Pipeline Investigation Report P94H0018

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

A release of ethane and a fire occurred at Mile Post (MP) 445 of the Regina Diversion Terminal (Diversion Terminal) on the Cochin Pipe Lines Ltd. (Cochin) system, near Regina, Saskatchewan, at approximately 0156 central standard time (CST) on 10 May 1994. The fire destroyed communication links between the Diversion Terminal and the control centre in Fort Saskatchewan, Alberta. At approximately 0250 CST, the operator at the control centre was notified by telephone of a fire on the system, and the line was shut down. The fire was allowed to self-extinguish. There were no injuries.

The Board determined that a lack of preventative maintenance on a densitometer pump resulted in bearing wear and damage to the containment shell which then ruptured.

1.0 Factual information

1.1 The accident

On 10 May 1994, at approximately 0156 CST, alarm messages began appearing on the Supervisory Control and Data Acquisition (SCADA) console for the Cochin Pipe Lines Ltd. (Cochin) system at the control centre of Amoco Canada Petroleum Company Ltd. (Amoco) located in Fort Saskatchewan, Alberta. The Cochin system is part of the "Natural Gas Liquids and Crude" business unit of Amoco and was transporting ethane at the time. The messages indicated that a problem existed at Mile Post (MP) 445 of the Regina Diversion Terminal (Diversion Terminal). Just before the first alarm message at 0156 CST, the pressure, temperature and density on the mainline at the Diversion Terminal were normal. The pressure and temperature on the propane and ethane pipeline laterals at the Diversion Terminal were also normal.

At approximately 0157 CST, an employee with Transport Canada's Flight Services Division at the Regina Airport noticed a fireball to the southwest of the airport. At the same time, all telephone communications were lost between the Amoco control centre and the Diversion Terminal.

At approximately 0205 CST, the Control Centre Operator (CCO) for the Cochin system acknowledged the alarms but did not take further action since he had attributed the alarms to a problem with the programmable logic controller (PLC) at the Diversion Terminal.

At approximately 0207 CST, the Transport Canada employee contacted a central emergency group for the Regina area who then contacted the local fire departments. The fire departments secured the access roads and alerted the control centres of both Petroleum Transmission Company (PTC) and TransCanada PipeLines Limited (TCPL) since both companies had facilities in the area.

At approximately 0235 CST, PTC's control centre at Empress, Alberta, requested the operator at its Richardson Terminal to check the system for pressure loss. Although no problems were noticed, the PTC line was shut down at 0236 CST as a precautionary measure.

At approximately 0240 CST, an employee at Procor's Regina storage site, located approximately eight kilometres (km) to the north of the Diversion Terminal, observed the fire and notified PTC's Richardson Terminal of the problem. At 0250 CST, the Richardson Terminal operator contacted Amoco's CCO in Fort Saskatchewan to notify him of the fire in the vicinity of the Diversion Terminal.

At 0250 CST, Amoco's CCO checked the alarm status on the leak detection system and found that the system had identified and declared a leak at 0225 CST at the Diversion Terminal.

At 0300 CST, the Amoco CCO sent an Amoco pipeline technician to the site to investigate. From the control centre in Fort Saskatchewan, the CCO shut down the upstream pump station at Findlater, Saskatchewan, MP 407, at 0304 CST, and continued to operate the downstream pump station at Estlin, Saskatchewan, MP 468, to reduce the pressure at the leak site. The station shut down on low suction at approximately 0344 CST.

At approximately 0316 CST, the Amoco pipeline technician arrived at the Diversion Terminal. At this time, the road past the Diversion Terminal had been blocked by the Royal Canadian Mounted Police (RCMP) at the south end where it joins the TransCanada Highway and at the north end. At 0320 CST, the Amoco technician requested assistance from other Amoco employees to close block valves.

At 0348 CST, an Amoco employee manually closed the block valve at MP 454. This block valve was immediately downstream of the Diversion Terminal. Another Amoco employee manually closed the block valve at MP 439 at 0350 CST. This block valve was immediately upstream of the Diversion Terminal. These valves were not remotely operated. The site was effectively isolated with the closure of these valves.

