Signals, noise, and eco-disaster at Enbridge

by Colby Cosh

“Learning about Enbridge’s poor handling of the rupture, you can’t help but think of the Keystone Kops,” said Deborah Hersman, chair of the NTSB. “Why didn’t they recognize what was happening? What took so long?” she said in a statement. She said that despite alarms and pressure differentials, Enbridge staff twice pumped more oil, about 81 per cent of the total release, into the ruptured pipeline. Hersman said that oil gushed from the rupture for more than 17 hours before the leak was discovered.

This is a fair bottom line when it comes to Enbridge’s Line 6B leak, which poured about a million gallons of diluted bitumen into a tributary of the Kalamazoo River on July 26, 2010. As an Albertan, with all the prejudices and interests that implies, I’ve been reading primary documents in the U.S. National Transportation Safety Board’s investigation of the spill. What I slowly came to understand, to my considerable horror, is that the leak may physically have happened to a bunch of poor bastards in Michigan, but the real problem was here, in Edmonton. This is where pipeline controllers—tired, young, inexperienced pipeline controllers working in a somewhat dysfunctional environment—struggled for long hours to interpret pressure readings as anything but the unthinkable.

How would oil pipeline controllers know there was a leak somewhere in their system? This is a simple question which defies a direct answer. (Boy, does it ever. Go look through the documentation for an answer: it’s a maddening way to spend a week of your life.) Under normal circumstances, it’s actually pretty clear when there might be oil leaking from a pipeline: you have pressure in the line downstream, indicating that there’s oil flowing in the direction of travel, but no pressure upstream. If this condition exists for more than a certain amount of time, the controller is supposed to shut everything down until the problem is located. But there’s a wrinkle. Shutdowns for maintenance can result in “column separations”–situations in which the oil is no longer one continuous flow through the line, but instead consists of pockets of liquid separated by air and other gases.

Column separations are common and, when there has been a shutdown, are anticipated. Yet they cause the same pressure imbalances, and trip the same alarms, that a leak would. Under those circumstances, it seems from the evidence of the NTSB investigation, controllers simply ignore those alarms. You can imagine how this panned out on the evening of the 6B leak, which was not so close to a populated area that it would be noticed immediately and rectified.

At about the moment of the leak, or not long before, there was a planned maintenance shutdown of the section of 6B that had ruptured, or was about to. The downstream pressure didn’t come back upon restart. The controller in charge and the person handling “material balance” agreed that it was probably same doo-doo, different day—nothing they hadn’t seen a bazillion times before. (It does not seem to have helped matters that the “material balance system” person in the control room had unclear responsibilities. The controllers seem to have regarded the MBS professionals as having enormous advisory authority—as being the go-to source for a true understanding of what was happening in the pipe. But the MBS guys themselves seem to have seen their job as basically perfecting a computer model, and, in NTSB interviews, basically took the attitude that they don’t know nuthin’ ’bout no oil.) The control room shut down 6B again and restarted again, with a shift change in the middle of all the head-scratching. After hours of this activity, Enbridge started getting panicky phone calls from an American utility company, Consumers Energy, whose Michigan consumers were reporting a scent suspiciously like that of liquid petroleum product.

Some of the witnesses who talked to the NTSB noted that northern Alberta has a chronic shortage of skilled labour, and the pipeline controllers probably didn’t have experience quite commensurate with their awesome responsibilities. There were generational differences between a gang of grouchy Enbridge oldies who were supposed to be providing guidance, but who in practice pursued a “throw ‘em in the pool and see if they swim” teaching model, and the young recent graduates whose fingers were on the buttons. The final NTSB report will surely contain entertaining subplots concerning sloppy, old-school, laissez-faire personnel management, and there’s even a whiff of sexism scandal.

But it seems to me that the core problem with the way Enbridge was doing business was neither a metallurgy problem or a human-factors problem. The problem is that it didn’t have a system for leak detection, as such. What it had was a system for detecting pressure anomalies. That system, in essence, sent out hundreds of “column sep” alarms for every “oil is flowing out onto a frigging ecosystem at a higher-than-optimum rate, and oh by the way the optimum is zero” alarm. Statisticians call these “false positives”. And they know that a test which reports too many false positives is no damn good, even if it absolutely never ignores a true positive.

