The Swiss Cheese Scenario: 25 Years Ago a Gas Pipeline Exploded in Whatcom County. Here’s how it Happened

This article first appeared in Salish Current.

It was the beginning of Bellingham’s night of hellfire.

At precisely 3:24:53 pm. on June 10, 1999, a block valve shut off the flow of gasoline to Olympic Pipe Line Co.’s Bayview terminal in Burlington. Minutes later, pressure spiked rapidly in the company’s 16-inch pipeline from 215 psi (pounds per square inch) to near 1,500 psi and almost immediately dropped back to normal. The pressure spike found a weakness in the pipe near Whatcom Creek. The pressure was relieved by the pipe’s rupture.

The leak of more than a quarter million gallons of gasoline and resulting explosion and fire shook Bellingham, its environment, and its people 25 years ago. The disaster was compounded by the deaths of two boys and a young man who had been at Whatcom Creek that day.

Events spanning several years converged on the day when one set of holes on several slabs of metaphorical Swiss cheese lined up, to disastrous effect. “Swiss cheese” may sound like a trivial way of measuring the horrible consequences of a sequence of mistakes. But for those who study the causes of industrial accidents, the Swiss cheese model (SCM) is serious business. The National Transportation Safety Board (NTSB) now uses it as part of its analysis of accidents to see what can be learned to avoid the same thing happening again.

Be it a surgeon’s misstep, an airliner crash, a bridge collapse or an industrial accident, the trail of seemingly small errors in judgment can add up to a catastrophe. SCM was put forth in a 1990 book, Human Error, by behavioral psychologist Dr. James Reason. The model suggests that serious accidents are often the result of “active failure” — triggering incidents — combined with “latent error” — conditions or mistakes that might only be discovered in hindsight.

In Reason’s analysis, layers of safety systems are likened to layers of Swiss cheese, famous for the random holes created in its making. Almost inevitably, each slice has a potential weakness or hole. When one set of holes align through all the layers, the defenses against an accident have failed.

Carl Weimer, former executive director of the Bellingham-based Pipeline Safety Trust, established in response to the explosion, takes the cheese analogy quite seriously. He remains an evangelist for pipeline safety.

“When giving presentations at conferences, etc., I do use a slide of the Swiss cheese model because in that type of visual setting it makes it easy for people to understand,” said Weimer, who is still an adviser to the PST.

Sequencing the road to catastrophe

A key early step in the progression toward the Olympic disaster was, by all measures, a good one. On Nov. 18, 1991, the pipeline managers hired a company called Tuboscope to run a test using a “pipeline intervention gadget” or “pig” for short. The test would cover the 37 miles of pipe running from the two refineries at Ferndale to Olympic’s Allen pumping station at Mount Vernon.

The pig came in the form of a device called a “magnetic flux leakage tool” inside the pipe to detect any anomalies such as dents and loss of thickness through corrosion. Tuboscope reported that all seemed fine, which NTSB later acknowledged as correct.  

So, the baseline condition of the piping was established in 1991. A good slice of the cheese.

But then came the City of Bellingham’s need to dig near the pipeline to install a new water line at the Dakin-Yew water treatment plant on Hannah Creek, across Lakeway Drive from Whatcom Falls. Work on the water project would be spread over 1993-1994.

The city contracted with IMCO General Construction of Ferndale to do the work. The excavation necessary for the water line project also exposed sections of the Olympic pipeline. The digging proceeded, often without Olympic inspectors at the job site. NTSB’s report also noted that inspection data was missing from day logs when Olympic excavation monitors were on site. That was a failure to follow the practice of using excavation “spotters,” one NTSB reviewer wrote. 

On one of the workdays, a mechanized backhoe digger operated by an IMCO employee was at work next to the Olympic gas pipe when a nearby worker thought he heard the clunk of metal on metal. He later said that IMCO supervisors ordered the area of the damage to be resealed in the tar solution that protects the pipeline against corrosion.

The incident was denied by IMCO supervisors and other workers at the excavation site. But later testing inside the pipeline would throw suspicion back on IMCO. Testing conducted in 1996 and 1997 revealed denting inside the 16-inch pipe near the section that ruptured the day of the massive gasoline spill and explosion. The denting was found to be in line with exterior gouging marks on sections of pipe excavated after the accident.

IMCO aggressively pushed back on the accusation and went so far as to question the character of the worker, whom IMCO lawyers had questioned in a deposition. A company executive, in a letter to NTSB, asked the agency to omit the worker’s testimony from the final report on the accident. In fact, the NTSB did just that, but still found IMCO responsible for damaging the Olympic piping based a broader body of evidence, including finding metallic traces of a kind of steel that could match the teeth of a backhoe.

The IMCO executive’s letter also revealed that the company’s own insurance company had concluded that it was at risk for liability after the lethal accident and, against IMCO’s wishes, negotiated settlements with injured parties. The IMCO letter said that the company had wanted its day in court to defend itself.

The damage to the pipeline was what Reason would classify as a latent failure. The gouges and dents on the pipeline lay buried for more than four years: a latent and lethal threat in waiting. 

Five years later, Olympic ordered a new pipeline test, as its own policy requires. On March 18, 1996, the company brought back Tuboscope with its magnetic flux “smart” pig. The testing found that much had changed in the 16-inch line since 1991. An NTSB summary noted “20 defects with 20% or greater pit depth were reported.” One of the defects was reported at about 11 feet downstream from the location of the eventual rupture.