At approximately 0354 CST, the pressure in the propane pipeline lateral dropped to 0 kilopascal (kPa) (0 pound per square inch (psi)). The ethane pipeline lateral was being flared by an Amoco employee at the Procor storage site to reduce the pressure in that line.

At approximately 0538 CST, a section of the mainline at the Diversion Terminal ruptured, allowing a larger volume of ethane to fuel the existing ethane fire. At this point, the section of line between the block valves at MP 439 and MP 454 had been blocked off from the mainline for several hours.

The fire at the mainline rupture self-extinguished at approximately 1130 CST on 10 May 1994. A small fire continued to burn at the block valve on the propane lateral due to hydrocarbon vapours remaining in that line. At approximately 1710 CST, 11 May 1994, following a nitrogen purge of the lateral, the fire at the block valve on the propane lateral self- extinguished.

The mainline section was repaired and put back into service by 1830 CST on 14 May 1994.

The ethane pipeline lateral was blind flanged and permanently disconnected from the mainline. The propane lateral was put into manual service on 15 July 1994. Remote operation of this lateral is not yet possible.

1.2 Injuries

There were no injuries as a result of this occurrence.

1.3 Damage to equipment and product lost

The eight-inch Borsig ball valves on the propane pipeline lateral, the ethane pipeline lateral and the propane bypass loop were destroyed. The three-metre (m) (10-foot) section of mainline between the propane and ethane pipeline laterals sustained a 74-centimetre-long (cm) (29-inch) rupture. The control building and its contents, consisting of the PLC (hardware for data acquisition), the uninterrupted power supply, and the master control cubicle, were destroyed.

Approximately 2,596 cubic metres (m3) (16,433 barrels (bbl.)) of ethane was lost from the mainline, 453 m3 (2,854 bbl.) of propane from the propane pipeline lateral, and 467 m3 (2,955 bbl.) of ethane from the ethane pipeline lateral.

Approximately four hectares (10 acres) of field were burned on the west side of the north/south road past the Diversion Terminal and 16 hectares (40 acres) were burned on the east side of that road.

1.4 Commodity pipeline operations

1.4.1 General

The Cochin system consists of a 3,100-km (1,938-mile) 323.9-millimetre (mm) (12-inch) multi- product liquid pipeline operating between Fort Saskatchewan and Sarnia, Ontario. The pipeline transports ethane, propane, and ethylene in batch mode.

The pipeline has 31 pump stations, five U.S. propane terminals, access to underground storage at two Canadian locations, connections to several U.S. pipeline systems, and several injection and delivery locations. The entire pipeline system is monitored and controlled from a central control centre located in Fort Saskatchewan.

1.4.2 The diversion terminal

1.4.2.1 General

The Diversion Terminal at MP 445 is an injection and delivery location on the Cochin pipeline. It is unmanned and is remotely operated through the Amoco control centre in Fort Saskatchewan. The Diversion Terminal permits batches of ethane or propane to be received from or delivered to storage caverns at Procor's Regina storage site located approximately 8 km north of the Cochin mainline. The Cochin mainline at the Diversion Terminal and the storage caverns are connected by two parallel pipeline laterals: one for the transportation of ethane, the other for propane.

Temperatures and pressures of the mainline and the pipeline laterals are transmitted to Fort Saskatchewan for monitoring and control. Product densities are also transmitted to the control centre.

The pipeline facilities at the Diversion Terminal consist of above-ground piping, a densitometer system, two mainline block valves, a block valve on each pipeline lateral, and a block valve on the propane bypass loop.

At the time of the occurrence, ethane was flowing in the mainline at approximately 610 m3 per hour (3,861 bbl. per hour) at a pressure of 8,140 kPa (1,181 psi). Since the Diversion Terminal was not receiving or delivering product, the block valves to both pipeline laterals were closed.

The ethane pipeline lateral had not been operating for approximately three years. The pressure in the lateral was 2,821 kPa (409 psi). The latest shipment on the propane pipeline lateral had been on 28 April 1994. The pressure in the propane pipeline lateral was 3,067 kPa (445 psi).

