Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire

What HappenedOn September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.#

What We FoundThe probable cause of the accident was the Pacific Gas and Electric Company’s (PG&E) (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas.#

What We RecommendedWe made recommendations to the U.S. Secretary of Transportation, the Pipeline and Hazardous Materials Safety Administration, the Governor of the State of California, the California Public Utilities Commission, the Pacific Gas and Electric Company, the American Gas Association and the Interstate Natural Gas Association of America. Previously issued recommendations to the Pipeline and Hazardous Materials Safety Administration, the California Public Utilities Commission, the Pacific Gas and Electric Company.#

PAR-11-01, page 1Official PDFPacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire San Bruno, California September 9, 2010 Accident Report NTSB/PAR-11/01 PB2011-916501 National Transportation Safety Board#

PAR-11-01, page 2NTSB/PAR-11/01 PB2011-916501 Notation 8275C Adopted August 30, 2011 Pipeline Accident Report Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire San Bruno, California September 9, 2010 National Transportation Safety Board 490 L’Enfant Plaza, S.W. Washington, DC 20594#

PAR-11-01, page 3National Transportation Safety Board. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010. Pipeline Accident Report NTSB/PAR-11/01. Washington, DC. Abstract: On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company, ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. The Pacific Gas and Electric Company estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area. As a result of its investigation of this accident, the National Transportation Safety Board makes recommendations to the U.S. Secretary of Transportation, the Pipeline and Hazardous Materials Safety Administration, the governor of the state of California, the California Public Utilities Commission, the Pacific Gas and Electric Company, the American Gas Association, and the Interstate Natural Gas Association of America. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Internet at <http://www.ntsb.gov>. Other information about available publications also may be obtained from the website or by contacting: National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2011-916501 from: National Technical Information Service 5301 Shawnee Road Alexandria, Virginia 22312 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.#

PAR-11-01, page 4NTSB Pipeline Accident Report Contents Figures ........................................................................................................................................... vi Tables ........................................................................................................................................... vii Acronyms and Abbreviations ................................................................................................... viii Executive Summary .......................................................................................................................x Investigation Synopsis .....................................................................................................................x Probable Cause.............................................................................................................................. xii Recommendations ......................................................................................................................... xii 1. Factual Information ...................................................................................................................1 1.1 Accident Narrative .....................................................................................................................1 1.1.1 Preaccident Events ...........................................................................................................3 1.1.2 Events Leading Up to Rupture ........................................................................................5 1.1.3 The Rupture ...................................................................................................................12 1.2 Emergency Response ...............................................................................................................12 1.3 Injuries .....................................................................................................................................18 1.4 Damage ....................................................................................................................................18 1.5 Meteorological Information .....................................................................................................21 1.6 Personnel Information ..............................................................................................................21 1.6.1 Milpitas Technician and Other Workers at the Milpitas Terminal ................................21 1.6.2 SCADA Operators .........................................................................................................22 1.7 Pipeline Information ................................................................................................................23 1.7.1 Line 132 .........................................................................................................................23 1.7.2 1956 Relocation Project (Segment 180) ........................................................................25 1.7.3 Multiyear Replacement Project and Seismic Risk .........................................................29 1.7.4 Underground Environment at Accident Location ..........................................................30 1.7.4.1 2008 Sewer Replacement .................................................................................30 1.7.4.2 Guidelines for Pipe Bursting ............................................................................33 1.7.4.3 Pipe Bursting Study .........................................................................................33 1.7.5 Pipeline MAOP ..............................................................................................................33 1.7.5.1 “Grandfather Clause” .......................................................................................34 1.7.5.2 MAOP for Line 132 .........................................................................................35 1.7.5.3 Periodic Pressure Increases to MAOP .............................................................36 1.7.6 History of Seam Defects in PG&E Gas Transmission Pipelines ...................................38 1.7.7 Protection Against Accidental Overpressure .................................................................39 1.8 Examination of Accident Pipe .................................................................................................39 1.8.1 Welds .............................................................................................................................41 1.8.2 Crack Initiation ..............................................................................................................43 1.8.3 Material Properties .........................................................................................................46 1.8.4 Historical Information About Steel Grades ...................................................................47 1.8.5 Burst Pressure Study and Finite Element Modeling ......................................................48 iii#

PAR-11-01, page 5NTSB Pipeline Accident Report 1.9 Pipeline Operations and Management .....................................................................................51 1.9.1 SCADA System Operations ..........................................................................................51 1.9.1.1 Milpitas Terminal.............................................................................................52 1.9.1.2 Work Clearance Procedures .............................................................................54 1.9.1.3 Emergency Response Procedures ....................................................................55 1.9.2 Use of Automatic Shutoff Valves and Remote Control Valves ....................................56 1.9.3 Public Awareness ...........................................................................................................57 1.9.4 PG&E Risk Management/Integrity Management Program ...........................................59 1.9.4.1 Geographic Information System ......................................................................59 1.9.4.2 Risk Management Procedures..........................................................................61 1.9.4.3 Threats Identified for Line 132 ........................................................................65 1.10 Oversight ................................................................................................................................67 1.10.1 State Oversight by CPUC ............................................................................................67 1.10.2 Federal Oversight by PHMSA .....................................................................................69 1.11 Postaccident Actions ..............................................................................................................71 1.11.1 Actions Taken by PG&E .............................................................................................71 1.11.2 Actions Taken by CPUC .............................................................................................72 1.11.3 Actions Taken by PHMSA ..........................................................................................74 1.11.4 Actions Taken by Congress .........................................................................................74 1.12 Previous NTSB Safety Recommendations ............................................................................75 1.12.1 January 3, 2011, Safety Recommendations to PG&E, CPUC, and PHMSA Regarding Record-keeping and Hydrostatic Pressure Testing ................................75 1.12.2 June 8, 2011, Safety Recommendations to PHMSA and PG&E Concerning Emergency Response ..........................................................................................77 1.12.3 Other Relevant Recommendations ..............................................................................78 1.12.3.1 Grandfathering of Higher Permissible Stress Levels for Pre- 1970 Pipelines ..............................................................................................................78 1.12.3.2 Constructing and Modifying Pipelines to Accommodate Use of In-Line Inspection Equipment .................................................................................79 1.12.3.3 Rapid Shutdown and ASVs and RCVs ..........................................................80 1.13 Other Information ..................................................................................................................81 1.13.1 Pipeline Assessment Methods for Integrity Management ...........................................81 1.13.1.1 Pressure Testing .............................................................................................82 1.13.1.2 In-line Inspection ...........................................................................................83 1.13.1.3 Direct Assessment ..........................................................................................85 1.13.2 Automatic Shutoff Valve Technology .........................................................................86 1.13.3 2008 Natural Gas Explosion in Rancho Cordova, California ......................................87 2. Analysis .....................................................................................................................................88 2.1 Introduction ..............................................................................................................................88 2.2 Preaccident Events ...................................................................................................................90 2.2.1 Work Clearance Procedures for Electrical Work at Milpitas Terminal ........................90 2.2.2 Internal Line Pressure Prior to Failure ...........................................................................91 2.3 Cause of Pipeline Rupture .......................................................................................................92 2.3.1 Fracture Origin and Failure ...........................................................................................93 2.3.2 Deficiencies in Fabrication of Accident Pipe Segment .................................................94 iv#

PAR-11-01, page 6NTSB Pipeline Accident Report 2.3.3 Deficiencies in Quality Control Associated with 1956 Relocation Project .....................................................................................................................................95 2.3.4 2008 Sewer Pipe Bursting Operation ............................................................................96 2.4 Adequacy of PG&E Emergency Response ..............................................................................97 2.4.1 Internal Communication and Coordination ...................................................................98 2.4.2 Notifying Emergency Responders ...............................................................................100 2.4.3 Line Break Recognition ...............................................................................................101 2.4.4 Rapid Shutdown, ASVs, and RCVs ............................................................................102 2.4.5 Deficiencies in Postaccident Drug and Alcohol Testing .............................................104 2.5 MAOP ....................................................................................................................................106 2.5.1 MAOP of Line 132 ......................................................................................................106 2.5.2 Grandfathering of Pre-1970 Pipelines .........................................................................106 2.6 Integrity Management Program .............................................................................................107 2.6.1 PG&E GIS and Pipeline Record-keeping ....................................................................108 2.6.2 Threat Identification and Risk Assessment .................................................................110 2.6.2.1 Weighting of Threats .....................................................................................110 2.6.2.2 Identification and Assessment of Design/Material and Construction Threats on Line 132..............................................................................110 2.6.2.3 Regulatory Assumption of Stable Manufacturing- and Construction-Related Defects .....................................................................................112 2.6.3 Self-Assessment of Program Effectiveness .................................................................113 2.6.4 Summary of PG&E Integrity Management Practices ..................................................114 2.7 Adequacy of PG&E’s Public Awareness Program Evaluation..............................................115 2.8 Summary of PG&E Practices.................................................................................................116 2.9 Inspection Technology ...........................................................................................................118 2.10 Oversight ..............................................................................................................................119 2.10.1 Performance-Based Safety Programs ........................................................................119 2.10.2 Authority and Enforcement .......................................................................................122 3. Conclusions .............................................................................................................................124 3.1 Findings..................................................................................................................................124 3.2 Probable Cause.......................................................................................................................127 4. Recommendations ..................................................................................................................128 4.1 New Recommendations .........................................................................................................128 4.2 Previously Issued Recommendations ....................................................................................132 4.3 Previously Issued Recommendations Classified in This Report ...........................................134 5. Appendix .................................................................................................................................140 v#

PAR-11-01, page 7NTSB Pipeline Accident Report Figures Figure 1. Picture of crater and ruptured pipeline. .......................................................................... 2 Figure 2. Picture of ejected pipe section. ....................................................................................... 2 Figure 3. Aerial view of fire........................................................................................................... 3 Figure 4. Overview of Line 132. .................................................................................................... 4 Figure 5. Picture of local control panel. ......................................................................................... 6 Figure 6a. Normal electrical configuration at the Milpitas Terminal. ........................................... 7 Figure 6b. Temporary electrical configuration at the Milpitas Terminal preceding the accident. .................................................................................................................................... 8 Figure 7. Schematic showing regulating valve control. ................................................................. 8 Figure 8a. Valve configuration at the Milpitas Terminal prior to 5:22 p.m. ............................... 10 Figure 8b. Valve configuration at the Milpitas Terminal about 5:25 p.m. .................................. 11 Figure 9. Firefighters approaching accident scene. ...................................................................... 13 Figure 10. Location of valve closures. ......................................................................................... 17 Figure 11. Picture showing area of damage from blast and fire. ................................................. 19 Figure 12. Picture of destroyed houses. ....................................................................................... 20 Figure 13. Picture of a burned car in front of several destroyed houses. ..................................... 20 Figure 14. Map showing PG&E peninsula gas transmission lines. ............................................. 24 Figure 15. Line 132 installation, relocations, and replacements. ................................................. 26 Figure 16. Sketch of underground utilities environment. ............................................................ 30 Figure 17. Diagram of excavations relative to Segment 180. ...................................................... 32 Figure 18. Schematic of accident pipe. ........................................................................................ 40 Figure 19a. Picture showing cross section of longitudinal seam in pup 1. .................................. 42 Figure 19b. Picture showing cross section of longitudinal seam in typical DSAW pipe. ............................................................................................................................................... 42 Figure 20. Picture of pipe section with white arrows showing direction of crack propagation. .................................................................................................................................. 44 Figure 21. Pictures highlighting rupture initiation site in pup 1 longitudinal seam. .................... 45 Figure 22a. Stress contours at an internal pressure of 375 psig for the finite element model of the weld geometry similar to pup 1. Contour values are the same as in figure 22b. ................................................................................................................... 50 Figure 22b. Stress contours at an internal pressure of 375 psig for the finite element model of a DSAW seam. Contour values are the same as in figure 22a. ........................ 50 Figure 23. Flowchart of PG&E’s emergency response procedures. ............................................ 55 vi#

PAR-11-01, page 8NTSB Pipeline Accident Report Tables Table 1. Injuries............................................................................................................................ 18 Table 2. PG&E gas transmission pipeline seam leaks or test failures, 1948–2011. .................... 39 Table 3. Average and standard deviation of mechanical test data for all lengths of pipe. ............................................................................................................................................... 46 Table 4. Minimum yield strength, tensile strength, and elongation requirements according to PG&E and API pipe specifications. ......................................................................... 47 Table 5. Incoming and outgoing lines at Milpitas Terminal. ....................................................... 53 Table 6. Survey postcard responses to public awareness brochures. ........................................... 59 Table 7. PG&E’s reportable events by cause for 2004–2010. ..................................................... 65 Table 8. Line 132 risk values. ...................................................................................................... 66 vii#

PAR-11-01, page 9NTSB Pipeline Accident Report Acronyms and Abbreviations AGA American Gas Association ANPRM advance notice of proposed rulemaking API American Petroleum Institute ASME American Society of Mechanical Engineers ASOS Automated Surface Observing System ASTM American Society for Testing and Materials ASV automatic shutoff valve CFR Code of Federal Regulations COF consequence of failure Consolidated Western Consolidated Western Steel Corporation CPUC California Public Utilities Commission DOT U.S. Department of Transportation DSAW double submerged arc welded ECDA external corrosion direct assessment ERW electric resistance welded GIS geographic information system GRI Gas Research Institute GSR gas service representative GTI Gas Technology Institute HCA high consequence area HV Vickers hardness number INGAA Interstate Natural Gas Association of America KSFO San Francisco International Airport viii#

PAR-11-01, page 10NTSB Pipeline Accident Report ksi 1,000 pounds per square inch LOF likelihood of failure MAOP maximum allowable operating pressure MOP maximum operating pressure MP mile point NPRM notice of proposed rulemaking NTSB National Transportation Safety Board PAPERS Public Awareness Program Effectiveness Research Survey PG&E Pacific Gas and Electric Company PHMSA Pipeline and Hazardous Materials Safety Administration PLC programmable logic controller psi pounds per square inch psig pounds per square inch, gauge RCV remote control valve RMP risk management procedure RSPA Research and Special Programs Administration SBFD San Bruno Fire Department SCADA supervisory control and data acquisition SMLS seamless SMYS specified minimum yield strength the Corps U.S. Army Corps of Engineers UPS uninterruptible power supply ix#

PAR-11-01, page 11NTSB Pipeline Accident Report Executive Summary On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area. Investigation Synopsis The National Transportation Safety Board’s investigation found that the rupture of Line 132 was caused by a fracture that originated in the partially welded longitudinal seam of one of six short pipe sections, which are known in the industry as “pups.” The fabrication of five of the pups in 1956 would not have met generally accepted industry quality control and welding standards then in effect, indicating that those standards were either overlooked or ignored. The weld defect in the failed pup would have been visible when it was installed. The investigation also determined that a sewer line installation in 2008 near the rupture did not damage the defective pipe. The rupture occurred at 6:11 p.m.; almost immediately, the escaping gas from the ruptured pipe ignited and created an inferno. The first 911 call was received within seconds. Officers from the San Bruno Police Department arrived on scene about 6:12 p.m. Firefighters at the San Bruno Fire Department heard and saw the explosion from their station, which was about 300 yards from the rupture site. Firefighters were on scene about 6:13 p.m. More than 900 emergency responders from the city of San Bruno and surrounding jurisdictions executed a coordinated emergency response, which included defensive operations, search and evacuation, and medical operations. Once the flow of natural gas was interrupted, firefighting operations continued for 2 days. Hence, the emergency response by the city of San Bruno was prompt and appropriate. However, PG&E took 95 minutes to stop the flow of gas and to isolate the rupture site—a response time that was excessively long and contributed to the extent and severity of property damage and increased the life-threatening risks to the residents and emergency responders. The National Transportation Safety Board found that PG&E lacks a detailed and comprehensive procedure for responding to large-scale emergencies such as a transmission pipeline break, including a defined command structure that clearly assigns a single point of leadership and allocates specific duties to supervisory control and data acquisition staff and other involved employees. PG&E’s supervisory control and data acquisition system limitations caused delays in pinpointing the location of the break. The use of either automatic shutoff valves or remote control valves would have reduced the amount of time taken to stop the flow of gas. x#

