Pipeline Investigation Report P12H0103

On 23 June 2012, at approximately 1200 Mountain Standard Time, an ignition and fire occurred in a valve-enclosure structure at Spectra Energy Transmission Compressor Station N4, located approximately 160 km northwest of Fort St. John, British Columbia. Two maintenance employees sustained burn injuries when sweet natural gas that had been leaking from a station valve ignited. The 2 employees were performing annual inspection work on motor-operated valves. The injured employees were air-lifted to the Fort St. John Hospital. One employee was released later that day, while the second employee was transferred to a burn unit in Vancouver.

Westcoast Energy Incorporated, carrying on business as Spectra Energy Transmission (Spectra), was conducting an inspection of the motor-operated valves (MOV) in Compressor Station N4 (CS-N4) during its annual maintenance shutdown. CS-N4, a compressor station that forms part of Spectra’s Transmission North pipeline, is located approximately 160 km northwest of Fort St. John, BC (Figure 1).

The accident took place within the weather enclosure structure that was housing MOV-0409 (Figure 2). This motor-operated valve controls the 91.44-cm (36-inch) loop discharge pipeline for the compressor station.

In 1993, MOV-0409 and MOV-0417 (in operation since the 1960s) were enclosed within weather protection enclosure structures. The 2 enclosures shared a common wall, with an opening to allow inside access between the enclosures (Figure 3). MOV-0409 controls the 91.44-cm (36-inch) loop discharge pipeline, and MOV-0417 controls the emergency blow-down pipeline for the compressor station. MOV-0409 and MOV-0417 are both equipped with 130 volts-direct-current (VDC) motor operators, enclosed within the limit-switch housing. There is no other electrical equipment in these enclosures. Under normal operating conditions, MOV-0409 is left in the fully-open position, meaning that high-pressure gas will flow through the valve unobstructed. If an emergency shutdown sequence occurred at the compressor station, MOV-0409 would move to the fully-closed position automatically. The maintenance work on MOV-0409 required the line to be pressurized.

The enclosure structure around MOV-0409 is approximately 2.4 m by 3.7 m (8 feet by 12 feet). The enclosure structure around MOV-0417 is approximately 3.7 m by 3.1 m (8 feet by 10 feet).

Spectra transports natural gas from its Fort Nelson gas plant to the Canada-USA border. The section of pipeline that travels from Fort Nelson to CS-2 has a capacity of 50.72 million cubic metres (1.8 billion cubic feet) of gas per day. There are 4 intermediate compressor stations (CS-N2, CS-N3, CS-N4, and CS-N5). At the time of the occurrence, only 2 compressor stations were required to meet production and supply demands.

The product in the pipeline was sales-quality, sweet non-odourized natural gas. Natural gas is predominately (95%) methane gas, and is non-toxic. It is extremely flammable, and can form an explosive mixture when mixed with air. It is a known asphyxiant, and can displace oxygen in an enclosed space. The methane concentration in air at which a flammable or explosive mixture occurs is in the range of 5% to 15%.

On the day of the occurrence, the operating pressure for the 91.44-cm (36-inch) compressor-station discharge piping was 4 295 kilopascals (kPa) (623 pounds per square inch gage (psig). For the compressor-station piping, the operating pressure in the station piping was 4 309 kPa (625 psig).

The work environment at a compressor station is classified as a hazardous area, with a Canadian Standards Association (CSA) Canadian Electrical Code designation of Class 1, Zone 0, and Group D. This designation signifies the following:

• Class I: A location where a quantity of flammable gas or vapor, sufficient to produce an explosive or ignitable mixture, may be present in the air;
• Zone 0: An area in which an explosive gas atmosphere is continuously present or present for long periods; and
• Group D: The type of product present is Benzene, Butane, Methane, and/or Propane.

Operational events before the occurrence

A number of operational events and decisions, starting from approximately 10 months before the occurrence, is listed below. Note that the Spectra employees include:

• Senior electrical and instrumentation technician (SP-1), who primarily worked on Spectra’s Transmission South pipeline, and was certified as a station operator (SO) for CS-N4;
• Electrical and instrumentation technician (SP-2), who was the SO for CS-N2;
• Electrical and instrumentation technician (SP-3), who was the SO for CS-N3; and
• Mechanical technician (SP-4) for CS-N4.

Operational events and decisions before the occurrence

16 August 2011

• Fugitive gas emissions^{Footnote 1} (FGEs) were surveyed and quantified at MOV-0409. (Note: Leaks had been detected from MOV-0409 since 2006 and tracked for at least the last 10 months.)
• A FGE tag (Photo 1) was affixed to the single entrance (i.e., man-door) to the combined enclosure structure located in the enclosure section for MOV-0417.

Late August 2011

• Attempts were made to stop the stem leak by injecting high-pressure grease into the valve stem seal cavity.
• The tattle-tale vent (TTV) was replaced with a bull plug, in an attempt to minimize gas leakage into the enclosure structure.
• The FGE was recorded in the Spectra’s malfunction notification system. As the repair required the valve and associated pipeline to be purged of gas, the repair was deferred until the next annual shutdown of CS-N4.
• An egress door was added to the MOV-0409 enclosure. This door did not include an air-quality testing port (Photo 2).