The two pipeline laterals each had an outside diameter of 273.1 mm (10 inches) and a wall thickness of 7.6 mm (0.298 inch). Both were manufactured to meet the requirements of the Canadian Standards Association (CSA) Standard CAN/CSA Z245.1 in effect at that time and were pipe grade 52, category III. The pipeline laterals were constructed in 1980. The pipe coating consisted of paint for the above-ground piping and polyethylene tape for the below- ground piping.

The mainline at this location had been constructed in 1977 and had last been hydrostatically tested at that time. The pipe had an outside diameter of 323.9 mm (12 inches) and a wall thickness of 12.7 mm (0.500 inch). The pipe was manufactured to meet the requirements of CSA Standard CAN/CSA Z245.1 in effect at that time and was pipe grade 52, category III. The pipe had been manufactured using electric resistance welding (ERW) for the longitudinal seam.

Each time the Diversion Terminal is visited by an Amoco employee, a safety check list is completed. This safety check covers such items as condition of the perimeter fence, station signage, wind sock and valves. The last safety check had occurred on 09 May 1994. No unusual conditions were noted at that time.

1.4.2.2 The densitometer pump

The densitometer pump was a close-coupled magnetic drive type pump manufactured by Kontro (model HCOL/HSP Kontro SEAL/LESS) and rated at a maximum pressure of 10.3 megapascals (MPa) (1,500 psi). Its power rating was 3/4 horsepower and it could pump a maximum of 33.3 litres per minute (8.8 gallons per minute) with a constant head of 3 m (9.8 feet). The pump ensured that an adequate flow of product passed through the densitometer.

The pump had been in continuous operation since its installation in 1979 and had not been inspected for wear during this period. The manufacturer's maintenance instructions recommended that the pump be checked for bearing wear after 800 to 1,200 hours of operation. Amoco did not have a preventative maintenance program for this pump.

1.5 Laboratory analysis

The densitometer pump and several other components from the Diversion Terminal were sent to the Amoco Research Centre in Naperville, Illinois, U.S., for analysis. A TSB Engineering Laboratory representative was consulted during the analysis (Engineering Report LP 77/94).

1.5.1 The densitometer pump

The densitometer pump was disassembled and each component inspected. The pump shaft was severely worn in two areas corresponding to the two bearing contact points at the torque ring end of the shaft and at the impeller end of the shaft. The wear at each location was only on one side of the shaft. The wear at the torque ring end of the shaft was 180 degrees to that at the impeller end. Approximately 0.38 mm of metal was worn from the shaft surface which contacted the bearing nearest the torque ring. This wear was on the side of the torque ring which contacted the containment shell. Approximately 0.30 mm of metal was worn from the shaft surface which contacted the bearing near the impeller.

An analysis of the shaft showed that it was made of Type 316 stainless steel. There was no evidence of surface hardening that would have improved wear resistance.

The wear on the bearings was uniform around their diameter. Measurements of the inside diameter of the bearings indicated that a minimum of 1.59 mm of metal had worn from the bearing closest to the torque ring and a minimum of 0.86 mm of metal had worn from the bearing closest to the impeller. The manufacturer's dimensional tolerance specifications between the containment shell and the torque ring were 1.48 mm to 1.58 mm.

The bearings were made from a graphite composite which had solid lubricants built into the matrix. The product flowing through the pump cooled the bearings and flushed away debris.

The inside diameter of the containment shell was worn and the surface was rippled by wear damage. Measurements of the wall of the containment shell indicated that approximately two-thirds of the wall had been worn away before the shell ruptured in a ductile mode.

1.5.2 Mainline

The section of mainline between the mainline block valves sustained a 74-cm fishmouth rupture in the pipe wall, approximately 10 cm from the ERW seam weld. The rupture was consistent with a ductile overload failure. Voids which were present in the steel near the fracture typically form when ductile fracture occurs at high temperatures. Mechanical tests and chemical analyses indicated that the pipe met the requirements of CSA Z245.1, Grade 386 (API 5L, grade X56).

