 31 had been conducted during the months of May and June 1995 and no leaks had been detected in the area of Line 100-4.

1.6 Commodity pipeline operations

The TCPL Gas Control Centre (GCC), located in Calgary, Alberta, relies on selected telemetric data from compressor and meter stations coming from the TCPL SCADA telemetry network to determine the optimum operating scenarios for moving contracted quantities of Western Canadian natural gas. The TCPL pipeline system is subdivided in Regional Control Centres (RCCs), each under the direct command of an ROC with direct remote control over a series of compressor stations. At the time of this occurrence, the ROC was located in Winnipeg.

After the pipeline ruptures, TCPL performed a detailed investigation into the SCADA operation of all line isolation valves from the Winnipeg RCC. This work revealed two programming errors in the SCADA system which resulted in the station "ESD" and "Isolate-All" commands not being acted upon at Station 30. All SCADA programming faults were traced and their causes corrected.

On the day of the occurrence, the duties of the TCPL operator were to staff the site due to minor SCADA communication and information update problems which existed between Station 30 and the RCC. SCADA personnel was scheduled to be on site the day of the accident to correct these SCADA performance problems.

A review of the telemetry data for the day in question shows that, before the break, TCPL was flowing natural gas at approximately 174.7 million m³ (6.2 billion cubic feet) per day through the six lines in Western Canada. All functions had been normal for the previous 24 hours and no abnormalities in operations were identified from this review.

1.7 Cathodic protection on Lines 100-3 and 100-4

Cathodic protection (CP) is provided by means of an impressed current on each of the six pipelines from MLV 30 to MLV 31. The distribution system for CP is located in the yard of Compressor Station 30. There are no magnesium anode installations on this section of the pipeline system. When the section of Line 100-4 which contained the break was installed in 1973, TCPL tied the pipe into the existing CP system at Station 30. TCPL did likewise when Line 100-3 was installed in 1968.

In order to determine the effectiveness of the CP system and to ensure that the existing minimum industrial norm of 850 millivolts (mV) "off" cathodic potential and of 900 mV "on" cathodic potential were met, TCPL's field staff performed close pipe-to-soil surveys (close surveys) at various times during the life of the system. The close surveys for 1985 and 1991 for Lines 100-3 and 100-4 showed that the potentials at the rupture site exceeded the minimum industrial norm.

1.8 Stress corrosion cracking mitigation program

Prompted by a series of in-service SCC-related ruptures starting in March 1985, TCPL has developed a SCC Mitigation Program as a component of its "Pipeline Maintenance Program" (PMP). Initial emphasis of the SCC Mitigation Program was placed on Line 100-2 in Northern Ontario. The program was then expanded to include Line 100-1 in the Toronto-to-Montreal corridor, Line 100-1 in Northern Ontario, and other selected pipelines in various geographical regions of the TCPL system.

The SCC Mitigation Program includes the following:

1. defining environmental conditions conducive to the creation of SCC;
2. determining the extent of SCC on the pipeline system through hydrostatic testing and selective excavation; and
3. identifying and removing "significant" pipeline defects (over 10 per cent in depth of the pipe wall) that could affect system integrity.

In July 1989, TCPL experienced a pipeline leak, but not a rupture, attributed to SCC at MLV 31-3 + 8.8 km, near Brandon, Manitoba. In 1990, TCPL hydrostatically tested Line 100-3 between MLV 30 and MLV 31 as well as between MLV 31 and MLV 32. In 1994, TCPL subsequently expanded the scope of its PMP investigations into SCC with excavations conducted in Western Canada. However, as of the date of this accident, TCPL had not expanded the scope and area of the PMP investigations into SCC outside those areas already investigated in Western Canada. TCPL based this decision on the following points:

1. the soil conditions were classified as being low on the SCC-susceptibility scale and did not rank among the ones of major concern;
2. the operating history of the system to that point did not include SCC-related occurrences;
3. the results of 28 excavations since 1988, all of which did not indicate serious SCC activity; and
4. the successful hydrostatic re-testing of Line 100-3 in 1990.

Before the occurrence at Rapid City, TCPL had scheduled additional excavations for Western Canada starting in 1996 through 1998.

