Pipeline and Hazardous Materials Safety Administration (PHMSA), DOT.
Notice; Issuance of advisory bulletin.
The Pipeline and Hazardous Materials Safety Administration (PHMSA) is issuing this advisory bulletin to remind owners and operators of natural gas distribution pipelines of the possibility of failure due to an overpressurization on low-pressure distribution systems. PHMSA is also reminding such owners and operators of existing federal integrity management regulations for gas distribution systems.
PHMSA guidance, including the advisory bulletin, can be found on PHMSA's website at https://www.phmsa.dot.gov/guidance.
Start Further Info
FOR FURTHER INFORMATION CONTACT:
Technical Questions: Michael Thompson, Transportation Specialist, by phone at 503-883-3495 or by email at firstname.lastname@example.org.
General Questions: Ashlin Bollacker, Technical Writer, by phone at 202-366-4203 or by email at email@example.com.
End Further Info
Start Supplemental Information
I. Natural Gas Distribution Systems
Natural gas distribution systems deliver natural gas to customers for heating, cooking, and other domestic and industrial uses. A basic natural gas distribution system has four elements: (1) Mains that transport gas underground; (2) service lines that deliver natural gas from the main to the customer; (3) regulators that control the pressure of gas to a designated value; and (4) meters that measure the quantity of natural gas used by each customer. Customer piping takes natural gas from the meter to the customer's heating equipment and other appliances.
There are two types of natural gas distribution systems used to supply natural gas to the customer: High-pressure distribution systems and low-pressure distribution systems. In a high-pressure distribution system, the gas pressure in the main is higher than the pressure provided to the customer. A pressure regulator installed at each meter reduces the pressure from the main to a pressure that can be used by the customer's equipment and appliances. These regulators incorporate an overpressure protection device to prevent overpressurization of the customer's piping and appliances should the regulator fail. Additionally, as of April 14, 2017, all new or replaced service lines connected to a high-pressure distribution system must have excess flow valves. (§ 192.383).
Excess flow valves can reduce the risk of overpressurization in natural gas distribution pipelines by shutting off unplanned, excessive gas flows. Because each customer's service line in a high-pressure distribution system is protected by an excess flow valve and a pressure regulator, it is highly unlikely that an overpressurization condition in the main would impact customers.
In a low-pressure natural gas distribution system, however, the natural gas in a distribution pipeline flows predominantly at the same pressure as the pressure contained within the customer's service line piping. Natural gas is typically supplied to distribution pipeline mains from a high-pressure source that connects to, and flows through, a regulator station. The regulator station functions to reduce the pressure to a level that allows the gas to flow continuously at a low pressure all the way to premises of the customers where the gas is ultimately consumed. Since there are no regulators at the customer meter set in a low-pressure system, an overpressure condition occurring on the distribution system can affect all customers served by the system in the event that the regulator(s) that controls the pressure for the system fails. This scenario is what happened in the September 13, 2018, accident in Merrimack Valley that prompted the subsequent National Transportation Safety Board (NTSB) report and recommendations.
II. CMA's Accident in Merrimack Valley
A. Accident Synopsis
On September 13, 2018, a series of structure fires and explosions occurred after high-pressure natural gas entered a low-pressure natural gas distribution system operated by Columbia Gas of Massachusetts (CMA), a subsidiary of NiSource, Inc.
CMA delivers natural gas to about 325,000 customers in Massachusetts. According to an investigation of the accident conducted by the National Transportation Safety Board,
the fires and explosions damaged 131 structures, including at least 5 homes that were destroyed in the city of Lawrence and the towns of Andover and North Andover. CMA shut down the low-pressure natural gas distribution system serving 10,894 customers, including some outside the affected area who had their service shut off as a precaution. An 18-year-old male was killed when a home exploded, and the house's chimney fell onto the vehicle where he was sitting. Another person in the vehicle at the time of the explosion was seriously injured, as was someone on the second floor of the house. In total, 22 people, including 3 firefighters, were transported to hospitals for treatment of their injuries.