08 May 2012

• SP-4 commenced training as the SO at CS-N4. SO training involves reviewing the SO manual under the mentorship of certified SOs. The mentors review progress and conduct field observations of the trainee. The trainee is certified when the 2 mentors independently sign off that the trainee has met the requirements to be a station operator. The mentorship process typically takes 3 months.

20 May 2012

• The valve service contractor determined that MOV-0409 had a possible stem leak, and that the required parts were not immediately available.

30 May 2012

• Spectra’s work scheduling department generated the June 2012 work schedule for CS-N4.
• The annual MOV maintenance activity was on the schedule. The scheduled maintenance included testing the MOV valve limit switches, adjusting the limit-switch torque settings contained within the housing, and testing the start/stop electrical valve operator (operator) located on top of each valve. However, as the MOV-0409 repair work could not be completed due to unavailable parts, the malfunction notification relating to this FGE did not appear on the work schedule.

01 June 2012

• The scheduled outage at CS-N4 was started.

08 June 2012

• SP-1 arrived at CS-N4 from Dawson Creek (British Columbia).

18 June 2012

• The Transmission North team leader reviewed and confirmed the post-outage start-up plan for CS-N4.
• The regular station operators for CS-N4 (SP-4’s mentors) departed the site.

21 June 2012

• The station was repressurized with natural gas to normal operating pipeline pressure. Pressurization was a requirement for the MOV maintenance work.

Operational events on the day of the occurrence

As part of the annual maintenance shutdown at CS-N4, the valve preventive maintenance and compressor unit test runs were to be completed on June 23. The list below summarizes the operational events and decisions on the day of the occurrence.

Operational events and decisions on the day of the occurrence (times are approximate)^{Footnote 2}

07:00

• SP-2 arrived at CS-N4.
• SP-1 assigned SP-2 to a non-MOV repair.

09:00

• SP-3 arrived at CS-N4. (Note: SP-2 and SP-3 had been on site at various times during the shutdown, but this was only the second day that they had been on site together. SP-1 had been temporarily re-assigned to CS-N4, and was a certified station operator. Also, SP-4 was permanently assigned to CS-N4, but was in training as a station operator. Three of the 4 maintenance technicians were station operators, and the fourth was in the process of being certified. As a consequence, the SP-1 and SP-4 each thought that the other was the acting SO for CS-N4.)

09:15

• SP-1 conducted a job briefing with SP-2, SP-3, and SP-4. The job briefing addressed the order in which the valves were to be maintained.
• It was established that the following work activities would be performed at each MOV:
• open the limit-switch housing cover^{Footnote 3}, ^{Footnote 4} on the valve operator;
• manipulate the open and shut push buttons to verify the buttons;
• ensure that the MOVs stopped at the predetermined set-points when moved;
• check for the presence of moisture on the inside of the housing cover;
• listen for inappropriate noise from the valve motor; and
• check for screw tightness at all electrical terminal points.

09:30

• SP-1 instructed SP-2 and SP-3 to remove the cover bolts from the limit-switch explosion-proof housing cover on each of the MOVs. (Note: As the senior electrical and instrumentation technician, SP-1 intended to provide an in-service training exercise to the other electrical and instrumentation technicians and mechanical technician regarding the annual maintenance procedures. Removing the cover bolts ahead of time would facilitate the in-service training exercise, by reducing the time waiting for bolts to be removed).

10:00

• SP-3 entered the enclosure structure for MOV-0409, using the south unmarked man-door (i.e., with no FGE tag attached). The door closed behind the SP-3.
• SP-3 noticed the presence of gas, but continued with the assigned task of removing the bolts from the operator cover of MOV-0409. (Note: The cover remained closed after the bolts were removed.)
• SP-3 entered the portion of the enclosure structure housing MOV-0417. The presence of gas was also noticeable.
• SP-3 removed the bolts from the operator cover of MOV-0417.
• SP-3 exited the enclosure structure using the MOV-0417 door. On exiting, SP-3 propped the door open.
• Upon meeting SP-2 outside the enclosure structure, SP-3 commented on the presence of gas. SP-2 indicated that the FGE as a known problem, and that it had been leaking at this location for a while.
• SP-3 noticed the fugitive-gas-emissions tag attached to the man-door. As it was a known condition, both SP-3 and SP-2 assumed that a plan was in place to ventilate the enclosure structure later.

11:00

• SP-3 started to inspect the MOVs.

11:15

• SP-1 received a phone call from Spectra's Vancouver Gas Control Centre (VCGC), notifying SP-1 that there may be a problem at CS-N3, as CS-N3 had shut down.

11:20

• SP-1 informed SP-3 that SP-3's station (i.e., CS-N3) had shut down.
• SP-4 and SP-3 returned to the local control room to meet with SP-1 and to help rectify the problem at CS-N3.
• After unsuccessful attempts to rectify the problem remotely, it was decided that SP-3 should return to CS-N3.

11:30

• VGCC was informed that CS-N4 could provide the needed horsepower for gas movements scheduled for that day.
• The maintenance team decided that the CS-N4 maintenance work could be completed before re-starting CS-N3.