PAR-11-01, page 12NTSB Pipeline Accident Report PG&E’s pipeline integrity management program, which should have ensured the safety of the system, was deficient and ineffective because it— • Was based on incomplete and inaccurate pipeline information. • Did not consider the design and materials contribution to the risk of a pipeline failure. • Failed to consider the presence of previously identified welded seam cracks as part of its risk assessment. • Resulted in the selection of an examination method that could not detect welded seam defects. • Led to internal assessments of the program that were superficial and resulted in no improvements. Several deficiencies revealed by the National Transportation Safety Board investigation, such as PG&E’s poor quality control during the pipe installation and inadequate emergency response, were factors in the 2008 explosion of a PG&E gas pipeline in Rancho Cordova, California. (See Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 [Washington, DC: National Transportation Safety Board, 2010].) This 2008 accident involved the inappropriate installation of a pipe that was not intended for operational use and did not meet applicable pipe specifications. PG&E’s response to that event was inadequate; PG&E initially dispatched an unqualified person to the emergency, causing an unnecessary delay in dispatching a properly trained and equipped technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in San Francisco, which involved inaccurate record-keeping, the dispatch of first responders who were not trained or equipped to close valves, and unacceptable delays in shutting down the pipeline. (See Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 [Washington, DC: National Transportation Safety Board, 1982].) The National Transportation Safety Board concluded that PG&E’s multiple, recurring deficiencies are evidence of a systemic problem. The investigation also determined that the California Public Utilities Commission, the pipeline safety regulator within the state of California, failed to detect the inadequacies in PG&E’s integrity management program and that the Pipeline and Hazardous Materials Safety Administration integrity management inspection protocols need improvement. Because the Pipeline and Hazardous Materials Safety Administration has not incorporated the use of effective and meaningful metrics as part of its guidance for performance-based management pipeline safety programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines could be improved. Without effective and meaningful metrics in performance-based pipeline safety management programs, neither PG&E nor the California Public Utilities Commission was able to effectively evaluate or assess PG&E’s pipeline system. xi#

PAR-11-01, page 13NTSB Pipeline Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the Pacific Gas and Electric Company’s (PG&E) (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. Recommendations The National Transportation Safety Board makes new recommendations to the U.S. Secretary of Transportation, the Pipeline and Hazardous Materials Safety Administration, the governor of the state of California, the California Public Utilities Commission, the Pacific Gas and Electric Company, the American Gas Association, and the Interstate Natural Gas Association of America. The National Transportation Safety Board previously issued recommendations to the Pipeline and Hazardous Materials Safety Administration, the California Public Utilities Commission, and the Pacific Gas and Electric Company as a result of this accident. xii#

PAR-11-01, page 14NTSB Pipeline Accident Report 1. Factual Information 1.1 Accident Narrative On September 9, 2010, about 6:11 p.m. Pacific daylight time, 1 a 30-inch-diameter segment of an intrastate natural gas transmission2 pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point (MP) 39.28 of Line 132, 3 at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. (See figure 1.) The section of pipe that ruptured, which was about 28 feet long, and weighed about 3,000 pounds, was found 100 feet south of the crater. (See figure 2.) PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. (See figure 3.) Eight people were killed, many were injured, and many more were evacuated from the area. The ruptured pipe segment was installed in 1956. According to PG&E records (which were later found to be incorrect), the ruptured segment was constructed from 30-inch-diameter, seamless American Petroleum Institute (API) 5L 4 grade X425 steel pipe with a 0.375-inch wall thickness. The maximum allowable operating pressure (MAOP6) for Line 132 was 400 pounds per square inch, gauge (psig). The PG&E specified maximum operating pressure (MOP7 ) was 375 psig. 1 All times in this report are Pacific daylight time unless otherwise specified. 2 A transmission line is defined as a pipeline, other than a gathering line, that (1) transports gas from a gathering line or storage facility to a distribution center, storage facility, or large-volume customer that is not downstream from a distribution center; (2) operates at a hoop stress of 20 percent or more of specific minimum yield strength (SMYS); or (3) transports gas within a storage field. 3 MPs are measured along the length of the pipeline relative to the distance from the Milpitas Terminal, where Line 132 originates, which is designated as MP zero. 4 The API develops industry-based consensus standards that support oil and gas production and distribution. API 5L is a specification for line pipe. 5 This signifies that the pipe has a SMYS of 42,000 pounds per square inch (psi). Yield strength is a measure of the pipe’s material strength and indicates the stress level at which the material will exhibit permanent deformation. Although yield strength is expressed in psi, this value is not equivalent to a pipe’s internal pressure. 6 MAOP is defined by the Pipeline and Hazardous Materials Safety Administration (PHMSA) as the maximum pressure at which a pipeline or segment of a pipeline may be operated under Title 49 Code of Federal Regulations (CFR) Part 192. (Part 192 contains the minimum Federal safety standards for the transportation of natural gas by pipeline.) 7 MOP is an operating limit defined by PG&E. As explained by PG&E, sometimes a line’s MOP equals the MAOP. But when a line is crosstied to (open to) a line with a lower MAOP, the higher rated line is limited by the MAOP of the lower rated line. In the case of Line 132, when it was open to Line 109 (which had a MAOP of 375 psig), as it was at the time of the accident, the MOP of Line 132 was 375 psig. 1#

PAR-11-01, page 15NTSB Pipeline Accident Report Figure 1. Picture of crater and ruptured pipeline. Figure 2. Picture of ejected pipe section. 2#

PAR-11-01, page 16NTSB Pipeline Accident Report Figure 3. Aerial view of fire. 1.1.1 Preaccident Events During the hours leading up to the accident, three PG&E employees and one contractor were working on an electrical distribution system as part of the replacement of the uninterruptible power supply (UPS8) at the Milpitas Terminal, where Line 132 originates. (See figure 4.) The electric work had been approved by a PG&E work clearance9 form, which was submitted to PG&E’s gas control center (referred to in this report as the SCADA10 center) on August 19, 2010, and approved on August 27, 2010. 8 A UPS is an electrical apparatus that provides backup power. 9 A work clearance is a procedure used by PG&E to notify the supervisory control and data acquisition (SCADA) center of work that may affect gas flow, gas quality, or SCADA monitoring. For more information about the work clearance process, see section 1.9.1.2, “Work Clearance Procedures.” 10 PG&E used a computer-based SCADA system to remotely monitor and control the movement of gas through its pipelines. SCADA operators located at the SCADA center in San Francisco monitor operating parameters such as flow rates, pressures, equipment status, control valve positions, and alarms indicating abnormal conditions. (For more information, see section 1.9.1, “SCADA System Operations.”) 3#

PAR-11-01, page 17NTSB Pipeline Accident Report Figure 4. Overview of Line 132. The work on September 9, 2010, was the continuation of a larger project to temporarily transfer electrical loads from an existing UPS distribution panel onto individual smaller UPS devices. 11 The intent of this operation was to complete the removal of all loads from the existing UPS distribution panel so it could be removed from service and replaced. Future work included replacing the UPS and transferring each load from the small, temporary UPSs back onto a new UPS. On the evening of September 9, 2010, one SCADA operator (operator D) became the primary point of contact for workers at the Milpitas Terminal, but at various times all five of the SCADA staff answered telephone calls and handled alarms relating to events at the Milpitas Terminal. The SCADA operators sat together in the SCADA center and communicated frequently throughout the evening about the work. (It should also be noted that the San Francisco SCADA operations were scheduled to move during the next shift to an alternate SCADA facility in Brentwood, California, as part of a regular exercise. Some of the SCADA operators scheduled to work the night shift, who had reported to the Brentwood location, were monitoring the lines and were communicating by telephone with the day shift SCADA staff in San Francisco. 11 The smaller UPS devices serve a single component on a circuit. 4#

PAR-11-01, page 18NTSB Pipeline Accident Report However, after the rupture of Line 132, the exercise at the Brentwood facility was cancelled, and the staff at Brentwood reported to the San Francisco facility.) 1.1.2 Events Leading Up to Rupture At 2:46 p.m. (about 3.5 hours before the rupture), a gas control technician at the Milpitas Terminal (hereafter referred to as the Milpitas technician) spoke with SCADA operator A in San Francisco to initiate the work clearance for the planned UPS work. At 3:36 p.m., the Milpitas technician called the SCADA center and spoke with SCADA operator B to find out whether the valves on two of the incoming lines would close upon losing power. Operator B confirmed that they would fail closed. The Milpitas technician then informed operator B that he would lock the valves open. Before performing the transfer of equipment that powered instrumentation and provided SCADA data to the SCADA center, the workers at the Milpitas Terminal called the supervisor of SCADA and controls to discuss the impacts of the work. He advised them to put the regulating control valves12 in manual control to prevent the valves from operating. As the electrical work progressed, the Milpitas technician called the SCADA center to alert them each time work was about to begin that would affect SCADA data. In keeping with this practice, at 4:03 p.m., the Milpitas technician alerted SCADA operator C that the installation of one of the smaller UPSs was about to begin. The Milpitas technician stated that he was going to put the regulating valves in manual control at the regulating valve controllers and return them to automatic after the transfer was complete. During this portion of the electrical work, beginning at 4:18 p.m., the SCADA center lost SCADA data for pressures, flows, and valve positions at the Milpitas Terminal. SCADA operator B called the Milpitas Terminal at 4:32 p.m., asking “What’s going on?” in reference to the extended loss of SCADA data. During that phone call, the workers at the Milpitas Terminal were in the process of restoring power and SCADA data. At 4:38 p.m., the Milpitas technician contacted the SCADA center to verify the SCADA data had returned to normal. At the completion of this portion of the electrical work, the regulating valve controllers were returned to automatic control. Following the transfer of critical loads from the UPS panel, workers at the Milpitas Terminal began to remove power from an unidentified breaker. During that work, the workers opened a circuit that resulted in a local control panel unexpectedly losing power. (See figure 5.) Rather than reenergizing the circuit, the workers pulled drawings and began investigating how to power the local control panel from an alternate source. One of the technicians stated in a postaccident interview that while measuring electrical currents with a clamp-on amp meter, the workers noticed some of the displays at the local control panel went blank. Subsequent troubleshooting showed this to be the result of erratic output voltages from two redundant 24-volt d.c. power supplies (power supplies A and B on figures 6a and 6b). These 12 The regulating valves operate as the primary means of pressure control through the Milpitas Terminal. They are full port valves with electric actuators governed by controllers. Pressure sensors control the position of the valves from fully open to fully closed or in between to maintain a downstream pressure or be given a percent open by the gas system operator. 5#

PAR-11-01, page 19NTSB Pipeline Accident Report erratic voltages to pressure transmitters resulted in an erroneous low pressure signal to regulating valve controllers, causing them to command the regulating valves to a fully open position. (See figure 7.) Until then, the regulating valves on all incoming lines except Line 300B had been closed. When the valves opened fully, the monitor valves, whose purpose is to protect against accidental overpressure, became the only means of pressure control. The erratic voltages from the 24-volt power supplies also affected valve position sensors, generating erroneous signals to the SCADA center. Figure 5. Picture of local control panel. 6#

PAR-11-01, page 20NTSB Pipeline Accident Report Figure 6a. Normal electrical configuration at the Milpitas Terminal. 7#

PAR-11-01, page 21NTSB Pipeline Accident Report Figure 6b. Temporary electrical configuration at the Milpitas Terminal preceding the accident. Figure 7. Schematic showing regulating valve control. 8#

PAR-11-01, page 22NTSB Pipeline Accident Report At 5:22 p.m., as a result of regulating valves fully opening and the erroneous signals caused by the erratic voltages, the SCADA center alarm console displayed over 60 alarms within a few seconds, including controller error alarms and high differential pressure and backflow alarms from the Milpitas Terminal. (See figure 8a.) These alarms were followed by high and high-high pressure alarms13 on several lines leaving the Milpitas Terminal, including Line 132. At 5:25 p.m., SCADA operator C called the Milpitas technician to report the high pressure alarms, stating that they “look real.” During this conversation, the Milpitas technician realized that the pressure and regulating valve controller displays on the local control panel had lost all data. At the same time, the SCADA consoles displayed constant pressures14 on the downstream lines and showed all regulating and a majority of monitor and incoming line valves15 at the Milpitas Terminal as not open. 16 (See figure 8b.) At 5:28 p.m., the Milpitas technician called SCADA operator D to ask what pressure values were being displayed on his SCADA console. During the discussion, they both realized that the SCADA center was not receiving valid data for incoming and outgoing lines at the Milpitas Terminal. Operator D notified the Milpitas technician that his SCADA console was showing 458 psig at the Milpitas Terminal “mixer.” 17 Operator D concluded that the regulating and/or station bypass valves may have opened. This was confirmed by the Milpitas technician. With all of the regulating valves wide open, the pneumatically controlled and actuated monitor valves limited pressure on the outgoing lines. The monitor valves were set at 386 psig;18 however, due to a typical lag in the monitor valves response time, the pressure in the lines leaving the Milpitas Terminal peaked at 396 psig19 between 5:22 p.m. and 5:25 p.m. At 5:42 p.m., the Milpitas technician called the SCADA center and reported to SCADA operator C that the regulating valves on incoming Line 300B (the primary line feeding the mixer) had opened fully. Operator C reminded the Milpitas technician that he was unable to see valid pressures or valve positions from the Milpitas Terminal on his SCADA console. The Milpitas technician asked if he could reduce the local set point of the monitor valves from 386 to 370 psig to bring down the line pressures; operator C approved the reduction. 13 High pressure alarms are set at or below the MOP, and high-high pressure alarms are set at MOP plus 3 psi. 14 On a loss of data, the SCADA system displays the last valid reading. 15 The valves on incoming lines are locally controlled at the Milpitas Terminal and are either fully open or closed. 16 Any position less than 100 percent open is considered “not open.” 17 In the 1980s, a mixer was used at the Milpitas Terminal to mix several gas grades from various sources. The mixer has since been removed but the terminology is still used. 18 The monitor valve set point is set locally. The PG&E monitor valves are set to a value above the MOP of the line but below the MAOP. SCADA operators have the ability to remotely set the monitor valve position but cannot override the local pressure set point. 19 Until 5:22 p.m., the pressure had been 359 psig. 9#

PAR-11-01, page 23NTSB Pipeline Accident Report Figure 8a. Valve configuration at the Milpitas Terminal prior to 5:22 p.m. 10#

PAR-11-01, page 24NTSB Pipeline Accident Report Figure 8b. Valve configuration at the Milpitas Terminal about 5:25 p.m. At 5:52 p.m., the senior SCADA coordinator asked SCADA operator D to lower the upstream set points for gas supplying the Milpitas Terminal. When the Milpitas technician called operator D to report that the monitor valves were shut on Line 300B, operator D stated that his console was showing almost 500 psig on downstream headers20 3–7. He asked the Milpitas technician to place a pressure gauge on Line 132 to get a reading of the pressure leaving the Milpitas Terminal. 20 A header is a common pipeline, typically of larger diameter, where two or more other pipelines combine through “T” connections. Headers are typically required when multiple redundant inlet sources are used to feed a single downstream location. 11#

PAR-11-01, page 25NTSB Pipeline Accident Report At 6:02 p.m., operator D commented to a SCADA operator at the Brentwood facility, “we’ve got a major problem at Milpitas and we’ve over pressured the whole peninsula.” At 6:04 p.m., the senior SCADA coordinator informed the supervisor at the Milpitas Terminal that the pressure on the incoming lines at the Milpitas Terminal had been lowered to 370 psig. At the same time, the Milpitas technician reported to SCADA operator C that he had manually read a pressure of 396 psig on outgoing Line 132. High-high pressure alarms continued to appear in the SCADA system until just after the rupture. 1.1.3 The Rupture SCADA data indicate that the rupture occurred about 6:11 p.m., when the pressures on Line 132 upstream of Martin Station (7 miles downstream from the rupture site) rapidly decreased from a high of 386 psig. At the same time, a pressure of 386.4 psig was recorded at Half Moon Bay (located about 10 miles upstream of the rupture). By 6:15 p.m., Martin Station generated the first low pressure alarm for Line 132, followed 20 seconds later by another alarm (150 psig). These low-pressure alarms occurred while SCADA operator D was on the phone with a SCADA operator at the Brentwood facility, who alerted him to the low pressures. By 6:36 p.m., the Line 132 pressure at the Martin Station was 50 psig. The pressures in Lines 101 and 109, which are interconnected to Line 132, also decreased but at a slower rate than Line 132. 1.2 Emergency Response The first 911 call reporting an explosion was received about 6:11 p.m. Many subsequent 911 calls were received from residents and police officers reporting a fire, a gas station explosion, and a possible airplane crash. San Bruno Police Department resources were dispatched, and the first police unit arrived on scene about 6:12 p.m. The first San Bruno Fire Department (SBFD) firefighters to respond had heard the explosion and seen the fire from their station, which was about 300 yards from the accident site. They had reported the fire and were preparing to respond just as the initial dispatch (first alarm21 ) was issued. They were immediately en route and on scene about 6:13 p.m. (See figure 9.) About the same time, 6:13 p.m., some residents began self evacuating from the accident area. Police officers then began securing the area and conducting evacuations south and north of the fire. At 6:16 p.m., police officers requested that California Highway Patrol troopers divert traffic from the scene. Troopers began closing highways in the immediate area. 21 A total of six alarms were requested as firefighters responded to various locations surrounding the accident area. 12#

