Mayflower Pegasus Pipeline Spill -- Faulty Sensor Hypothesis

[Update 10/17/2016 -- NOTE WELL this essay will outline a theory that the Mayflower AR Tar Sands Pipeline (Dilbit) spill may have been caused by an improperly closed block valve. --- BH]

On Friday, March 29, 2013, at 2:44 p.m, Jennifer Dement of 50 Starlite Road North, Mayflower Arkansas called 911 to report what she described as an "oil spill" at her home.

This turned out to be a rupture of the Exxon-Mobil Pegasus pipeline, which was in fact transporting a synthetic product called "Dilbit" (diluted bitumen).

Related: TAR SANDS LEXICON

Spills of diluted bitumen are extraordinary difficult to clean up, since the components separate. The lighter NGLs float when they hit water, the heavier ones, sink.

I've been thinking about a couple of mysteries surrounding this spill. 
For example, no one really knows exactly WHY it spilled when and where it did.
There is also a curious problem with the timeline. 

I want to advance my Faulty-Sensor Hypothesis to explain two mysteries about this pipeline failure: 1) why it failed when and where it did, and 2) how Exxon-Mobil could have claimed to have detected the problem 90 min. before the first 911 call.

The gist of the theory is that 3 things contributed to the failure. 

1) Latent defective LF-ERW weld. 
2) a faulty pressure sensor, and 
3) Pipeline operators following Standard Operating Procedure and closing a block valve on a pressurized pipeline.

This is a clear example how INHERENTLY DANGEROUS these pipelines are. As my friend, researcher Vera Scroggins has pointed out to me: there have been numerous pipeline failures, almost one or two major failures every week! And if we rule out failures due to external damage by digging accident, like a backhoe strike, then all of them were caused by either mechanical failure, or operator error.  Many or most have been caused by skilled operators with specialized knowledge, diagrams, etc. 
 
A lot of attention has been given to the theory promoted by Exxon-Mobil that the SOLE CAUSE of the rupture was the latent defects in the LF-ERW pipe. The problems with this kind of pipe has been known to PHMSA since 1988.

See: http://opsweb.phmsa.dot.gov/pipelineforum/reports-and-research/seam-weld/

However, little attention has been given to any theories to explain WHY this section of pipe failed when and where it did.

Many reasons why pipelines fail:

See: http://primis.phmsa.dot.gov/comm/reports/safet/AllPSIDet_1993_2012_US.html?nocache=2752
Also: http://insideclimatenews.org/news/20130909/dilbit-exxons-pegasus-may-have-contributed-pipelines-rupture

Latent defects in pipeline materials or welds can be stressed and exacerbated by any of the following conditions:

• Pressure Cycling (starting and stopping the pipeline under normal operation)
• External forces (such as a strike by construction equipment, or seismic activity -- Pegasus failed about 25 miles from an earthquake swarm)
• Internal vibrations and resonances (cf. "Kohlhase Effect")
• Hydrostatic Stress Testing for safety compliance  
• Reversal of Flow (as was done on Pegasus)
• Changes in Pipeline Elevation
• Changes in Viscosity and/or Gravity (density) of Transported Product

 Pipelines also commonly fail due to corrosion:

• Corrosion due to coating failure
• Corrosion due to stray DC
• Corrosion due to damp conditions,
  or exposure to corrosives, e.g. salt
• Steel pipes contain stored electro-chemical energy.
  Pipelines WANT to corrode!

And similarly, there is stored mechanical energy in a rolled coiled steel pipe.

• The stored mechanical energy in a pipe makes it WANT to explosively unwind and go *spoing!* like a piano string or spring which breaks under tension. We can see this in photos of many pipeline accidents:
  
  

  

  Sissonville, WV. A failed section of the pipe has actually uncoiled itself, and is now flat.

Timeline: WTF?

Another troubling thing is the timeline of events. Inside Climate News has done some excellent reporting on the fact that there are several different timelines of events on the day of the failure, which have been advanced by the operator Exxon-Mobil:

• http://insideclimatenews.org/news/20130411/exxon-didnt-know-its-pipeline-ruptured-until-called-arkansas-authorities-or-did-it?page=show  
   
• http://insideclimatenews.org/news/20130429/one-month-after-exxon%E2%80%99s-arkansas-oil-spill-still-no-answers-basic-questions?page=show

According to one scenario (in this ICN article) Exxon Mobil detected the drop in pressure at 1:15, and had shut the pipeline down by 1:30pm. The only problem with this is that the first call to 911 didn't come until 2:44pm, 1 hour and 15 mins later. How can Exxon have corrected the problem 75 min. before the pipeline was observed leaking?