1.5.3 Propane lateral block valve

The flanges attached to the valve were not an integral part of the valve body, but components that were welded on during valve construction. No defects were noted in the welds joining these flanges to the valve body. The grooves on the gasket seating surface were in good condition on the flanges on the valve and on the mating flanges on the propane lateral. All seating surfaces were essentially flat. There was no damage to indicate a gasket failure.

1.5.4 Finite element stress analysis

A finite element stress analysis of the piping near the propane lateral block valve was conducted to determine whether ground movement contributed to the failure. The study was conducted using relative movement of ground supports of 0 mm, 25.4 mm, 50.8 mm and 76.2 mm and an internal pressure of 2,970 kPa. The study indicated that the load to cause leakage at the flanged joint would have greatly exceeded the load required to yield the adjacent piping.

1.5.5 Insulating gaskets

Since the insulating gaskets at the Diversion Terminal were destroyed in the fire, an insulating gasket which had experienced the same length of service and been exposed to the same environment was examined. This gasket was taken from the propane pipeline lateral at a location approximately 8 km from the Diversion Terminal. An unused insulating gasket from stock was also examined for comparison purposes. Following a visual examination of the in- service gasket, neither damage nor significant deterioration was detected when compared to the unused gasket. Mechanical and physical testing of the in-service gasket indicated that its properties had not deteriorated after 13 years of service.

1.6 Weather

At 0100 CST, on 10 May 1994, the ambient temperature was 12.8 degrees Celsius with an overcast sky. Between 0100 CST and 0700 CST, the winds were generally out of the southeast and varied between approximately 50 km/h and 60 km/h (30 mph to 36 mph). At 0700 CST, the winds decreased slightly in speed and began to change direction to out of the northwest. From 0900 CST until the time when the fire self-extinguished at approximately 1130 CST, the winds were out of the northwest and the speeds were increasing from approximately 44 km/h to 60 km/h (26 mph to 36 mph).

1.7 Pipeline monitoring and system control

1.7.1 The supervisory control and data acquisition system

In 1993, Amoco upgraded the SCADA system and leak detection software for the Cochin system. Amoco has installed remote workstations at various points on the Cochin pipeline system such as pump stations, delivery points and pipeline interchange points. These workstations interface directly with various field devices which measure pipeline pressure, temperature, flow and density. The remote workstations continuously collect field data which are then sent over the network to the master server computer located in Fort Saskatchewan. Analog signals are transmitted every 30 seconds or when they fall outside the limits of a pre-determined range of values ("report by exception"); discrete signals are transmitted when a change of status has occurred. Data from Canadian sites are transmitted by telephone lines and data from American sites are transmitted by satellite.

Within the control centre, the CCO has the use of two SCADA workstations, each with two consoles, to monitor and control pipeline operations. The SCADA data can be displayed in many different window formats to facilitate monitoring and control. Of the two SCADA consoles at each workstation, one displays an overview of the pipeline system and the other displays specific information selected by the CCO for monitoring or control purposes.

Alarms indicating changes to the operating condition of the pipeline are generated by the SCADA system. These alarms are assigned priority levels based on the source of the problem. Each SCADA window, other than the system overview window, has a permanent section titled "Newest Priority Alarms" which displays the five most recent highest priority unacknowledged alarms. These alarms are displayed according to their priority level and then in chronological order within that level. Alarms are colour-coded to indicate their level of severity.

When the SCADA system detects a condition that falls into the alarm category, it generates an alarm that provides the CCO with both an audible and a visual message. However, the control centre supervisor indicated that, up to and including 10 May 1994, the audible alarm function had been disabled due to the large number of changes in operating conditions that would have caused an audible alarm to be generated, but that would not have represented a serious situation.

Another feature of the new SCADA system is the overview window titled "Event Summary" in which all events occurring on the Cochin system, including alarm situations, are displayed. An event is any condition that happens on the pipeline system including conditions that would fall into the alarms category and conditions that are part of normal pipeline operations, such as a pump unit being brought on-line or a valve being opened. Events are not colour-coded. This section scrolls forward as new events occur.