The July 1995 pipeline rupture on Line 100-4 at Rapid City was the first time that TCPL had an SCC pipeline rupture on Line 100-4. It was also the first time that a pipeline rupture had occurred west of Winnipeg. The investigation found similarities between this occurrence and previous SCC-related ruptures on the TCPL system. The similarities are as follows:

• The pipeline was originally coated externally with polyethylene tape at the occurrence site, which was similar to the external coating on the pipeline at other SCC rupture sites on the TCPL system.
• While the occurrence site was in a wheat field adjoined by fields of canola and alfalfa, the soil conditions were a sand/clay till material which was found at other SCC-related occurrence sites.
• The topography in this area is classified as undulating to gently rolling, with moraine surficial deposits predominating. Numerous small pothole wetlands occur along the pipeline route in this MLV section with seven of these small wetlands occurring in the vicinity of the rupture. The terrain has been rated as "imperfect" to "poorly" drained. The soil conditions at this occurrence site were similar to the soil conditions found at other SCC occurrence sites on the TCPL system.

For a comprehensive overview of TCPL's PMP together with information on soil conditions and pipeline coatings which can influence the development of SCC, refer to TSB reports P92T0005, P91H0041, P91H0117, and P95H0003.

1.9 Spacing of main line pipes on the TCPL system

TCPL's records indicate that, at the rupture site, the limits of the TCPL right-of-way measure 66.10 m (220.33 feet). (Refer to the drawing in Appendices A and B.) Within the right-of-way, the spacing between Lines 100-1, 100-2, 100-3 and 100-4 is generally 9.1 m (29.85 feet). At the rupture site, the horizontal spacing between Lines 100-3 and 100-4 had been reduced to 7.0 m (22.97 feet), which was less than the company's horizontal spacing standard. Line 100-6 is located at the north limit of the TCPL right-of-way and passes from the north to the south side under the five other pipelines at a location downstream of the accident site.

At the accident site, Line 100-5 passes under Lines 100-1, 100-2, 100-3 and 100-4 with a minimum spacing between the top of the Line 100-5 carrier pipe and the bottom of the other four carrier pipes of 80 cm to 170 cm (2.62 feet to 5.58 feet). While the vertical spacing between pipelines on the TCPL system generally follows accepted industry standards of the CSA, there are no regulations, standards and/or guidelines setting out safe horizontal spacing distances between parallel pipelines. Instead, TCPL has established company standards for horizontal spacing between main line pipelines. These company standards are based on studies of crater size for pipeline ruptures, for the diameter and the operating pressures that exist on TCPL. TCPL has approximately 270 crossover piping locations on its main line system which are similar to the crossover piping arrangements found at the Rapid City occurrence site.

1.10 Metallurgical testing

The chemical composition and mechanical properties of the pipe sections from Lines 100-3, 100-4 and 100-5 remote from the area that failed were consistent with the pipe specifications at the time of purchase.

A metallurgical examination of the fracture area determined that Line 100-4 ruptured as a result of stress overload at a pre-existing defect located at the toe of the longitudinal seam weld, indicative of external SCC. Two major flaws, identified as "A" and "B", and approximately 2.35 m (7.7 feet) apart, were observed initiating from the outside diameter surface in the toe of the DSAW longitudinal seam weld of the 3.41-m (11.19-foot) pipe transition section on Line 100-4. The failure did not initiate at the change in pipe wall thickness at the ends of the pipe transition piece, but rather slightly remote from one end. These defects occurred during the operational life of the pipeline and were not the result of manufacturing, pre-installation or construction defects in the pipe wall. The pipe failed when flaw "A" extended 81 per cent into the nominal pipe wall thickness, at which point the remaining wall thickness was no longer sufficient to withstand the normal operating pressure of the pipeline.

Although flaw "B" was deeper and longer than flaw "A", its irregular shape made its surface area smaller than that of flaw "A". Significant deformation was present around flaw "B", but not around flaw "A". Surface examination revealed surface corrosion and SCC colonies (secondary cracks on the surface) in the immediate area of both flaws. Fractography showed that a zone of fresh crack growth was observed at the tip of flaw "A", but not at the tip of flaw "B". Multiple initiation sites were present for flaw "B", consistent with several cracks from one SCC colony linking together to form a single crack front which then propagated in the heat-affected zone at the toe of the DSAW longitudinal seam weld. However, this mechanism was not apparent for flaw "A". The metallurgical examination concluded that flaw "A" had initiated from a pre-existing defect at the toe of the DSAW longitudinal seam weld. Metallurgical examination of several cross-sections in the toe of the DSAW longitudinal seam weld showed the presence of small laminations which could have separated and propagated due to the thermal and/or residual stresses inherent to the DSAW welding process.