So Enbridge couldn’t really tell when there was a leak. Or, rather, they couldn’t tell up until about the point that the leak was physically splashing dilbit onto someone’s boots a couple thousand miles from the control room. This issue, I am sorry to say, should have been foreseeable. The company has modified its doctrines as a consequence of the 6B leak, and takes alarms much more seriously now. Taking the alarms seriously won’t help if they are as nonspecific as ever, but clearly there is a lot of action going on within Enbridge, and an appearance of earnestness.

It bears remembering that the proven permanent implications of the 6B spill don’t amount to much beyond the half-billion dollars Enbridge has spent on cleanup. The economic incentives are correctly positioned here: no one wants another spill less than Enbridge and its bean-counters. This isn’t, as far as I have seen anyone bother to demonstrate, a problem of economic “externalities”. The externalities in this case have been internalized right down Enbridge’s throat, with appropriate effectiveness. Moreover, pipelines in general have to be judged against the alternatives to having pipelines—which, in some cases, may have worse permanent environmental effects than worst-case spills like the one that Enbridge’s ham-handedness and bad luck caused.

But one can’t help feeling queasily grateful that the 6B rupture did happen in Michigan, in a part of the world where a smell of oil spreads to a human habitat sooner rather than later, and where well-equipped cleanup crews can start work quickly (even if this work is somewhat futile and clumsy at first). That doesn’t inspire confidence in the very different proposition that is Enbridge’s proposed Northern Gateway pipeline to Canada’s west coast. Nothing at all about the NTSB’s final report, I’m afraid, is likely to. And that report is going to be read closely in Canada. Very closely. By thousands of people. On both the “drill baby drill” side of the new Canadian political spectrum and the “if God meant us to dig our hands would be Garden Weasels” side.

Signals, noise, and eco-disaster at Enbridge

  1. Now this is journalism! Fasten your seatbelt, maybe get a helmet, expect incoming.

    • It also stands out for being painstaking slogging through documents which were publicly available but extremely voluminous, and then being reported in more detail than many other news outlets. The author deserves credit for doing the work.

      • Yup, great piece Colby.

        “But one can’t help feeling queasily grateful that the 6B rupture did
        happen in Michigan, in a part of the world where a smell of oil spreads
        to a human habitat sooner rather than later, and where well-equipped
        cleanup crews can start work quickly (even if this work is somewhat
        futile and clumsy at first).”

        On a related note, Shell has begun a PR campaign to prepare us all for Arctic drilling, where cleanup crews could take days or weeks just to get to a spill. You really have to see this site to believe it: http://arcticready.com/

        At least they give people the opportunity to mock them with user-submitted ad contest: http://arcticready.com/social/gallery?sort_by=value&sort_order=DESC&page=4

        Update: It’s a hoax. As reported by, well, Macleans: http://www2.macleans.ca/2012/07/16/yes-men-take-on-shell-in-ad-campaign-hoax/

        Ahem.

  2. A great read, but frankly I think the final analysis does not go far enough. As noted, Enbridge is going to “earnestly” take its fairly useless alarms much more seriously. Or more precisely, the young Enbridge operators have learned a lesson, well sort of.

    It would also be interesting to know just how much a false alarm shutdown costs. Especially a false alarm associated with a remote area where visual inspection could take days. My guess is that the first Enbridge operator who costs the company millions by being conservative will also learn a lesson.

    The problem is not really with Enbridge as a company. They are likely doing the best they can with a business model, that does not plan for failure. Pipelines could be set up with leakage detection, prepared catchment areas for minor leaks, improved access plans to remote areas. Enbridge would no doubt let us know that these measure would destroy the industry, which is code for would hurt their shareholders. That is the proper nature for a company, deliver value to its shareholders.

    The public trust needs to be protected by an independent regulatory agency with teeth. The primary consideration has to be the methodologies and practices necessary to transport bitumen safely. (Of course safely needs to be defined as well, and should likely be route dependent) That sets up a cost structure and the pipeline may or may not be economically viable as a result. The funny thing is really a conservative approach to resource development, kinda makes me wish we had a conservative government.