Although an alarm may be acknowledged by the CCO, acknowledgement in and of itself does not mean that the problem has been corrected. Once an alarm has been acknowledged, messages will no longer appear in the "Newest Priority Alarms" window. If the situation producing the alarm has not been corrected, messages continue to appear in the event section of the system overview screen. The CCO can call up a system alarms summary window or an event summary window at any time to display all alarms in the system or all system events, respectively.

1.7.2 The pipeline model application system

The Pipeline Model Application System (PMAS) comprises three modules for leak detection and batch tracking: the Real Time Transient Model (RTTM), the Estimated Time of Arrival (ETA), and the Predictive Model (PM). The PMAS runs a mathematical simulation of the pipeline using data transferred to it on a regular basis from the SCADA system. Each module provides the CCO with different types of information for monitoring the operation of the Cochin pipeline system. The information from the modules is displayed in a window format on a console at the PMAS workstation. The PMAS workstation is adjacent to the SCADA workstation.

The PMAS leak detection module, the RTTM, is based on real time simulation of fluid flow in the pipeline. It uses data from the SCADA system to compute pressure, temperature and flow rate profiles along the pipeline. The RTTM declares a leak when certain calculations exceed a pre-determined threshold value. When the RTTM has declared a leak, the line section containing the leak appears in red on the "Linefill Display" window. Various other display windows are available through the PMAS to assess the situation.

One such window is the Volume Balance Section (VBS) trend display, one of the most valuable tools for monitoring pipe leak detection. The VBS trend graphically displays the flow balance and the packing rate in the pipeline system. The flow balance is the net flow into and out of a pipeline section as measured by the flow meters. The packing rate is the rate of change of the product in a pipeline section, as calculated by the model. The flow balance and packing rate measure the same quantity. However, flow balance is based on measured flows while the packing rate is calculated by the PMAS based on pressure, temperature and product density provided by the SCADA system. During normal operations, the flow balance and packing rate should parallel each other. When a leak occurs, the packing rate would begin to drop and the flow balance would begin to rise, resulting in a positive volume balance. Because of the graphical nature of this display, a positive trend in volume balance would be immediately evident.

Crucial PMAS alarms, such as leak alarms, are routed to the SCADA system and are therefore displayed on both the PMAS and SCADA consoles. A leak alarm has the highest priority rating.

The PMAS console has a permanent alarm window which can display up to three unacknowledged alarms. These alarms are displayed in time order, with the most recent alarm at the top. This window scrolls forward as subsequent alarm messages are received. Although only three alarms are displayed at a time, earlier messages can be reviewed by scrolling on this window. However, on 10 May 1994, this window was not scrolling forward as designed.

1.7.3 Commissioning

The new SCADA system was put into full operation by December 1993.

Between April and December 1993, the PMAS was operated simultaneously with the old leak detection system so that the new system could be fine-tuned and the CCOs could become familiar with the system. During January 1994, the PMAS was used as the primary batch tracking and leak detection system and the old leak detection system was used for comparison and backup. From February to mid-March 1994, although the old system was available for backup purposes, it was not required.

1.8 Training

Training for the CCOs on the new SCADA system and the PMAS took place in December 1993. The formal classroom training was eight hours in length. Following the formal training course, each operator received approximately eight to ten hours of individual training over a period of several evening shifts. This training consisted of interpretation of model information including trends and other graphics material related to leak detection.

The Operator's Manual for the PMAS is a quick reference on how to start, stop and monitor the modules. It is kept at the PMAS workstation. There is a separate User Manual for each module which documents the entire user-module interface in detail.

2.0 Analysis

2.1 Introduction

The laboratory analyses of the mainline rupture, the lateral block valve flanges and gaskets, and ground movement forces eliminated these areas of concern as potential sources of the initial ethane release. Combining the SCADA sequence of events with the metallurgical results of the densitometer pump examination pointed to the rupture in the containment shell as the ethane source.