A metallurgical examination of the fracture area determined that Line 100-3 ruptured as a result from overstress caused by heat exposure from the fire which lowered the mechanical properties of the pipe to a point that the pipe wall yielded to the stresses from the internal operating pressure. The metallurgical examination showed that, as the overstress progressed, it generated laminations associated with a banded microstructure and inclusion stringers. Even though the laminations were not in the initiation area nor did they play a role in the initiation of the failure, their presence represented areas of low strength through which the fracture progressed.

A metallurgical examination of the pipe removed from Line 100-5 found that exposure to the fire did not affect the metallurgy of the pipe.

A magnetic particle inspection of the pipe sections from Lines 100-3 and 100-5 did not reveal any secondary SCC cracking. This examination confirmed that the Line 100-3 pipe sections failed as a result of the failure of Line 100-4.

2.1 Introduction

The metallurgical examination identified SCC as the source of the pipeline weakness that led to the stress overload at a pre-existing defect in the exterior surface of the pipe wall of Line 100-4. The initial explosion and fire led to heat overload which resulted in the rupture of another pipeline. As well, a third pipeline suffered fire damage to the exterior coating on the pipe surface. The pipeline ruptures and loss of internal operating pressures in the two lines were immediately acted upon, triggering a series of emergency procedures by TCPL operations and field staff.

The analysis will focus on the spacing of main line pipelines, the ESD of pipeline facilities, the coating and the environmental conditions which led to the SCC, and the policies and procedures employed by TCPL when identifying, excavating, verifying, and repairing areas susceptible to SCC.

2.2 Consideration of the facts

2.2.1 Horizontal spacing of main line pipelines

The geometry of the failed section of pipe that came from Line 100-3 indicated that the piece of pipe had ruptured as a result of the direct effects of the explosion from Line 100-4 and the intense heat that followed from the burning natural gas.

When a company designs a new pipeline system, the pipeline industry has to adhere to various CSA standards and NEB regulations to ensure a properly designed system to meet existing safety and operational requirements. One of these CSA standards dictates the minimum vertical spacing between pipelines that cross each other. This CSA standard is very specific with respect to minimum vertical spacing between pipelines for various situations. However, in the case of horizontal spacing of adjacent parallel pipelines, there is neither a national CSA standard, nor a NEB regulation, nor industry guidelines.

While the pipeline industry is not provided direction with respect to safe horizontal spacing distances, the investigation found that the presently installed spacing distance between Lines 100-3 and 100-4 is fairly standard in the pipeline industry. While TCPL has company standards on horizontal spacing between main line pipelines, the Canadian pipeline industry has not identified horizontal spacing requirements between parallel pipelines and has not established national standards that will be applicable to all pipelines in Canada.

2.2.2 Emergency shut-down of pipeline facilities

The TCPL Emergency Procedure Manual clearly outlines steps that company personnel are to follow during an emergency situation at any location on the pipeline system.

TCPL diligently performs various surveys and tests of the performance capabilities of its ESD and SCADA systems. For those sections that are found to be deficient, TCPL continuously upgrades its ESD and SCADA systems to ensure that the pipeline system continuously meets an adequate level of response to ensure the safe operation and shut-down during all normal and emergency situations.

While TCPL performs these various activities, the human-to-machine interface may be inadequate to meet the demands placed on it during emergency situations. From the initial moments until the complete isolation of the Rapid City compressor station, numerous attempts were made by the ROC and by the TCPL employee to shut down and isolate the facilities and the flowing pipeline system from the accident site.

Before this occurrence, there did not appear to be any unusual operational problems with the ESD and SCADA systems which warranted immediate action by TCPL. On the day of the accident, SCADA personnel was on site to correct performance problems with the SCADA system. However, during this emergency and when shutting down the facilities became a priority, the system would not shut down. There was an unusually long period of time before the facilities were shut down and the flow of natural gas to the accident site was stopped. Once the system was shut down, most notably by issuing "Isolate-All" commands to the upstream and downstream compressor stations and then performing a valve-by-valve closure at the Rapid City compressor station, the ROC was required to re-issue commands to re-close the main closed valves every 15 minutes. An ESD system is intended to have the capability of shutting down the facility and evacuating all the natural gas in the station piping to the atmosphere to rapidly control an emergency. Once the nature and extent of the occurrence have been determined, the ROC could restart various segments of the pipeline system that are unaffected by the occurrence, and could initiate a re-start on a line-by-line, valve-by-valve basis.

