Shell Pipeline Company, LP (SPLC) transports fuels, chemicals, and crude oil for Shell and their customers. SPLC owns or has partial interest in 67 products terminals, 550 storage tanks, owns and operates 5,500 miles of pipeline, and has partial ownership of 10,500 miles of pipeline. Shell Pipeline Company LP and its affiliates transport over two billion barrels of crude oil and refined products annually in several states.

ATMOS Pipe is a software-based, statistical pipeline integrity monitoring system developed by ATMOS International. By applying statistical techniques to pipeline instrument readings, the system uses flow and pressure measurements taken at the inlet, outlet and block valves to determine whether these measurements correspond to normal pipeline operation or a leak condition. SPLC required a triple redundant leak detection solution. To meet this requirement, the system was reengineered and installed at Shell’s primary and backup Control Center facilities.

Shell chose three pipelines for this system to monitor: Erath-East Houston crude pipeline (EE), Texas-Louisiana Ethylene (TL), Texas Propylene (PR). Prior to deploying the new system, Shell Pipeline used rate of change (ROC) and line balance as the main tools for pipeline leak detection. These tools provide leak detection accuracies of 5.5% on Erath to East Houston pipeline, 5% on Texas Propylene pipeline, and 30% on Texas Louisiana pipeline. SPLC system implementation goals were to improve leak detection sensitivity, to provide 100% uptime, and to create a familiar interface for the pipeline controllers.

Goals of availability

Nearly all of the vast volume of petroleum now transported by pipeline moves through highly automated pipeline systems. These computer-aided systems, called SCADA (Supervisory Control and Data Acquisition), allow highly trained operators working in sophisticated central control rooms to control and monitor rates of flow, pressures and fluid characteristics. Fluctuations can be detected quickly, alerting operators to potential leaks and allowing them to shut down pipelines and dispatch crews to investigate.

The SPLC control center remotely controls all the movement of products in the company’s pipeline network. The control center demands maximum availability of its control system, Vector SCADA, to meet this important responsibility. Operability of Vector SCADA is a must to insure safe and efficient transportation. SPLC requires Vector SCADA availability of 99.999%. To meet 90 seconds of downtime per year goal, SPLC runs three redundant systems. Dual T-1 data circuits interlink the systems. The T-1 circuits form a mesh network configuration to increase fault tolerance.

Redundant servers

With the new software, Shell Pipeline was able to specify redundancy at the hardware and software level. A typical installation of the software could be accomplished using two servers: a primary and a backup leak detection server. But Shell Pipeline’s availability demands required an even more robust solution. An SPLC/ATMOS installation requires 10 computers: 6 leak detection servers (LDS), 2 license servers, and 2 data distributors. Harnessing the compact processing power of a blade server enabled SPLC to implement all the software instances by connecting eight blades in a blade center chassis and running two HP DL380 servers as data distributors. An installation was established at each Vector SCADA host for complete redundancy and to minimize WAN traffic concerns.

Vector redundancy

Shell Pipeline runs three Vector SCADA hosts. Each host resides on a HP ALPHA-Server GS/1280. The HP ALPHAServer is a multiprocessor, mirrored-disk, server computer. The server operating system is OpenVMS 8.2. Having a prime host and two hot backups allows one to be running, one standing by, and one to undergo maintenance. Vector SCADA switches hosts automatically during an outage.

Data distributor

The data distributor is the backbone of data routing from Vector SCADA to the new software system. The Data Distributor application resides on a HP Proliant DL380 dual-core server with mirrored hard drives and dual NICs. Each instance consists of a primary and secondary data distributor. Switching from primary to secondary data distributors is performed automatically.

Server redundancy

SPLC uses a triple redundant server setup in each location. Six HP Proliant Blades establish our three groups of two servers. The three groups correspond to a primary, secondary, and tertiary level. The three test pipelines were divided with two pipelines on one LDS and one pipeline on a second LDS.

License server

SPLC utilizes two license servers in each location. The purpose of the license server is to transmit licenses to LDUs (leak detection units). The license authorizes the LDU to perform its two tasks. The primary task is to calculate the leak detection variables on the LDU’s assigned pipeline segment. The secondary task is to write those variables back to the Data Distributor.

Software organization

The software is installed on multiple blade servers running Microsoft Windows 2003 Server Service Pack 1 Operating System, Microsoft SQL Server 2000, and Microsoft .NET Framework 2.0. A blade server can support 25 LDUs. SPLC separated the three pipeline LDSs (16 LDUs) between two blade servers for maximum reliability and future expandability. TL pipeline’s leak detection is segmented across seven LDUs. The pipeline received a primary LDS server with two redundant back-up machines (secondary and tertiary). EE and PR pipelines leak detection is segmented across 9 LDUs. The pipelines were combined and share one primary LDS server with two redundant back-up machines.

At each location, both data distributors establish open sockets to the three Vector SCADA computers. Only the primary Vector SCADA transmits and receives information. The primary data distributor at each site transmits to all six LDS servers. The backup data distributor is a hot standby and receives information from Vector SCADA, but only transmits information when it becomes prime. The data distributors communicate with the LDS using an OPC (Open Connectivity) server. The data distributor OPC server automatically switches from main to back-up data distributor machine in the event of a failure. The LDSs automatically follow the OPC server switch to the new primary data source.

The system management tool (SMT) provides the system administrator an overview of the health of the software applications running inside the node. The SMT controls the LDS licensing and the switching of LDS servers from primary to backup. Additionally, the SMT displays system information about which DD is primary and providing data to the LDS servers.

SCADA and communications

Vector SCADA communicates by sending ASCII messages to the data distributor. The data distributor translates these messages and sends them to the OPC Server for the LDS client machines to read pipeline operation data (e.g. pressures, flowrates, valve status, pump start/stop) into their LDUs. With every scan, each LDU contacts the primary license server to refresh its license. Refreshing a license also alerts the license server to the LDUs operational status. When a primary LDU stops contacting the license server, the license server passes the write enabled license to the next LDU.

Shell Pipeline’s redundant system displays the primary LDUs with active and updating license states. Backup LDUs show active licenses but their outputs are disabled. Only the LDUs with active and updating license status in the primary Vector node update SCADA with leak detection information.

Each LDU can have one of three states:

  • InActive – no license (red)
  • Active – licensed with outputs disabled (yellow)
  • Active and updating – licensed with outputs enabled (green).

System management tool

The system management tool (SMT) displays a graphical overview of the ATMOS instance. The SMT is divided into two tabs: LDS servers and data distributor/license servers. The matrix overview gives a system administrator the ability to see the license status of all the LDUs inside each instance simultaneously. The SMT communicates using Hypertext Protocol to the LDSs, license servers, and data distributors.

If the system requires maintenance, the system administrator can manually set whole LDSs or individual LDUs to “assume primary” from the device requiring service. The data distributor/license server tab displays the primary and backup devices. The system administrator can use the SMT to right-click the backup license server and have it assume primary. Upon assuming primary, it begins serving licenses to the LDUs.

Data distributor utility

The system administrator uses the data distributor administration application to control all aspects of the data distributor. The communications tab controls the manual switching between the prime and backup data distributors. By clicking “take primary,” the data distributor administration program sets the “DDACTIVENODE” tag to Data Distributor 1 or 2. The LDSs and the OPC server reference this tag and automatically switch data distributors’ OPC feeds. The new primary data distributor becomes authorized to read and write to Vector and the OPC server.

Automatic switchovers

The entire data chain – from Vector SCADA to the data distributors to each individual LDU on an LDS – can perform automatic switchover. Vector SCADA performs automatic switchover between its two alternate Vector hosts. ATMOS Pipe performs automatic switchovers of its triple redundant LDUs/LDSs and redundant license servers/data distributors. Shell Pipeline built a triple redundant system at three locations.

Presentation to controllers

One of SPLC’s goals was to implement the new software and provide controllers with familiar screens and wording to allow easy transition to the enhanced leak detection tool. Pipeline controllers are greeted with a familiar SCADA overview screen of the pipeline system. The software’s overview screen has few updates from a regular pipeline overview screen. The lines above the pipeline segments graphically display the LDU segments. The LDU segments change color when a segment is alarming or the alarming is disabled. Clicking on a LDU segment takes you to the LDU detail screen. The LDU detail screen gives pertinent data relating to the LDU. The screen is segmented into three sections: LDU Health, Imbalances, and field flowrates and pressures affecting the software’s calculations.

The LDU health section provides a quick view into the LDUs status. Watchdog status displays if the software is running on the LDU. Transient status indicates if any large or small transients are affecting normal pipeline flow. Alarming status signifies that the LDU will alarm to SCADA if a leak is detected. Alarming can be disabled for testing or tuning so that SCADA will not be alarmed and pipeline operations impacted. LDU status displays that the line is running, stopped, or shut-in. LDU enabled shows that the LDU has received a license and writing is enabled.

The imbalance section focuses on the Lambdas and the mean flow difference. The software uses the variable lambda to depict a leak’s probability factor. Shell Pipeline uses “imbalance” instead of lambda when displaying the information on Vector screens. The maximum imbalance can be viewed on the main page. All seven imbalances are viewed on the next page. Format builders set a pokepoint to allow this transition.

Field flow and pressure values populate the third section. These flows and pressures are referenced by the software to generate their output values and directly affect the mean flow difference and lambda values.

Testing and results

ATMOS Pipe is running on SPLC’s production Vector SCADA systems. However, the system is currently running in the background of our SCADA system. Alarms, warnings and events go solely to the CPM Engineer for evaluation. To further evaluate the software’s performance, SPLC will simulated a leak through analog manipulation of flowrates and pressures on the Erath to East Houston crude pipeline. SPLC will also conducted a leak test by siphoning several hundred pounds from the Texas Louisiana pipeline to test a real world leak condition. Both tests proved that ATMOS performed properly. The leak tests demonstrated ATMOS’ ability to find the leak and alarm in a fraction of the time required by ROC or Line Balance.

Conclusions

Upon completion of software tuning, Shell Pipeline experienced considerable increases in pipeline leak detection sensitivity. The Erath-to-East Houston pipeline sensitivity increased from 5.5% to 3.4% on the segment between Erath, Louisiana, and Port Neches, Texas. The Port Neches, Texas, to East Houston, Texas, segment increased from 5.5% to 3.7%. Texas Propylene had 5% sensitivity before, and then increased to 3%. Texas-Louisiana sensitivity increased from 30% to 7%. The new software has proved robust in testing and failover simulation. Three LDS servers, two data distributors, and two license servers must fail before the software would fail at a SCADA location.

In general, Shell Pipeline’s implementation of ATMOS Pipe proved successful. The goals were to improve leak detection sensitivity, provide 100% uptime via robust redundancy, and to create a familiar interface for the pipeline controllers. Working together, Shell Pipeline’s control center team and the ATMOS design and engineering team achieved each goal.

Acknowledgment

Based on a paper presented at the ENTELEC Annual Conference and Exposition, April 9-11, 2008, Houston, Texas.