As it turns out, there is a simple explanation which explains both questions. 

How Pipeline Failures are detected

Pipelines are isolated by block valves. In the case of the Pegasus pipeline, these valves are typically located ~18 miles apart.

Leaks are detected as a pressure drop in the pipeline. When this happens, then pipeline is shut down, pump stations are shut down, and block valves on either side of the detected leak are closed to isolate the section of pipe with the failure, to minimize the amount of product which escapes.

Now keep in mind that pipelines are maintained by a SCADA control system which monitors, and tries to maintain the pipeline at a constant pressure. This is similar to your home heating or cooling system, which automatically tries to maintain a constant temperature.

Under normal operating conditions, small drops in pressure may be compensated by an increase in pressure at the pump stations. This is how control systems work.

HOWEVER, in the event of a detected leak, then the normal control system must be disabled or bypassed, and the pipeline is shut down.

The determination of when to shut down a pipeline is probably a combination of automation, and also human judgment, since the pipeline operator wants to maintain profits by moving product. A false alarm could cost them lots of money. 

I believe that due to the complexity of judging the circumstances of each situation, and the possible grave and costly consequences if there is a failure,  means that mostly this decision is still done by human operators, and not computers.

But many scenarios have been worked out ahead of time, and are documented as decision-tree flowcharts in Standard Operating Procedures which operators must follow.


Exxon Mobil Pegasus Pipeline near Mayflower

These are three block valves in the vicinity of the spill.

1. At the crossing of AR-10 on the western edge of Lake Maumelle: 34.880715,-92.671152 Elevation 310'
2. Near the railroad tracks and Ross Hollow Rd at the western side of the Arkansas River crossing: 34.926013, -92.484686 (about 13 miles from #1) Elevation 280'
3. East Conway Pump Station: 35.12427,-92.281412 (25 miles from #2) Elevation 400'
4. Another just west of Romance: 35.226971,-92.086353 (14 miles from #3)  Elevation 600'

Pegasus Pipeline Map near Mayflower Arkansas
showing locations of block valves (1-3) and site of rupture (*).
Lake Maumelle is in the lower left, and Lake Conway is center-right.

Pegasus Pipeline Elevations, showing locations of nearby Block Valves
NOTE: Direction of Flow is from RIGHT to LEFT, from #3 towards #1.
<====== Direction of Flow ======

Faulty Sensor Hypothesis

Let us imagine that the pressure sensor at the Arkansas River block valve (#2) fails, and reads 0 psi, but not because of a leak, but because the pressure sensor fails. What would happen? How would the pipeline operator respond?

According to their current (heavily redacted) response plan, the OCC Supervisor should immediately give the order to shut down the pipeline:

However, one faulty sensor would give misleading indications, because the pressure on either side of the fault would appear fine. 

Problems with Exxon-Mobil's official report:

On their blog, Exxon-Mobil claims:

"Within approximately 90 seconds after receiving the low pressure alarm, the controller in the Operations Control Center initiated a full shutdown of the pipeline. It took approximately 16 minutes to fully shut down all of the pumps on the pipeline and isolate the impacted segment of the pipeline by closing isolation valves."

http://www.exxonmobilperspectives.com/2013/04/10/14-questions-answered/

However, by the fastest route from the Conway Station to the Arkansas River Block Valve, it would take 40 min to drive, and it is a manual valve.

Map: http://goo.gl/maps/Dq99o

"Currently, only one shut-off valve exists along the pipeline in the watershed, according to the water utility. It's at the western end of Lake Maumelle and an Exxon representative would have to drive to the site to manually close it."

(Note: this is talking about valve #1 at the western edge of Lake Maumelle)

http://insideclimatenews.org/news/20130904/exxon-pipeline-relocation-push-zero-risk-drinking-water-goal

Fluid Hammer:

Anyone who has lived in a home with steam heat has heard the pipes in the house banging in the pipes. Sometimes water valves in a home will bang and rattle the whole house as they are opened or closed.