11:40

• SP-1 and SP-4 repaired a torque assembly and a faulty microswitch on 1 of the valves that SP-3 and SP-4 had been working on. The work required an electrical shutdown of that valve, which was shut off.
• At the completion of the repair, SP-4 returned to the local control room to restore power to the repaired valve.

11:50

• SP-1 moved on to the MOV-0409 enclosure structure, and entered using the south man-door. The sound of escaping gas was apparent on entering the enclosure. (Note: SP-1 had occasionally worked around escaping gas, and consequently, the sound of escaping gas alone was not a deterrent to entering the enclosure.)
• SP-1 approached the valve, climbed up onto a concrete block that facilitated access to the valve operator, and started the inspection.
• SP-1 raised the operator cover to observe the action of the torque switches, while pushing the buttons located on the outside face of the cover (Photo 3).

12:00

• Upon noticing an increased presence of gas, SP-1 closed the operator cover, and pressed the STOP button followed by the CLOSE button (Photo 4).
• By this time, SP-4 had returned from the local control room and started to enter via the south door into the enclosure structure, which put SP-4 in sight of SP-1. Upon noting a strong presence of gas, SP-4 started to warn SP-1.
• At that moment, the gas ignition and subsequent fire occurred. The force of the ignition blew SP-4 out the man-door approximately 7.62 metres (25 feet) from the enclosure structure.
• Both SP-4 and SP-1 sustained second-degree burns to their hands and faces. SP-1 sustained third-degree burns to the hands and arms and second-degree burns to the back. (Note: SP-1 and SP-4 were wearing inherently fire-retardant NOMEX IIIa coveralls.)

12:02

• Workers in the vicinity offered first aid, and attempted to extinguish the fire using portable fire extinguishers. CS-N4 and the associated piping were isolated and evacuated of all gas.

On 16 July 2012, at approximately 10:45, CS-N4 was returned to normal service, following completion of repair of the seals on the valve stem on MOV-0409, and other associated repair work to the enclosure. The skylight on the enclosure had been reinstalled, having previously been removed to allow gas to escape from the enclosure.

Site examination

During the site examination, the following was determined:

• The enclosure had sustained minor structural damage.
• Within the enclosure, fire damage had occurred to the upper portions. There was fire damage to the polyethylene film that covered the enclosure’s skylight. There was fire damage on the aluminum sheeting of the ceiling.
• Burn marks were present on the valve operator cover of MOV-0409.
• The TTV on MOV-0409 had been replaced with a bull plug (figures 4 and 5). The TTV is a safety feature of the valve, designed to warn company employees of the presence of a build-up of leaking gas within the cavity of the valve and of an inherent danger.
• The MOV-0409 valve was one-third open, which had allowed pipeline pressure gas to escape. The limit switches were energized.

Assessment of potential ignition sources

Spectra contracted GC Phillips Consulting Ltd (GC Phillips) to conduct an assessment of the conditions leading to the fire. Four possible sources of ignition for the leaking gas within the enclosure were examined:

1. Electrical spark or auto-ignition from the electrical housing valve operator heater,
2. Electrical spark from activation of the OPEN valve switch,
3. Mechanical spark from closing the limit-switch housing cover, and
4. Electrical spark from the motor stop switch.

The assessment determined the following:

• The ignition source was likely a spark from the motor stop switch, which occurred when the switch was commanded to CLOSE.
• The spark would have been sufficient to ignite the flammable mixture of gas that was present in the enclosure structure.

Regulatory requirements for pipeline integrity management

Section 40 of the National Energy Board (NEB) Onshore Pipeline Regulations, 1999, SOR/99-294 (OPR-99) specifies, in part, federally regulated pipeline companies are required to develop pipeline integrity management programs and to initiate corrective action for defects which are known to exist or are found to exceed criteria established by the CSA Z662.

Section 3.2 of the CSA Z662-11 (Pipeline System Integrity Management Program) specifies, in part:

Operating companies shall develop and implement an integrity management program that includes effective procedures for managing the integrity of the pipeline system so that it is suitable for continued service, including procedures to monitor for conditions that can lead to failures, to eliminate or mitigate such conditions, and to manage integrity data. Such integrity management programs shall include a description of operating company commitment and responsibilities, quantifiable objectives, and methods for:

1. Assessing current potential risks;
2. Identifying risk reduction approaches and corrective actions;
3. Implementing the integrity management program; and
4. Monitoring results.

Spectra’s pipeline integrity management system

Spectra’s pipeline integrity management system (PIMS) manual is the governing document for managing the integrity of its pipeline facilities. This document provides a systematic approach to identifying and mitigating potential risks to the pipeline.

PIMS also provides the basis for developing the company’s annual pipeline maintenance (PM) program. Together, PIMS and PM use a risk-based process to ensure safety and service reliability of the pipeline system.

Hazard-control hierarchy

A commonly used hazard-control hierarchy for high-risk work location consists of 4 broad categories:

1. Elimination of the hazard
2. Alternative methods of inspection or engineering controls
3. Administrative controls
4. Personnel protective equipment requirements.