While there were several attempts to initiate a local ESD by the local TCPL employee, the ESD was not initiated. Post-occurrence testing determined that the local ESD button was functional. It was concluded that it had not been depressed sufficiently. The operator stated that, during his training, he would be aware of the initiation of the shut-down of the compressor station by the sudden change in the background equipment noise level, the sound of alarms within the plant and the sound of natural gas venting through the various blow-down valves in the station yard. If the local ESD command is not sent, the initiation button will spring back, prompting the initiator to reattempt a local ESD. However, during this occurrence, the noise of the escaping natural gas and the fire overshadowed the normal background noise and alarms of the station. Several attempts were made by the local TCPL employee to initiate a local ESD. However, the spring-back feature of the local ESD proved to be inadequate in clearly indicating whether a local ESD had been initiated. If there had been a feedback signal indicating that the local ESD had not engaged, it would have become apparent to the initiator that the button should be depressed again.

While the ROC located in Winnipeg and the local TCPL employee made numerous attempts to shut down the operating facilities to restrict the flow of natural gas to the accident site, the ensuing fire burned out of control. The initial explosion, followed by the intense fire and heat, damaged various facilities at the compressor station, located approximately 200 m upstream of the occurrence site. Part of the various facilities that sustained fire and heat damage was the ESD wiring used to control and shut down the compressor station facilities and valves during normal and emergency situations. Various methods of analysis are available to identify potential safety deficiencies with respect to the reliability of primary systems and the availability of alternative means of control. One such method is a fault-tree analysis which could be applied to an existing SCADA/ESD system to identify shortcomings in the existing system and correct any deficiencies.

2.2.3 Exterior coating and environmental conditions

Initiated in 1985, the PMP is designed to address the SCC problem that TCPL has found to exist on its system. It is now known that polyethylene tape and asphaltic coatings show a particular susceptibility to SCC, under specific environmental conditions. Polyethylene tape coating was found at the subject occurrence site. Of all the tape coating systems that demonstrate a propensity to develop SCC, polyethylene tape coating shows a much higher susceptibility. CP survey measurements taken by TCPL employees indicated full CP in the section containing the rupture.

The PMP found that the polyethylene exterior coating system experiences disbondment and/or deterioration over time. This situation of disbonded and/or deteriorated coating acts as an electrical shield to the CP current and is referred to as CP shielding. With this phenomenon, impressed current from the CP system cannot access exposed metal which lies under the coating. This electrical shielding causes changes in the potential gradient of the CP system, that is, in areas of insufficient CP current. This in turn produces an area on the pipeline of insufficient CP defence against SCC, which may, over time, lead to a pipeline rupture, assuming that all other factors necessary for SCC to occur are present at the site.

It is known that bacteria in the soil and groundwater act to accelerate the process of SCC. However, the role played by bacteria in this process of disbondment and/or deterioration is not well known or understood. While much time and resources have been expended to understanding the SCC phenomenon, little understanding exists as to the interaction between bacteria, the coating primer, and the polyethylene tape coating and the existence of SCC.

2.2.4 TCPL's stress corrosion cracking soils model

A key component of TCPL's SCC Mitigation Program initiated in 1985 was the establishment of a SCC soils model. The purpose of this model is to aid TCPL employees in the identification of soils that are known to encourage the development of SCC. In its present form, the SCC soils model covers principally the TCPL facilities east of Winnipeg. While TCPL has done some field excavation work west of Winnipeg, the SCC soils model had not been expanded to cover the Western Canada region of the TCPL facilities. Experimental and field research has found SCC in the western regions of Canada on pipelines operating in those areas. As was noted in previous TSB investigation reports into SCC-related occurrences, TCPL had an SCC-related leak on its western pipeline system, in 1989, at Brandon. However, TCPL had not expanded the SCC soil model to cover its complete system, until moneys were budgeted in 1994 to commence development of a system-wide SCC soils model in 1995. At the time of the Rapid City occurrence, TCPL was just beginning to develop an expanded SCC soils model to cover the Western Canada region of the TCPL system. TCPL now expects to have the system-wide SCC soils model in place in 1997.

