Pipeline Investigation Report P94H0004

Jet fuel was discovered seeping onto the tarmac at Terminal 2 of the Toronto/Lester B. Pearson International Airport, Mississauga, Ontario, on 19 January 1994. The pressurized underground aircraft fuelling system was shut down and the leak stopped. No fire or injuries resulted.

The Board determined that the 254-millimetre (10-inch) pipeline in the area of the terminal developed a leak, most probably because of surface corrosion, forcing fuel to ground level.

1.1 The accident

At approximately 1130 eastern standard time (EST), on 19 January 1994, jet fuel was observed on the tarmac around the at-grade jet fuelling hydrants for gates 78 and 80 of Terminal 2 at the Toronto/Lester B. Pearson International Airport (LBPIA) in Mississauga, Ontario. One edge of the jet fuel leak was located approximately 15 metres (50 feet) from the Terminal 2 building. Transport Canada's (TC) "Pearson Airport Emergency Response" (PAER) plan was initiated by LBPIA officials. A clean-up program was undertaken by Consolidated Aviation Services (CAS), the fuelling system operator, to contain the product and to render the area safe for aircraft and passenger traffic.

At approximately 1430 EST, jet fuel was again obvious on the tarmac in the same general area as earlier noted. However, this time, jet fuel was found coming out of the cracks between the slabs of concrete that make up the tarmac. This location is approximately 30 metres (100 feet) from the Terminal 2 building. TC's PAER plan was initiated again. In the interest of safety, gates 74 through 82 were shut, the aircraft traffic to these gates was re-routed, and the general surrounding area of the tarmac isolated with emergency barricades. It was noted that jet fuel was finding its way underground to the outfall of the Mimico and Etobicoke creeks. As part of TC's PAER plan, absorbent booms were placed on the two creeks.

It was quickly realized that a section of the LBPIA jet fuelling system was leaking. CAS found that they could access the two manually operated emergency isolation valves located in the area of gates 74 and 75 in below-ground enclosures on the airport tarmac but only close one of them. Since the emergency isolation valve near gate 74 would not hold because of a broken shear pin, CAS had to isolate this section of the fuelling system by accessing Chamber 4 to rotate the spectacle plates. Entry into below-ground Chamber 4 was impossible because of pools of frozen sludge approximately 2.7 metres (9 feet) in depth. The sludge also prevented access to the spectacle plates for the two 10-inch pipelines located in Chamber 4. CAS employees unsuccessfully attempted to break the frozen sludge with various types of equipment.

At 0001 EST, on 20 January 1994, CAS shut down the complete fuelling system for the three terminals in the interest of safety. At about the same time, portable heaters from LBPIA were brought in to melt the frozen sludge at the access points.

Once the melted sludge was pumped out of the two access points and the area was rendered safe for CAS employee entry, one of the emergency valve units was found to be inoperative for two reasons. Firstly, the build-up of debris and corrosion on the exterior surface of the valve and its stem rendered proper closure of the valve impossible. Secondly, the shearing of the valve wheel's shear pin made it impossible to operate the valve. The suspected leaking section of the fuelling system was therefore isolated by installing isolation spectacle blinds at one end of the section on both 10-inch pipelines located in Chamber 4. At the opposite end of the two suspected leaking sections of the fuelling system, the emergency isolation valve was completely removed from one of the 10-inch pipelines and isolation spectacle blinds were installed on both lines to complete the isolation procedure.

At 1330 EST, on 21 January 1994, the delivery of jet fuel to LBPIA was resumed. During the 37.5 hours that the fuelling system was shut down, major delays to flight schedules resulted. Some major airline companies had to incur extra fuelling and operational costs by purchasing additional jet fuel at other airports before arriving at LBPIA or after departure from LBPIA with less than a full tank. This situation arose because CAS had to use tanker trucks, which were limited in numbers and less efficient for the designated task, to refuel aircraft at LBPIA. As well, CAS stated that the fuelling system was shut down for 37.5 hours in part because of the decision to use vacuum trucks to keep the airport open by draining 300,000 litres of jet fuel from the system. The defective pipe runs under the concrete tarmac, making examination without severe disruption to this area of the airport impossible.