That was not Olympic’s only trouble spot. After a 1,000-gallon leak of Olympic’s 20-inch section of pipe in Ebey Slough in the Snohomish River delta, the Washington Department of Ecology (DOE) ordered the company to perform in-line testing of both the 20-inch and 16-inch pipelines.

Olympic ordered a different test to be conducted by Enduro Corp., with a caliper “pigging” process that is considered more sensitive than the magnetic flux tool. The caliper pig detected further anomalies in the pipeline running from Ferndale through Bellingham to Olympic’s Allen terminal in Mount Vernon. Specifically, it found denting in the section near the water line excavation done by IMCO three years earlier

In a response to the state, in July 1997, Olympic produced a “dig sheet” that included the area near the future rupture. While it performed excavations and some repair work on some sections of the pipe, Olympic did not dig up the part that might have made June 10, 1999, a day like any other in Bellingham. NTSB noted that comments by a pipeline engineering assistant indicated that “it is a difficult area to access and that this location was not inspected” by exposing that section of pipe.

There was an attempt, however. A worker from Olympic’s construction unit went to the site and reported back to a supervisor that it was “too wet to perform the excavation at that time,” according to the NTSB report. Informed of the situation, the engineering assistant reportedly said they “would go back and try again when it dried up.” That never happened.

Thus, the one stretch of pipe damaged by an excavation sometime between 1993 and 1994, the one most vulnerable to a spike in gas pressure, was not excavated. The damaged pipe remained a slumbering calamity, buried and forgotten for nearly five more years: the most crucial slice in the Swiss cheese analogy.

The Bayview station

Construction of Olympic Pipe Line’s Bayview Terminal in Burlington had also been underway during the 1990s. Employees questioned by NTSB investigators said the facility was to add storage and pumping capacity in anticipation of the completion of the proposed Cross-Cascade Pipeline that would have brought gas from Pasco west to Woodinville and then to Allen station and on to Bayview.

As the terminal was being prepared to go on line on Dec. 16, 1998, problems began to develop that weren’t recognized until after the Whatcom Creek explosion. Later, some workers on the Bayview facility told the NTSB that they weren’t given enough training or opportunity to explore the terminal’s workings before the company put it on line. 

A fussy relief valve at Bayview, labelled RV-1919, was causing problems because its pressure settings were too low for the operations. The valve was there to guard against pressure surges in the pipeline and to direct overflow of product to a tank. It was decided, incorrectly as it turned out, that the pilot spring that controlled a piston in the valve and its pressure setting needed to be replaced.

A review of the manufacturer’s literature on the valve would have shown that the fix required not just a new spring but additional components to function properly. The NTSB narrative in its final report noted that one of the mechanics on site went to his truck and returned with a spring. That was the only change made in the valve, which would trigger at least 41 shutdowns of the system’s “block” valves in the terminal’s piping system in the run-up to full operations at Bayview. The abrupt shutdowns caused spikes in pipeline pressure.

The NTSB report noted that the last pressure surge analysis done on the Olympic pipeline as a whole was in 1991, which would not yet have included the impact of the Bayview facility. 

Olympic did not document the block valve closures, nor did the company view them as abnormal operations because the block valve was closing as intended by the design of the facility. The Swiss cheese layers of judgment failings were continuing to stack up. 

On June 10, 1999, a block valve slammed shut on its own, apparently triggered by a failure of the RV-1919 valve, shutting down product flow to the Bayview terminal. Almost immediately afterward, pressure began building on the pipeline north of Burlington.

The Renton control center 

At about 3:30 p.m. on June 10, 1999, an operations controller at Olympic’s Renton facility sat down and tapped his computer keyboard. Nothing. The controller checked with the computer system administrator who was in the next room and learned that the computers were not responding. They had lost access to the supervisory control and data acquisition (SCADA) system.

NTSB concluded that development work that one controller had been doing on one of the two Olympic system computers may have overloaded the system. The Olympic system controller should have been testing such work on a computer that wasn’t connected to the network, the NTSB concluded.

The operators in Renton called their counterparts in Ferndale and Allen, and the pipeline was shut down as a precaution. The Renton computer was brought back up after about 20 minutes. The NTSB report noted that at that point “none of the readily available information indicated that the pipeline had ruptured.” So pumping of product from the Cherry Point refinery was restarted. NTSB records don’t indicate how much product was then added to the total 277,000 gallons of gasoline spilling into Whatcom Creek before it ignited.

It would take another 95 minutes before the Renton control center knew that minutes earlier the 16-inch pipeline had ruptured at Whatcom Creek in Bellingham as a sudden surge in pipeline pressure from about 215 psi to nearly 1500 psi. The pressure would quickly subside as the pipe’s rupture began to spew unleaded gasoline.

The first knowledge of the massive outflow of gasoline was not discovered by the Renton center’s computer system. That information came from an Olympic employee who happened to pass near Whatcom Creek and reported a heavy smell of gas in the area. 

Assigning responsibility

On Sept. 13, 2001, Olympic Pipe Line, with its owner Equilon Pipeline and three of its managers, were charged with felony offenses rising from the Bellingham explosion. It was the first criminal prosecution of any oil industry personnel in such a case in American history.

Right up to that day, IMCO and Olympic officials persisted in blaming each other for the tragedy. Olympic blamed IMCO for damaging the pipe. IMCO blamed Olympic for not following the orders of Ecology by failing to excavate the one point along the pipeline that ruptured.

NTSB says that they were both right.

The agency’s final report included as many as 12 points over eight years that investigators identified as contributing to the disaster — multiple layers of “Swiss cheese.”