B. Background on CMA's Natural Gas Main Replacement Project
The low-pressure natural gas distribution system in the Merrimack Valley was installed in the early 1900s and was constructed with cast iron mains. The system was designed with 14 regulator stations to control the pressure of natural gas entering the downstream distribution pipeline mains. Each regulator station contained two regulators in series—a “worker regulator” and a “monitor regulator”—each with a sensing line connected to a downstream section of main for the purpose of providing a pressure measurement back to the regulator station so that the system could be maintained at a specified pressure level of 0.5 pounds per square inch. The Start Printed Page 61098“worker” regulator is the primary regulator that maintains the natural gas pressure, and the “monitor” regulator provides a redundant backup to the “worker” regulator. Each of the regulator stations reduced the natural gas pressure from about 75 pounds per square inch gauge (psig) to 12 inches of water column (w.c.), or about 0.5 psig, for distribution through the mains and delivery to customers.
Beginning in 2016, CMA initiated an effort to replace 7,595 feet of low-pressure cast iron and bare steel mains with 4,845 feet of low-pressure and high-pressure polyethylene (plastic) mains. CMA contracted with Feeney Brothers, a pipeline services firm, to complete the replacement project. A work package, which included materials such as isometric drawings and procedural details for disconnecting and connecting pipes, was prepared for each of the planned construction activities. However, no package was prepared for the relocation of the Winthrop Avenue sensing lines serving the Winthrop Avenue regulator station.
The first stage of the project involved the installation of the plastic main, which was completed in late 2016. The regulator sensing lines at the Winthrop Avenue regulator station remained attached to the cast iron main that would ultimately be decommissioned.
CMA connected the plastic pipe to the distribution system, which allowed it to be monitored for pressure changes. The second stage of the project began in 2018 and involved the installation of tie-ins to the new plastic main, after which the legacy cast iron mains would be decommissioned and abandoned in their existing location. On the day of the accident, the sensing lines were still connected to the abandoned cast iron main.
At the Winthrop Avenue regulator station, about 0.5 mile south of the work area, the sensing lines connected to the abandoned cast iron mains continued providing data input to the two pressure regulators used to control the system pressure.
Once the contractor crew isolated the cast iron main, the natural gas pressure began to drop in the cast iron main and the sensing lines continued to provide those readings to the regulator station. As the pressure dropped, the pressure regulators responded by opening further to inject more gas to into the downstream system to the newly installed plastic system. Because there were no sensing lines connecting the regulator station to the newly installed plastic mains, the legacy sensing lines continued to provide “zero” pressure readings to Winthrop Avenue regulators, thereby causing them to fully open and provide a continuous flow of gas into the new low-pressure plastic system, resulting in an extreme overpressurization of the distribution system. This immediately resulted in multiple fires, explosions, and injuries.
C. National Transportation Safety Board (NTSB) Accident Investigation and Recommendations
Since the accident, the National Transportation Safety Board (NTSB) issued several safety recommendations. On November 14, 2018, NTSB recommended that the operator, NiSource Inc.:
- Revise the engineering plan and constructability review process across all of its subsidiaries to ensure that all applicable departments review construction documents for accuracy, completeness, and correctness, and that the documents or plans be sealed by a professional engineer prior to commencing work (P-18-6);
- Review and ensure that all records and documentation of its natural gas systems are traceable, reliable, and complete (P-18-7);
- Apply management of change process to all changes to adequately identify system threats that could result in a common mode failure (P-18-8); and
- Develop and implement control procedures during modifications to gas mains to mitigate the risks identified during management of change operations. Gas main pressures should be continually monitored during these modifications and assets should be placed at critical locations to immediately shut down the system if abnormal operations are detected (P-18-9).
In response, NiSource Inc. has taken actions that satisfied the NTSB's recommendations, which are now classified as “Closed.”