3.1 Findings

1. The rupture of Line 100-4 initiated in the toe of the double-submerged arc-welded (DSAW) longitudinal seam weld of a 3.41-m-long transition piece of pipe as a result of a stress overload at a major pre-existing stress corrosion cracking (SCC) defect.
2. A second major SCC flaw, approximately 2.35 m away from the one that led to the rupture, was found in the toe of the DSAW longitudinal seam weld on the same transition piece of pipe.
3. Line 100-4 was externally coated with an asphaltic tape coating; however, the 3.41-m-long transition piece of pipe was fabricated in the field during the construction of Line 100-4 and field-coated with a primer and a hand-applied polyethylene exterior tape coating.
4. SCC is known to occur under polyethylene exterior coatings, which are known to disbond and/or degenerate, thus creating an area on the surface of the pipe which is shielded from the cathodic protection (CP) system.
5. Surveys of the effectiveness of the CP system showed that the CP potentials at the rupture site exceeded minimum industrial norms.
6. Located parallel and horizontally approximately 7 m to the north, the Line 100-3 rupture initiated as a result of overstress caused by heat exposure from the Line 100-4 fire, which lowered the mechanical properties of the pipe to a point that the pipe wall yielded to the internal operating pressure stresses.
7. While TCPL has company standards on horizontal spacing between main line pipelines, there are no National Energy Board regulations, no Canadian Standards Association (CSA) industrial standards, or no guidelines which set out safe horizontal distances between parallel pipeline systems as is the case for vertical distances between pipelines which cross each other.
8. Line 100-5 passed directly under the occurrence site and did not rupture; however, the surface coating experienced fire damage and the section was replaced with new pipe.
9. While the Winnipeg Regional Operations Controller (ROC) reacted immediately to the simultaneous indications of a loss in pressure and a pipeline rupture, he tried numerous times over a two-hour period to initiate a computer-initiated emergency shut-down (ESD) command to the Rapid City compressor station, which would have isolated the flow of natural gas to the occurrence site, but was restricted from successfully carrying out this computer command due to the effects of the explosion and fire on the local ESD equipment used to carry out these computer commands and SCADA system programming errors.
10. The Winnipeg ROC had to re-issue "close" commands every 15 minutes because the Supervisory Control and Data Acquisition system does not have the capability during an ESD to override the 15-minute feature of the "close" command.
11. The TCPL employee located at Compressor Station 30 attempted without success, on several occasions, to initiate a local ESD, but the equipment did not provide a clear indication that an ESD had been initiated.
12. While TCPL had been developing a SCC soils model since 1985, at the time of the occurrence, the SCC soils model only covered the pipeline system from Winnipeg eastward and did not cover all the areas of the system which contained SCC-susceptible soils.

3.2 Cause

The initial rupture was caused by a ductile overload fracture as a result of external stress corrosion cracking and the secondary rupture was the result of heat overload from the initial fire and the delay in shutting down Line 100-4.

4.1 Action taken

4.1.1 TCPL's stress corrosion cracking mitigation program

As a result of this occurrence, TCPL modified and accelerated the scope and depth of its SCC Management Program in Western Canada, consisting of hydrostatic re-testing, soils modelling, investigative digs and pipe replacement. There have been a total of 91 investigative digs, 55 of which were in Western Canada. Furthermore, as part of the TCPL SCC Management Program:

1. the SCC soils model has been modified to cover all sections of TCPL's pipeline system;
2. it has been found that 81 of the locations excavated had hand-applied polyethylene exterior coating;
3. six sections of Line 100-4 in Western Canada have been hydrostatically re-tested to identify any other potential SCC locations with structurally significant defects; and
4. three in-line inspections were run in Northern Ontario. The data from these runs identified SCC at 12 different locations. As of late 1996, SCC with a depth of less than 10 per cent of the pipe wall thickness has been confirmed at four of these sites through excavation digs. Further excavation work was planned for the eight remaining sites.

4.1.2 National Energy Board's inquiry into stress corrosion cracking

On 11 August 1995, the NEB announced a public inquiry into SCC occurrences on Canadian oil and gas pipeline systems. The inquiry evaluated the extent of SCC on pipelines and the steps that can be taken to effectively deal with SCC.

The NEB inquiry panel report was released to the NEB and the general public on 19 December 1996. The inquiry report contains 27 recommendations to promote public safety on buried oil and gas pipelines in Canada and can be grouped into the following general categories:

1. SCC management programs;
2. design changes;
3. research;
4. SCC database;
5. emergency response practices; and
6. information sharing.