As defined by the Quality Systems Toolbox (Figure 6), the control options are ranked in terms of effectiveness and sustainability: ^{Footnote 5}

• The most effective and sustainable control is physical elimination of the hazard.
• The least effective options are the use of administrative controls and the use of Personal Protective Equipment (PPE). These control options require increased employer participation and supervision to ensure the required level of risk mitigation.

Managing gas leaks: Elimination control

The Canadian Association of Petroleum Producers (CAPP)^{Footnote 6} document on best practices in the management of FGEs^{Footnote 7} specifies, in part:

Where feasible, repairs or replacements should be done within 45 days from the time the leak is detected. Where a major shut down is required to facilitate this work, or there are marginal economics for repairing the component, the repair or replacement may be delayed until the next planned shutdown, provided that this does not pose any safety, health or environmental concerns.

The timeline for repairing a leak is based on cost and risk. Cost is measured in terms of lost product and the associated environmental impact.

Leaks had been detected from MOV-0409 since 2006. Since that time, attempts were made on a number of occasions to install a temporary repair, using high-pressure grease. These efforts were ultimately unsuccessful. In August 2011, the FGE from MOV-0409 was quantified through a fugitive emission survey (FES). A FES is designed to identify emissions of natural gas and other hydrocarbons emanating from pressurized piping and associated equipment. The lost product from MOV-0409 was estimated to be approximately 245 tonnes CO2 (carbon dioxide equivalent). The dollar value of this lost product was about $48 000. The threshold at which a gas release must be reported to the provincial government of British Columbia is 10 000^{Footnote 8} tonnes. Gas releases must be reported to Environment Canada when the quantity lost reaches 50 000^{Footnote 9} tonnes. The FGE from CS-N4 was well below both reporting thresholds.

At the time of the occurrence, 8 of approximately 1000 valves at Spectra were experiencing gas leaks.

Based on a best practice from outside the Canadian pipeline industry, documenting and classifying hydrocarbon releases is a key performance health and safety indicator for Oil and Gas UK.^{Footnote 10} In North America, a classification system is being developed by the offshore industry that will define 3 health-and-safety risk categories, based on the scope of potential damage. The leak criteria for these risk levels have not yet been finalized. For federally regulated pipelines, both the NEB and the Transportation Safety Board (TSB) require the reporting of all natural gas releases.

Spectra's notification manual: Administrative control

In August 2007, Spectra's maintenance notification system was enhanced to capture the results of FESs, and to document the associated repairs at compressor stations. Within this notification system, all malfunctions are assigned a priority, which in turn determines the urgency of the required response. Spectra specifies the priority categories as follows:

Emergency: Includes work needed due to risk to personnel safety, immediate environmental impact, a breakdown affecting production or the possibility of major equipment damage. Response must be immediate and overtime is justified. This priority has a lead time set to 2 days.

Urgent: Includes work needed in a timely fashion to prevent the deterioration of a piece of equipment or operating system. There is no immediate threat, but action must be taken as soon as possible. This work does not take precedence over any scheduled work, manpower is not diverted, and overtime is not justified. This is the first work selected for the next planning period. This priority has a lead time set to 7 days.

Next PM: Includes preventive maintenance or work that will be done when the next preventive maintenance is scheduled. This priority has a lead time set to 45 days.

Routine: Includes work that is thoroughly planned and scheduled to take advantage of available capacity such as routine repairs, replacements, enhancements and project work that is not critical to the operation of the facility. This priority has a lead time set to 45 days.

Safety and Inspection: These 2 priorities are not used for notifications.

The priority assigned by Spectra to the MOV-0409 malfunction notification was “safety.” The safety priority has no associated lead time, and is not meant to be used for notifications. In this case, the repair required a station shutdown. Because the safety classification does not have a lead time, it was used when repairs were assigned to periods with lead times beyond 45 days.

Air-quality management within enclosure structures: Engineering control

When the enclosure structure was originally constructed, access to MOV-0417 and MOV-0409 was through a single-entry door to MOV-0417. Within the enclosure structure for MOV-0409, an air-inlet vent had been installed low to the ground, and an exhaust vent had been installed approximately 1 m (3 feet) below the roof of the building (Figure 7). In 2006, the man-door to MOV-0417 was equipped with an air-quality testing port and associated signage (Photo 5).

In August 2011, 2 weeks after the FGE from MOV-0409 was surveyed, a second door was installed on the enclosure (i.e., in the portion that housed MOV-0409). This second door would provide rapid egress if personnel became incapacitated on the MOV-0409 side of the enclosure. This second door was not installed with an air-quality testing port, which is a typical feature for man-door entrances to enclosure structures.

Facilitating egress to the outside of enclosure MOV-0409 ensured that the structure was not designated as a confined space, as per the federal and provincial occupational health and safety regulations. Spectra classifies the MOV enclosures as enclosed spaces, rather than as confined spaces. Its operator training manual^{Footnote 11} indicates that, before entering valve-enclosure structures,

• employees should check for gas buildup with a portable gas detector through the external sensing port, located on the man-door.
• employees are instructed not to enter if the atmosphere exceeds the safe work practices recommended limits.
• once within the enclosed space, the man-door should be held open while the enclosure is occupied. In this case, a length of lumber was available to prop the door open. (Note: On the day of the occurrence, there was no continuous air-quality monitoring or ventilation monitoring.)
• if occupancy is for an extended period of time, employees should refer to the safe work practice regarding a confined space. (Note: There is no indication of the time limit that would trigger a reclassification of an enclosed space to a confined space.)