1.2 The jet fuel

Commercial airline companies in Canada use jet fuel referred to as "Jet A". Jet A fuel has a flash point of 38 degrees Celsius and is either white or pale yellow in colour with a petroleum odour. It is lighter than water and insoluble in water. Once released into the environment, it may form a combustible mixture at/or above the flash point. Upon combustion, it will form toxic gases. Released material may accumulate static charges which may cause an electrical fire.

1.3 Environmental information

The recovery booms on the two creeks collected a quantity of jet fuel and vacuum trucks were used to complete the recovery process. Environment Canada monitored the collection and clean-up. The amount of jet fuel which found its way into the waterways could not be determined. Immediately following the discovery of the jet fuel leak, TC assumed responsibility for blocking off the storm sewer adjacent to the occurrence area to ensure that no jet fuel migrated to Mimico Creek or other water courses. TC installed a "pig" inflatable device in the storm sewer for this purpose. However, it was later determined that this pig was both defective and incompatible with jet fuel.

1.4 The fuelling system

1.4.1 Particulars of the pipeline

The fuelling system is owned by the Pearson International Fuel Facilities Corporation (PIFFC) and is operated by CAS.

Construction of the fuelling system which has a storage and a pipeline component began in 1961. The fuelling system has been expanded continuously to meet ever-increasing fuel demands from an ever-growing airport. The pipeline under the tarmac in the vicinity of gates 78 and 80 was installed between 1970 and 1971. The storage component can hold 17 million litres of jet fuel in both above-ground and below-ground storage tanks. The pipeline encircles each of the three airport terminals and consists of varying pipe diameter sizes ranging from 100 to 610 millimetres.

The fuelling system is demand-oriented, has a generally constant pressure of 1,241 kilopascals (kPa) (180 pounds per square inch (psi)), and delivers 4 to 5.8 million litres per day. It takes approximately 2 million litres (400,000 gallons) to fill the pipeline fuelling system. The delivery of jet fuel is provided through at-grade fuelling hydrants located at each of the 120 airport gates.

A cathodic protection system which made the pipeline cathodic with respect to its surrounding environment was applied to the fuelling system. The pipeline was coated with concrete which provided external protection for the buried system as well as buoyancy control for those areas with a high-water table.

1.4.2 The access points

The fuelling system is sectionalized by emergency valves at 25 key locations referred to as access points. Each access point permits quick and easy access for CAS employees to isolate various sections of the fuelling system during an emergency situation, when performing general maintenance activities, or when modifications to the fuelling system are deemed necessary. There are both "wet" and "dry" access points installed on the fuelling system. The dry-type access point to below-ground chambers exists at some locations on Terminals 1 and 2, in addition to Terminal 3. The design is very recent and includes a hand-operated, metal door opening to the below-ground concrete enclosure. This type has the advantage of keeping the below-ground concrete chamber dry at all times. During an emergency situation, CAS employees can enter within a matter of minutes, do a safety check for dangerous substances and proceed to close emergency valves. However, the wet-type access point to below-ground chambers is utilized for some of the access points on Terminals 1 and 2. Based on an older design, this type permits liquid to build up within the below-ground enclosure. A crane is required to remove the metal plate covering the entrance. Once the metal plate is removed, any accumulated liquids have to be removed and the below-ground enclosure has to be decontaminated to meet safety requirements.

1.4.3 Method of control

In 1990, CAS invested in a Programmable Logic Control (PLC) system which gives indications of movements of jet fuel into the pipeline system such as product flow, product temperature and product pressure from the tank farm into the system. However, the PLC system does not provide indications of pressure, product flow and the status of valves (open or closed) between the tank farm and the 120 airport gates.

1.5 Weather

At the time of the incident, the day was clear with drifting snow, an outside temperature of minus 21.5 degrees Celsius and winds from the southwest at 19 knots.

1.6 Product loss

On 05 July 1994, CAS advised TC in writing that approximately 6,000 litres of jet fuel had been lost. However, the company's fuel balancing system was unable to provide an estimate of the volume at the time of the accident.