The loss of internal operating pressure due to the product release caused a leak message and alarm to be generated at the control centre in Fort Saskatchewan. However, when the alarm was first generated, the CCO did not act upon it. As a result, there was a delay of approximately one hour in initiating the emergency response and in isolating the Diversion Terminal from the mainline.

The analysis will focus on the breakdown of the densitometer pump and its maintenance history and discuss the SCADA system and the reaction of the CCO to the messages he was receiving.

2.2 Consideration of the facts

2.2.1 Laboratory analysis

2.2.1.1 The densitometer pump

The geometry of the damage on the shaft and the torque ring indicated that the assembly was out of balance. This situation caused the shaft to press against the bearing preferentially on one side, resulting in higher-than-normal contact stresses and subsequent wear on the shaft surfaces and associated components.

Although the shaft was not hardened, the design of the pump was such that there should not have been direct contact between the shaft and the bearings.

Since the tolerance specification between the containment shell and the torque ring was only 1.48 mm to 1.58 mm, the wear on the bearing nearest the torque ring allowed the ring to contact the containment shell. This was evident from the wear on both the containment shell and the torque ring.

The wear on the containment shell indicates that this situation continued until the shell could no longer contain internal pressure.

Once the containment shell ruptured, the end of the pump with the drive motor was blown off and ethane was released to the atmosphere. When the motor was blown away from the pump, the electrical wires would have been torn from the motor and probably shorted, providing the ignition source.

Although excessive wear of the containment shell would probably have caused a drop in the output flow and pressure head of the pump, these parameters were not monitored.

2.2.1.2 Other components

The results of the examinations of the other components at the Diversion Terminal indicate that the damage was a result of these components being exposed to the fire.

2.2.2 Maintenance

The manufacturer's instruction manual for the densitometer pump recommended that a maintenance schedule be established based on the wear rate of the bearings. The manufacturer suggested that bearing wear be checked after 800 to 1,200 hours of operation and provided a procedure for estimating the "end of bearing life" based on this wear. In one year of operation, the pump at the Diversion Terminal would have exceeded the recommended check period by at least five times. The pump had never been examined for wear during its 15 years of operation.

Signs of bearing wear would only have been evident if the pump had been disassembled for inspection or maintenance purposes. Since neither had occurred during the 15 years that the pump was in operation, the wear continued until the equipment eventually failed. The inspection completed monthly at the Diversion Terminal would not have included disassembling components.

2.2.3 Pipeline monitoring and control

The alarm messages which began appearing at 0156 CST indicated a problem at the Diversion Terminal. Combining operating experience with upstream pipeline conditions, the CCO decided that a problem existed with the PLC at the Diversion Terminal. The CCO therefore acknowledged the alarms but, according to Amoco's procedure for PLC problems, did not immediately send anyone to investigate. The procedure for a PLC problem calls for an immediate on-site investigation if an injection or delivery is taking place or about to take place.

During the next half hour, messages and alarms for the entire Cochin system were constantly being scrolled at the SCADA workstation and assessed by the CCO. When the first leak message for the Diversion Terminal was displayed, it appeared at the same time as several other system alarms.

The CCO had previously interpreted the alarm messages at the Diversion Terminal as indicative of a hardware or PLC problem. Since a leak detection system can generate false leak alarms due to bad instrumentation data, communications problems, or SCADA system problems, the CCO may have registered the leak message as a further indication of a hardware problem.

Two system defences which could have alerted the CCO to the seriousness of the problem were not functioning:

1. the "Unacknowledged Alarms" window at the PMAS console was not scrolling messages forward as designed; and
2. the audible alarm function of the SCADA system had been inhibited as part of a management decision to avoid the irritation of the many alarms that could have generated an audible message.

Once the leak alarm was acknowledged, a leak message continued to scroll on the events window at the SCADA workstation in chronological order with all other messages on the system. However, there was nothing in terms of visual impact to differentiate that message from the other system messages.

In addition, the "Linefill Display" window which would have further indicated the leak location may not have been displayed on the PMAS console at that time.