During a limited employee survey related to air-quality measurements in enclosure structures, the following was determined:

• Spectra maintenance employees described the difference between an enclosed space and a confined space in terms of access and egress.
• The MOV enclosure structures were not perceived as confined spaces.
• Employees recognized that a confined space would have stricter entry requirements and would require at least 3 people at all times.
• The employees were not aware of the ventilation capacity within the enclosure structures.
• Employees did state that typical behavior was to leave the enclosure man-door open for a while before entry, to complete the preventative maintenance work.

Work planning: Administrative controls

Spectra established its maintenance cycles for gas transmission components based on industry best practices and manufacturer recommendations. Scheduling of maintenance and repair work is coordinated by its Asset Management Group, using a work-planning software application. The repair scheduling process is conducted on a monthly basis as follows:

• Each month, the maintenance cycles are used to create automated work plans for both electrical and mechanical work for gas transmission components.
• Field personnel can also generate malfunction notifications that are integrated into the automated monthly plans.
• The automated plans for the upcoming month are reviewed by a scheduler within the planning department, to ensure there are sufficient employees, contractors, and material for the work.
• Some maintenance work requires a shutdown of the compressor station. In these instances, work items are re-scheduled to a time when the compressor station is to be shut down (e.g., annual maintenance shutdown). Since a station shutdown involves purging all natural gas from the system, and any release of gas has both environmental and service delivery implications, non-critical repairs are typically scheduled during planned annual outages, which is typical of the oil and gas industry.^{Footnote 12}
• Work to be completed in a particular month is printed out. The resulting work plan is reviewed with site personnel.
• As the work list is sorted by “trades” (e.g., technician or contractor), sequencing of the work is at the discretion of the site personnel. The work plan is the core documentation that drives work for the shift.

In the June 2012 work plan, there were 39 preventive/predictive maintenance orders relating to work at CS-N4. The malfunction notification for MOV-0409 was not listed, as it was not scheduled for repairs in June 2012 due to lack of parts. Field workers commented that it appeared that malfunction notifications often disappeared from the work plan.

Also, the work-planning system does not consider a work item to be complete until a completed time is entered. It was noted that the completed time was not entered on a consistent basis. Consequently, from a maintenance-planning and scheduler perspective, it appears that the work is incomplete, and the work ends up on a backlog list for cleanup. Approximately 65% (estimated) of the backlog items had resulted from incomplete field-data entry into the work-planning system.

Work permitting: Administrative controls

Spectra's Safe Work Permit Practice (a section within the company's Safe Work Practices Manual) defines the range of permits and their requirements. This practice indicates that station operators issue work permits to employees and contractors if there is a potential safety impact during a work activity. The permit is a single form with check-boxes that can be configured to meet all work types, including hot work, cold work, and confined-space entry. According to Spectra's Safe Work Practices Manual, issuing a hot-work permit requires gas-monitoring tests. The Safe Work Permit Practice section defines a confined-space entry permit, but does not mention nor provide guidance for an enclosed-space entry permit. On the permit itself, the issuer can select the type and frequency of atmosphere monitoring. However, there is no place on the permit to indicate whether atmosphere testing had been performed before entry.

Spectra practices relating to work permits include the following:

• Work permits are to be issued before the commencement of work.
• A SO can self-permit only if there will be no impact on compressor-station operations. Self-permit is typical in the industry for facilities that are often operated by a single person.
• The SO is not required to issue a permit for routine operational duties (e.g., inspections, non-maintenance work, and daily, weekly, or monthly checklists).
• Once issued, a permit will remain on site for 2 years.

Work permits are used for both hot work and cold work. Some site personnel were uncertain whether the planned PM inspection work that day required a hot-work permit or a cold-work permit. However, as the scheduled work did not include welding, cutting, burning, grinding, or the use of non-intrinsically safe tools, the cold-work process was used.

At CS-N4, the field practice related to self-permitting had evolved to the point where it was not uncommon to record permitting details after work had been completed.

In Canada, the pipeline industry has developed a number of strategies to address the use of self-permitting. For example, the Canadian branch of one major oil and gas company^{Footnote 13} uses a feedback mechanism, whereby an employee contacts an issuing authority before and upon completion of the work. Once the job is complete, the worker signs off the permit, and contacts the issuing authority to advise on the status of the work and report that the worker is leaving the location. Another strategy used is to integrate work-permit management into the product-maintenance scheduling software.^{Footnote 14}

Personal gas detectors: Personal-protective-equipment control

In March 2011, Spectra initiated training in the use of handheld, personal, portable gas detectors for work at compressor stations. Spectra sent a number of employees to the manufacturer for training in the operation and maintenance of the personal gas detectors. Using a train-the-trainer approach to information dissemination, these trained employees were expected to share the information with their colleagues. At the time of the occurrence, the transition from the use of handheld portable gas detectors to wearable portable gas detectors was still in progress.

Decision-making and risk adaptation

Decision-making in high-risk contexts such as Spectra's CS-N4 is driven by experience,^{Footnote 15} which in turn is driven and reinforced by the outcomes from risk-management behaviours.^{Footnote 16} As the benefits of risky behaviors and the costs of safe behaviors increase compared to the costs of risky behavior and the benefits of safe behavior, individuals will accept more risk. The set-point that defines acceptable risk management slowly drifts toward greater perceived efficiency, and, often unknowingly, into a more risky space.

Social normalizing pressures will tend to propagate behaviors across members of a group. In the absence of identified hazards, accidents, or reported close calls, organizations may not recognize the fact that normal adaptations are adjusting the risk boundary outward into a region of increased likelihood of an adverse outcome. This process is risk adaptation.

In addition, Klein's expectation-primed decision-making model highlights that the more skilled an individual is, the more likely that individual's decision-making will be influenced by expectation. The down-side is that expectation can mask subtle cues that indicate that the situation is not as expected, and may be more risky. The implication is that situations will appear normal or familiar, unless the “out of the ordinary” instance is of sufficient magnitude to attract attention and subsequent analysis.

Explicit effort is required to anchor behaviour such that risk is managed in the field to the same level as it is described in policy documents and manuals. Typical strategies to ensure that behaviour is aligned with risk-management expectations include reassessment of risk and risk-mitigation strategies when contexts change; developing specific, context-appropriate standard operating procedure documentation for safety-critical operations; and ensuring that operating practices align with procedures. This alignment of behaviour with policy is a critical requirement that characterizes closed-loop risk management systems.^{Footnote 17} In the absence of adverse outcomes, this effort is increasingly seen in terms of costs by employees and management alike.^{Footnote 18}

The accident

At the time of the occurrence, Spectra personnel were performing preventive maintenance and inspection on MOV-0409 as part of an overall annual inspection program for the MOVs located in CS-N4. MOV-0409 was enclosed within a weather protection structure. The maintenance work involved testing the valve limit switches and adjusting the torque settings within the housing of the electrical valve operators. Before the enclosure structure was entered, it had not been tested for the presence of gas, and the Spectra employees were not wearing personal gas detectors.

A leak had been first noted in valve MOV-0409 as early as 2006. With a continuous gas leak since at least August 2011, it is likely that the flammable mixture of gas had existed in the upper portion of the enclosure structure before the start of work. In addition, the tattle-tale vent (TTV) on MOV-0409 had been replaced with a bull plug (BP). With the BP installed, the only route for the released gas coming off the valve stem was to exit the valve body through the top of the valve actuator. Replacing the TTV with a BP negated a safety feature of the valve that was designed to warn company employees of a potentially hazardous presence of natural gas. The accident occurred when MOV-0409 was moved from the fully-closed to the fully-open position, which increased the flow of natural gas through the leaking valve stem. The pipeline gas was released through the valve stem into the enclosure structure. During the attempt to shut the valve, a spark from the motor stop switch likely occurred when the CLOSE button was activated. The spark was sufficient to ignite the flammable mixture of gas that was present in the enclosure structure, resulting in the fire, the explosion, and the subsequent injuries to 2 maintenance workers.

Management of gas leaks

Starting in August 2011, when the fugitive emission survey (FES) identified the leak at MOV-0409, a FGE tag on the outside of the man-door of the enclosure structure for MOV-0417 was used to flag this danger. However, when a second man-door for MOV-0409 was installed at this enclosure structure, no additional FGE tagging was added. When fugitive gas emission (FGE) tags are not installed at all entrances to enclosure structures where there is a leaking valve, maintenance workers may underestimate the potential dangers, increasing the risk of worker injuries and fatalities.

Cost/benefit and environmental-impact criteria are well developed triggers to motivate the repair of gas leaks. However, FGEs can be left unrepaired for 45 days or longer, depending on whether the facility must be shut down for the repair. In this occurrence, the leak was known and had been documented and tracked for at least 10 months. As repair parts were unavailable, the repair was not scheduled for the June 2012 station outage. Spectra had developed an operator training manual, which specifies the procedures for entering valve-enclosure structures. These procedures include air testing for the presence of gas and personal protective equipment (PPE) requirements. In terms of the generally-accepted hierarchy of risk-management options, risk management of this leak was administrative at the site level. Reliance on administrative procedures and use of PPE as primary risk-mitigation defences is intrinsically weaker than fixing the problem.

Air-quality management within enclosure structures

Within the enclosure structure for MOV-0409, ventilation vents had been installed low to the ground and approximately 1 m (3 feet) below the roof of the building. The placement of the upper vent was not optimal, as it allowed gas to accumulate near the ceiling. The enclosure was originally constructed with a single entrance, which was the west door to the MOV-0417 enclosure. In 2006, an air-quality testing port was installed on this door. In August 2011, when FGEs were detected from MOV-0409, a second exit door to facilitate egress was added. By focusing on the egress requirements only, Spectra installed the second door without an air-quality testing port, which was a typical feature for the other enclosures. In the absence of industry standards and/or recommended guidelines for the design, construction, and installation of enclosure structures, some enclosures may not be optimally designed to maintain air quality, increasing the risk of worker injuries and fatalities.

Work planning

Scheduling maintenance and repair work at Spectra was conducted using a work-planning software application. There were a number of information deficiencies and inconsistencies relating to the use of this work-planning system, including the following:

• The monthly work plan identifies the work to be done in that month. In this occurrence, the June 2012 work plan included the annual preventive maintenance for a valve with a leak that had existed for at least 10 months. During the work-planning process, it was determined that the required parts were not available. Consequently, this repair activity had to be rescheduled, and was therefore removed from the work plan. Field workers commented that it appeared that malfunction notifications often disappeared from the work plan.
• The monthly work plan did not display the pre-existing hazard (i.e., FGE) associated with MOV-0409, thus decoupling the repair-status information from the regular maintenance schedule. This decoupling resulted in a maintenance plan that did not address how the work was to be performed in the context of a leaking valve. As a result, the sole risk-mitigation strategy was reliance on the team leader and maintenance personnel to remember the repair status of equipment at their site and to discuss its implications at the pre-job briefing session.
• An estimated 65% of recorded backlog each month was due to incomplete data-entry from the field, arising from confusion regarding how and when hours of work must be updated from the default values in the system.
• The priority assigned to the malfunction notification at MOV-0409 was “safety.” Because the safety classification does not have a lead time, this category was typically used when the period for repairs was beyond 45 days. Maintenance technicians adapted a non-recommended priority classification to accommodate data entry of repairs that did not have a finite repair date.

As a result, the Spectra work-planning tool was not well aligned with the operational expectations of field technicians.

Self-permitting

Self-permitting by station operators is a necessary requirement in installations where there is normally only 1 employee. This process ensures that employees on their own still work through the hazard-assessment and risk-mitigation process. However, when the issuer and the receiver are the same person, the permitting activity becomes a reflective task; there is no dialogue between 2 people. Over time, the self-permitting process can become repetitive and lose relevance. Without appropriate reinforcement, it may be seen as a paperwork activity that interferes with efficient workflow and can be deferred to a later time.

At CS-N4, field practices regarding permitting of Spectra employees had adapted to the point where it was not uncommon to record permitting details after work activities had been completed. When work permits are not completed before the start of the work, employees may not fully consider all potential work site hazards, increasing the risk of workplace accidents.

At Spectra, there is no connection between the generation of the monthly work schedule and the associated safe-work permits, whether self-permitted or issued by the station operator. Safe-work permits are generated on site and remain at the compressor stations. This practice serves to isolate field risk-mitigation practices from back-office planners, schedulers, and the team leader. Under these circumstances, it is very difficult for management remote from the stations to detect how self-permitting is evolving. The lack of a rigorous permitting process by a CS-N4 station operator familiar with the site resulted in a lost opportunity for senior personnel to reinforce appropriate translation of corporate policies and associated documents into field practice.

Decision-making risk adaptation by maintenance workers

At the time of the occurrence, the maintenance crew's perception of risk had adapted considerably. Habituation to this long-standing leak had reached the point where entry into MOV-0409 was seen to be no more risky than entry into any of the other MOV enclosures. Factors that reinforced this risk adaptation include the following:

• The absence of clearly defined limits to the capacity of the passive venting configurations within MOV enclosures, leading to inconsistent approaches to when the entry door remained open.
• The absence of a FGE tag on all entry doors.
• The absence of valve repair status on the maintenance worksheet.
• The adaptation of the self-permitting process to the point that permits were completed after the work was completed. The lack of a mechanism to tightly couple permitting and its associated risk assessment with work items before the start of work allowed this adaptive behaviour to evolve.
• The absence of specific risk-assessed standard operating procedures, resulting in maintenance technicians developing procedures from a variety of procedural and manufacturer documents (e.g., TTV replaced with BP, removal of the limit-switch housing cover bolts while the equipment was energized).
• Previous experience with working in environments with leaking gas, resulting in an underestimation of the risk associated with the sound of escaping gas.

When risk adaptation occurs and perceived risk is diminished, cues to potentially hazardous situations (e.g., the presence of leaking gas) will be overlooked, increasing the potential for workplace accidents.

Site management practices

At Spectra, field operating procedures related to such things as permitting, enclosed-space entry, valve maintenance, and use of new PPE were managed using a largely “open-loop” approach. That is, documented policies and procedures were required to be read, and satisfactory completion of multiple-choice quizzes reinforced learning points. It was assumed that operational practices were derived appropriately. There was no site-level routine monitoring and documentation of new hazards (e.g., the leaking valve) or specific risk-assessed standard operating procedures by which field practices could be benchmarked. By contrast, “closed-loop” management systems include ongoing feedback mechanisms to ensure that the system is performing within predicted boundaries. In the absence of continuous monitoring and risk assessment, “open-loop” site-management practices can reinforce risk adaptation by employees, resulting in operational practices that are inconsistent with the risk reality.