The Board believes that implementation of the measures recommended by the NEB public inquiry will go a long way towards better managing the risks associated with SCC in pipelines.

4.1.3 Supervisory control and data acquisition programming

TCPL has advised that the SCADA programming faults pertaining to the "ESD" and "Isolate-All" commands discovered in the course of this investigation have been corrected.

4.2 Action required

4.2.1 Emergency shut-down system

4.2.1.1 Regional operations centre emergency shut-down

The Board is concerned that the ROC was unable to effect a rapid shut-down of the system, as per the system's emergency shut-down (ESD) design capability.

The force of the explosion eliminated all communication elements to and from the station. Thus, the ROC had no control over the ESD system due to the collateral damage to the plant's telecommunication equipment. As a result of this communication failure, the computer was unable to initiate the commands as sent by the ROC controller, thereby allowing the plant to continue pumping product through the pipeline.

Notwithstanding the efforts of both the ROC and the on-site TCPL employee to effect an ESD, the system was not completely isolated for nearly two hours after the initial rupture of Line 100-4. (Even this required an improvisation by the ROC to effect the shut-down through the cumbersome process of closing all the necessary valves one by one, then following up every 15 minutes to keep them closed.) In the meantime, the continued flow of product into the fire led to significant collateral damage, including the failure of a second pipeline and damage to a third. From a design perspective, the Board believes that ESD systems should be hardened against the explosive forces and fire associated with this type of system failure. Indeed, to be fail-safe, the ESD feature should be capable of automatically isolating the flow of product to an accident site, overriding other commands if necessary, until it has been verified that it is safe to reactivate normal operations. Therefore, the Board recommends that:

4.2.1.2 Local emergency shut-down procedures

In addition to the system shortcomings with respect to remote ESD by the ROC, this accident revealed shortcomings in local ESD procedures. Several times, the on-site TCPL employee attempted to initiate a local ESD. When a local ESD is activated for training purposes, the operating noise level in the plant drops noticeably, indicating to personnel that the ESD has been successfully activated. However, under the conditions of this occurrence, the noise level from the ruptured pipelines in the plant area was much higher than the normal operating noise level in the plant. Therefore, the employee had no feedback that the shut-down had not taken place as intended.

The Board recognizes that compressor stations are often unstaffed. Nevertheless, as a backup to the remote system defences for ESD, company employees should be capable of initiating an ESD locally. This requires not only the necessary equipment and training for affected employees, but also a feedback loop, so that the employee can determine if the shut-down has been initiated. Therefore, the Board recommends that, as part of the design review of Recommendation P97-01 above:

4.3 Safety concern

4.3.1 Horizontal spacing of pipeline systems

The Board notes that there are currently Canadian Standards Association requirements for vertical spacing between pipeline systems in Canada. It is understood that these requirements address the safety issues associated with pipeline systems that cross over each other in a vertical manner. However, there are no similar requirements for the horizontal spacing of pipeline systems.

In view of the potential for catastrophic consequences in the event of a natural gas pipeline failure, particularly in highly populated areas, both vertical and horizontal separation of adjacent pipelines are essential to protect them from collateral damage. The Board is concerned that current standards may be inadequate in this regard.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail, Charles Simpson and W.A. Tadros, authorized the release of this report on 10 June 1997.

Appendix A - Planimetric view for line break

Image

Appendix B - Topographic plan view for line break

Image

Appendix C - Glossary

API

American Petroleum Institute

cm

centimetre(s)

CP

cathodic protection

CSA

Canadian Standards Association

DSAW

double-submerged arc-welded

ESD

emergency shut-down

EST

eastern standard time

GCC

Gas Control Centre

ha

hectare(s)

km

kilometre(s)

kPa

kilopascal(s)

m

metre(s)

m²

square metre(s)

m³

cubic metre(s)

MAOP

maximum allowable operating pressure

MLV

main line valve

MPa

megapascal(s)

mm

millimetre(s)

mV

millivolt(s)

NEB

National Energy Board

NPS

nominal pipe size

PMP

Pipeline Maintenance Program

psig

pounds per square inch gauge

RCC

Regional Control Centre

RCMP

Royal Canadian Mounted Police

ROC

Regional Operations Controller

SCADA

Supervisory Control and Data Acquisition

SCC

stress corrosion cracking

SMYS

specified minimum yield strength

TCPL

TransCanada PipeLines Limited

TSB

Transportation Safety Board of Canada