1.7 Other information

1.7.1 Location of the leak

In an effort to identify the cause and location of the leak, CAS removed the remaining jet fuel in the isolated section of the fuelling system and carried out a pressure test using compressed air. The initial air test did not provide any indication of the extent, type or location of the leak. After several attempts by CAS to get a successful air test, none of these air tests appeared to indicate that a problem existed. At the end of these tests, the company removed one of the 10-inch pipelines that was suspected of leaking from regular service and back-filled it with concrete, and the second pipeline was returned to regular service in September 1994.

1.7.2 Testing and maintenance

CAS officials advised that they perform a monthly leak test on the jet fuelling system. This test consists of isolating the pipeline systems during off-peak hours (0000 to 0500) and observing if there is a pressure loss as measured by the dial gauges. CAS has not kept records of the tests nor does it have procedures manuals or written directives to indicate how and when such tests are to be conducted. No CAS employees who could indicate that they had performed leak tests were identified.

CAS officials also advised that they perform a number of monthly safety and maintenance procedures such as checking the condition of the fuelling hydrants. However, during the investigation, the company could not produce a copy of the procedures manual or written directives to indicate when these activities were carried out. No company records outlining these activities were available.

Similarly, it was claimed that private contractors have been employed to check the cathodic protection system but such a procedure was not outlined in company manuals or directives nor were records kept to verify such activity.

CAS officials originally indicated that the jet fuelling system pressure was checked every three months. As the investigation progressed, they then advised that this time period was every month. However, as indicated, the company did not keep records to support either claim.

1.7.3 Effects of concrete encasing and microbial action

Research by the National Association of Corrosion Engineers (NACE) has shown that the presence of concrete on a buried pipeline can make the concreted section anodic and as such promote corrosion. It has also been shown that microbial action in swampy areas produces corrosion on buried structures such as pipelines.

1.7.4 Location through terminal 2

A portion of the jet fuelling system passes through the end section of the Terminal 2 building in the vicinity of gates 73, 74 and 75. Initially, this section of pipeline was located outside the building but, during the last expansion of the terminal, the line was not relocated and the terminal was built around it. The section of the airport jet fuelling pipeline system that passed under Terminal 2 has been drained and filled with concrete.

1.7.5 Emergency response procedures

During the investigation, CAS could not provide an emergency response manual and accompanying training programs used to prepare CAS employees for the steps to follow when responding to an emergency situation involving the facilities of the company. Such a manual would form an integral part of TC's PAER.

1.8 Federal regulation of commodity pipelines

Commodity pipelines used to deliver jet fuel to aircraft at Canadian airports are under federal legislative authority. Pursuant to the Aeronautics Act, the Parliament of Canada gave the Minister of Transport broad responsibility with respect to airports and associated facilities. The Aeronautics Act empowers the Governor in Council to make regulations respecting the handling, marking, storage, and delivery of fuel and any lubricants or chemicals used in connection with the operations of aircraft. Pursuant to the Transportation of Dangerous Goods (TDG) Act, commodity pipelines at airports also come within the legislative authority of the Parliament of Canada. The TDG Act applies specifically to commodities transported by pipeline which are not governed by the National Energy Board (NEB) Act or a provincial law. The TDG Act empowers the Governor in Council to make regulations prescribing safety requirements and safety standards of general or particular application. Although these regulations making powers exist, TC has not established any regulations pertaining to standards, safety requirements or specifications for the design, construction, operations, maintenance, abandonment, and deactivation of such pipelines under either the Aeronautics Act or the TDG Act.

2.1 Introduction

The importance of the fuelling system to the smooth and efficient operation of LBPIA cannot be overstated. Presently, CAS provides a continuous, large volume fuelling service in all weather conditions, without the need for a large fleet of tanker trucks. However, this accident has identified operational and equipment deficiencies that need to be addressed for the reliable and safe operation of the fuel delivery system.

2.2 Consideration of the facts

2.2.1 Emergency shut-down

The primary concern identified by the investigation was the inability of CAS, during an emergency situation, to isolate sections of the fuelling system in a safe and expeditious manner. It took the company 9.5 hours to realize that they could not isolate the suspected leaking section of pipeline and another 28 hours to access and complete the isolation process. The delay in accessing and closing the emergency valves had a significant effect on fuelling operations which, in turn, had a major effect on aircraft movements at LBPIA. The delay also prolonged the exposure of the travelling public and the local environment to the dangers inherent in the fuel leak.