PAR-11-01, page 26NTSB Pipeline Accident Report Figure 9. Firefighters approaching accident scene. At 6:18 p.m., an off-duty PG&E employee notified the PG&E dispatch center in Concord, California, of an explosion in the San Bruno area. Over the next few minutes, the dispatch center received additional similar reports. About 6:20 p.m., the initial incident commander, a Millbrae Fire Department battalion chief, arrived on scene. When the SBFD chief later arrived on scene,22 he assumed incident command. A battalion chief from the North County Fire Authority was designated as the deputy incident commander.23 Fire operations were supervised by a Millbrae Fire Department division chief and were organized into area commands. 24 Battalion chiefs supervised each area. A representative from the county dispatch center responded to the accident area, and requests for additional response resources were relayed through this representative. At 6:23 p.m., 5 minutes after the PG&E dispatch center received the first call reporting an explosion in the San Bruno area, a dispatcher sent a gas service representative (GSR) working in 22 The SBFD chief’s arrival time was not recorded in any of the documentation provided to the National Transportation Safety Board (NTSB). 23 Forty-two local, county, state, and Federal fire departments assisted in the accident response. 24 Area command is a command organization established to oversee the management of large or multiple incidents. 13#

PAR-11-01, page 27NTSB Pipeline Accident Report Daly City (about 8 miles from San Bruno) to confirm the report, as required by PG&E procedures. 25 About the same time, a PG&E supervisor (supervisor 1) saw the accident fire while driving home from work. He called the PG&E dispatch center, reported the fire, and then proceeded to the scene. By 6:24 p.m., firefighters responding to the south side of the accident area had reported to incident command that hydrants were dry. About the same time, firefighters responding to the north side discovered that the explosion had damaged a water line. To address this, firefighters established water supplies using 1,000–2,000 feet of large-diameter supply hose at two locations. At 6:27 p.m., a PG&E dispatcher called the SCADA center and asked SCADA operator C if the SCADA center staff had observed a pressure drop “at a station in [the San Bruno] area.” The dispatcher stated that he had received reports of a flame shooting up in the air accompanied by a sound similar to a jet engine and that a PG&E supervisor and a GSR had been dispatched to the area. Operator C replied that the SCADA center had not received any calls about the incident. At 6:29 p.m., the senior SCADA coordinator informed a SCADA coordinator at the Brentwood facility that there had been a gas line break and further stated that there had been an overpressure event at the Milpitas Terminal earlier. Reports of a plane crash, a gas station explosion, or some combination of the two persisted throughout the initial hours of the emergency response. By 6:30 p.m., some staff at the SCADA center realized that there had been a rupture along Line 132 in the San Bruno area. However, they did not know the exact location of the rupture and continued to try to identify it. About 6:30 p.m., the on-scene fire operations supervisor declared the incident a multi-casualty incident. Soon after, a medical group was established, and medical units were positioned north and south of the accident scene. At 6:31 p.m., SCADA operator B reported to dispatch that there was “a major pressure drop at a station up in that area [near San Bruno].” About 6:35 p.m., an off-duty PG&E gas measurement and control mechanic (mechanic 1), who was qualified to operate mainline valves, saw media reports about the fire. Suspecting a transmission line break, he notified the PG&E dispatch center, and proceeded to the PG&E Colma yard26 to obtain his service truck and the tools necessary to shut off mainline 25 PG&E procedures require the GSR to evaluate the danger to life and property, assess damage, and make or ensure that conditions are safe. The procedures also require field personnel to notify a field service supervisor, a dispatcher, a gas maintenance and construction supervisor, or an on-call gas supervisor. Nowhere does the procedure instruct field personnel, the dispatch center, or the SCADA center to contact emergency services through 911 or other means. The procedure does not discuss the involvement of city or emergency officials. Notifications that are outlined in the procedure focus on company personnel and supervisors only. On June 8, 2011, the NTSB issued safety recommendations relating to this PG&E procedure. For more information, see Section 1.12, “Previous NTSB Safety Recommendations.” 26 The Colma yard is a small PG&E facility about 4.5 miles from San Bruno, where equipment and vehicles are stored. 14#

PAR-11-01, page 28NTSB Pipeline Accident Report valves. Mechanic 1 lived only a couple of miles from the accident site and the Colma yard. While en route to the Colma yard, mechanic 1 received a call from a supervisor (supervisor 2) directing him to report to the yard and to contact a second mechanic (mechanic 2) to do the same. Before mechanic 1 could place the call, mechanic 2 called him to check on his well being. Both mechanics proceeded to the Colma yard. Meanwhile, another PG&E supervisor (supervisor 3), who lived about 4 miles from the rupture site, learned of the explosion and fire through media reports and notified the SCADA center. He then proceeded to the accident site. About 6:40 p.m., firefighters requested two water tenders,27 which were used as water sources and assigned as needed to various locations around the fire. A California wildfire battalion chief was assigned as a liaison to oversee the water tenders. Supervisor 1 was the first PG&E employee on scene. The GSR, who had been delayed in traffic, arrived shortly thereafter. Both were confirmed on scene at 6:41 p.m., with supervisor 3 following soon after. However, none of these three PG&E first responders were qualified to operate mainline valves. Upon arrival, supervisor 3 and supervisor 1 informed firefighters of their presence as PG&E representatives on scene. At 6:48 p.m., supervisor 1 called the PG&E dispatch center to request that gas and electric crews respond to the scene. Mechanic 1 arrived at the Colma yard about 6:50 p.m., and mechanic 2 arrived soon after. They obtained a map showing the location of pipeline valves in the area and watched further news reports regarding the accident. Processing the visual information, mechanic 1 recognized the rupture as occurring in Line 132 and called a supervisor (supervisor 4) to tell him he was going to isolate the rupture. Supervisor 4 authorized the action. By 6:55 p.m., supervisor 3 had contacted another supervisor (supervisor 5) who activated the PG&E operations emergency center28 in San Carlos and declared supervisor 3 the deputy incident commander. About 7:06 p.m., the two PG&E mechanics left the Colma yard, driving toward the first mainline valve (at MP 38.49) that they planned to close; they were joined en route by a supervisor (supervisor 6). The three arrived at the first valve location by 7:20 p.m. 27 A water tender is a firefighting apparatus used to shuttle, store, and supply water. 28 The San Carlos operations emergency center command post is permanently equipped with computers, desks, and communication equipment. PG&E’s emergency plans define the specific responsibilities of personnel staffing the center. The center directed field resources within the immediate San Bruno area. Later, a larger operations emergency center in the San Francisco headquarters was also activated because of the extent of the emergency. The San Francisco emergency operations center is a central location from which the emergency response activities of the local operating department are prioritized and coordinated. 15#

PAR-11-01, page 29NTSB Pipeline Accident Report Meanwhile, the SCADA center and dispatch center staff were occupied with making outgoing calls to brief PG&E departments and officials of the incoming information, such as the rumors of an airplane crash and a gas station explosion. Between 6:50 and 7:00 p.m., SCADA operators D29 and B30 made comments indicating that there had been a break on Line 132, but SCADA operator C made comments indicating uncertainty as to the nature of the accident.31 During a phone call at 7:07 p.m., operator D responded to a dispatch employee who reported the rumor that there had been a plane crash by saying, “It’s easy to believe it’s a plane crash. We still have indication that it is a gas line break. We’re staying with that. If you talk to the fire department I would inform them of that.” There was no indication that the dispatch center passed this information to the fire department. At 7:22 p.m., at the direction of supervisor 3, supervisor 1 contacted the PG&E dispatch center to convey that although it was still unconfirmed, the incident was likely a reportable gas fire. Within minutes, the dispatch center relayed this information to the SCADA center; the SCADA center confirmed that Line 132 was involved. At 7:27 p.m., supervisor 6, who was with the two mechanics, requested that the SCADA center close two valves at the Martin Station. SCADA operator D remotely closed the valves downstream of the rupture by 7:29 p.m., which stopped the gas flow from north to south. (See figure 10.) By 7:30 p.m., the two mechanics had manually closed the mainline valve (at MP 38.49) south (upstream) of the rupture, stopping the gas flow at that location. By 7:42 p.m., 91 minutes after the rupture, the intensity of the fire had decreased such that firefighters could approach the rupture site and begin containment efforts. By 7:46 p.m., the two mechanics, with some assistance from supervisor 6, had manually closed two more valves downstream of the rupture (at MPs 40.05 and 40.05-2) at the Healy Station. Closing these valves isolated the ruptured section of pipe. About 7:57 p.m., a PG&E pipeline engineer informed the SCADA center staff that the rupture in Line 132 had occurred at MP 39.3332 and explained that several mainline valves had been closed to isolate the break. He also told the staff that the downstream crosstie valves between Lines 109 and 132 had been opened to reestablish gas flow to the Martin Station. About the same time, the San Bruno Recreation Center, staffed by the American Red Cross, was opened as a shelter for evacuees. 29 During a phone call beginning at 6:53 p.m., SCADA operator D said in a conversation with the on-site SCADA supervisor, “Yeah, absolutely we believe it’s a break on line 132.” 30 During a phone call beginning at 6:55 p.m., SCADA operator B said to a dispatch employee, “Transmission line 132 is busted.” 31 During a phone call beginning at 6:55 p.m., SCADA operator C stated to supervisor 3, “I don’t think it is [a] transmission [line].” 32 PG&E has since clarified that the rupture occurred at MP 39.28. 16#

PAR-11-01, page 30NTSB Pipeline Accident Report By 11:32 p.m., additional PG&E crews had manually closed two distribution line valves and squeezed (that is, pinched with hand tools) three more distribution lines to stop the gas-fed house fires surrounding the pipeline rupture. Figure 10. Location of valve closures. 17#

PAR-11-01, page 31NTSB Pipeline Accident Report Although the gas flow through the transmission line break and several local distribution lines had been stopped, the resulting fires continued. Firefighters declared 75 percent of all active fires to be contained about 4:24 a.m. on September 10. Fire operations continued to extinguish fires and monitor the accident area for hot spots until about 8:00 p.m. on September 11, when the SBFD transferred incident command to the San Bruno Police Department. During the 50 hours following the accident, about 600 firefighting (including emergency medical service) personnel and 325 law enforcement personnel responded. Fire crews and police officers conducted evacuations and door-to-door searches of houses throughout the response. In total, about 300 houses were evacuated. Firefighting efforts included air and forestry operations. Firefighters, police officers, and members of mutual aid organizations also formed logistics, planning, communications, finance, and damage assessment groups to orchestrate response efforts and assess residential damage in the accident area. 1.3 Injuries As a result of the pipeline rupture and fire, 8 people were killed, 10 people sustained serious injuries, and 48 people sustained minor injuries. (See table 1.) For five of the fatalities, the cause of death was “generalized conflagration effects,” and for the remaining three, the cause of death was “undetermined.” Twenty-one people were transported to hospitals by ambulance, including three firefighters who were treated for smoke inhalation. Forty-five other people were transported to hospitals by private vehicle. Table 1. Injuries. Injury Typea Number Fatal 8 Serious 10 Minor 48 Total 66 a Title 49 CFR 830.2 defines fatal injury as any injury that results in death within 30 days of the accident and serious injury as an injury that (1) requires hospitalization for more than 48 hours, commencing within 7 days of the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages or nerve or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. 1.4 Damage The rupture of Line 132 released an estimated 47.6 million standard cubic feet of natural gas, created a 72-foot-long by 26-foot-wide crater, and ejected a 28-foot piece of pipe weighing 3,000 pounds, which came to rest about 100 feet away. The gas ignited and caused an explosion. As previously noted in section 1.2, “Emergency Response,” the fire was declared about 75 percent contained at 4:24 a.m. on September 10, 2010, about 10 hours and 13 minutes after the accident occurred. 18#

PAR-11-01, page 32NTSB Pipeline Accident Report The fire damage extended to a radius of about 600 feet from the pipeline blast center, mostly spreading in a northeast direction. (See figure 11.) The fire affected 108 houses—38 of which were destroyed, 17 of which received severe-to-moderate damage, and 53 of which received minor damage.33 (See figure 12.) In addition, 74 vehicles were damaged or destroyed. (See figure 13.) The burned area also included a park with woodlands and a playground. According to PG&E, the cost to repair the pipeline was about $13,500,000, natural gas accounted for $263,000. 34 and the loss of Figure 11. Picture showing area of damage from blast and fire. 33 The city of San Bruno used the following damage categories to classify structural damage to houses at the accident site: (1) severe indicated that a house was not safe to occupy and most likely would need to be demolished or completely renovated prior to occupancy, (2) moderate indicated that a house had substantial damage and repairs would be necessary prior to occupancy, and (3) minor indicated that a house had the least amount of damage and could be legally occupied while repairs were being made. 34 PG&E has reported it will not be repairing Line 132 in the area of the accident. 19#

PAR-11-01, page 33NTSB Pipeline Accident Report Figure 12. Picture of destroyed houses. Figure 13. Picture of a burned car in front of several destroyed houses. 20#

PAR-11-01, page 34NTSB Pipeline Accident Report 1.5 Meteorological Information Air temperature and moisture information was retrieved from the Automated Surface Observing System (ASOS) at San Francisco International Airport (KSFO), located about 3 miles to the east of the accident site at an elevation of 13 feet. Air temperature at the accident time (6:11 p.m.) was about 64° F and had decreased to 59° F by midnight. Dew point temperatures remained consistent at about 52° F throughout this period. The wind across the northern and central portion of the San Francisco peninsula was estimated to have been from the west with magnitudes from 15–25 knots (which equates to about 17–29 mph) from the accident time through about 10:00 p.m.35 After 10:00 p.m., the wind magnitude decreased at the KSFO ASOS. At the NTSB’s request, a professional meteorologist familiar with the local terrain and micro-climates reviewed the small-scale wind flow for the accident neighborhood. This expert indicated that the wind in the accident area would have been from the northwest, aligned with Skyline Boulevard. Slightly northwest of the accident location, a branching of the northwesterly wind would have brought a weaker flow across the accident neighborhood from the west-northwest, with eddying also occurring. The expert estimated that wind speeds between 6:00 and 9:00 p.m. would have been 15–20 mph. 1.6 Personnel Information 1.6.1 Milpitas Technician and Other Workers at the Milpitas Terminal The Milpitas technician had been on duty for about 12 hours 11 minutes when the accident occurred.36 He had been hired by PG&E on December 26, 1984. During his employment, the Milpitas technician had successfully completed 171 training courses. He had taken four courses specific to his position in the 17 months before the accident. 37 The electrical contractor had been on duty for 4 hours 41 minutes at the time of the accident. After the accident, PG&E had the four workers at the Milpitas Terminal provide specimens for toxicological testing, pursuant to 49 CFR 199.105 and 199.225. 38 These 35These wind magnitude estimates were based primarily on data retrieved from the KSFO ASOS and observations made by commercial aircraft near KSFO at altitudes close to the accident elevation. 36 Investigators collected detailed work/rest information for all of the employees at the Milpitas Terminal and the SCADA center who were on duty at the time of the accident. This information included awakening and to bed times, time awake, and time on duty on the day of the accident, as well as information from each employee about the quality of their overall rest, whether they had medical issues related to sleep, and whether they had received training about fatigue. For more information, see the Human Performance Group Chairman’s Factual Report and Addendum in the NTSB public docket for this accident. 37 Investigators collected information about training courses taken by each of the PG&E employees at the Milpitas Terminal and the SCADA center who were on duty at the time of the accident. (No training information was available for the contractor.) According to PG&E, available training courses specific to their duties included gas clearance process initial training, gas clearance process training, and refresher gas clearance process training. Training records indicated that each employee had successfully completed the gas clearance process initial training, six of the employees had also successfully completed the gas clearance process training, and one had successfully completed refresher gas clearance process training. For more information, see the Human Performance Group Chairman’s Factual Report in the NTSB public docket for this accident. 38 The California Public Utilities Commission (CPUC) requires PG&E to adhere to postaccident toxicological protocol consistent with PHMSA regulations. 21#

