This is a synopsis from the Safety Board's report and does not include the Board's rationale for the conclusions, probable cause, and safety recommendations. Safety Board staff is currently making final revisions to the report from which the attached conclusions and safety recommendations have been extracted. The final report and pertinent safety recommendation letters will be distributed to recommendation recipients as soon as possible. The attached information is subject to further review and editing.
On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.
The National Transportation Safety Board's investigation found that the rupture of Line 132 was caused by a fracture that originated in the partially welded longitudinal seam of one of six short pipe sections, which are known in the industry as "pups." The fabrication of five of the pups in 1956 would not have met generally accepted industry quality control and welding standards then in effect, indicating that those standards were either overlooked or ignored. The weld defect in the failed pup would have been visible when it was installed. The investigation also determined that a sewer line installation in 2008 near the rupture did not damage the defective pipe.
The rupture occurred at 6:11 p.m.; almost immediately, the escaping gas from the ruptured pipe ignited and created an inferno. The first 911 call was received within seconds. Officers from the San Bruno Police Department arrived on scene about 6:12 p.m. Firefighters at the San Bruno Fire Department heard and saw the explosion from their station, which was about 300 yards from the rupture site. Firefighters were on scene about 6:13 p.m. More than 900 emergency responders from the city of San Bruno and surrounding jurisdictions executed a coordinated emergency response, which included defensive operations, search and evacuation, and medical operations. Once the flow of natural gas was interrupted, firefighting operations continued for 2 days. Hence, the emergency response by the city of San Bruno was prompt and appropriate.
However, PG&E took 95 minutes to stop the flow of gas and to isolate the rupture site - a response time that was excessively long and contributed to the extent and severity of property damage and increased the life-threatening risks to the residents and emergency responders. The National Transportation Safety Board found that PG&E lacks a detailed and comprehensive procedure for responding to large-scale emergencies such as a transmission pipeline break, including a defined command structure that clearly assigns a single point of leadership and allocates specific duties to supervisory control and data acquisition staff and other involved employees. PG&E's supervisory control and data acquisition system limitations caused delays in pinpointing the location of the break. The use of either automatic shutoff valves or remote control valves would have reduced the amount of time taken to stop the flow of gas.
PG&E's pipeline integrity management program, which should have ensured the safety of the system, was deficient and ineffective because it -
- Was based on incomplete and inaccurate pipeline information.
- Did not consider the design and materials contribution to the risk of a pipeline failure.
- Failed to consider the presence of previously identified welded seam cracks as part of its risk assessment.
- Resulted in the selection of an examination method that could not detect welded seam defects.
- Led to internal assessments of the program that were superficial and resulted in no improvements.
Several deficiencies revealed by the National Transportation Safety Board investigation, such as PG&E's poor quality control during the pipe installation and inadequate emergency response, were factors in the 2008 explosion of a PG&E gas pipeline in Rancho Cordova, California. (See Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010)). This 2008 accident involved the inappropriate installation of a pipe that was not intended for operational use and did not meet applicable pipe specifications. PG&E's response to that event was inadequate; PG&E initially dispatched an unqualified person to the emergency, causing an unnecessary delay in dispatching a properly trained and equipped technician. The National Transportation Safety Board concluded that PG&E's multiple, recurring deficiencies are evidence of a systemic problem.
The investigation also determined that the California Public Utilities Commission, the pipeline safety regulator within the state of California, failed to detect the inadequacies in PG&E's integrity management program and that the Pipeline and Hazardous Materials Safety Administration integrity management inspection protocols need improvement. Because the Pipeline and Hazardous Materials Safety Administration has not incorporated the use of effective and meaningful metrics as part of its guidance for performance-based management pipeline safety programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines could be improved. Without effective and meaningful metrics in performance-based pipeline safety management programs, neither PG&E nor the California Public Utilities Commission was able to effectively evaluate or assess PG&E's pipeline system.
- The following were not factors in this accident: seismic activity, corrosion, direct third-party damage, or drug use by the workers at the Milpitas Terminal.
- The accident pipe comprising the pups did not conform to PG&E or other known specifications for pipe and was fabricated at an undetermined facility to no known specification.