2.2.2 The leak

A number of situations could have permitted jet fuel to escape from the system. These are as follows:

1. external damage to the surface of the pipe from the original installation and subsequent corrosion through the pipe wall;
2. the pipe surface because of insufficient cathodic protection;
3. one or more faulty gaskets at one or more of the at-grade jet fuelling hydrants; and
4. internal corrosion of the pipeline because of water and other impurities in the jet fuel.

While the event which caused the fuelling system to leak would only become evident if the system were exposed, the most obvious reason for the jet fuel leak is external corrosion. For most aging pipeline systems (this section of the pipeline is over 22 years old), external corrosion is an ever-increasing problem. A break in the protective coating or construction damage to the protective coating or pipeline wall will accelerate the corrosion process. The rate of corrosion in this case could also have been increased by microbial action from swampy areas as well as the shift from cathodic to anodic protection because of the presence of concrete on the pipe surface. While cathodic protection surveys had been carried out each year, they do not guarantee that the system has not been corroding between the check points.

2.2.3 Maintenance and operations manual

The need for a maintenance and operations manual is paramount. The existence of such a manual ensures a consistent and thorough application of maintenance and operations policies, practices and procedures. Comprehensive manuals would have addressed the build-up of sludge in the emergency valve access points. The manuals would also detail regular inspection procedures which would have identified the inoperative valve. This, in turn, would have corrected the situation that resulted in the length of the delay in isolating the compromised section of the pipeline.

2.2.4 Emergency response manual

A current emergency response manual is also required. Included with each emergency response manual are dry-run exercises. Such exercises permit company officials and personnel to identify deficiencies with the company plan and initiate and implement appropriate changes. Routine dry-run exercises would have identified the difficulty of access to emergency valves as well as the need to clean the access point enclosure on a regular basis.

2.2.5 Pipeline monitoring and control

Given the nature of the fuelling operations at LBPIA, the volumes of jet fuel moving daily, and the need for current and comprehensive information on pipeline activities, a well-structured and comprehensive pipeline monitoring and control system should be mandatory. Presently, a centralized computer system monitors inventory and generates business records. However, the system falls short of monitoring internal operating activities of the product in the pipeline. No records have been retained. The key to any monitoring and control system is product pressure and the retention of records.

The present approach of using two exterior-mounted dial gauges is inadequate. Given that between 4 and 5.8 million litres of jet fuel are moved each day, it would seem appropriate for CAS to have product pressure available to the control room operator. In addition to product pressure, the operator should be able to monitor product flow in and out of the system, product temperature, product density, and impurities in the jet fuel. The monitoring and control system should have the ability to automatically indicate to the operator when jet fuelling service is required at any one of the 120 hydrants located at LBPIA, when to initiate jet fuel deliveries and when to terminate these activities. Records should be automatically retained of these activities. The operator should be able to shut down various sections of the fuelling system from the control panel just by instructing the monitoring and control system to initiate a shut-down.

Technology exists to accomplish all of these tasks. Pipeline operation records, together with business records, should be retained to provide a comprehensive account for verification and historical purposes. Inherent in any pipeline monitoring and control system is the need for comprehensive instruction manuals and associated training programs.

2.2.6 Leak detection

Given the nature of the fuelling operations, a well-structured and well-understood leak detection system should be mandatory. Not only did the company not have a leak detection policy in place, it did not keep records of any previous leak tests, and was unsure of whether the test was performed every month or every three months. However, the present approach of a 30-minute leak test using two exterior-mounted dial gauges is inadequate. Given that between 4 and 5.8 million litres of jet fuel are moved each day, it would seem appropriate for CAS to perform a continuous leak detection test. Technology exists to accomplish this task. During off-hours, the company could perform a more comprehensive test for a duration of at least two hours. Written records of all tests should be retained for verification and historical purposes. Incumbent in any leak test is the need for visible inspection. Presently, there are 120 at-grade fuelling hydrants at LBPIA. During the proposed two-hour leak test, CAS personnel would visually inspect all hydrants to ensure that they are not leaking either through the hydrant valve and/or the seals. As required, corrective action would be initiated and the daily two-hour test re-started.

2.2.7 Pipeline location

A portion of the fuelling system passes through an area frequented by the travelling public in Terminal 2. Since the pipeline acts as a low point along which jet fuel migrates, the possibility of this liquid seeping into the Terminal 2 building is always present. This portion of the fuelling system should therefore be outside of the building.