On September 24, 2019, the National Transportation Safety Board (NTSB) issued its accident report and identified the probable cause of, and contributing factors to, CMA's accident in Merrimack Valley. NTSB found that the probable cause of the accident was CMA's weak engineering management that failed to adequately plan, review, sequence, and oversee the construction project that abandoned the cast iron main without first relocating the regulator sensing lines to the new plastic main. NTSB also found that a contributing cause of the accident was a low-pressure natural gas distribution system that was designed and operated without adequate overpressure protection. As a result of its investigation, NTSB made several recommendations to NiSource, Inc., the Commonwealth of Massachusetts and several other States, and PHMSA. NTSB made two recommendations to PHMSA. The first (P-19-14) called for PHMSA to “revise Title 49 Code of Federal Regulations Part 192 to require overpressure protection for low-pressure natural gas distribution systems that cannot be defeated by a single operator error or equipment failure.” Having investigated multiple overpressurization accidents over the past 50 years, NTSB concluded that low-pressure natural gas distribution systems that use only sensing lines and regulators to detect and prevent overpressurization are not optimal to prevent overpressurization accidents.
NTSB's second recommendation (P-19-15) called for PHMSA to “issue an alert to all low-pressure natural gas distribution system operators of the possibility of a failure of overpressure protection, and the alert should recommend that operators use a failure modes and effects analysis (FMEA) or equivalent structured and systematic method to identify potential failures and take action to mitigate those identified failures.” NTSB found that CMA's constructability review 
process was not sufficiently robust to detect the omission of a work order to relocate the sensing lines; and that CMA's engineering risk management processes were deficient. NTSB explained that for regulator sensing lines, CMA only considered excavation damage as a risk to be mitigated. NTSB concluded that a comprehensive and formal risk assessment, such as FMEA, would have identified the human error that caused the redundant regulators to open and over pressurize the low-pressure system.
In response to NTSB's recommendation P-19-15, PHMSA is issuing this advisory bulletin to remind owners and operators of low-pressure natural gas distribution systems of the possibility of a failure of overpressure protection devices. Currently, there are Federal regulations in place that specify several minimum safety standards requiring operators to account for the possibility of overpressure events in the Start Printed Page 61099design and operation of their systems. Specifically, the Distribution Integrity Management Program (DIMP) regulations at 49 CFR 192.1005 require operators of natural gas distribution systems to develop and implement an integrity management program for pipelines they own, operate, or maintain. Under DIMP, operators must identify existing and potential threats to the integrity of their systems, and to rank the risks so that known issues can be evaluated by the risks they pose. PHMSA agrees with the NTSB that low-pressure distribution system operators need to be reminded of their obligation to identify all threats to their systems and take mitigative measures in accordance with the risks to their systems. The diversity of designs and operating conditions of those systems mean that the risks associated with overpressure conditions may be best managed by a combination of design elements and engineering practices tailored to the unique attributes and conditions of their specific systems that pipeline operators are best positioned to identify and implement. Therefore, PHMSA is reminding operators of low-pressure distribution systems of their existing obligations under the DIMP regulations to consider and implement such tailored approaches to mitigate or eliminate the risk of an overpressurization event.
D. Distribution Integrity Management Program Regulatory Provisions
PHMSA first adopted integrity management regulations for hazardous liquid pipelines in 2000, then for gas transmission pipelines in 2003. Subsequently, the Pipeline Integrity, Protection, Enforcement, and Safety Act of 2006 (PIPES Act of 2006; Pub. L. 109-468) mandated that PHMSA prescribe minimum safety standards to extend integrity management to gas distribution pipeline systems. The 2006 legislation directed PHMSA to require operators of distribution pipelines to identify and assess risks on their distribution lines, to remediate conditions that present a potential threat to pipeline integrity, and to monitor program effectiveness. In response to that mandate, PHMSA implemented new requirements in 49 CFR part 192, subpart P, that rely on operator-specific programs to improve the overall integrity of pipeline systems and reduce risk (74 FR 63905; December 4, 2009). PHMSA concluded that this performance-based approach was a more effective method for improving pipeline system safety—given the diversity of distribution systems and the particular threats to which different systems may each be exposed—than imposing a “one-size-fits-all” prescriptive requirement.
The DIMP regulations require operators of natural gas distribution systems to develop, write, and implement an integrity management program for pipelines they own, operate, or maintain. An integrity management plan is a written set of policies and procedures that each operator must develop and implement to ensure compliance. Pursuant to § 192.1007,
an integrity management plan must include procedures for implementing the following elements:
- Periodically assess and improve the integrity management program; and
- Report performance results to PHMSA and, where applicable, also to state public utility commissions.
a. Knowledge (192.1007(a)). This section requires an operator to develop an understanding of its distribution pipeline. An operator must identify the characteristics of its pipeline's design and operations, and of the environment in which it operates, which are necessary to assess applicable threats and risks. This must include considering information gained from past design, operations, and maintenance. This section further requires that operators develop their understanding from reasonably available information. Operators have considerable knowledge of their pipeline to support routine operations and maintenance, but this information may be distributed throughout the company, in possession of groups responsible for individual functions. Operators must assemble this information to the extent necessary to support the development and implementation of their IM program.