This is a well known effect called Fluid Hammer, and can be a very destructive force if it is not compensated by good design.

http://en.wikipedia.org/wiki/Water_hammer

All liquids pipelines are subject to fluid hammer, the effects of which may be more pronounced by high-gravity materials like Diluted Bitumen, the product being transported in the Pegasus. 

``If a leak is detected and safety valves block the flow of DilBit, a potentially devastating phenomenon called a "fluid hammer" can elevate pressures far above the pipeline's operating pressure. A column of DilBit at high pressure is like a freight train 30-miles long--impossible to stop quickly. Tons of inertia feed a train wreck inside the pipeline... a fluid hammer.``  -- http://www.opednews.com/populum/printer_friendly.php?content=a&id=161133

Fluid Hammer is a well-known issue in Crude-Oil Pipelines:

"....[D]ue to their lower compressibility, liquids are subject to water-hammer issues while gasses are not." -- Journal of Pipeline Engineering, Volume 9, No 3, Third Quarter 2010 

http://www.pipemag.com/publications/journal/currentSample/JPE%20September%202010%20-%20sample%20issue.pdf

...however usually have greatest effect when valves are slammed shut.

BH Conjecture: Timeline for the Faulty Sensor Hypothesis

Let us give Exxon-Mobil operations personnel the benefit of the doubt and assume they followed Standard Operating Procedures at each step:

1:15 PM: Pressure drop detected from Arkansas River Block Valve.

1:17 PM: Exxon-Mobil operators followed the Safety plan, and ordered shut down the Conway Station. But since we are assuming there was no actual pipeline rupture, the pipeline remained charged.

1:30: Discussion occurs, maps are examined, keys are located, personnel dispatched to check the valve. 

2:15: Personnel are arrive at the Arkansas River Block Valve... no sign of a leak. Still "to be safe", they decided to close the valve.

2:30: Block valve is fully closed.

This action, closing the block valve on a fully pressurized pipeline, sends a fluid hammer shock wave backwards towards Mayflower, and this pressure shock is what caused the pipeline to rupture at the site of the latent, defective LF-ERW weld.

Closing a Block Valve rapidly under pressure
causes Fluid Hammer pressure wave
in opposite direction of flow

If it was the #1 block valve closed first, there still could be a similar situation. You can see there is a big hill just down stream of the #2 valve, so a backwards flow down that hill would come with the added force of gravity.

Photo: The Duncan Firm

Conclusions:

There is a simple explanation for how a failed sensor, coupled with the pipeline operators following Standard Operating Procedures, could have contributed to why the defective weld failed when it did. This also explains why the first signs of the pipeline leaking was AFTER Exxon claimed they had first shut down the pipeline.

This hypothesis could be verified by deposing the operators involved, and also by examining records maintained by the operator.

Some of these records have been turned over to the AR Attorney General's office, and/or PHMSA. However these records thus far have not been made public.


Thanks:

I want to thank Michael Holstrom and Steven Kohlhase for conversations which inspired my thinking on this matter, although neither (to my knowledge) endorse this hypothesis. This is solely my own.

William Huston

Contact: WilliamAHuston@gmail.com


---
William Huston is a notorious Uncredentialed Hack Blogger, and known Purveyor of Reckless Speculations and Questionable Assertions. Everything herein should be considered suspect and fact-checked against published reports, and the test of reason applied.

Update: 9/17/13: "speedlaw" in the comments made an excellent point about the speed of the valve closing. This means the risk of hammer is likely reduced, if the general theory holds, that slamming the valve closed is what triggers the biggest force.  But even if it took 15 min. to close that valve, we have to consider the difference between the inertial force of a few hundred gallons of water at 125 psi in household pluming, vs. the inertial force of that mass of 18 miles * 20" of heavy Dilbit at 708 psig traveling at 2 mph. I just calculated it's about 4.7 joules/sec. Whereas this is about the same as 2x 100 ton freight cars traveling at 60mph, min. I could be worse, because the shutdown of a pipeline requires coordination at several different points. Any timing being off at any point and incredible stresses can be placed at other points. I will write about this in a future blog.