  3. Colby, kudos for spending the time to understand some of the technical aspects of the NTSB report. And by poring over “primary documents”.

    As you have correctly pointed out, measuring pressure differentials (delta P) is a rough approximation /first indicator of alarm. And the false positives are numerous, especially when the consistency of the shipped product (in this case diluted bitumen, dlbit) can vary.

    “Material balance” is a more accurate means of measuring losses/pipeline performance. For the lay person, this is simply measuring/metering the actual flow at various stages of the pipeline (ie if you put in 100 units/hr at the start of the line at point A and only 50 units/hr comes through at point B 10 kms downstream, then you know 50 units/hr is going somewhere. If it’s simply filling void portions of the line due to a shutdown, then you will see flow rates rise over time as the pipe(“column separations”) is/are filled.

    But the fact that this was a start-up situation after a “planned maintenance shutdown” should draw special attention. The ageing pipeline had been identified as having Stress Corrosion Cracking (SCC) which is not uncommon on much older lines. The metallurgical failure is often a result of fatigue. (Think of when as a kid you would grab a coat hanger and repeatedly bend it back and forth – generating heat and eventually causing the metal to fail by repeated bending – this is fatigue failure).

    If a pipeline has been weakened, and fatigue is the failing mechanism, then the highest stress is during start-up when the differential in pressure is greatest when you go from no internal pressure to maximum (operating) over a relatively short period of time.

    I could go on. Hindsight is 20/20. But one wonders, with an ageing line, reports of thousands of microscopic stress fractures, and false positives, why Enbridge did not upgrade to a more robust material balance system over the past few years. Sure it would have cost $$$ retrofitting. Would be interesting to see if they did look at this option, internally.

    New lines no doubt would be built from scratch (instead of retrofitting) with much more robust safety/reporting systems and a higher level of automation/automatic shut downs.

  4. Very good piece of journalism but I am not sure that the following is necessarily correct. The author says:

    “This isn’t, as far as I have seen anyone bother to demonstrate, a problem of economic “externalities”. The externalities in this case have been internalized right down Enbridge’s throat, with appropriate effectiveness.”

    This is only true if the only cost of the spill is the cleanup and there are no longer-term environmental damage. Has this been established in this case?

    • I believe Enbridge’s insurance is covering the $800 million + cost. But, they (industry) will eventually pay for this through higher insurance rates. Enbridge probably eats the $4-$5 million fine (or whaatever it is).

      I’d read the fine print on the policy though to see if the insurance company could limit liability somehow through Enbridge’s actions/inaction. I have no reason to believe this to be the case, here though.

      • $3.7 million fine. Historic, but really just a slap on the wrist to a company like Enbridge. Worth also noting that the US federal government has paid tens of millions towards the cleanup to date.

  5. Colby, no mention that Enbridge ignored hundreds of abnormalities along Line 6B, including the one that eventually burst, for years? Or Enbridge’s distinct lack of transparency about what was in Line 6B to aid the cleanup (folks were skimming the surface, assuming that they were dealing with conventional light oil; not DilBit which sinks when it comes out of the pipeline environment)? This goes way deeper than monitoring systems that do not do what the pipeline company advertises to the public and the ill-prepared control-room folks who made the problem worse. It is a cautionary tale about the dangers that we still have not addressed in pushing ever-greater quantities of DilBit through systems not prepared to handle the raw stuff—just look at Line 6B which Enbridge is trying to double capacity on even before all the info is in from this disaster. This is all about cash flow, not oil flow.

  6. Time to buy shares in the railways!!!

    • Did you just land on Go and collect $200?

  7. An interesting post. I’ve always wondered about some of the details of pipelines.

    “Taking the alarms seriously won’t help if they are as nonspecific as ever”

    I agree with that statement. There must be a better way.

    • I haven’t checked (sounds like something Colby may now be into).

      Wanna bet that the TCPL line reversal proposal between Sarnia/Mtl (Line 9?) has a very sophisticated Material Balance/state-of-the-art control system planned (if not already in place when flowing as currently configured)?