PHMSA recognizes that there may be gaps in the knowledge an operator possesses when it develops its initial IM plan. Operators must identify these gaps and the additional information needed to improve their understanding. Operators are required to provide a plan for gaining that information over time through the normal activities of operating and maintaining pipeline systems (e.g., collecting information about underlying components when portions of the pipeline must be excavated for other reasons). Operators must also develop a process by which the program will be periodically reviewed and refined, as needed.
b. Identify threats ((§ 192.1007(b)). Identification of the threats that affect, or could potentially affect, a distribution pipeline remains critical to ensuring integrity. Knowledge of applicable threats allows operators to evaluate the safety risks they pose and to rank those risks, allowing safety resources to be applied where they will be most effective. This section requires that operators consider the general categories of threats that must be reported on annual reports. Operators are required to consider reasonably available information to identify threats that affect their pipeline or that could potentially affect it (e.g., landslides in a hilly area with loose soils even if no landslide has been experienced). The section specifies that operators should minimally consider data sources resulting from normal operation and maintenance in evaluating threats.
c. Evaluate and rank risk (192.1007(c)). This section requires that an operator evaluate the identified threats to determine their relative importance and rank the risks associated with its pipeline. Operators must consider the likelihood of threats and the consequences of a failure that might result from each threat. Consideration of consequences is important to help ensure that risks are properly ranked. A potential accident of relatively low probability but that would produce significant consequences should be considered to be of higher risk than an accident with somewhat greater likelihood, but one that is not expected to produce major consequences.
d. Identify and implement measures to address risks (§ 192.1007(d)). This section requires operators to determine and implement measures designed to reduce the risk of failure of gas distribution pipeline systems.
e. Measure performance, monitor results, and evaluate effectiveness (§ 192.1007(e)). This section requires operators to develop performance measures, including some that are specified for use by all operators. Measuring performance periodically enables operators to determine whether actions being taken to address threats are effective, or whether different or additional actions are needed. An operator must also periodically re-evaluate the threats and risks to its gas distribution pipeline.
f. Periodic evaluation and improvement (§ 192.1007(f)). This section requires operators to re-evaluate risks across the entire pipeline system periodically and to consider the relevance of threats in one specific location as compared to other locations. Start Printed Page 61100Operators must consider the results of their performance monitoring in these evaluations, which must be performed at least once every five years. An operator must determine an appropriate period for conducting a complete program evaluation based on the complexity of its system. An operator should conduct a program evaluation any time there are changes in factors that would increase the risk associated with a failure.
While DIMP regulations have been in place since 2009, some operators may not be sufficiently aware of their pipeline attributes, nor adequately or consistently assessing threats as part of their DIMP programs. Early in the investigation, NTSB determined that several of NiSource's engineering processes were deficient. For example, the NTSB found that CMA's inadequate planning, documentation, and recordkeeping processes led to the omission of the relocation of sensing lines during a construction project. Further, NTSB found that CMA's constructability review process was not sufficiently robust to detect the omission of a work order to relocate sensing lines. It was the abandonment of the cast iron main without first relocating the sensing lines that led directly to the accident. Thus, it is necessary to identify and evaluate the physical and operational characteristics of each pipeline system to evaluate risks adequately. It is also important that an operator focus its DIMP on identifying the conditions that can cause failures and address them before a failure occurs. Therefore, PHMSA is reminding owners and operators of their continuing obligation to comply with DIMP regulations and is alerting operators that PHMSA considers the possibility of an overpressure protection failure to be a high-risk threat. PHMSA reminds operators of low-pressure systems that they must consider reasonably available information about possible threats to their gas distribution system, including such sources as the NTSB report, industry publications, and this advisory bulletin.