PAR-11-01, page 35NTSB Pipeline Accident Report regulations require drug and alcohol testing for each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor, and further state that the decision not to administer a test “shall be based on the operator’s determination, using the best available information at the time of the determination, that the covered employee’s performance could not have contributed to the accident.” (PHMSA has not issued any guidance regarding the type of analysis or justification that would be acceptable in reaching such a determination.) According to section 199.105, drug tests are to be conducted as soon as possible but no later than 32 hours after an accident. According to section 199.225, alcohol testing is to be conducted as soon as practicable after an accident, and if it is not done within 2 hours of an accident, the operator is required to prepare and maintain a record stating the reasons the test was not promptly administered. The regulation further states that if the test is not administered within 8 hours of the accident, the operator shall cease attempts to do so and state in the record the reasons for not administering the test. PG&E notified its testing contractor at 12:30 a.m. on September 10 that drug and alcohol testing services were needed, and informed her that the 8-hour time frame for alcohol testing would likely be exceeded but instructed her to collect the specimens anyway. The contractor reported to NTSB investigators that she was never made aware of, nor did she inquire about, the time of the rupture. She indicated she was aware of the regulatory 8-hour time limit for alcohol testing. The Milpitas technician provided a urine specimen at 3:10 a.m. on September 10. The specimen was then tested for the following illegal drugs: cannabinoids, cocaine metabolites, opiates, amphetamines, and phencyclidine. The test results were negative. He also took a breathalyzer test to detect ethyl alcohol in his system. The test was administered at 3:36 a.m. on September 10. Between 3:51 and 5:21 a.m. on September 10, specimens for drug and alcohol testing were also collected from two other PG&E employees and a contractor who had been on duty at the Milpitas Terminal when the accident occurred; the drug test results were negative. No documentation was generated as to why alcohol testing was not promptly administered in accordance with 49 CFR 199.205. The CPUC indicated that it was investigating the untimely alcohol testing for possible enforcement action. 1.6.2 SCADA Operators As previously noted, three operators were staffing the SCADA center at the time of the pipeline rupture, and all three were involved in responding to the events surrounding the accident. SCADA operator D, who served as the primary point of contact with the Milpitas technician, had been on duty for about 12 hours 11 minutes when the accident occurred and remained on duty for an additional 3 hours 20 minutes after the rupture. He had been hired by PG&E on June 18, 1979. Over the years, operator D had successfully completed 104 training courses. During the 17 months before the accident, he had taken three courses specific to his position. 22#

PAR-11-01, page 36NTSB Pipeline Accident Report SCADA operator C had been on duty for about 12 hours 41 minutes when the accident occurred and remained on duty for an additional 3 hours 20 minutes after the rupture. He had been hired by PG&E on December 8, 1983. Operator C had successfully completed 76 training courses while employed with PG&E. During the 18 months before the accident, he had taken three courses specific to his position. SCADA operator B had been on duty for about 13 hours 6 minutes when the accident occurred and remained on duty for an additional 3 hours 50 minutes after the rupture. He had been hired by PG&E on September 17, 1974. Throughout his career, he had successfully completed 86 training courses. He had taken three courses specific to his position in the 17 months before the accident. PG&E did not conduct drug or alcohol testing for any of the employees at the SCADA center. PG&E indicated that the SCADA staff were not identified for testing because they were “deemed to be monitoring and responding to the rupture, not contributing to the rupture event.” 1.7 Pipeline Information 1.7.1 Line 132 Line 132 originates at the Milpitas Terminal and extends north about 46 miles to the Martin Station. 39 (See figure 14.) Line 132 is one of three gas transmission lines in the PG&E peninsula system. The other two are Lines 101 and 109. In all three lines, gas flow is typically from south to north. The peninsula system includes six crossties that connect the three transmission lines and allow gas to flow between them. (Four of those crossties are shown on figure 14; the two not shown connect Lines 132 and 109 at MPs 29.06 and 31.93.) 39 Line 132 continues north beyond the Martin Station for a short distance as a distribution line. 23#

PAR-11-01, page 37NTSB Pipeline Accident Report Figure 14. Map showing PG&E peninsula gas transmission lines. 24#

PAR-11-01, page 38NTSB Pipeline Accident Report Line 132 was originally constructed in phases, with construction projects in 1944 and 1948. According to the PG&E geographic information system (GIS),40 Line 132 is made up of 24-, 30-, 34-, and 36-inch-diameter segments of various steel grades with various longitudinal seam weld types, such as double submerged arc welded (DSAW), electric resistance welded (ERW), and seamless (SMLS). In response to a request for construction records for the 1948 portion of the Line 132 project, PG&E provided more than 18,000 pages of records, including material procurement orders from the Consolidated Western Steel Corporation (Consolidated Western) Maywood, California, plant, accounting records, specifications, foreman journal entries, and radiography receipts. The records indicated that 10 percent of the girth welds 41 were radiographed (that is, x-rayed) at the construction site and inspected according to a set of standards agreed upon by engineers from PG&E and the construction contractor. Radiographs of the girth welds also captured a small portion of the longitudinal welds from each of the two pipe segments joined by the girth weld being radiographed. Records from the 1948 project included logs for 209 radiographs, including 19 rejected welds, 4 of which were reexamined and determined to be acceptable. Those four were all longitudinal welds. Of the remaining 15 rejected welds, 5 were longitudinal welds and 10 were girth welds. An additional 14 girth welds were classified as “borderline.” The foreman’s log from the 1948 construction project noted several instances of construction damage, including dents and dent repairs. After the 1948 installation, the 20- and 24-inch segments of Line 132 were tested for leaks in accordance with the construction contract by introducing air at 100 psig and using a soap and water solution on girth welds. According to construction records, as a final check before introducing gas, the 20- and 24-inch segments were pressured to 100 psig with air and held for 48 hours. Gas was introduced into the 30-inch portion of the line upon completion, and the line was checked “for leaks and breaks.” 1.7.2 1956 Relocation Project (Segment 180) In 1956, PG&E relocated 1,851 feet of Line 132 that had originally been installed in 1948. The relocation was necessary because the existing elevation of Line 132 was incompatible with land grading that had been done in connection with residential housing being built at that location. This relocation, which included the installation of the pipe at the accident location, started north of Claremont Drive and extended south to San Bruno Avenue, and rerouted Line 132 from the east side to the west side of Glenview Drive. (See figure 15.) The relocation work was not contracted out, but rather was performed by PG&E construction crews. Construction documentation provided to the NTSB consisted of about 300 pages of journal vouchers, material transfers, paving receipts, and various other cost accounting sheets. PG&E did 40 The GIS is a database of pipeline attributes populated by PG&E. 41 Girth welds, which are typically done at the time of installation in the field, join adjacent pipe pieces and extend around the circumference of the pipe. 25#

PAR-11-01, page 39NTSB Pipeline Accident Report not provide any design/material or construction specifications, inspection records, as-built drawings, or radiography reports. A reference to two cases of bar soap “for testing” was the only indication that any type of on-site leak testing of the girth welds may have been performed. Figure 15. Line 132 installation, relocations, and replacements. 26#

PAR-11-01, page 40NTSB Pipeline Accident Report In 1961, PG&E completed a second relocation project on a portion of Line 132 immediately to the south of the 1956 relocation. As a result, 1,742 feet of the original 1,851 feet of pipe from the 1956 relocation project, including the rupture location, remained in operation. In PG&E’s records, this segment is known as Segment 180. At the time of the accident, Segment 180 was documented in the PG&E GIS as 30-inch-diameter seamless steel pipe API 5L X42 with a wall thickness of 0.375 inch, installed in 1956. The manufacturer is listed as “NA, ” indicating the information was unknown or unavailable. This portion of the GIS database was populated in 1998 using data from a pipeline survey sheet created in 1977. PG&E discovered during the investigation of this accident that the material specification information for Segment 180 on the 1977 pipeline survey sheet had been obtained from accounting records rather than engineering records. Specifically, the source of the information was a 1956 journal voucher used to allocate material expenses from one construction job to another, which contained an erroneous material description. After the accident, NTSB investigators discovered that Segment 180 was not X42 seamless pipe, as stated in the GIS database, and that other documents relating to the 1956 project had correctly indicated that the pipe intended for use in that project had a DSAW longitudinal seam. The investigation revealed that seamless pipe was not, and still is not, available in diameters larger than 26 inches. The PG&E director of integrity management and technical support acknowledged in postaccident interviews that during the time when the pipe for Segment 180 was purchased, all 30-inch pipe purchased by PG&E would have been DSAW, not seamless. Investigators also discovered that the material code listed on the journal voucher corresponded to X52 pipe, not X42. The investigation also revealed that the pipeline at the rupture location was made up of six short pipe segments, known as pups, which were welded together circumferentially. None of the pups were X52 pipe. Each pup ranged from 3.5–4.7 feet long. The NTSB Materials Laboratory determined through tensile and chemical composition testing that the material properties in some of the pups did not meet PG&E 1948 material specifications or industry pipeline material specifications for this time period. The GIS database did not reflect the presence of these pups, although it is intended to record each change in material properties as a separate segment. Further, the investigation revealed that several of the pups had partially welded longitudinal seams that left part of the seam unwelded and that several girth welds joining the pups contained multiple weld defects. Examination revealed that the longer pipe pieces (joints) on either side of the sequence of pups were standard X52 DSAW pipe. (For more information about the pups, see section 1.8, “Examination of Accident Pipe.”) 27#

PAR-11-01, page 41NTSB Pipeline Accident Report As noted earlier in this section, PG&E could not produce any design/material or construction specifications for the 1956 relocation project. PG&E stated its belief that the project followed the standards in the American Society of Mechanical Engineers (ASME)-sponsored code B31.1.8, 1955 edition, Gas Transmission and Distribution Piping Systems. 42 In 1955, PG&E’s then-superintendent of gas transmission and distribution was an active member of the ASME B31.1.8, 1955 edition, code committee. According to PG&E, the pipe used was left over from previous purchases of pipe for other construction projects. According to PG&E, between 1947 and 1957, it purchased a total of 320,065 feet of 30-inch pipe from three suppliers. Based on its records search and the characteristics of the accident pipe, including the numbers painted on the inside of the DSAW long joint south of the pups, PG&E indicated its belief that the pipe at the location of the rupture was most likely manufactured by Consolidated Western in 1948, 1949, or 1953 and was originally purchased for Line 153, Line 131, or the 1948 Line 132 project. PG&E stated that Consolidated Western manufactured the pipe for these three projects at its Maywood, California, plant until May 1949, and afterwards at its South San Francisco plant. NTSB investigators examined the records and determined that the pipe used for the 1956 project was assembled from multiple material procurement orders. The PG&E 1948 specification for 30-inch pipe, the most recently applicable specification at the time of the 1956 relocation project, called for steel pipe with longitudinal seams joined by electric fusion welding (now referred to as submerged arc welding43 ). A PG&E document prepared in 1962, titled “History of Pipe Purchases,” states that, beginning in 1948, all purchased pipe with diameters of 20–36 inches would have been DSAW pipe. For pipe with 0.375-inch-thick walls, it specified that wall thickness could not be less than 90 percent of the specified thickness and that any defect reducing the wall thickness to less than this amount would be considered injurious. It also specified a minimum yield strength of 52,000 psi. Regarding hydrostatic pressure tests at the time of manufacture (that is, at the pipe mill), the specification stated that— each length of pipe…including jointers, shall be tested to a hydro-static pressure which will produce a stress of 90% of the specified minimum transverse yield strength [1170 psi in the case of 30-inch pipe with a wall thickness of 0.375 inch], which pressure shall be maintained for not less than ten seconds. …While under pressure, the pipe length shall be struck a blow with a two-pound hammer, or its equivalent, near both ends of the weld. The PG&E specification further provided that 95 percent of the finished pipe sections were to be between 30 feet 6 inches long and 31 feet 4 inches long. Consistent with 42 All versions of the ASME-sponsored codes for pressure piping are referred to in this report as ASME codes, even though several other organizations have also been associated with their development over time. The ASME code for pressure piping was originally developed in cooperation with the American Engineering Standards committee, which later changed its name to the American Standards Association, and then to the American National Standards Institute, Inc. 43 Submerged arc welding is a form of arc welding where the filler wire and the pipe seam are submerged in a bed of pelletized flux. The flux protects the weld from impurities while it is in its molten state. 28#

PAR-11-01, page 42NTSB Pipeline Accident Report API standards at that time, it stated that no more than 5 percent of the order could consist of jointers, defined in the specification as two (or more)44 pieces of pipe joined by welding, and that a jointer could not contain pipe lengths measuring less than 5 feet. At the NTSB’s investigative hearing, the PG&E director of integrity management and technical support testified that he believed the accident segment of pipe was a jointer manufactured at a mill. In July 1949, Moody Engineering Company submitted a report to PG&E on the supervision and inspection of the manufacture of 100,000 feet (3,222 pieces) of 30-inch-diameter pipe by Consolidated Western’s Maywood, California, manufacturing plant. The report explained the manufacturing process, the chemical and physical properties of the steel, and the hydrostatic pressure test procedure used at the factory. According to the report, based on inspections of each piece of pipe, 244 pieces were repaired to meet PG&E specifications, and 19 pieces were permanently rejected. Moody Engineering Company concluded that the pieces that had been accepted met PG&E specifications and were shipped in March and April 1949. 1.7.3 Multiyear Replacement Project and Seismic Risk According to the PG&E GIS, in 1995, PG&E replaced several sections of Line 132, including segments that ended about 565 feet to the south and about 610 feet to the north of Segment 180. These replacements were part of a multiyear replacement project on the peninsula lines to address seismic hazards. Some segments of Lines 109 and 132 crossed the San Andreas Fault and were therefore rerouted to reduce seismic risk. Segment 180 does not cross the fault, and a 1992 report prepared by the PG&E geosciences department in connection with the replacement project indicated that Segment 180 had a low-to-moderate seismic risk. The subsequent risk assessments of Segment 180 assigned a score of 0 for any “ground movement” threat. (For more information on threat scores and risk assessment, see section 1.9.4, “PG&E Risk Management/Integrity Management Program.”) A low seismic risk for the accident area was also indicated by a February 2011 report prepared for PG&E under contract by TRE Canada, a company that specializes in measuring ground deformation using satellite imagery. TRE Canada analyzed the Earl Avenue and Glenview Drive area from May 1992–August 2010 and found that the accident area did not experience any significant vertical movement during that time. According to a PG&E public information fact sheet, the purpose of the multiyear project, which began in 1985, was “to maintain safe and reliable gas service to our customers,” and it would eventually “replace all aging natural gas pipelines in the system over a 25-year period.” In addition to seismic hazard, other factors considered in setting replacement priorities for the project were age, construction factors, and condition of the pipe. 44 PG&E provided multiple documents containing the specification. In one document, jointers are defined as “two pieces joined by welding,” and in another as “two or more pieces joined by welding.” 29#

PAR-11-01, page 43NTSB Pipeline Accident Report 1.7.4 Underground Environment at Accident Location At the time of the accident, Line 132 was buried underground along the west side of water line, which crossed about 2.5 feet above Line 132 at the location of the rupture and was destroyed, resulting in the lack of functional fire hydrants near the accident scene. A 10-inch-diameter sanitary sewer line crossed below Line 132 about 108 inches south of pup 1. (The sewer line is discussed further below.) In addition, a 4-inch-diameter gas distribution line ran parallel to Line 132, about 6 feet 9 inches to the west. (See figure 16.) Farther below the buried utilities, at a depth of about 9 feet, was a drainage system with a catch basin running from west to east, which emptied into a canyon just east of the accident location. Glenview Drive.45 Other underground utilities at the accident site included a 6-inch-diameter Figure 16. Sketch of underground utilities environment. 1.7.4.1 2008 Sewer Replacement In June 2008, the city of San Bruno issued a change order to an existing contract to upgrade the sanitary sewer main along Earl Avenue to Glenview Drive. The change order specified that the contractor replace the existing 6-inch vitrified clay sewer pipe with a 10-inch-diameter polyethylene pipe by pneumatic pipe bursting, which is a widely used method of replacing buried pipe without digging an open trench. Two pits are required to install the new 45 As a result of the rupture, this portion of Line 132 is no longer in service. 30#

PAR-11-01, page 44NTSB Pipeline Accident Report pipe: an entry pit (normally a long slender trench to allow the pipe to bend as it is introduced into the ground) and an exit pit (normally a square pit at an existing manhole to allow for the cable, pulley block, and bursting head removal). The bursting head, a conical pneumatic expanding device, is introduced through the entry pit. It travels through the existing pipe, breaking it into pieces and radially expanding the existing hole. The new pipe, attached to the back of the bursting head, is simultaneously pulled into place. The bursting head is pulled by a cable that runs through the existing sewer pipe to the exit pit, through a pulley block, and up to a winch located above the exit pit at street level. The existing sewer pipe ran underneath Line 132 at the intersection of Earl Avenue and Glenview Drive, requiring an excavation of the sewer pipe on either side of Line 132. The contractor dug a potholing46 trench that extended about 4 feet or more to the west and 3 feet to the east of Line 132. Further, according to the contractor, in the area where the sewer pipe crossed under Line 132, the old sewer pipe was broken up and removed by hand before the pipe-bursting operation began. The pneumatic expanding device was turned off as it passed under the area where the sewer pipe crossed under Line 132. Prior to the excavation, the contractor had contacted the local one-call service company 47 and filed the required notices. The exit pit was located at an existing manhole on Glenview Drive approximately 8 feet from the east side of Line 132. A 10-ton constant tension winch was located at the west wall of the pit. 48 The cable traveled down from the winch, into the exit pit, and over a pulley that was braced near the bottom of the pit against three overlapping sheet pilings. The outer two pilings spanned the full height of the pit and were driven into the floor of the pit at the west wall. The shortest distance from the center of the sheet pilings to the sidewall of Line 132 was estimated to be 7.7 feet. As the cable left the exit pit, it passed under Line 132, through the potholing trench, and continued along the existing sewer pipe to the entry pit. The pipe bursting began at the entry pit 290 feet to the west on Earl Avenue. A video of the project recorded the sound of the pneumatic bursting and showed the movement of the replacement pipe at the exit pit and the movement of the cable at the winch. Based on the recording, the pneumatic bursting rate was 214 strokes per minute. Based on the video, the replacement pipe pull rate ranged from 0.1–0.2 inches per second. According to the contractor, the maximum load on the winch was 14,000 pounds and the diameter of the cable was 0.562 inch. As the bursting head approached the potholing trench, the pneumatic device was turned off. From there, the replacement sewer pipe was pulled through the potholing trench, underneath Line 132, and up to the exit pit. (See figure 17.) 46 Potholing refers to holes used when excavating the ground near a utility service to visually locate the utility. Small holes are dug on either side of a pipe with a backhoe until the location of the utility can be visually confirmed. 47 A one-call, or 811, service is a required notification system used to ensure the identification and marking of buried pipelines before excavation. 48 Constant tension indicates that the force exerted by the winch on the cable can be set to a constant value, selected by the operator, that otherwise does not vary during the bursting process. 31#

PAR-11-01, page 45NTSB Pipeline Accident Report Figure 17. Diagram of excavations relative to Segment 180. According to postaccident interviews, a PG&E gas mechanic was on site while part of the potholing trench was hand dug and after the polyethylene sewer pipeline had been pulled into the exit pit. The gas mechanic measured the vertical clearance between the bottom of Line 132 and the top of the new sewer pipeline, and determined that there was about 9 inches of clearance between the two. He also inspected the gas pipeline for damage and was satisfied with the work; he did not mention any problems or express any concern to the contractor foreman. The contractor proceeded to backfill the trench. The backfilling was neither witnessed nor inspected by the PG&E gas mechanic. 32#

PAR-11-01, page 46NTSB Pipeline Accident Report 1.7.4.2 Guidelines for Pipe Bursting Investigators reviewed studies that quantify safe distances for pipe bursting adjacent to utilities. According to one study,49 there is a 95 percent probability that ground vibrations will be within safe levels for buried utilities at a distance of 7.5 feet or more from the bursting head, unless the buried utility is in poor structural condition. Nearby utilities and buried structures closer than 7.5 feet may require a small excavation (that is, potholing) in the bursting path to provide shielding from the vibration. Another report50 concluded that the bursting head should not pass closer than 2.5 feet from buried pipes and 8 feet from sensitive surface structures. That report states that the problems related to nearby utilities are often relieved by localized excavations; to avoid damage, the general rule is that nearby utilities should be excavated whenever the vertical and horizontal separation is less than twice the replacement pipe diameter between the new pipe and existing utilities. 1.7.4.3 Pipe Bursting Study Investigators used information from a land survey of the accident site, the above referenced studies on pipe bursting ground vibrations, a video of the Earl Avenue sewer replacement project, and the contractor’s testimony to calculate the forces on Line 132 caused by the pipe bursting process. Investigators considered the effect of ground vibrations from the bursting head, constant loads from the winch at the exit pit, and vibratory loads from the winch at the exit pit. The calculations indicated that ground vibrations from the bursting head could have deformed pup 1 (where the rupture initiated) out-of-round by up to 0.004 inch. The effect of the deformation on the stress state of the pup 1 seam weld defect was less than a 6-psi change in internal gas pressure. The calculated external soil pressure on the side of pup 1 (approximately 10 feet from the winch brace), due to the 14,000-pound load on the sidewall of the exit pit, was 0.1 psi. This soil pressure had an effect on the stress state of the pup 1 seam weld defect equivalent to a 2.5-psi increase in internal gas pressure. The calculated variation in external soil pressure due to vibratory loads on the sidewall of the pit was less than 0.01 psi. The internal gas pressure on the day of the sewer replacement project was approximately 365 psig. In 2008, the gas pressure in Line 132 varied daily by up to 110 psi. 1.7.5 Pipeline MAOP Prior to 1961, there were no regulations in the state of California governing natural gas pipeline safety. There was, however, a voluntary national consensus standard in ASME B31.1.8, 1955 edition, which called for hydrostatic pressure testing of newly constructed pipelines at 1.1–1.4 times the intended MAOP, depending on the class location. PG&E elected not to hydrostatically test Segment 180 of Line 132, and it is unknown if PG&E followed the other guidelines of the ASME standard. 49 A. Atalah, “The Ground Vibration Associated With Pipe Bursting in Rock Conditions,” paper presented at North American Society for Trenchless Technology, NO-DIG 2004, New Orleans, Louisiana, March 22-24, 2004. 50 J. Simicevic and R.L. Sterling, Guidelines for Pipe Bursting, TTC Technical Report #2001.02 (prepared by Trenchless Technology Center for U.S. Army Corps of Engineers, Engineering Research and Development Center, 2001). 33#

PAR-11-01, page 47NTSB Pipeline Accident Report In 1961, the CPUC began regulating natural gas pipeline safety in California under General Order 112, State of California Rules Governing Design, Construction, Testing, Operation, and Maintenance of Gas Gathering, Transmission, and Distribution Piping Systems, which was based on the ASME B31.1.8, 1958 edition. General Order 112 required hydrostatic pressure testing of newly constructed pipelines in class 3 areas at 1.5 times the intended MAOP, however it was not applied retroactively to existing installations such as Line 132. Therefore, PG&E was not required to pressure test Line 132 to comply with General Order 112. Federal regulations issued in 1970 include a requirement in 49 CFR 192.505 that any segment of newly constructed gas transmission pipeline intended to operate at a hoop stress51 of 30 percent or more of its SMYS undergo a hydrostatic pressure test for a minimum of 8 hours to substantiate its MAOP. In certain class 1 or 2 locations, the test pressure must be at least 125 percent of the MAOP; in class 3 and 4 locations, the required pressure is 150 percent of MAOP. The MAOP for a newly constructed pipeline segment is derived from the pressure used during this hydrostatic testing. 1.7.5.1 “Grandfather Clause” For pipelines constructed before 1970 that were not required to be hydrostatically tested, 49 CFR 192.619(a) (3), known as the “grandfather clause,” allows the MAOP to be based on “the highest actual operating pressure to which the segment was subjected during the 5 years preceding … July 1, 1970.” In contrast to MAOP based on hydrostatic pressure testing, the grandfather clause does not specify a minimum amount of time that the historical pressure must have been held to be used as the basis for the MAOP. As originally proposed, 49 CFR 192.619 did not include a grandfather clause but rather specified that the MAOP be set at the lowest of several alternatives, including (1) the design pressure of the weakest element in the pipeline system or (2) a percentage, based on the class location, of the pressure to which the pipeline was tested after construction. However, the Federal Power Commission (the predecessor of the Federal Energy Regulatory Commission) submitted comments on the proposed rule, pointing out that the proposed MAOP limits were similar to those in the ASME-sponsored B31.8, 1968 edition, Gas Transmission and Distribution Piping Systems. The Federal Power Commission stated— The proposed regulation does not recognize that the B31.8 Code did not establish these minimum test levels until 1952. Prior to that time, between 1935 and 1951, the predecessor Code, B31, required only that a pipeline be tested to a pressure 50 [psig] in excess of the proposed maximum operating pressure. There are thousands of miles of jurisdictional interstate pipelines installed prior to 1952, in compliance with the then existing codes, which could not continue to operate at their present pressure levels and be in compliance with [the] proposed section []. 51 A hoop stress is a circumferential stress in thin-walled cylinders (for example, the internal diameter is greater than 40 times the wall thickness) and is assumed to be approximately uniform through the thickness of the wall. 34#

PAR-11-01, page 48NTSB Pipeline Accident Report The [Federal Power] Commission has reviewed the operating record of the interstate pipeline companies and has found no evidence that would indicate a material increase in safety would result from requiring wholesale reductions in the pressure of existing pipelines which have been proven capable of withstanding present operating pressure through actual operation. The preamble to the final rule establishing Part 192 stated— [i]n view of the statements made by the Federal Power Commission, and the fact that [the U.S. Department of Transportation (DOT)] does not now have enough information to determine that existing operating pressures are unsafe, a ‘grandfather’ clause has been included in the final rule to permit continued operation of pipelines at the highest pressure to which the pipeline had been subjected during the 5 years preceding July 1, 1970.52 In 1987, the NTSB recommended elimination of the grandfather clause in (ANPRM) inviting public comment on whether the grandfather clause should be eliminated. 53 Safety Recommendation P-87-9. In 1989, the Research and Special Programs Administration (RSPA), the predecessor agency of PHMSA, issued an advance notice of proposed rulemaking The ANPRM noted that the grandfather clause allowed certain pipelines to operate at hoop stress levels above 72 percent of SMYS, whereas nongrandfathered pipes were limited to 72 percent of SMYS. The ANPRM also noted that the NTSB had recommended elimination of the grandfather clause. Based on public comments received on the 1989 ANPRM, RSPA decided not to eliminate the grandfather clause. (For more information on Safety Recommendation P-87-9 and the ANPRM, see section 1.12, “Previous NTSB Safety Recommendations.”) PHMSA statistics indicate that 61 percent of onshore gas transmission pipelines (about 180,000 miles) were installed prior to 1970. PHMSA does not keep track of how many of these pipelines have MAOPs established under the grandfather clause. 1.7.5.2 MAOP for Line 132 The MAOP for Line 132 was established as 400 psig pursuant to the grandfather clause. According to PG&E logs from the Milpitas Terminal, the highest operating pressure on Line 132 during the applicable 5-year period was 400 psig on October 16, 1968. The MOP set by PG&E for Line 132 was 375 psig. According to the manager of the PG&E integrity management program, PG&E considers the MOP to be the maximum pressure at which a pipeline system, as distinguished from a pipeline segment, can operate. She explained that the MOP of a pipeline system is governed by the lowest MAOP of any interconnected lines. Thus, when crossties connecting Line 132 (MAOP of 400 psig) and Line 109 (MAOP of 375 psig) are open, the MOP of Line 132 is the MAOP of Line 109—that is, 375 psig. 52 Federal Register, vol. 35, no. 161 (August 19, 1970), p. 13248. 53 Federal Register, vol. 54, no. 236 (December 11, 1989), p. 50780. 35#

PAR-11-01, page 49NTSB Pipeline Accident Report 1.7.5.3 Periodic Pressure Increases to MAOP Title 49 CFR 192.917(e) addresses required actions for particular threats. It is one of the integrity management program rules that became effective in 2004 54 and states, in part: (3) Manufacturing and construction defects. If an operator identifies the threat of manufacturing and construction defects (including seam defects) in the covered[ the risk of failure from these defects. The analysis must consider the results of prior assessments on the covered segment. An operator may consider manufacturing and construction related defects to be stable defects if the operating pressure on the covered segment has not increased over the maximum operating pressure experienced during the five years preceding identification of the high consequence area. If any of the following changes occur in the covered segment, an operator must prioritize the covered segment as a high risk segment for the baseline assessment or a subsequent reassessment. 55 ] segment, an operator must analyze the covered segment to determine (i) Operating pressure increases above the maximum operating pressure experienced during the preceding five years; (ii) MAOP increases; or (iii) The stresses leading to cyclic fatigue increase. (4) ERW pipe. If a covered pipeline segment contains low frequency electric resistance welded pipe (ERW),[56] lap welded pipe or other pipe that satisfies the conditions specified in ASME B31.8S, [57 ] Appendices A4.3 and A4.4, and any covered or noncovered segment in the pipeline system with such pipe has experienced seam failure, or operating pressure on the covered segment has increased over the maximum operating pressure experienced during the preceding five years, an operator must select an assessment technology or technologies with a proven application capable of assessing seam integrity and seam corrosion anomalies. The operator must prioritize the covered segment as a high risk segment for the baseline assessment or a subsequent reassessment. PG&E had a practice of raising the operating pressure to MAOP once every 5 years on several of its pipelines, including Line 132 and the other peninsula lines (Lines 101 and 109), as a strategy to continue classifying any manufacturing and construction defects on those lines as “stable, ” meaning that they were not anticipated to grow in service. 54 For more information about integrity management programs, see Section 1.10.2, “Federal Oversight by PHMSA.” 55 A covered segment is defined in 49 CFR 192.903 as a segment of a gas transmission pipeline located in a high consequence area (HCA). 56 Line 132 includes several ERW segments. 57 ASME-sponsored code B31.8S, 2004 edition, Managing System Integrity of Gas Pipelines: ASME Code for Pressure Piping, B31 Supplement to ASME B31.8. 36#

PAR-11-01, page 50NTSB Pipeline Accident Report According to PG&E, the pressure on Line 132 was raised to 400 psig at the Milpitas Terminal in December 2003 and December 2008 for about 2 hours each time. During the pressure increase, the downstream pressures at the Martin Station in 2003 and 2008 were 383 psig and 382 psig, respectively, due to the normal pressure gradient. PG&E acknowledged in response to inquiries from NTSB investigators that the pressure needed to serve customers is not usually the MAOP. However, PG&E went on to explain that— under certain circumstances where the operating pressure is raised above the maximum pressure experienced during the preceding [5] years, PHMSA regulations … require the operator to schedule a priority assessment capable of assessing seam integrity. In these circumstances, ASME B31.8S calls for a hydrostatic pressure test, which would take a line out of service for a period of at least a week. To avoid this and any potential customer curtailments that may result, PG&E has operated, within the applicable 5-year period, some of its pipelines that would be difficult to take out of service at the maximum pressure experienced during the preceding 5-year period in order to meet peak demand and preserve the line’s operational flexibility. The regulatory history of 49 CFR 192.917(e)(3) indicates that the rule as originally proposed called for a one-time pressure test to address manufacturing and construction defects.58 However, the final rule59 did not include this requirement. The preamble to the final rule explained: [PHMSA] has been convinced by the public comments, including discussions at the public meetings, that it is not necessary to require a once-in-a-lifetime pressure test to address the threat of material and construction defects. Historical safe operation, which in many cases involves several decades, provides confidence that latent defects will not result in pipeline failure as long as operating conditions remain unchanged. The final rule requires that an assessment be performed if operating pressure is increased above the historic level or if operating conditions change in a manner that would promote cyclic fatigue. At the NTSB investigative hearing, the PHMSA deputy associate administrator for field operations testified that, “it was not the intent when the regulation was written that it would warrant the raising of pressures to avoid a certain assessment. If you’re adjusting the pressure periodically, you need to … make that part of your overall assessment of the risk on that pipeline.” The CPUC director of consumer protection and safety division stated that the CPUC did not agree with the PG&E interpretation of 49 CFR 192.917, and commented that the practice of “artificially raising the pressure in a pipe that has identified integrity seam issues seems to be a wrong-headed approach to safety.” PHMSA officials were unaware of any other operators following such a practice. 58 Federal Register, vol. 68, no. 18 (January 28, 2003), pp. 4278, 4318. 59 Federal Register, vol. 68, no. 240 (December 15, 2003), pp. 69817, 69791. 37#

PAR-11-01, page 51NTSB Pipeline Accident Report A study that looked at the stability of manufacturing- and construction-related defects is discussed in Gas Research Institute (GRI)60 report GRI-04/0178, Effects of Pressure Cycles on Gas Pipelines, dated September 17, 2004: the risk of pressure-cycle-induced fatigue can be dismissed if and only if the pipeline has been subjected to a reasonably high-pressure hydrostatic test. Therefore, it would seem that eliminating the risk of failure from pressure-cycle-induced fatigue crack growth of defects that can survive an initial hydrostatic test of a pipeline requires that the test pressure level must be at least 1.25 times the maximum operating pressure. A PHMSA report from 2007, No. 05-12R, Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines, also looked at defect stability and concluded the following: To summarize, experience and scientific analysis indicates that manufacturing defects in gas pipelines that have been subjected to a hydrostatic test to 1.25 times MAOP should be considered stable. No integrity assessment is necessary to address that particular threat in such pipelines. The principal challenge for deciding whether or not to consider manufacturing defects to be stable is associated with those gas pipelines that have never been subjected to a hydrostatic test to a minimum of 1.25 times MAOP. 1.7.6 History of Seam Defects in PG&E Gas Transmission Pipelines On May 20, 2011,61 the NTSB learned that a DSAW segment on Line 132 had experienced a longitudinal seam leak in October 1988 at MP 30.44, about 8.78 miles south of the San Bruno rupture. Until May 6, 2011, the PG&E GIS had listed the cause of the leak as “unknown.” However, as a result of records discovered during a PG&E postaccident records search,62 information was added to indicate that 12 feet of Line 132 had been replaced “due to a longitudinal defect.” A leak survey inspection and repair report dated October 27, 1988, classified the cause of the leak as a “material failure” and indicated that a material failure report was prepared, but PG&E could not locate any such report. Records showed that the replacement work had started on November 1 and been completed on November 4, 1988. No further information was available regarding the cause of the leak. Seam leaks or test failures in PG&E gas transmission pipelines are listed in table 2. 60 In 2000, the GRI combined with the Institute of Gas Technology to form the Gas Technology Institute (GTI), a nonprofit research and development organization that develops, demonstrates, and licenses new energy technologies for private and public clients, with a particular focus on the natural gas industry. PG&E is a member of the GTI. 61 Shortly after the September 9, 2010, rupture, NTSB investigators asked PG&E to provide a leak/repair history for Line 132. However, this information was not provided until 8 months after the accident. 62 For more information about this records search, see Section 1.11.1, “Actions Taken by PG&E.” 38#

PAR-11-01, page 52NTSB Pipeline Accident Report Table 2. PG&E gas transmission pipeline seam leaks or test failures, 1948–2011. Pipeline Diameter Year Found Line (inches) Description 1948 132 30 Multiple longitudinal seam cracks found during radiography of girth welds during construction 1958 300B 34 Seam leak in DSAW pipe 1974 300B 34 Hydrostatic test failure of seam weld with lack of penetration (similar to accident pipe) 1988 132 30 Longitudinal seam defect in DSAW pipe 1992 132 30 Longitudinal seam defect in DSAW weld when a tie-in girth weld was radiographed 1996 109 22 Cracking of the seam weld in DSAW pipe 1996 109 22 Seam weld with lack of penetration (similar to accident pipe) found during camera inspection 1996 DFM-3 -- Defect in forge-welded seam weld 1999 402 16 Leak in ERW seam weld 2011 300A 34 Longitudinal seam crack in 2-foot pup of DSAW pipe (found during camera inspection) 2011 153 30 Longitudinal seam defect in DSAW pipe during radiographic inspection for validation of seam type 1.7.7 Protection Against Accidental Overpressure Title 49 CFR 192.195, “Protection Against Accidental Overpressuring,” requires “each pipeline that is connected to a gas source so that [MAOP] could be exceeded as the result of pressure control failure or of some other type of failure, must have pressure relieving or pressure limiting devices that meet the requirements of [sections] 192.199 and 192.201.” Section 192.201, in turn, requires—for pipelines operated at 60 psig or higher—that such devices must ensure that the pipeline pressure does not exceed MAOP plus 10 percent, or the pressure that produces a hoop stress of 75 percent of SMYS, whichever is lower. 1.8 Examination of Accident Pipe The ruptured section of pipe and two cutout sections of pipe, immediately south and north of the ruptured section, as illustrated in the figure 18 schematic, were examined at the NTSB Materials Laboratory. The southern63 section of pipe consisted of a single portion of pipe (commonly referred to as a joint). 64 The center section (the ruptured section found about 100 feet from the crater) was fractured at both ends and comprised a continuation of the same long joint from the southern section as well as four shorter lengths of pipe (pups). The northern section of pipe comprised two more pups and a portion of another long joint. For convenience, the pups were numbered 1–6 in the south-to-north direction. The girth welds that joined the pups were numbered sequentially from south to north as C1, C2, and so on through C7. 63 “Southern” refers to the north-south alignment of the pipeline prior to the accident. 64 A joint is a single length of pipe, typically 20 feet or greater in length. 39#

PAR-11-01, page 53NTSB Pipeline Accident Report Figure 18. Schematic of accident pipe. 40#

PAR-11-01, page 54NTSB Pipeline Accident Report The length of pups 1–5 varied from 43.00–46.75 inches, and pup 6 measured 54.25 inches. All six pups were nominal 0.375-inch wall thickness pipe, as was the south long joint. However, the north long joint was nominal 0.312-inch wall thickness pipe. The pipe material codes on documents associated with the 1956 relocation project specified 0.375-inch wall thickness pipe. The circumference of each length of pipe was consistent with nominal 30-inch-diameter pipe. There were no observed areas of preexisting external or internal corrosion on any surface of the pipe. 1.8.1 Welds The longitudinal seam welds on pups 1–3 were fabricated using a fusion welding process that deposited weld metal along the outer portion of the seam, but left an unwelded region along the inner portion of the seam. (See figure 19a.) The weld reinforcement, as well as part of the pipe body for pup 1, had been removed by grinding. The unwelded region persisted along the entire length of each seam. The size of the unwelded region, combined with the grinding of the weld reinforcements (and the pipe body for pup 1), resulted in net intact seam thicknesses of 0.162, 0.195, and 0.162 inch for pups 1, 2, and 3, respectively. The unwelded region defect was observed during a visual weld inspection of each pup. As shown in figure 19a, there was a 15° difference in the orientation of the inner surface of the pipe across the pup 1 longitudinal seam (an angular misalignment). For pup 2, the difference was 0°; and for pup 3, the difference was between 7–10° . The south and north long joints, as well as pup 6, were standard factory-made DSAW figure 19b.) The outer and inner weld passes overlapped, resulting in full penetration in the joint, and each weld exhibited a raised weld reinforcement with a smooth surface. No cracks or pipe, made by a submerged arc welding65 process on the outer- and inner-diameter surfaces. (See surface-connected defects were observed on the longitudinal seam welds of the DSAW pipe sections. 65 DSAW pipe has been arc welded on the outside and inside of the longitudinal seam. 41#

PAR-11-01, page 55NTSB Pipeline Accident Report Figure 19a. Picture showing cross section of longitudinal seam in pup 1. Figure 19b. Picture showing cross section of longitudinal seam in typical DSAW pipe. 42#

PAR-11-01, page 56NTSB Pipeline Accident Report The longitudinal seam welds on pups 4 and 5 were fabricated using a fusion welding process that deposited weld metal down along the outer portion of the seam, as well as a manual arc welding process that deposited weld metal down along the inner portion of the seam. The weld reinforcement on the outer surface of each pup had been removed by grinding. The pup 4 seam welds achieved near full penetration. The pup 5 outer and inner seam welds penetrated 0.073 and 0.072 inch into the seam, respectively. X-ray examination of the pup 4 longitudinal seam indicated incomplete fusion,66 porosity, and undercutting67 defects. A similar examination of the pup 5 longitudinal seam indicated a lack of penetration defect along the entire length of the seam. The girth welds were fabricated using a shielded metal (manual) arc welding process along the outside and inside of the joint. 68 All girth welds exhibited incomplete fusion, slag inclusion, 69 and porosity defects at one or more locations. Except for C1 and C6, each girth weld exhibited lack of penetration defects, and all but the C2 and C3 welds exhibited undercutting defects. Each girth weld exhibited a raised weld reinforcement on the outer surface of the pipe. Square pipe ends, as opposed to beveled pipe ends, were observed along several welds. 1.8.2 Crack Initiation Fracture features in the center section of pipe were consistent with the rupture initiating at a preexisting 2.4-inch-long crack in the pup 1 longitudinal seam 20.3–22.7 inches north of the C1 girth weld (approximately mid-span). The direction of crack propagation is indicated by the white arrows in figure 20. Optical and electron microscope examination of the fracture initiation site indicated that the preexisting crack grew by two different modes prior to the rupture. (See figure 21.) The crack first grew by ductile fracture70 starting at the root of the weld, reducing the area of the intact cross section, measured over the 2.4-inch-long initiation site, by approximately 33 percent (stage 1). It subsequently grew by fatigue fracture,71 further reducing the area of the intact cross section by approximately 10 percent (stage 2). The ductile fracture and fatigue fracture regions are colored yellow and green, respectively, in figure 21. The fracture elsewhere along the seam was caused by the rupture (stage 3) and was primarily quasi-cleavage fracture. 72 Occasional small thumbnail-shaped fatigue cracks were observed elsewhere along the pup 1 weld root. The other pups with unwelded seam defects exhibited one or more ductile fracture 66 Incomplete fusion is indicated when weld metal penetrates into the seam but does not melt together with the base metal in the body of the pipe. 67 Undercutting is indicated when, in the course of welding the seam, the adjacent pipe body is melted away, thereby reducing the wall thickness of the pipe. 68 Girth welds are typically fabricated from outside of the pipe. The pipe ends are beveled to enable complete weld penetration. 69 Slag inclusion is indicated when brittle particles are frozen and incorporated into the weld metal. 70 Ductile is a mode of fracture in which the metal ahead of the crack undergoes plastic deformation prior to the crack advancing. A plastic material undergoes permanent deformation (that is, strain) in response to an applied load. When the load is removed, the object does not return to its original shape. 71 Fatigue is a mode of fracture, associated with alternating stresses, in which the crack advances with each alternating stress cycle. 72 Quasi-cleavage is a mode of fracture, typically associated with high-deformation rates in otherwise ductile materials, that is similar in appearance to a cleavage fracture. 43#

PAR-11-01, page 57NTSB Pipeline Accident Report cracks that initiated from the root of the weld but did not exhibit fatigue at the ductile fracture boundary. Figure 20. Picture of pipe section with white arrows showing direction of crack propagation. 44#

PAR-11-01, page 58NTSB Pipeline Accident Report Figure 21. Pictures highlighting rupture initiation site in pup 1 longitudinal seam. 45#

PAR-11-01, page 59NTSB Pipeline Accident Report 1.8.3 Material Properties The rolling direction of the steel used to fabricate each length of pipe was determined by evaluating the orientation and relative length of manganese sulfide inclusions (stringers) in the base metal of each length of pipe. 73 Elongated stringers were observed in the longitudinal direction in the south and north long joints and pup 6, consistent with plate rolled in the longitudinal direction (the standard direction for manufactured pipe). Elongated stringers were observed in the transverse direction in pups 1, 2, 3, and 5, consistent with short widths of plate rolled in the transverse (nonstandard) direction. The long stringer orientation was undetermined for pup 4. The chemical composition of pup 4 differed significantly from the other lengths of pipe. Pup 4 had elevated levels of phosphorous, copper, and tin, consistent with steel made from recycled scrap material. Pups 1, 2, 3, and 5 did not meet the X52 SMYS requirement according to the material specifications for pipe purchased by PG&E from Consolidated Western, nor did they meet the X42 SMYS requirement (Segment 180 was erroneously listed as X42 in PG&E’s GIS system). The yield strength for pups 4 and 6 met the X42 SMYS requirement but did not meet the X52 requirement. The yield strength for the south and north long joints met the requirements for all specifications. Table 3 shows the yield strength and tensile strength for all pipe pieces. Table 4 shows PG&E 1948 pipe specifications and API pipe specifications in effect at the time of the 1956 pipe installation. Table 3. Average and standard deviation of mechanical test data for all lengths of pipe. Sample Yield Strengtha (ksib) Tensile Strength (ksi) Elongation (percent in 2 inch) South long joint 57.0 ± 0.6 83.2 ± 0.3 30.0 ± 0.7 Pup 1 36.6 ± 0.3 63.6 ± 0.2 39.4 ± 0.5 Pup 2 32.0 ± 0.1 52.0 ± 0.0 48.8 ± 0.8 Pup 3 34.9 ± 0.5 60.3 ± 0.3 42.8 ± 0.4 Pup 4 48.3 ± 0.5 79.0 ± 0.0 34.0 ± 0.7 Pup 5 38.5 ± 0.3 71.8 ± 0.3 35.8 ± 1.1 Pup 6 50.5 ± 1.4 78.7 ± 0.3 30.8 ± 0.8 North long joint 54.0 ± 0.4 76.9 ± 0.2 30.4 ± 0.5 a Determined using the 0.5 percent extension under load method. b The abbreviation ksi indicates 1,000 psi. 73 Stringers are manganese sulfide particles that elongate in the rolling direction when a thick slab of steel is reduced in thickness by passing it through a rolling stand at high temperatures. 46#

PAR-11-01, page 60NTSB Pipeline Accident Report Table 4. Minimum yield strength, tensile strength, and elongation requirements according to PG&E and API pipe specifications. Minimum Yield Minimum Tensile Minimum Elongation Specification Strength (ksi) Strength (ksi) (percent in 2 inch) 7R-61963 PG&E material specification 52.0 72.0 22 API 5LX X52, 1954 52.0 66.0 20 API 5LX X42, 1954 42.0 60.0 25 The weld properties of the DSAW lengths of pipe (long joints and pup 6) were compared to the weld properties of the other pups. Examination showed that the DSAW seam welds had a much finer microstructure74 than the partial longitudinal seam welds in pups 1, 2, and 3 and that the lengths of DSAW pipe had heat-affected zones75 that conformed to the shape of the weld, while pups 1, 2, and 3 each had a wide heat-affected zone of comparatively uniform width that extended from the outer surface to the inner surface of the pipe. The features indicated that the two sets of welds were fabricated using different rates of heat input and total heat input. The microhardness for the DSAW welds ranged from 191–192 HV500, 76 whereas the microhardness for the pup 1, 2, and 3 welds ranged from 155–159 HV500. The microhardness for pup 4 was not constant but varied with distance from the pipe surface. The microhardness for the pup 5 welds was 191 HV500. 1.8.4 Historical Information About Steel Grades Prior to 1961 and the adoption of General Order 11277 by the CPUC, there was no regulation in the State of California that governed pipeline construction or the type and testing of pipe that PG&E could use for the conveyance of natural gas. Pipeline operators could write their own specifications for pipe or rely on consensus standards from organizations such as the American Standards Association, API, and the American Society for Testing and Materials (ASTM). ASME-sponsored code B31.1, American Tentative Standard Code for Pressure Piping, a standard covering pressure piping, was first issued in 1935. In 1952, sections relevant to the conveyance of natural gas were issued separately as ASME B31.1.8, Standard Code for Gas Transmission and Distribution Piping Systems. In 1955, the code was revised to include the four-tier construction type and population density-based class location system in use today. The ASME B31.1.8, 1955 edition, did not contain a specification for pipe, but referenced consensus standards such as API 5L, API 5LX, ASTM A134, and ASTM 139 (among others). 74 As the molten weld metal cools and freezes, it organizes into crystalline structures called grains. Microstructure is a description of the size, appearance, and orientation of the grains. 75 The heat-affected zone is the material next to the weld that reached a temperature high enough to produce changes in the structure of the metal. 76 HV500 is an indentation hardness measurement unit, “HV” referring to the Vickers hardness test. The test was done by applying a 500 gram load to a diamond indenter and measuring the size of the resulting impression. Higher numbers indicate harder materials. 77 General Order 112 contained the state’s regulatory scheme for gas pipelines. 47#

