Abstract
Automation bias was likely the main contributing factor in the Enbridge pipeline disaster that occurred on July 26, 2010, when large amounts of crude oil were released into the Kalamazoo River and Talmadge Creek. An examination of the Enbridge oil pipeline accident suggests that complacency and automation bias played leading roles but were overlooked by regulators. Moreover, we believe that because the National Transportation Safety Board overlooked existing research on automation bias, its recommendations are flawed and could exacerbate, rather than alleviate, the problem. Industry, policy makers, and regulators need to consider automation bias when developing systems to reduce the likelihood of complacency errors.
Keywords
Less experienced operators and better adherence to safety protocols might have prevented failure to attend to repeated warnings that a shutdown was necessary.
On July 26, 2010, Enbridge Energy Partners’ 6B heavy-crude pipeline ruptured near Marshall, Michigan, resulting in the largest inland oil spill in American history. In the Enbridge control room in Edmonton, Canada, pipeline operators with decades of experience ignored critical alarms that required emergency shutdown of the line. Instead, they pumped more crude oil into the line for 17 hours. In Marshall, Michigan, reports of crude-oil smells began shortly after the spill, but emergency responders were unaware of the source. Enbridge had not engaged with first responders to establish emergency protocols and did not contact its local employees to inspect the line for spills.
When the pipeline was finally shut down, nearly 1 million gallons of diluted bitumen (dilbit) were spilled into nearby wetlands and rivers, causing severe damage to the ecosystem and endangering the health of local residents. The heavy crude sank to the bottom of riverbeds and lakes, thereby rendering ineffective traditional cleanup methods such as skimming. Cleanup costs alone would eventually exceed $1 billion (Smith, 2013).
A subsequent investigation by the National Transportation Safety Board (NTSB) found a “culture of deviance” for covering up flaws in the pipeline and for failing to follow safety protocols. Project managers charged with overseeing the pipeline’s integrity failed in recognizing warning signs that preceded the pipeline rupture, failed in responding to critical alarms, and failed in implementing appropriate containment and cleanup procedures.
We contend that it was not deviance but complacency brought about by automation bias that led to the Enbridge pipeline disaster. Mosier, Skitka, Heers, and Burdick (1998) define automation bias as the “omission and commission errors resulting from the use of automated cues as a heuristic replacement for vigilant information seeking and processing” (p. 47). Although early studies of automation bias focused primarily on the aviation industry, the phenomenon has been observed in a wide range of settings that involve the “detection and repair of malfunctions in complex technological systems” (Bahner, Hüper, & Manzey, 2008, p. 689). Over time, operators who experience false alarms are less likely to respond in an appropriate manner to real system failures (Meyer, 2001).
If automation bias was the chief contributing factor in the Enbridge Pipeline spill, the NTSB’s recommendation to increase training to reduce the risk of future spills may have the opposite effect and increase the risk of future spills.
Background and Sequence of Events
Founded in 1949 as the Interprovincial Pipe Line Ltd., Calgary-based Enbridge Energy Partners managed the world’s longest crude-oil pipeline system. In the 1990s, the company expanded into the United States and acquired natural gas assets in both countries. The company was renamed Enbridge in 1998 to better reflect its increasingly diversified and international operations (Enbridge, 2015b).
Enbridge described itself as “a leader in the safe and reliable delivery of energy in North America” and “one of the Global 100 Most Sustainable Corporations in the World” (Enbridge, 2015a). In 2010, Enbridge posted revenues of more than $15 billion and net earnings of $970 million. The company employed 6,500 people in Canada and the United States.
On July 25, 2010, an operator (Operator 1) with 29 years of industry experience arrived early to help with a scheduled 30-day shutdown of line 6B, which carried dilbit from the Alberta oil sands through several American states and ultimately to a refinery in Sarnia, Ontario, Canada. During his three decades with the company, banks of switches and lights had gradually been replaced by the massive LCD screens that provided up-to-date data on the company’s distribution lines. However, in this case, modern technology would end up exacerbating the problem as operators and other Enbridge employees misinterpreted key data.
Other than moving the shutdown ahead by one hour to avoid a conflict with another operation, everything appeared to be going according to plan. At 3:58 p.m., Operator 1 issued a stop command to the pump at Mendon Station, some 40 miles upstream from the station at Marshall, Michigan (NTSB, 2012).
Suddenly a high-priority low-pressure alarm went off, prompting the Marshall Station to shut down its pumps to prevent damage (Figure 1). Over the next several minutes, more alarms went off at Marshall, indicating improper pressure readings. By the time the operator was able to reach the materials balance system (MBS) analyst, an engineer who oversaw pressure levels in the pipeline, the alarms had cleared. The MBS analyst assured the operator that the alarms had been caused by column separations, a usually harmless phenomenon in which gas bubbles form due to pressure changes, thereby mimicking a leak. Column separations were common during shutdowns, and considering that the alarms had cleared, the MBS analyst told the operator to proceed as planned. By the time the operator ended his shift a couple of hours later, there had been no further alarms, and he did not even think to mention the earlier alarms to the next shift operator.
Initial pressure drop on line 6B. Sequential pressure drops are observed beginning with the Griffith Pumping Station near Chicago at 5:55 p.m. (top), followed by an abrupt drop in pressure at Marshall Station at 5:58 p.m. (bottom). In response to the loss-of-pressure alarm, the operator increases pressure at the Stockbridge Terminal to avoid a perceived column separation. Source. National Transportation Safety Board.
Meanwhile, nearly 2,000 miles away, a 911 dispatcher for rural Calhoun County, Michigan, began to receive calls of natural gas and crude-oil smells. First responders sent to investigate were unable to locate the source but noted strong crude-oil smells (Carlson, 2010). None of the first responders was aware that Enbridge owned a pipeline that pumped 43,000 cubic meters of heavy crude oil through their county each day.
Back in Edmonton, the night shift operator (Operator 2) who had taken over from Operator 1 continued to follow procedures as usual, unaware of the situation unfolding in Michigan. It was not until after 2:30 a.m. that a new set of high-priority alarms went off indicating volume imbalances near Marshall. This time, the alarms continued to sound for nearly two hours.
The night operator, like the MBS analyst, thought the low pressure at Marshall might be caused by a column separation. To clear the alarm, he decided to add 1,600 cubic meters to the line, but nothing came out the other end. He then decided to consult the night shift MBS analyst, who recommended pumping more crude into the line to clear the column separation. When that did not work, both approached the control center operation supervisor for advice. “There are two choices here. Either consider it a leak, or try it again,” the supervisor answered (NTSB, 2012, p. 12). But if it were deemed a leak, regional management would need to become involved and the line would have to be shut down under emergency protocols. They decided to call it a false alarm and recommended trying again (NTSB, 2012).
The operator followed the procedure for false alarms, which states,
If shift leader and MBS determine that the MBS alarm is temporary, pipeline operator continues normal operations. No pipeline shut down is required or if pipeline was shut down, resume normal operation. (NTSB, 2012, p. 12)
The less experienced operator protested because the readings simply did not look right. He had already pumped significant amounts of additional volume into the line and the pressure remained low, but the supervisor assured him that he was overreacting. Even in a worst-case scenario when a leak had occurred, the crude would simply be put “on the ground.” The supervisor had seen leaks occur before, and, unlike offshore oil spills, they were easily contained and remediated.
As soon as the line began pumping more crude, it set off more alarms. By 6:00 a.m., it was nearing the end of the shift and the pumps were operating at their maximum capacity. Still, the pressure imbalance was not improving. Although Operator 2 was concerned, there was not much he could do. “The oil has to be going somewhere,” he said to the operator next to him. “Whatever,” replied the other operator. “We’re going home and will be off for a few days. Let’s not worry about it anymore” (Munroe, 2012).
When the morning shift supervisor reviewed the logs of the previous shifts, he was dismayed that the pressure imbalances had not yet been resolved. He decided to call the Chicago regional manager, who was responsible for the line. Previously, the regional manager had served in a similar capacity for Enbridge’s Lakehead system, which ran from North Dakota to Chicago. In 1991, a major spill along the Lakehead system occurred near Grand Rapids, Minnesota. The subsequent investigation led to industrywide procedure changes, including what was known as “the 10-minute rule.” Simply stated, if a pipeline operator could not determine the cause of an alarm within 10 minutes, the operator was required to initiate emergency shutdown procedures (Kemp, 2013). The regional manager was unconcerned because he was certain that someone would have smelled the crude and reported a spill.
At 9:17 a.m., Enbridge received a call from an employee of Consumer Energy Gas in Marshall. Consumer Gas had been getting calls all night about gas smells, and the employee had been out looking for the source. The phone operator called the control room to say that there was oil on the ground near Marshall and in one of the creeks. The shift supervisor called the regional manager back to ask that they send someone out to check the complaint. The supervisor was assured that “it’s not a priority” to close the line, but they would send someone out to look at it.
When the leak was finally confirmed nearly two hours later, the supervisor notified Marshall’s police department and began emergency shutdown procedures. By then, nearly one million gallons of dilbit had been spilled into the wetlands around Talmadge Creek (Figure 2), more than 80% of which was the result of extra crude that had been pumped into the line in order to restore pressure.
River system spill impact. Nearly 1 million gallons of diluted bitumen – a mixture of heavy oil and toxic dilutants, such as benzene, naphtha, and hydrogen sulphide – spilled into Talmadge Creek (bottom right) and was carried 35 miles downstream along the Kalamazoo River (left).
A Culture of Complacency
Concerns about the integrity of the 6B pipeline were raised as early as 2005, when the company undertook an engineering study of the 40-year-old pipeline. At the time, a junior analyst revealed “crack fields” as long as 51 inches. However, instead of reporting the need to repair the cracks, the senior analyst who oversaw the study changed the term crack field to crack-like feature, thereby giving Enbridge a green light to continue using the line (Pipeline and Hazardous Materials Safety Administration, 2014). Cracks that had troubled a junior analyst with very little field experience were less disconcerting for the more senior analyst, who had observed many cracks that did not rupture.
The Marshall spill was not the only accident facing Enbridge. The company’s director of environment, health, and safety explained that in 23 years, Enbridge went without a single fatality, and then over a period of 6 months, Enbridge had three fatalities in separate incidents. The director blamed a culture of complacency. People with many years of experience became accustomed to doing jobs in a certain way. This long period without accidents instilled a false sense of security, he explained, in which very experienced people were no longer afraid of workplace safety risks. That attitude, in turn, led to shortcuts that caused accidents. He was increasingly frustrated that Enbridge staff simply ignored protocols and directives (Koby, 2012).
Enbridge managers made critical errors based on the false belief that the alarms were caused by a harmless column separation. Alarms sound regularly during routine shutdowns, and in nearly every case, they are caused by column separations. As a result, Enbridge operators ignored safety protocols, such as the 10-minute rule. Had they followed the 10-minute rule, the damage would have been minimal. Instead, their experience with previous alarms suggested that the way to address it was to pump more crude into the line to clear a nonexistent column separation.
Pipeline operators are frequently faced with critical alarms. Each time they shut down the line, it reduces the amount of product that can be delivered to customers, which can prove costly and reflect poorly on operators. A less expensive option is to request visual inspection of lines, but this option can also be taxing to local employees who are called out frequently to respond to false alarms. Visual inspection can also take time and result in a larger release.
The cost of the cleanup to Enbridge is estimated to be $1.2 billion, which represents more than a year of company earnings and does not take into account the human and environmental toll to the local community. Dead wildlife cannot be brought back to life, and health effects cannot be undone. If one added up the costs of responding to every false alarm by shutting down lines, would it come even close to the cost of remediating this one spill? Probably not. Consider BP, which in 2006 shut down its Trans-Alaska Pipeline with twice the capacity of line 6b. BP estimated that the total cost in materials and lost revenue to replace 25 km of leaking pipe was $170 million (Lee, 2006).
Enbridge managers relied on reports by residents and first responders. Oil spills produce strong odors that are hard to ignore. Experience suggested that had a spill occurred, someone would have reported it to the company. People did notice but were not aware of a pipeline in the area. As noted earlier, not even first responders knew of the existence of line 6B. Therefore managers did not call on local employees to inspect the line for problems even though those employees were stationed only a short distance from the spill at Marshall Station. The emergency check on-site mechanism was faulty in its setup and thus proved ineffective.
The NTSB placed most of the blame on control room operators. Investigators reported the following:
“Due to the rapid growth of Enbridge’s pipeline system, Enbridge hired additional control center staff without objectively assessing whether that growth in personnel would affect safe operations.
“The leak detection process was prone to misinterpretation, and control center analysts and operators were not adequately trained in how to recognize or address leaks, especially during startup and shutdown. Therefore, low-pressure alarms, material balance system alarms, and sudden and complete loss of pump station discharge pressure were mistakenly attributed to column separation rather than a pipeline rupture. Furthermore, the control center ignored warnings from field and operations personnel that there was a possible leak. In postaccident interviews, control center personnel attributed its disinclination to believe a rupture had occurred to the absence of external leak detection notifications, despite known limitations of the leak detection system.
“Control room personnel did not follow the established procedure to shut the pipeline down if column separation couldn’t be resolved within 10 minutes.
“Enbridge failed to train the control center staff in team performance, which resulted in poor communication and lack of leadership.” (Pipeline and Hazardous Materials Safety Administration, 2014).
The NTSB’s recommendations paint a picture of inexperience and poor management. Yet, we know that the key decision makers had decades of experience. A more likely explanation points to automation bias and complacency.
According to some researchers, a problem such as occurred in the Enbridge case cannot be addressed by better training, given that it is human nature to ignore frequent false alarms. Parasuraman and Wickens (2008) found that training did not improve operator accuracy in complacency studies. In fact, the only time that training improved operator reliability was when operators had to balance multitasking operations. In some instances, operators could be taught to exercise better judgment in automated tasks when multitasking manual tasks, although the initial reliability was lower.
An example cited by Parasuraman and Wickens involved manually monitoring fuel levels in an engine while at the same time tracking engine conditions electronically. Subjects who were multitasking missed engine alarms more frequently than did those who only had to monitor engine conditions. Under these restricted conditions, multitasking subjects could be taught to recognize engine alerts better. However, Enbridge control room operators were singularly focused on one task. Moreover, the problem had less to do with detection and more to do with interpretation and response.
Complacency studies suggest that the only effective way to address the problem is to create reliable systems (Moray & Inagaki, 2000). If that is true, the NTSB’s recommendation to have more experienced operators could be counterproductive, as experience breeds complacency. Counterintuitive as it seems, properly trained new employees might be more effective than experienced ones. A good example is the junior analyst who discovered crack fields in the pipeline but was overruled by a more experienced senior analyst. Junior employees have less experience with the negative consequences of responding to false alarms and are therefore more likely to follow standard procedures.
More reliable systems that reduce the number of false alarms might improve operator reliability, but the costs of implementing such systems can be prohibitive. For instance, leak detection systems have become more common in newer pipelines, but it can be prohibitively costly to retrofit older lines. Even when such systems are cost-effective, they might not improve operator reliability.
According to Parasuraman and Manzey (2010), “complacency occurs for highly reliable (yet imperfect) automation and even when the automation fails on only a single occasion in the operator’s experience” (p. 390). Complacency is reinforced when there are “no performance consequences” (false alarms), and complacency is reduced when failures occur and result in performance consequences (actual spills). In automation studies, subjects who were exposed to repeated variable signal reliability over much shorter periods increased detection efficiency (Parasuraman, Molloy, & Singh, 1993). This result would suggest that operators who have been responsible for spills might be better suited to make correct decisions than would operators without incidents.
Unfortunately, performance consequences failed to improve decision making in the Enbridge spill. Despite having overseen a similar spill in 1991, the regional director ignored overwhelming system data and repeated alarms, choosing instead to rely on public reports of noxious smells. We believe that performance consequence learning is unlikely to override complacency when it comes to rare catastrophic events such as the Enbridge pipeline spill.
The Enbridge case demonstrates that automation bias is not limited to airlines and air traffic. Although few managers are likely to have responsibility for pipelines, greater awareness of the problem of complacency may help to reduce the serious economic, environmental, and social costs associated with poor decision making in critical infrastructure systems.