2.2.8 Federal regulations

A lack of appropriate regulations governing the commodity pipeline jet fuelling system at LBPIA was identified. Even though regulation making powers exist, commodity pipelines at Canadian airports remain unregulated. This accident highlights the need for consistent regulations governing these federal facilities.

3.1 Findings

1. The pressurized underground aircraft fuelling system developed a leak, forcing jet fuel to ground level.
2. The leak continued for 9.5 hours after which time the entire fuelling system was shut down. It took an additional 28 hours to isolate the leak site and return the fuelling system to operation.
3. There was likely surface corrosion on a 254-millimetre (10-inch) underground pipeline at the source of the leak.
4. Consolidated Aviation Services (CAS) did not have a maintenance and operations manual together with associated programs for its employees.
5. At the time of the investigation, CAS did not have an emergency response manual which would have formed an integral part of Transport Canada's Pearson Airport Emergency Response plan or associated training programs for its employees.
6. There were no relevant manuals or policy directives for CAS staff concerning leak checks and the company did not retain any records of such checks.
7. The type and quality of the pipeline monitoring and control system equipment relied on by CAS did not meet current standards.
8. The type and quality of the leak detection equipment relied on by CAS did not meet current standards.
9. A portion of the fuelling system passed through the Terminal 2 building utilized by the travelling public.
10. At the time of the accident, CAS could not determine the amount of jet fuel lost; however, it was later determined that 6,000 litres of jet fuel was lost.
11. There are no national standards or guidelines governing commodity pipeline systems at Canadian airports.

3.2 Cause

The 254-millimetre (10-inch) pipeline in the area of the terminal developed a leak, most probably because of surface corrosion, forcing fuel to ground level.

4.1 Action taken

4.1.1 Leak testing of the system

During the off-peak hours from 0000 to 0500, Consolidated Aviation Services (CAS) will measure pressure loss with its Programmable Logic Control system. Records of the weekly leak tests, which form part of the CAS standard operating procedure, are kept. All CAS tank farm operators can and do perform these leak tests. Once a year, CAS will pressure-test the pipeline system as required by Transport Canada (TC).

4.1.2 Spill prevention and counter measure plan

CAS has in place a Spill Prevention and Counter Measure Plan which has three emergency response units; one at each of the three LBPIA terminals. The CAS emergency response system is coordinated with the TC emergency response system for LBPIA. Each CAS employee is trained to react immediately to an emergency according to prescribed procedures. The CAS system ties directly into the TC system. The TC Duty Manager is the designated coordinator of all emergencies for the airport.

4.1.3 Emergency shut-down

Pearson International Fuel Facilities Corporation is upgrading emergency valves and access to below-ground chambers. This will greatly reduce the 9.5 hours it took to realize that the suspected leaking section of the pipeline fuelling system could not be isolated. Completion of this project is scheduled for mid-1995.

4.1.4 Safety checks of the jet fuelling hydrants

CAS indicates that roughly 50 per cent of the jet fuelling hydrants are used every day and are checked by the fuellers. The balance of the jet fuelling hydrants are checked every three months. CAS is currently undertaking a program to seal all jet fuelling hydrant pit bottoms to contain leaks.

4.1.5 Transport Canada policy for handling of fuel at Transport Canada-owned airports

TC publication TP2231, entitled Policy and Standards for the Storage, Handling and Dispensing of Aviation Fuel at Transport Canada Owned Airports, has been recently revised. TP2231 applies to all TC airports and refuelling facilities at other Canadian airports. TP2231 dictates the following key requirements:

1. a maintenance management program for the fuelling system and all associated equipment;
2. environmental management and emergency plans;
3. annual leak testing of transmission piping associated with the hydrant distribution system;
4. continuous leak detection around each hydrant pit;
5. annual testing of the cathodic protection system; and
6. daily reconciliation of storage tank inventories.

With respect to LBPIA, TC has contracted a consultant to conduct a site assessment including the fuel pipeline and hydrant fuel distribution system.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson, John W. Stants, and members Zita Brunet and Hugh MacNeil, authorized the release of this report on 10 May 1995.