PAR-11-01, page 61NTSB Pipeline Accident Report The API 5L specification was first issued in 1928 and is incorporated today by reference in 49 CFR Part 192, Appendix B. In the 1940s and 1950s, it classified pipe according to minimum yield strength using letter grades and number grades, and it listed approved welding processes. The SMYS for grades A and B was 30 and 35 ksi, respectively. According to the specification, the average length for a piece of 5L pipe was to be no less than 17.5 feet. In 1948, API issued Standard 5LX, “API Specification for High Test Line Pipe (Tentative).”78 Submerged arc welding was an approved process for welding 5LX line pipe. In 1948, API 5LX mentioned X42, X46, and X52 pipe, but only fully specified X42 pipe.79 The specifications for higher grades, such as the X52 cold-expanded80 pipe manufactured by Consolidated Western, were subject to agreement between purchaser and manufacturer. By 1954, API 5LX had incorporated X52 specifications, and a separate specification was not required by the purchaser. The specified minimum average length for 5LX pipe was 17.5 feet. ASTM 134 and ASTM 139 were two other specifications that pertained to arc welded pipe. 81 Whereas API 5L did not permit arc welding of grade A or B pipe during the 1940s and 1950s, ASTM A134 and ASTM A139 did. Automated welding was specified, but manual welding by qualified procedure82 could be substituted if agreed to by purchaser and manufacturer. Production weld test specimens with the weld reinforcement removed had to achieve 95 percent of the minimum tensile strength for the grade of steel specified or 100 percent with the weld reinforcement intact. The specified minimum length of ASTM 134 or ASTM 139 pipe was 20 feet. ASME B31.1.8, 1955 edition, specified a 20 percent lower design pressure for these grades of pipe. 1.8.5 Burst Pressure Study and Finite Element Modeling The NTSB conducted a study to estimate the internal pressure required to burst both a typical length of pipe and lengths of pipe with seam weld defects similar to those in pups 1, 2, and 3. For 30-inch-diameter X42 pipe with a wall thickness of 0.375 inch and no defect, the estimated burst pressure was calculated to be 1,300 psig. For pipe with incomplete seam weld penetration, such as seen in pups 1, 2, and 3 as fabricated (before the additional crack growth discussed in section 1.8.2, “Crack Initiation”), two different calculation methods were used: 78 The minimum mill strength test requirement for 5LX line pipe was 85 percent of SMYS, whereas the minimum mill strength test requirement for API 5L line pipe was 60 percent of SMYS. The SMYS requirements for 5LX line pipe were also higher than those for 5L line pipe. 79 The 5LX specification dispensed with the letter grade designations, instead designating pipe by an “X” followed by the SMYS in ksi. For instance, X52 indicated pipe with a SMYS of 52 ksi. 5LX was merged back into 5L in the 1980s. 80 “Cold” refers to an operation performed at room temperature. The Consolidated Western process initially formed the pipe to a diameter of 29.6 inches and then cold-expanded the pipe to a diameter of 30 inches by placing it in a die, plugging the ends of the pipe, and pumping water into the pipe under high pressure. 81 These grades are no longer included in 49 CFR Part 192, Appendix B. 82 A qualified welding procedure is one that has passed a series of tests and inspections. 48#

PAR-11-01, page 62NTSB Pipeline Accident Report • Net yielding according to ASME-sponsored code B31G, 2009 edition, Manual for Determining the Remaining Strength of Corroded Pipelines. • Propagation of a crack-like defect83 according to API 579-1/ASME FFS-1-2007, Fitness-for-Service. The seam welds for pups 1, 2, and 3 were fractured in the accident, and their mechanical properties could not be measured directly. Therefore, inferred values based on microhardness data were used to calculate the estimates. Further, the estimates do not take into account the additional effect of the angular misalignment of the pup 1 longitudinal seam, which (as discussed below) resulted in greater strains on pup 1. Calculated burst pressure estimates using these two methods were 594 and 515 psig for pup 1; 668 and 574 psig for pup 2; and 558 and 430 psig for pup 3, respectively. Finite element models were constructed to examine the stresses and strains in sections of pipe with differing longitudinal seam welds: (1) one model was based on the geometry of a section of pipe with a DSAW seam without defects; (2) one model was based on a section of pipe with a geometry similar to pup 1; (3) one model was based on a section of pipe with a geometry similar to pup 3 and an angular misalignment of 10°; and (4) one model was based on a circular section of pipe with a similarly sized weld defect, but without any angular misalignment. Internal pressures up to 400 psig were applied to the models. The material properties included elastic and plastic behavior84 consistent with X42 steel, which has a nominal yield stress of 42,000 psi. The model with the DSAW seam had small stress concentrations at the corners where the weld reinforcement intersected the wall of the pipe (on the order of 2 percent of the pipe wall thickness in size), but the stress in the model did not reach the yield stress. The unwelded region and angular misalignment in the model based on the pup 1 seam created a crack-like geometry (that is, notch) leading to a severe stress and strain concentration. 85 In that model, at 375 psig, the zone of material beyond the yield stress was on the order of half the pipe wall thickness in percent greater than those of the pipe with the similarly sized weld defect but no angular misalignment. The plastic strains were also as much as 40 percent greater than those for the pup 3 weld geometry. size. (See figures 22a and 22b.) The plastic strains86 at the pup 1 notch tip were more than 100 83 API 579 defines a crack-like flaw as a flaw that may or may not be the result of linear rupture but has the physical characteristics of a crack when detected by a nondestructive evaluation technique. A flaw is defined as a discontinuity, irregularity, or defect that is detected by inspection. 84 A plastic material undergoes permanent deformation (that is, strain) in response to an applied load. When the load is removed, the object does not return to its original shape. 85 The term “crack-like” is used to describe a feature that has the shape of a crack but where the material on opposite faces of the feature was never fused or bonded. 86 Plastic strain is permanent deformation that occurs when a material is stressed above its yield strength. It produces a change in shape that is not reversed when the load is removed. 49#

PAR-11-01, page 63NTSB Pipeline Accident Report Figure 22a. Stress contours at an internal pressure of 375 psig for the finite element model of the weld geometry similar to pup 1. Contour values are the same as in figure 22b. Figure 22b. Stress contours at an internal pressure of 375 psig for the finite element model of a DSAW seam. Contour values are the same as in figure 22a. 50#

PAR-11-01, page 64NTSB Pipeline Accident Report 1.9 Pipeline Operations and Management PG&E was incorporated in California in 1905 and is based in Walnut Creek, California. The company—a subsidiary of the PG&E Corporation—provides natural gas and electric service to 15 million people throughout a 70,000-square-mile service area in northern and central California. This area stretches from Eureka in the north to Bakersfield in the south and from the Pacific Ocean to the Sierra Nevada Mountains. The PG&E gas facilities include 42,141 miles of natural gas distribution pipelines and 6,438 miles of transmission pipelines, 1,059 of which are located in HCAs. 87 Of these 1,059 HCA pipeline miles, 50 miles are in class 1 areas, 29 miles are in class 2 areas, 945 miles are in class 3 areas, and 4 miles are in class 4 areas. PG&E also generates and provides hydroelectric and nuclear power. PG&E is an intrastate public utility and is regulated by the CPUC. 1.9.1 SCADA System Operations The PG&E SCADA center is located at PG&E headquarters in downtown San Francisco. The SCADA center manages the operations of PG&E’s entire gas transmission pipeline system, including terminals and regulating stations. The center is staffed by three SCADA operators during the day shift (6:00 a.m. –6:00 p.m.) and two operators during the evening shift (6:00 p.m. –6:00 a.m.). Also working each shift are one coordinator and one senior coordinator. Prior to the shift change, the departing staff provides a verbal briefing to the incoming staff. The SCADA operators manage alarms and control set points as well as coordinating fieldwork on various pipelines. The SCADA operators are not assigned specific regions on the pipelines but rather all oversee all transmission line operations. Therefore, the operator who acknowledges an alarm may not be the same operator working with the field personnel who generated the alarm. Further, an operator who started as the point of contact for field operations may not be the operator who answers the telephone when there are additional questions from the field. All of the operators sit next to each another in a common area of the control center. The SCADA operators have several screens and can select different views for controlling the system, starting with the entire peninsula system with a GIS overlay showing flows and pressures at key regulating stations and terminals. The operators can select a specific region, which shows a smaller geographic area in greater detail with cross connects, pressure, flows, and status of valves. The operators are also capable of seeing any terminal or regulating station by clicking on the station or using a drop-down menu. They can change set points to the specific station valves as well as watch the incoming and outgoing line pressures and flows. 87 Class location is defined in 49 CFR 192.5, and it refers to the number of buildings in an area that is 220 yards on either side of the centerline of a continuous 1-mile length of pipeline. Class 1 has 10 or fewer buildings, class 2 has 10–46 buildings, class 3 has 46 or more buildings, and class 4 has a prevalence of buildings of 4 or more stories. 51#

PAR-11-01, page 65NTSB Pipeline Accident Report The PG&E procedure for responding to SCADA alarms requires that during the first 10 minutes after any alarm, the SCADA operator must acknowledge, analyze, and respond by analyzing upstream and downstream points to help determine the system condition and cause of the alarm. An additional 10 minutes is allocated for determining the necessary next steps. If deemed necessary by the senior SCADA coordinator, an abnormal incident report is filed. As a result of a rulemaking project initiated prior to the San Bruno accident in response to recommendations stemming from an NTSB safety study, 88 on November 20, 2009, PHMSA issued a regulation requiring pipeline operators that use SCADA systems to define the roles and responsibilities of pipeline controllers during normal, abnormal, and emergency operating conditions, and to provide them with the necessary information, training, and processes to fulfill those responsibilities. (See 49 CFR 192.631. 89 ) In addition, the rule requires operators to have written alarm management plans, have a controller training program, and implement methods to prevent controller fatigue. Operators are required to develop the procedures by August 1, 2011, and to implement some of the procedures—including those related to roles and responsibilities and fatigue mitigation—by October 1, 2011; and others—including those related to adequate information and alarm management—by August 1, 2012. PG&E met the August 1, 2011, deadline for developing its procedures. 1.9.1.1 Milpitas Terminal The Milpitas Terminal is located at the southernmost point of Line 132. This station, which is typically not staffed, consists of four incoming lines and five pressure-regulated outgoing lines. The specific lines, their dimensions at Milpitas Terminal, and their MAOPs and MOPs are listed in table 5. 88 Supervisory Control and Data Acquisition (SCADA) in Liquid Pipelines, Safety Study NTSB/SS-05/02 (Washington, DC: National Transportation Safety Board, 2005). 89 The substance of the final rule is published at Federal Register, vol. 74, no. 231 (December 3, 2009), p. 63310; and the expedited implementation deadlines are published at Federal Register, vol. 76, no. 116 (June 16, 2011), p. 35130. 52#

PAR-11-01, page 66NTSB Pipeline Accident Report Table 5. Incoming and outgoing lines at Milpitas Terminal. Incoming Lines at Milpitas Terminal Line Number Diameter (inches) MAOP (psig) MOP (psig) 107 36 720 477 131 30 595 590 300A 34 558 558 300B 34 600 600 Outgoing Lines at Milpitas Terminal Line Number Diameter (inches) MAOP (psig) MOP (psig) 132 30 400 375 101 36 400 375 109 24 375 375 100 20 400 375 San Jose Distribution Feeder Main 24 200 200 Within the Milpitas Terminal, the incoming lines are routed through a separator and several common headers before splitting into multiple regulating control valve sets. Each of the four incoming lines is pressure controlled through two sets of regulating valves, with each set consisting of a trim and load control valve preceded by a monitor valve upstream. The Milpitas Terminal also has a 20-inch-diameter mixer bypass90 line and a 24-inch-diameter station bypass line, each of which was outfitted with regulating and monitor valves. Each of the regulating valves is operated through an independent electronic controller connected to the programmable logic controller (PLC). The regulating valves are programmed by SCADA operators with pressure set points. In the case of Line 132, they were set to maintain pressure at less than 375 psig. Regulating valves are electrically actuated and will remain in their last position if they lose power but will open if they lose a control signal. The regulating valves can be placed in manual operation at the Milpitas electronic controller, which disables the SCADA center’s ability to control the valve. The monitor valves are stand-alone pneumatically actuated control valves with position monitoring wired to the PLC. They address the regulatory requirements (in 49 CFR 192.195) for pressure relieving or limiting devices to protect against accidental overpressure. In accordance with PG&E procedures, the pneumatic controller on the monitor valves is set to 10 psig above the MOP but below the MAOP of the line they are protecting. A SCADA operator can control the percent open on a monitor valve as long as it does not cause the valve to open further than 90 As noted earlier, in the 1980s a mixer was used at the Milpitas Terminal to mix several gas grades from multiple sources. Although the mixer has since been removed, the terminology “mixer bypass” is still used. 53#

PAR-11-01, page 67NTSB Pipeline Accident Report required to maintain the set point. Thus, a SCADA operator is not capable of overriding the local pressure set point of the pneumatic controller. The monitor valve is normally fully open and will only begin to close when downstream pressure, read through a sensing line connected to the pipeline, exceeds its set point. In the case of Line 132, the monitor valves at the Milpitas Terminal were set at a pressure of 386 psig on the day of the accident. However, due to a typical lag in the monitor valves response time, the pressure in Line 132 at the Milpitas Terminal reached 396 psig just prior to the accident. 1.9.1.2 Work Clearance Procedures According to PG&E procedures, whenever planned work on a gas line operating at more than 60 psig may impact gas pressure, flow, quality, or SCADA monitoring, a system clearance form must be completed and submitted to the SCADA center for approval. PG&E procedures require that the form be submitted at least 10 days prior to the planned work. The form must completely describe the work and include start and end times, as well as the name of the clearance supervisor (the person filling out the form or that person’s designee). The clearance form must also include any necessary special instructions, sequence of operations, and operating maps and diagrams. The form designates certain milestones (such as starting work, finishing work, and operation of equipment that will affect flow, pressure, or monitoring) at which the clearance supervisor is required to notify the SCADA center of work progress. Prior to starting work, the clearance supervisor is required to conduct an on-site briefing about how the work will be done with all individuals performing work under the clearance. According to workers at the Milpitas Terminal, work safety briefings were held at 6:00 a.m. and 1:00 p.m. However, those briefings focused on general safety issues and did not discuss the possible impacts of planned work on the SCADA system. At 1:30 p.m., the contractor held a briefing to discuss the order in which the planned work would be performed. The September 9, 2010, UPS work at the Milpitas Terminal was documented and approved as a one-time project. The form was submitted on August 19, 2010, and approved by the SCADA center on August 27, listing a start date of August 30 and a completion date of September 9. The checkbox under “service interruptions” was marked “no.” The checkbox under special instructions was marked “yes,” and the special instructions worksheet listed two items: (1) a notation explaining that the Milpitas technician was to contact the SCADA center prior to work and at the completion of work, and that he would be accompanied during the work by a contractor and a PG&E technician, and (2) the names and phone numbers of two of the technicians working on the project. The checkbox under “Will normal function of the facility be maintained” was marked “no,” but where the form reads “If no please explain,” there was no explanation included. The form did not indicate that any regulating valves at the Milpitas Terminal would be placed in manual control or that there could be interruptions to the instrumentation or impacts to the regulating valves and downstream pressures. 54#

PAR-11-01, page 68NTSB Pipeline Accident Report 1.9.1.3 Emergency Response Procedures PG&E’s emergency response procedures are outlined in the following diagram (figure 23), taken from PG&E’s Company Gas Emergency Plan. 91 Figure 23. Flowchart of PG&E’s emergency response procedures. PG&E summarized the role and interaction between its SCADA center and its dispatch center during an emergency as follows: Dispatch will notify [the SCADA center] of a gas event as noticed in the Utility Standard TD-4413S (Gas Event Reporting Requirements). Dispatch will send a field employee to the location of the gas incident per Utility Procedure TD-6436P-12 (Handling Emergency Conditions Reported by Outside Agencies and Company Personnel). Depending on the actual field condition observed, [the SCADA center] and Dispatch may have further interaction to dispatch additional field personnel or exchange information regarding the event. 91 PG&E Academy, Company Gas Emergency Plan (CGEP), GAS_0910WBT Dispatchers, Version 1, January 2010, web-based training module. 55#

PAR-11-01, page 69NTSB Pipeline Accident Report Utility procedure TD-6436P-12 states that the dispatched field employee is responsible for evaluating danger to life and property, ensuring that conditions are safe, and assessing damage. It also provides guidance for handling incoming calls from emergency service providers to the dispatch center, but does not discuss whether field personnel, the dispatch center, or the SCADA center are to directly initiate contact with emergency services through 911 or other means. The standard does not address the timeliness of response or the involvement of city or emergency officials. Notifications outlined in the procedure are limited to PG&E employees and supervisors. The procedure does not distinguish between a transmission line break and a distribution line leak. 1.9.2 Use of Automatic Shutoff Valves and Remote Control Valves According to Federal pipeline integrity management regulations at 49 CFR 192.935(a), an operator “must take additional measures beyond those already required by Part 192 to prevent a pipeline failure and to mitigate the consequences of a pipeline failure in a [HCA]. ” The additional measures must be based on the threats the operator has identified to each pipeline segment, and the operator must conduct a risk analysis of its pipeline to identify additional measures, including but not limited to, installing automatic shutoff valves (ASV) or remote control valves (RCV), installing computerized monitoring and leak detection systems, replacing pipe segments with pipe of heavier wall thickness, providing additional training to personnel on response procedures, conducting drills with local emergency responders, and implementing additional inspection and maintenance programs. Pursuant to 49 CFR 192.935(c), “[i]f an operator determines, based on a risk analysis, that an ASV or RCV would be an efficient means of adding protection to a high consequence area in the event of a gas release, an operator must install the ASV or RCV.” Similarly, the PG&E gas transmission integrity management program (discussed in more detail below) states that PG&E will consider the addition of ASVs or RCVs if they would be an efficient means of adding protection to an HCA. The regulation further states that in making the determination regarding use of an ASV or RCV, “an operator must at least consider the following factors—swiftness of leak detection and pipe shutdown capabilities, the type of gas being transported, operating pressure, the rate of potential release, pipeline profile, the potential for ignition, and location of nearest response personnel.” PG&E’s consideration of this issue is documented in an internal memorandum dated June 14, 2006, and summarized in its integrity management program. The memorandum, drafted by a PG&E senior consulting gas engineer following the CPUC’s 2005 audit, 92 states that industry references have indicated that most of the damage from a pipeline rupture occurs within the first 30 seconds and that the duration of the resulting fire “has (little or) nothing to do with human safety and property damage.” The memorandum concluded that the use of an ASV or RCV as a prevention and mitigation measure in an HCA would have “little or no effect on 92 See section 1.10.1, “State Oversight by CPUC” for more information about the findings of this audit. 56#