  8. Isn’t technology amazing the NTSB may have used a keyword resume search program to hire their chairperson. It is kind of baffling to think a person with out any physical sciences training would be appointed to the job. Just as baffling is the person they did hire is supposed to have formal training in Conflict and Resolution Analysis would publicly ridicule people’s work ethic towards a job that they have never done themselves let alone being inside a pipeline network control room, derogatory remarks is one sure fire way to avoid conflict, eh?

    Chairman Hersman received B.A. degrees in Political Science and International Studies from Virginia Tech, and an M.S. in Conflict Analysis and Resolution from George Mason University. She holds a commercial driver’s license (with passenger, school bus, and air brake endorsements) as well as a motorcycle endorsement.

    When a person takes their drivers license test, part of the practical section is the driver is supposed to “circle check” the outside of their vehicle for a visual inspection including tire pressure, everybody does it to get their license and afterwards you are supposed to check each and every time before you start your engine. Is this what she meant by “culture of deviance”, does she circle check her vehicle each and every time, do you? Probably not usually people rely on perfect strangers to tell them their vehicle’s tire is leaking, or their back tail lights aren’t working, and if your car is really dangerous and noticeable the police will pull you off the road.

    Unfortunately for the Enbridge workers over 3,000 kms away from the incident in the land of ambulance chasers none of the EMS first responders on Site bothered to call Enbridge for 14 hours after the initial reports of a smell were reported 3 hours earlier. Maybe the first Americans that spotted the oil thought they would become 21st Century Beverly Hillbillies even though the pipe crossing was clearly marked as being pipeline crossing belonging to Enbridge. Albeit Enbridge has already taken the brunt of blame for the spill, as a Canadian I am disappointed the Americans took over 14 hours to contact the pipelines operators 3,000 km away especially with today’s fabulous telecommunications systems. Even more unfortunate is the NSTB chairperson grandstanding use of derogatory remarks while downplaying the fact that the filling of the line could of and should of being stopped 3 hours after being discovered instead of the infamous 17 hours.

    Fair enough the NSTB has no power to enforce any of their investigative safety upgrade recommendations which Enbridge is already doing including public awareness campaigns, the NTSB seem to have ignored the fact that U.S. public education system is failing to educate their citizens in the most basic of the physical sciences. Furthermore it appears the U.S. Government is failing to meet their responsibilities in public awareness of pipeline systems, one only has to look at the success of their forestry service’s Smokey the Bear campaign to realize how effective a similar campaign for pipelines could be. But then on the other hand what would all the ambulance chasers do for a living?

  9. I worked in Enbridge until about 2 years ago. There is no such thing as a true “leak detection system”, because it would involve literally covering the entire line in sensors. What all pipeline companies do have is a system that detects a number of sensory inputs – pressures, temperatures, densities, etc. – that when there’s enough change in all of them, there may be a leak. Keep in mind these points change dramatically all the time as different commodities flow down the lines.

    Because every procedure, process and system is custom made, the
    decision to upgrade the MBS system (or another major internal system
    like scheduling), would literally take: 2 years of proposals to to get enough exec
    buy-in and budget; 2 years to come to a final high level design and pick
    vendor(s) to implement the components, then another 3 to actually
    implement. I wish I was exaggerating. This is what happened on their “Getting to B” project when I was there.

    Enbridge’s biggest problem correcting anything is actually the corporate culture Colby refers to. If you work at Enbridge, odds are you’ve been there your entire 25 year career or you’re a relative newbie. I was actually told in a meeting that “until you’ve been here for 10 years, you don’t have an opinion.” Opinions of what other midstream companies are doing are dismissed, because Enbridge runs the largest, most complex pipeline system in the world so *obviously* nobody can teach them anything. The dinosaurs run the place. Innovation is dismissed out of hand. Pat Daniel can’t retire fast enough but Al Monaco won’t much different – he won’t change out execs that need to go like Steve Wouri and Sonya Buys.

    I was very happy to get an opportunity elsewhere, quitting felt great.

  10. Thanks. I’d sometimes wondered how pipeline leaks are detected. I’d assumed that by now they must have some fabulously sophisticated method. Oh well …

Your email address will not be published. Required fields are marked *