Until the 0250 CST report of a fire in the vicinity of the Diversion Terminal, the CCO did not appear to register any information which would have made him reevaluate his original assessment of a PLC problem at the Diversion Terminal. At that point, the CCO checked the RTTM, found that the information verified a leak situation, and responded to the situation in accordance with Amoco's emergency procedures.

2.2.4 Pipeline operator's manual

The Cochin Pipeline Operator's Manual contains some general steps to follow to determine whether a false alarm has been declared. Checking the appropriate VBS trend display to determine whether the flow balance and packing rate trends are tracking together is recommended in the manual. When a leak occurs, the packing rate usually begins dropping and the flow balance begins rising due to the loss of pressure on the system. Although the CCO had been trained to check the VBS trend display to confirm a leak, that screen was not checked until 30 minutes after the system had declared a leak.

The manual also recommends checking the reasonableness of flow, and the temperature of pressure sensor values around the declared leak location at the time the leak is declared. However, none of the values could be checked because the fire had destroyed all communications at the declared leak location at the Diversion Terminal.

3.0 Findings

3.1 Findings

1. The densitometer pump failed when its containment shell had worn to the extent that it could no longer contain the internal pressure and it ruptured. The end of the pump and the drive motor were blown off, ethane was released to the atmosphere and ignited.
2. The bearings and shaft in the densitometer pump had worn to the extent that the torque ring contacted and began to wear the containment shell.
3. Wear on the containment shell continued until the containment shell could no longer contain internal pressure and ruptured.
4. There is no evidence to indicate that any maintenance had been done on the densitometer pump during its 15 years of operation.
5. Alarm messages indicating a problem at the Diversion Terminal appeared on the Control Centre Operator (CCO) console in Fort Saskatchewan were interpreted as a programmable logic controller (PLC) problem and were acknowledged but not acted upon.
6. Leak alarms appeared on the CCO console in Fort Saskatchewan and were acknowledged but not acted upon for an unknown reason until verbal notification of a fire was received.
7. The CCO previously interpreted the alarm messages as indicative of a PLC problem, and may have interpreted the new messages as a further indication of such a problem.
8. Two features of the Supervisory Control and Data Acquisition (SCADA) system which could have alerted the CCO to the seriousness of the problem were not functioning: the alarm window of the Pipeline Model Application System (PMAS) console was not scrolling forward as new alarms were generated, and the audible alarm function of the SCADA system had been inhibited.

3.2 Cause

A lack of preventative maintenance on a densitometer pump resulted in bearing wear and damage to the containment shell which then ruptured.

4.0 Safety action

4.1 Action taken

4.1.1 Densitometer pump

Since two similar densitometer pumps were in use on the Canadian portion of the Cochin Pipe Lines Ltd. system, on 07 July 1994, Amoco Canada Petroleum Company Ltd. (Amoco) removed both these pumps from service for inspection and repair or replacement.

Amoco is also assessing the densitometer system to identify the need for modifications.

4.1.2 Control centre operations

4.1.2.1 Alarms

In order to ensure that the audible alarm remains enabled, the number of alarms that will provide an audible warning in the control centre has been reduced to include only those that deal with the most severe cases.

An audible alarm has been added to all leak alarms generated on the Pipeline Model Application System (PMAS). This alarm is separate from the alarm generated on the Supervisory Control and Data Acquisition (SCADA) system.

4.1.2.2 The Pipeline Model Application System (PMAS)

Amoco has modified the design of the PMAS workstation software so that the most recent alarms on the "Unacknowledged Active Alarm" window will scroll.

A second workstation/monitor has been added to allow the CCO to view detailed PMAS screens on one monitor while leaving the second monitor for overview screens.

A new Volume Balance Section (VBS) overview screen has been added. It displays the information in a different format and provides the CCO with direct geographical feedback to events on the pipeline system.

4.1.2.3 Screen update speed

The geographical screen update speed has been improved so that updates are more responsive.

Amoco is continuing its work on improving the update time for tabular screens.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson, John W. Stants, and members Zita Brunet and Hugh MacNeil, authorized the release of this report on 19 May 1995.