As part of the DIMP plans, PHMSA recommends that operators enhance their processes and procedures by including a failure modes and effects analysis, or equivalent structured and systematic method of risk analysis. Including a failure mode and effect analysis or equivalent methodology can help identify and mitigate the possibility of an overpressure failure event. PHMSA also urges operators to develop and implement procedures for construction-related work that are specific to low-pressure distribution systems, such as repairs, uprates in pressure, or replacement of pipeline or pressure regulation facilities.
II. Advisory Bulletin (ADB-2020-02)
To: Owners and Operators of Natural Gas Distribution Systems
Subject: Overpressure Protection on Low-pressure Natural Gas Distribution Systems.
Advisory: PHMSA is reminding all owners and operators of low-pressure natural gas distribution systems of the risk of failure of overpressure protection systems. This advisory bulletin is intended to clarify for the public existing pipeline safety standards and highlight the importance of evaluating and implementing overpressure protection design elements and operational practices within their compliance programs. The contents of this advisory bulletin do not have the force and effect of law. They are not meant to bind the public in any way, even as pipeline owners and operators must comply with the underlying safety standards.
PHMSA encourages operators to review the NTSB's Pipeline Accident Report concerning Columbia Gas of Massachusetts' (CMA) overpressurization event in the Merrimack Valley on September 13, 2018. It may be instructive regarding a host of potential safety problems that operators of low-pressure natural gas distribution systems may need to address. A copy of NTSB's accident report is contained within Docket No. PHMSA-2020-0025 for this advisory bulletin.
PHMSA also reminds pipeline operators of their obligations to comply with the gas DIMP regulations at 49 CFR part 192, subpart P. Under DIMP, gas distribution operators must have knowledge of their pipeline systems; identify threats to their systems; evaluate and rank risks; and identify, evaluate, and implement measures to address those risks. CMA's accident in Massachusetts highlights the need for operators of low-pressure systems to review thoroughly their current DIMP for the threat of overpressurization and to make any necessary changes or modifications to become fully compliant with the Federal Pipeline Safety Regulations (§ 192.1007(f)).
Written Procedures (§ 192.1005)
Developing and implementing comprehensive written procedures with sufficient specificity is one of the most effective ways to prevent overpressurization of a low-pressure gas system. Therefore, PHMSA reminds operators of low-pressure systems to review their written integrity management plans to help ensure that they comply with § 192.1005 and to ensure that they specifically address the risk of an overpressurization event. PHMSA further recommends, in addition to having procedures for operations, maintenance, and emergencies (§ 192.605), that operators develop written procedures for all activities involving new construction or pipe replacement projects for low-pressure distribution systems. PHMSA recommends that these procedures account for the additional precautions needed to protect those systems from an overpressurization event. These procedures should include:
- Clear roles and responsibilities across all departments involved in the planning and execution of construction or pipe replacement projects;
- Description and delineated scope of work to be conducted, with a materials list, necessary schematics, and maps of the location of the work;
- Requirements to review and ensure that all records and documentation of the affected gas system(s) are traceable, reliable, and complete;
- The sequential process of how the work is to be carried out and who or what group is responsible for each step;
- Application of a “management of change” process to identify all changes that could threaten system integrity, particularly where there is a risk emanating from a common mode of failure, including a list of individuals and groups necessary for review along with their comment and approval before work commences; and
- Implement a review process sufficiently robust to detect the omission of critical process and procedural steps that could prevent possible overpressurization events.
Knowledge of Distribution System (§ 192.1007(a))
PHMSA reminds operators that they are required to develop procedures in their DIMP that demonstrate an understanding of their gas distribution systems (§ 192.1007(a)). An operator must identify the characteristics of its pipeline design and operations, and of the environment in which it operates, in the process of assessing applicable threats and risks. Section 192.1007(a) requires that operators develop their understanding from reasonably available information. This must include information gained from past design, operations, and maintenance. If an operator acquires a pipeline and the historical records were not obtained or are not reasonably available, the records do not need to be re-created. However, Start Printed Page 61101operators must assemble this information to the extent necessary to support the development and implementation of their integrity management programs. Underlying procedures must also identify additional information necessary to improve their understanding and provide a plan for gaining that information over time through the normal activities of operating and maintaining pipeline systems (e.g., collecting information about buried components when portions of the pipeline must be excavated for other reasons). Operators must also develop a process by which the program will be periodically reviewed and refined, as needed. The outcome of the process should be that all affected departments of an operator's organization are aware of any planned construction work, have had the opportunity to review and provide comments on potential failure modes and to adopt a process for providing final approval of construction procedures.