- The accident pipe would not have met generally accepted industry quality control and welding standards in 1956, indicating that those standards were overlooked or ignored.
- PG&E's inadequate quality control during the 1956 relocation project led to the installation and commissioning of a defective pipe that remained undetected until the accident, 54 years later.
- The fracture of Line 132 Segment 180 originated in the partially welded longitudinal seam of pup 1, which was progressively weakened due to ductile crack growth and fatigue crack growth.
- The combination of the size and shape of the weld defect significantly reduced the strength of the pup 1 longitudinal seam, making it susceptible to unstable crack growth under internal gas pressure.
- The 2008 sewer line installation did not damage the defective pipe that later ruptured.
- The internal line pressure preceding the rupture did not exceed the PG&E maximum allowable operating pressure for Line 132 and would not have posed a safety hazard for a properly constructed pipe.
- Had a properly prepared contingency plan for the Milpitas Terminal electrical work been in place and been executed, the loss of pressure control could have been anticipated and planned for, thereby minimizing or avoiding the pressure deviations.
- PG&E lacked detailed and comprehensive procedures for responding to a large-scale emergency such as a transmission line break, including a defined command structure that clearly assigns a single point of leadership and allocates specific duties to supervisory control and data acquisition staff and other involved employees.
- PG&E's supervisory control and data acquisition system limitations contributed to the delay in recognizing that there had been a transmission line break and quickly pinpointing its location.
- The 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was excessive.
- Use of automatic shutoff valves or remote control valves along the entire length of Line 132 would have significantly reduced the amount of time taken to stop the flow of gas and to isolate the rupture.
- Considering the challenges of the prolonged fire fueled by natural gas, the emergency response was well coordinated and effectively managed by local responders.
- The 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to properly record an explanation for the delay, and the failure to conduct drug or alcohol testing on the supervisory control and data acquisition center staff all demonstrate that the PG&E postaccident toxicological program was ineffective.
- If the grandfathering of older pipelines had not been permitted since 1961 by the California Public Utilities Commission and since 1970 by the U.S. Department of Transportation, Line 132 would have undergone a hydrostatic pressure test that would likely have exposed the defective pipe that led to this accident.
- There is no safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement for postconstruction hydrostatic pressure testing.
- The premise in Title 49 Code of Federal Regulations Part 192 of the Federal pipeline safety regulations that manufacturing- and construction-related defects can be considered stable even when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the maximum allowable operating pressure is not supported by scientific studies.
- The PG&E gas transmission integrity management program was deficient and ineffective.
- PG&E's public awareness program self-evaluation was ineffective at identifying and correcting deficiencies.
- The deficiencies identified during this investigation are indicative of an organizational accident.
- The multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem.
- Because in-line inspection technology is not available for use in all currently operating gas transmission pipeline systems, operators do not have the benefit of a uniquely effective assessment tool to identify and assess the threat from critical defects in their pipelines.
- The Pipeline and Hazardous Materials Safety Administration integrity management inspection protocols are inadequate.
- Because PG&E, as the operator of its pipeline system, and the California Public Utilities Commission, as the pipeline safety regulator within the state of California, have not incorporated the use of effective and meaningful metrics as part of their performance-based pipeline safety management programs, neither PG&E nor the California Public Utilities Commission is able to effectively evaluate or assess the integrity of PG&E's pipeline system.
- Because the Pipeline and Hazardous Materials Safety Administration has not incorporated the use of effective and meaningful metrics as part of its guidance for effective performance-based pipeline safety management programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines needs improvement.
- The ineffective enforcement posture of the California Public Utilities Commission permitted PG&E's organizational failures to continue over many years.
- The Pipeline and Hazardous Materials Safety Administration's enforcement program and its monitoring of state oversight programs have been weak and have resulted in lack of effective Federal oversight and state oversight exercised by the California Public Utilities Commission.
The National Transportation Safety Board determines that the probable cause of the accident was the Pacific Gas and Electric Company's (PG&E) (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section.
Contributing to the accident were the California Public Utility Commission's (CPUC) and the U.S. Department of Transportation's exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC's failure to detect the inadequacies of PG&E's pipeline integrity management program.
Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E's flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas.