For years, TransCanada, the Canadian company that wants to build the Keystone XL pipeline, has assured the project's opponents that the line will be equipped with sensors that can quickly detect oil spills.

In recent newspaper ads in Nebraska, for instance, TransCanada promised that the pipeline will be "monitored through a state-of-the-art oil control center 24 hours a day, 365 days a year. 21,000 sensors along the pipeline route relay information via satellite to the control center every five seconds."

Other companies make similar claims about their remote sensing technology, sometimes promising they can detect and isolate large spills within minutes.

But an InsideClimate News examination of 10 years of federal data shows that leak detection systems do not provide as much protection as the public has been led to believe.

Between 2002 and July 2012, remote sensors detected only 5 percent of the nation's pipeline spills, according to data from the Pipeline and Hazardous Materials Safety Administration (PHMSA).

The general public reported 22 percent of the spills during that period. Pipeline company employees at the scenes of accidents reported 62 percent.

Anthony Swift, an attorney who has spent years researching pipeline safety for the Natural Resources Defense Council, was taken aback by the findings. Swift's organization opposes the Keystone XL, and he said he had always known that leak detection systems didn't catch most of the spills. But "the fact that 19 out of 20 leaks aren't caught is surprising, and certainly runs counter to a lot of rhetoric we hear from the industry," he said.

Industry experts, however, were not surprised. Pipeline specialists interviewed by InsideClimate News said the findings are consistent with what they have observed.

"The reality of the science" is that there are limits to remote leak detection. "That's just the way it is," said Richard Kuprewicz, president of Accufacts, Inc., a consulting firm that provides pipeline expertise for government agencies, the industry and other parties. Kuprewicz has worked with TransCanada in the past, but is not involved with the Keystone XL.

Operators can feel pressured to "tell people things they shouldn't tell them because it's not true," Kuprewicz said. While the companies "may not be saying that with the intent of lying, the reality is, it's just real difficult to detect [releases] remotely."

TransCanada spokesman Grady Semmens answered questions about the Keystone XL in a series of emails. He said the pipeline's leak detection system will have "greater sensitivity" than is required by law. If the company can't identify the cause of a problem within 10 minutes, Semmens said the pipeline will be shut down and the affected section isolated "to immediately stop the flow of oil."

Leak detection is becoming increasingly important, because the industry plans to build thousands of miles of new pipelines over the next five years. Many of the pipelines will cross aquifers and rivers that are critically important for drinking water. Some of the projects, including the Keystone XL, will carry Canadian diluted bitumen, or dilbit, a mixture of heavy tar sands bitumen and light liquid chemicals. A recent InsideClimate News report on a 2010 dilbit spill in Michigan's Kalamazoo River revealed that the dilbit was much harder to clean up than conventional oil, because it gradually sank to the river's bottom.

The Michigan spill also showed the risk companies take when they tout the effectiveness of their leak detection technology.

Just 10 days before the accident, Enbridge Inc., which operates the Michigan pipeline, told federal regulators it could remotely detect and shut down a rupture in eight minutes. But when the line burst open, it took Enbridge 17 hours to confirm the spill.

Pipeline operators use a variety of methods to look for leaks, but the remote leak detection system—a combination of sensors, gauges, computer software and control room technicians called controllers—is the only one that offers real-time, continuous monitoring along the length of the line.

Operators often cite these systems as an example of their dedication to pipeline safety, particularly when they're questioned by citizens who fear that a leak may go undetected for hours or days.

Such questions are frequently asked in Nebraska, one of the six states along the Keystone XL's path. The line's southern leg, from Cushing, Okla. to the Texas Gulf Coast, is already under construction. The U.S. State Department is expected to decide early next year whether to approve the northern leg, which would cross the U.S.-Canada border.

Ninety miles of the Nebraska section of the line is scheduled to pass through the Ogallala/High Plains aquifer, which supplies drinking water to eight states and provides 30 percent of the groundwater used for irrigation nationwide. Twenty miles of that section will be buried in an area where the water table is less than 20 feet beneath the surface. An additional 70 miles will cross areas where the water table is 20 to 50 feet below ground.

Residents of Holt County, Neb., feel particularly vulnerable, because the region's high water table combined with the loose, sandy soil means any spilled oil would move quickly into the aquifer. Most residents get their drinking water from shallow private wells that aren't tested regularly for contaminants.

Landowners elsewhere along the route have similar concerns.

Dwayne and Zona Vig raise drug-free lean beef on a 15,000-acre ranch in Meade County, S.D., where the pipeline would be buried in the same field as an existing water line. The Vigs are especially worried about leak detection and emergency response. Their ranch is accessible only by dirt roads that are impassable during heavy rains, and they live 100 miles from the nearest hospital.

Zona Vig fears a small oil leak could go undetected for days, especially if it spread underground without reaching the surface.

"That is the one that scares us," she said.

Large Spills Easier to Detect

Kuprewicz and other experts say the reason remote systems find so few leaks is fairly simple: Remote sensors are good at detecting large spills and ruptures, but they're not so good at detecting smaller spills, which are far more common on the nation's pipeline system.

"Leak detection systems are imperfect," said Andrew Black, president of the Association of Oil Pipelines, which represents pipeline owners and operators. "...I think all operators will acknowledge that large ruptures are easier to detect."

In most cases, a well-designed, computer-based system will "find a major rupture in much less than 10 minutes," said Randy Allen, a staff consultant at UTSI International, which specializes in pipeline automation and leak detection. But Allen also pointed out that some smaller, slower leaks are virtually impossible to detect remotely.

According to InsideClimate News' analysis of PHMSA data, 76 percent of the leaks between 2002 and July 2012 involved fewer than 30 barrels of oil (1,260 gallons).