Identifying Threats and Ranking Risk (§ 192.1007(b)-(c))
PHMSA reminds operators of their obligation under DIMP regulations (part 192, subpart P) to consider available information when identifying all potential and existing threats to the integrity of their systems (§ 192.1007(b)). In accordance with § 192.1007(b), operators are required to consider seven specific threats, including equipment failure and incorrect operation. Further, PHMSA reminds operators to evaluate the risks associated with their distribution pipelines, determine the relative importance of each threat, and rank the risks posed to their pipeline systems (§ 192.1007(c)). PHMSA reminds operators that consideration of consequences is important to help ensure that risks are properly ranked. A potential accident of relatively low likelihood but one that would produce significant consequences may be a higher risk than an accident with somewhat greater likelihood, but one that is not expected to produce major consequences.
Given the catastrophic consequences of the Merrimack Valley accident, PHMSA considers the possibility of an overpressure protection system failure to be a high-risk threat for low-pressure distribution systems where there are not adequate provisions to protect such systems. Therefore, PHMSA recommends that operators consider the single point of failure that could lead to an overpressurization of a low-pressure system as a high-risk threat and to review and adjust their DIMP plans accordingly. NTSB's Pipeline Accident Report sufficiently documents the occurrence of overpressurization of low-pressure distribution systems such that the threat of overpressurization should be considered a real and present threat. If the threat of overpressurization of low-pressure distribution systems is not considered an existing threat by an operator, justification for the elimination of this threat from consideration should be documented.
In performing a risk analysis required by DIMP (§ 192.1007), PHMSA recommends operators use a failure modes and effectiveness analysis (FMEA) model or an equivalent structured and systematic method to identify and mitigate risks. Failure modes and effects analysis (FMEA) is a generally accepted and recognized engineering practice used to identify and assess potential failures, including common mode failures. As NTSB concluded, a comprehensive and formal risk assessment, such as FMEA, would have identified the human error that caused the redundant regulators to open and over-pressurize the low-pressure system. Operators may already be leveraging FMEA or other similarly robust methodologies to perform the risk analysis and should continue to do so. PHMSA recommends that operators consider adopting FMEA or another qualitative tool that may help to identify possible failures or consequences of those failures that would not be identified otherwise.
Identify and Implement Measures To Address Risk (§ 192.1007(d))
PHMSA reminds operators that they must determine and implement measures designed to reduce the risk of failure on their pipeline systems (§ 192.1007(d)). If additional actions have not been taken to reduce risks, justification should be documented (e.g., current overpressure protection design was determined to be sufficient; risks were deemed to be low).
There are several ways that operators can protect low-pressure distribution systems from overpressure events. Some notable examples include:
- Installing a full-capacity relief valve downstream of the low-pressure regulator station, including in applications where there is only worker-monitor pressure control;
- Installing a “slam shut” device;
- Using telemetered pressure recordings at district regulator stations to signal failures immediately to operators at control centers; and
- Completely and accurately documenting the location for all control (i.e., sensing) lines on the system.
Measure Performance, Monitor Results, and Evaluate Effectiveness (§ 192.1007(e))
PHMSA reminds operators that they must monitor performance measures from an established baseline to evaluate the effectiveness of DIMP (§ 192.1007(e)). Section 192.1007(e)(vi) requires that these performance measures include any additional measures determined necessary to control identified threats. PHMSA reminds operators to modify their DIMP as appropriate, considering the potential failure of overpressure protection systems as a high-risk threat.
End Supplemental Information
Issued in Washington, DC, on September 24, 2020, under authority delegated in 49 CFR 1.97.
Alan K. Mayberry,
Associate Administrator for Pipeline Safety.
[FR Doc. 2020-21508 Filed 9-28-20; 8:45 am]
BILLING CODE 4910-60-P