Findings as to causes and contributing factors

1. The accident occurred when escaping natural gas from a leaking valve stem found an ignition source and ignited.
2. The valve stem was leaking due to the failure of 2 stem-seal o-rings for MOV-0409.
3. Ignition of the natural gas likely resulted when the MOV’s close button was activated in an attempt to shut off the increased flow of gas. This action produced a sparking contact within the open electrical housing operator, and ignited the gas.
4. The enclosure structure had not been tested for the presence of gas before the start of the work, and the Spectra employees were not wearing personal gas detectors.
5. The work plan did not display the pre-existing hazard (i.e., FGE) associated with MOV-0409, resulting in a maintenance plan that did not address how the work was to be performed in the context of a leaking valve.

Findings as to risk

1. When fugitive gas emission (FGE) tags are not installed at all entrances to enclosure structures when there is a leaking valve, maintenance workers may underestimate the potential dangers, increasing the risk of worker injuries and fatalities.
2. In the absence of industry standards and/or recommended guidelines for the design, construction, and installation of enclosure structures, some enclosures may not be optimally designed to maintain air quality, increasing the risk of worker injuries and fatalities.
3. When work permits are not completed before the start of the work, employees may not fully consider all potential work site hazards, increasing the risk of workplace accidents.
4. When risk adaptation occurs and perceived risk is diminished, cues to potentially hazardous situations (e.g., the presence of leaking gas) will be overlooked, increasing the potential for workplace accidents.
5. In the absence of continuous monitoring and risk assessment, “open-loop” site management practices can reinforce risk adaptation by employees, resulting in operational practices that are inconsistent with the risk reality.

Other findings

1. Reliance on administrative procedures and use of personal protective equipment as primary risk-mitigation defences is intrinsically weaker than fixing the problem.
2. Replacing the tattle-tale vent with a bull plug negated a safety feature of the valve that was designed to warn company employees of the presence of gas.
3. The Spectra work-planning tool was not well aligned with the operational expectations of field technicians.
4. The lack of a rigorous permitting process by a CS-N4 station operator familiar with the site resulted in a lost opportunity for senior personnel to reinforce appropriate translation of corporate policies and associated documents into field practice.

Safety action taken

On 10 July 2012, the Transportation Safety Board (TSB) sent a safety information letter to the National Energy Board (NEB) advising it of this occurrence and stating that the Spectra employees had not been wearing personal gas detectors.

The following safety action was taken by the NEB following the occurrence:

1. An NEB health and safety officer issued an assurance of voluntary compliance (AVC) under the Canada Labour Code, which required Westcoast to submit its hazard prevention program and the hazard assessments conducted for valve-enclosures, for preventive maintenance and repairs to valves, and for working in the presence of natural gas. The AVC also required Westcoast to submit a corrective-action plan addressing the recommendations of the GC Phillips report. The NEB plans to conduct follow-up compliance activities, such as inspections, to assess Westcoast’s implementation of its commitments made in response to the AVC.

The following safety actions were taken by Westcoast following the occurrence:

1. A natural-gas-leak survey was conducted at all facilities within the transmission business division, including compressor stations and meter stations. A leak-reporting process has been implemented to ensure that all leaks, including fugitive emissions, that are not immediately repaired are entered into Westcoast’s incident learning and prevention system, and that a maintenance notification is entered into Westcoast’s general administration system that manages facility-maintenance planning. New maintenance notifications are reviewed weekly, and leak notifications are coded to enable tracking of the repair.
2. All fugitive emission locations were tagged and the area ribboned off. If the leak posed a threat to employees, the public, or the environment, the equipment was taken off-line and repaired, or measures were taken to mitigate the threat. All fugitive emissions that could not be immediately repaired were scheduled for repair at the next available equipment outage.
3. A fugitive emission survey (FES) process has been developed and will take place before a major facility outage.
4. All valve enclosures on the transmission system have been audited, and deficiencies in internal-atmosphere test ports and required signage have been corrected.
5. The valve-enclosure design standard has been updated to address design, construction, and materials. All valve enclosures will be assessed against this standard and either upgraded to meet the standard or removed if the enclosure is no longer required.
6. The allowable limit for certain work in a hazardous atmosphere has been reduced for transmission facilities to 0% of the lower explosive limit.
7. Based on this occurrence, as well as current industry practices, the safe-work permit for transmission facilities has been updated to better anticipate potential workplace hazards.
8. The valve-enclosure entry procedure has been updated.
9. A major-incident correction-actions project has been initiated across Westcoast’s western Canadian operations, to review and upgrade, as required, Westcoast’s safety processes and standards, including work permits.
10. The workplace hazard prevention program for Westcoast’s western Canadian operations has been revised. Workplace hazard assessments for all transmission facilities will have been completed in accordance with this program by 31 December, 2013.
11. Field-level safety assessments are now required, and are incorporated into a safe-work plan form.
12. Employees working on transmission facilities must wear a 4-head personal gas monitor.

Employees (management and workers) have been reminded that they must comply with safe work practices and procedures, or risk disciplinary action.

This report concludes the Transportation Safety Board’s investigation into this occurrence. Consequently, the Board authorized the release of this report on 17 July 2013. It was officially released on 26 September 2013.