The agency's database contains the most extensive pipeline spill data available to the public and includes every accident larger than five gallons. It recorded a total of 1,763 oil pipeline spills in the 10-year period.

The entries for almost half of the spills—803—did not identify how the leak was detected, in part because PHMSA has less stringent reporting requirements for leaks between 5 gallons and 5 barrels (210 gallons) in size. So InsideClimate News confined its analysis to the remaining 960 spills.

Black said that if InsideClimate News narrowed its analysis to the larger incidents, it would find the percentage of leaks detected by sensors to be much higher. And he was right—to a point.

PHMSA considers all spills greater than 50 barrels (2,100 gallons) to be "significant." But to test Black's hypothesis, InsideClimate News studied the data for spills that would be considered highly significant—those larger than 1,000 barrels (42,000 gallons).

This time the data showed that remote sensing systems detected 20 percent of the spills, a big improvement over the 5 percent detected in our original analysis.

Yet the general public discovered almost as many spills—17 percent—as the sensors. And 42 percent were discovered by employees at the scenes of accidents.

"The fact that 80 percent of leaks larger than 42,000 gallons go undetected by [remote] leak systems is a real sign of a problem," said Swift, the NRDC attorney.

Monitoring the Keystone XL

TransCanada has told federal and state regulators that the Keystone XL's leak detection system will be able to detect spills below 1.5 percent of the pipeline's flow.

Allen said one to two percent is "the most anyone's going to guarantee, because there are some hydraulic behaviors that thwart perfect leak detection."

He also said TransCanada's system is considered to be among the best in the industry, and he believes there is "a reasonable chance" that the company may be able to beat the 1.5 percent limit on some segments of the Keystone XL. "But they're not going to tell you they can, because they're not sure."

Because the Keystone XL will carry so much oil, that 1.5 percent represents hundreds of thousands of gallons per day.

The 36-inch wide pipe will be one of the largest pipelines in the country, with an initial capacity of 700,000 barrels per day that can later be expanded to 830,000 barrels—nearly 35 million gallons—per day.

A spill involving 1.5 percent of the initial capacity would be 10,500 barrels, or 441,000 gallons a day.

When calculated for the expanded capacity, that 1.5 percent comes out to 12,450 barrels, or 522,900 gallons a day.

Allen says TransCanada can use a technique called static pressure testing to look for smaller leaks.

But to do that, an operator must be willing to periodically shut down the line—and interrupt its business—to conduct the tests.

TransCanada declined to make a technical expert available for interviews. Semmens, the TransCanada spokesman, said the company will run static pressure tests whenever the line is shut down due to "operational constraints," such as a temporary delay in scheduled deliveries.

The Risk of False Alarms

Most pipeline companies buy their leak detection systems from specialized engineering firms, then customize the systems to meet the geographic and technical needs of individual projects.

Yet they all basically operate the same way. Sensors along the pipelines measure temperature, pressure, flow rates and other hydraulic data. The information feeds into the control room, where it serves two functions—tracking the amount of oil delivered to refineries and other customers, and monitoring the pipeline for potential leaks.

When the leak detection software senses something that could be a leak—perhaps an abrupt change in pressure and flow rates—it triggers an alarm. The controllers then analyze the data to determine whether there's really a problem.

This last step is crucial, because many alerts turn out to be false alarms. For instance, column separation—what's essentially a large bubble in the flow of oil—can look just like a leak on the remote systems.

False alarms can lead to costly mistakes.

At the time of the Michigan spill, Enbridge's controllers were working 12-hour shifts and simultaneously monitoring data coming in from multiple pipelines. When pipeline 6B ruptured,16 alarms went off. But the controllers and analysts concluded they were false alarms caused by column separation, and it was 17 hours before they realized they had a spill.

Operators can increase the sensitivity of their remote sensing systems to identify smaller leaks, Kuprewicz said. But when they do that, they also increase the chances of setting off false alarms.

"If you get a thousand [false alarms] a month, what happens when you get a big [real] one?" Kuprewicz said. "How do you tell the difference? You can't."

Allen, the UTSI consultant, said experienced controllers can recognize the warning signs even before the system sounds an alarm. But because they're usually busy making sure batches of oil are delivered to the right destinations, they're not necessarily looking at the hydraulic data used for leak detection.

No System is Perfect

The industry spends millions of dollars a year trying to improve remote leak detection, but Kuprewicz said there are limits to what can be done.

Leak detection systems work best for simple pipelines where the oil is flowing at a steady rate. But if a pipeline is shut down, or if the flow rate keeps changing—as is common with most pipelines, including the Keystone XL—detecting a leak is more difficult, because it's hard to determine how much oil should be in the pipeline at any given time.

Operators also rely on ground and aerial patrols to detect the smaller spills. Semmens, the TransCanada spokesman, said the company will conduct ground or aerial surveys on the Keystone XL at least once every 2 weeks. An Enbridge spokesman said his company will follow a similar schedule on the new pipeline it is building in Michigan, to replace the one that ruptured in 2010.

But even visual surveys aren't foolproof, because some spills never reach the ground surface, Kuprewicz said. That's why the people who patrol pipeline right-of-ways are always on the lookout for dead vegetation, a possible sign of an underground leak.

Another option is to install external sensors that can detect leaks smaller than 10 gallons per day. But these sensors are expensive and are rarely used.

The bottom line, said Kuprewicz, is that there's no perfect solution to spotting oil spills. Ideally, companies should combine the best leak detection technology with experienced operators—but even then, some leaks will go undetected.

"No one sells leak detection systems claiming they will not work," he said. "So you want to be careful about the claims and how realistic they are."