PAR-11-01, page 70NTSB Pipeline Accident Report increasing human safety or protecting properties,” and did not recommend using either as a general mitigation measure. The senior consulting gas engineer later testified at the NTSB investigative hearing that his research was limited to industry papers and that he had not reviewed studies conducted by PHMSA or other safety groups that had reached different conclusions. (Some of those studies are discussed later in this section.) The NTSB notes that in written comments submitted to RSPA for a 1997 public meeting on ASVs and RCVs, PG&E stated that it had “no objection to installing RCVs” and had “found them reliable, [and] install[ed] them when upgrading existing major control stations or installing new stations.” In the comments, PG&E also stated that safety would be enhanced by reducing the volume of flammable gas released, that a “major technical advantage is the ability to isolate the pipeline break quickly without requiring personnel to be sent to operate any mainline valve(s),” and that another advantage is being able to monitor valve positions remotely from the SCADA center. The PG&E manager of gas system operations stated at the NTSB investigative hearing that in the case of the San Bruno pipeline rupture, the use of RCVs could have reduced the time it took to isolate the rupture by about 1 hour. In addition, PG&E stated in both the June 14, 2006, memorandum and an earlier memorandum, dated June 24, 1996, that ASVs have proven to be unreliable for most applications due to the likelihood that normal operational conditions could trip sensors and result in unintended closures. Therefore, PG&E concluded that RCVs were preferable to ASVs and could contribute to a reduction in the effects of a pipeline rupture. Studies have indicated that a prolonged gas-fed fire leads to increased property damage.93 Further, in 1996, Congress ordered a study on the feasibility of installing RCVs on interstate natural gas pipelines. In its 1999 report on this issue,94 RSPA listed several benefits of using RCVs, including reduced property damage, reduced public disruption, reduced damage to other utilities, and allowing emergency responders to gain faster access to an accident site. Although these benefits could not be quantified, the report concluded that RCVs may provide the best means for achieving them. 1.9.3 Public Awareness Title 49 CFR 192.616 requires natural gas pipeline operators to develop and implement written continuing public education programs that adhere to the guidance provided in API Recommended Practice 1162, Public Awareness Programs for Pipeline Operators, which is incorporated by reference. 93 (a) M. Stephens, A Model for Sizing High Consequence Areas Associated with Natural Gas Pipelines, GRI-00/0189, Gas Research Institute, October 2000. (b) C.R. Sparks, Remote and Automatic Main Line Valve Technology Assessment, Gas Research Institute, July 1995. 94 Remotely Controlled Valves on Interstate Natural Gas Pipelines (Feasibility Determination Mandated by the Accountable Pipeline Safety and Partnership Act of 1996) (Washington, DC: U.S. Department of Transportation Research and Special Programs Administration, 1999). 57#

PAR-11-01, page 71NTSB Pipeline Accident Report API Recommended Practice 1162 provides specific guidelines for natural gas pipeline operators to develop, manage, and evaluate public awareness programs directed to stakeholder audiences, including the affected public, emergency officials, local public officials, and excavators. The recommended practice discusses the content of baseline outreach messages, frequency of distribution, and delivery methods; and requires pipeline operators to evaluate their public awareness programs annually. And, at least once every 4 years, operators must evaluate the effectiveness of their programs. Using the results of these evaluations, operators are expected to continuously improve their programs and implement necessary changes. The PG&E annual public awareness program review period is from June to June. During this time, the company documents baseline and supplemental program events that occurred during the review period, such as mailings and meetings, and reviews website content. In the program evaluation and effectiveness section of its program plan,95 PG&E states that the annual review will be conducted using the guidelines of the program plan. However, no specific guidelines for annual evaluations are defined. The most recent reports of the PG&E annual reviews prior to the accident were dated June 2010 and December 2009. Both reviews noted that all mailings had occurred in accordance with the PG&E plan; however, the quality of the content conveyed in the mailings was not considered. The corrective action items in both self-evaluation reviews pertained primarily to supplemental messages and strategies and did not significantly differ. In its 2009 report, the PG&E review noted the following action item for its emergency official audience, “Develop educational seminars to be offered at locations throughout the service territory in which local emergency response agencies would be invited to attend.” The 2010 review noted an action item for the same audience to “Continue to provide educational seminars throughout the service territory in which local emergency response agencies would be invited to attend.” No assessment of the quality of materials is noted. In 2010, PG&E also hired Paradigm Alliance, Inc., to conduct a program documentation review of its public awareness program for noncustomers along the pipeline right-of-way. The Paradigm report is dated June 2010. As a program effectiveness measure, Paradigm mailed public awareness brochures with detachable business reply mail survey postcards to 15,302 addresses. The addresses were near the right-of-way and included the other stakeholder audiences defined in API Recommended Practice 1162. Eight weeks after the mailing, Paradigm received 20 survey postcards in response. Table 6 below summarizes the responses. 95 Pacific Gas and Electric Company, Pipeline Public Awareness Plan, Procedure No. RMP-12, dated January 26, 2010. 58#

PAR-11-01, page 72NTSB Pipeline Accident Report Table 6. Survey postcard responses to public awareness brochures. Question Yes No Blank Do you or someone you know work or live near a pipeline? 7 9 4 Have you seen any information about pipeline safety within the last two years? 3 14 3 If you noticed what appears to be a pipeline leak, would you call 911? 17 0 3 Have you or anyone you know ever discovered a buried pipeline while digging? 17 0 3 Have you ever heard of the “One-Call” system before reading this brochure? 2 14 3a a In Paradigm’s report, only 19 responses to this question were documented. In 2007, PG&E participated in an API survey to evaluate the effectiveness of its public awareness program via the Public Awareness Program Effectiveness Research Survey (PAPERS). The survey, which evaluated 18 operators, including PG&E, measured retention and comprehension of awareness messages by the audiences defined in API Recommended Practice 1162. The survey found that the affected public96 was PG&E’s least informed audience, with 89 percent of the 155 respondents reporting that they did not recall receiving information from PG&E and 34 percent reporting that they considered themselves somewhat or very well informed. The 50 emergency responders that responded to the survey reported the highest awareness level; 85 percent of these indicated that they were somewhat or very well informed about pipelines. However, the survey also found the emergency official audience indicating a need for more information about potential pipeline hazards and appropriate training and response. 1.9.4 PG&E Risk Management/Integrity Management Program In October 2001, PG&E developed a risk management program presented in a series of risk management procedures (RMP). The current version of RMP-01, which has been revised several times, states that the risk management program was designed to provide a process for complying with the requirements for risk calculation and an integrity management program. 97 1.9.4.1 Geographic Information System PG&E states in RMP-01 that it will develop and maintain an inventory of all pipeline design attributes, operating conditions, environment (structure, faults, etc.), threats to structural integrity, leak experience, and inspection findings. This inventory is maintained in the PG&E GIS database. GIS data are used to calculate risk for each pipeline segment. (According to PG&E, a pipeline segment is a length of pipe that differs from adjacent pipe in some way, such as its material properties, age, manufacture, pressure test history, coating type or age, or leak 96 In the 2007 PAPERS, the affected public surveyed did not include PG&E distribution line customers, only the residents along its transmission line right-of-way. 97 For more information about the required elements of pipeline integrity management programs, see section 1.10.2, “Federal Oversight by PHMSA.” 59#

PAR-11-01, page 73NTSB Pipeline Accident Report survey history.) PG&E then selects a target threshold, segments above that threshold are reviewed for significant risk drivers, and some segments are selected for investigation and mitigation. Although the Federal integrity management regulations do not explicitly list all of the information that must be maintained for each segment, they state (at 49 CFR 192.917(b)) that to identify and evaluate the potential threats to a covered pipeline segment, an operator must gather and integrate existing data on the entire pipeline that could be relevant to the covered segment, including, at a minimum, the information specified in ASME B31.8S, 2004 edition, and “consider on both the covered segment and similar noncovered segments, past incident history, corrosion control records, continuing surveillance records, patrolling records, maintenance history, internal inspection records and all other conditions specific to each pipeline.” In addition, ASME B31.8S, 2004 edition, which is incorporated by reference into Part 192, notes that “[c]omprehensive pipeline and facility knowledge is an essential component of a performance-based integrity management program” and states, if an operator “lacks sufficient data or where data quality is below requirements, the operator shall follow the prescriptive-based processes [outlined in appendix A to ASME B31.8S, 2004 edition].” It further states that when all of the specified data elements98 for the prescriptive-based process are not available for each threat to perform the risk assessment, “it shall be assumed that the particular threat applies to the pipeline segment being evaluated.” ASME B31.8S, 2004 edition, also states that data applied in a risk assessment process should be verified and checked for accuracy and for missing or questionable data, and that the operator should choose values that conservatively reflect the values of other similar segments on the pipeline or in the operator’s system. The PG&E GIS was implemented in the 1990s and was populated with data from preexisting pipeline survey sheets. If information was missing, assumed values were entered, preceded by a negative sign to indicate they were assumed values. According to PG&E, the GIS was fully populated in 1998. If discrepancies between GIS data and actual conditions are discovered by field personnel, PG&E procedures require field engineers to report them to the PG&E mapping department, which validates the information by checking the original job package paperwork for that segment of pipeline. If the mapping department concludes that a change is warranted, it is made. NTSB investigators reviewed PG&E GIS data and pipeline survey sheets for Line 132 to determine how often assumed or unknown values were entered. They found that— • The pipe wall thickness was an assumed value for 21.5 miles (41.75 percent) of Line 132. • The manufacturer of the pipe was unknown (“NA”) for 40.6 miles (78.81 percent) of Line 132. 98 The required data for each segment include pipe material, year of installation, manufacturing process (or age of manufacture as an alternative), seam type, joint factor, and operating pressure history. 60#

PAR-11-01, page 74NTSB Pipeline Accident Report • The pipeline depth of ground cover was also unknown for 42.7 miles (82.79 percent) of Line 132. • Three values were used for the SMYS of grade B pipe: 35,000 psi (consistent with the value given in ASME B31.1.8, 1955 edition), 40,000 psi, and 45,000 psi. • Two segments with unknown SMYS were assigned values of 33,000 psi and 52,000 psi, whereas 49 CFR 192.107 requires operators to use a value of 24,000 psi when SMYS is unknown. • Six consecutive segments, totaling 3,649 feet, specified an erroneous minimum depth of cover of 40 feet. • Several segments, including Segment 180, specified 30-inch-diameter seamless pipe, although there was no API-qualified domestic manufacturer of such pipe when the line was constructed. • The GIS did not reflect the presence of the six pups in Segment 180. 1.9.4.2 Risk Management Procedures PG&E defines risk as the product of the likelihood of failure (LOF) and the consequence of failure (COF), each of which is determined by PG&E steering committees. Failure is defined as a breach of the structural integrity of the pipe. LOF is derived from combining the risks of the following threats, which, according to RMP-01, are weighted in proportion to PG&E and industry failure experience: 25 percent for external corrosion, 45 percent for third-party damage, 20 percent for ground movement, and 10 percent for design and material characteristics. For the integrity management program only, COF is a function of the potential impact radius. PG&E developed individual RMPs (as discussed below) for each of the perceived threats to the system: • RMP-02 contains an algorithm to calculate the risk of external corrosion, detailing possible threats to the pipeline caused by items such as soil resistivity, coating age, coating design, and d.c./a.c. interference. It considers the results of pressure tests (if any were conducted), visual inspections of the coating, casing surveys, corrosion leak rate, and external corrosion direct assessment (ECDA99 ) data, if available, to develop a ranking of coated piping. • RMP-03 contains the algorithm for third-party threats. It accounts for the likelihood of excavation frequency, class location, ground cover protection, damage prevention, pipe diameter, and wall thickness, among other factors, to rank the vulnerability of the pipeline. • RMP-04 contains the algorithm for ground movement and natural forces threat, such as seismic activity. • RMP-05 contains the algorithm for design/material threats and also addresses construction threats. It includes weighted factors for pipe seam design, girth weld 99 ECDA is a method of surveying a pipeline by first selecting likely areas of potential corrosion for assessment and then excavating and physically examining these areas. 61#

PAR-11-01, page 75NTSB Pipeline Accident Report condition, material flaws or unique joints (such as pre-1950 miter bends), pipe age, MOP versus pipe strength, leak history, and test pressure. Points are assigned for various risk factors so that higher scores indicate a higher threat. The maximum score that a segment can receive is 135. Pre-1970 pipes are assigned 30 points for pipe seam design and 10 points for pipe age. Pipe segments that have not been pressure tested are assigned 30 points; conversely, pipes that have undergone pressure testing receive a 30 or 40 point deduction, depending on the recency of the test. (The scores assigned to Segment 180 are discussed in section 1.9.4.3, “Threats Identified for Line 132.”) • RMP-06 contains the PG&E gas transmission integrity management program and is discussed below. • RMP-08 contains the procedure for identification, location, and documentation of HCAs. PG&E uses the potential impact circle method, described in 49 CFR 192.903, to determine HCAs. Pipe diameter and MAOP are used to calculate the potential impact circle, which designates an HCA according to whether the area within the potential impact circle contains 20 or more buildings intended for human occupancy. If it does, the area is classified as an HCA, regardless of class designation. PG&E records specify Line 132 from MP 8.39–40.08, which includes the location of the rupture, as a class 3 location. • RMP-09 includes requirements for performing ECDA, which consists of preassessment, including data collection; indirect inspections; prioritizing excavation locations and examinations; and postassessment, including data analysis. RMP-09 requires the collection of data that could be used for validating assumed values or determining unknown values in the GIS and calls for updating pipeline records with data collected during the preassessment process. • RMP-10 contains requirements for performing internal corrosion direct assessment, which consists of preassessments, including data collection and identifying sites; prioritizing excavation locations and examinations; and postassessment, including data and analysis. Dry gas internal corrosion is not included in the PG&E equation for calculating LOF because PG&E automatically classifies the few pipelines it has with the threat of internal corrosion as high risk. • RMP-11 contains procedures and requirements for performing in-line inspections. It includes steps for performing a preassessment, including data collection and work necessary to allow the line to accommodate in-line inspection tools; in-line inspection, including internal cleaning and inspection tool running; direct examination of identified anomalies; and postassessment, including data analysis and mitigation planning. • RMP-12 contains the PG&E pipeline public awareness plan. (See section 1.9.3, “Public Awareness,” in this report.) • RMP-13 contains requirements for performing stress corrosion cracking direct assessment. The procedures include preassessment, including data collection; indirect inspections; prioritizing excavation locations and examinations; and postassessment, 62#

PAR-11-01, page 76NTSB Pipeline Accident Report including data analysis. Stress corrosion cracking is not included in LOF calculations because PG&E classifies the few pipelines it has with this threat as high risk. 1.9.4.2.1 Integrity Management Plan The PG&E gas transmission integrity management program is set forth in RMP-06. It was developed to meet the requirements of 49 CFR Part 192 Subpart O, which became effective in 2004. RMP-06 identifies 22 potential threats to HCAs, which fall into 4 categories: time dependent, stable, time independent, and unknown. Manufacturing- and welding/fabrication-related defects are listed as stable defects (that is, they are not expected to grow in service). However, under 49 CFR 192.917(e)(3), such defects would not be considered stable in the event of certain increases in operating pressure.100 RMP-06 section 3.5, “Threat Analysis, ” states that a manufacturing threat is assumed to exist in pipe segments installed before 1970. Under the heading “Insufficient Data or Poor Quality Data,” RMP-06 states that the integrity management program “avoids the use of data assumptions to identify applicable threats.” RMP-06 section 4, “Baseline Assessment Plan, ” addresses the initial evaluation of the condition of the pipeline, which is used as a baseline for further inspections. This section specifies that all HCAs will be assessed in accordance with the schedule set forth in the baseline assessment plan and that HCAs with the highest potential for risk are given priority. Consistent with 49 CFR 192.921, it specifies that at least 50 percent of the HCAs identified in the plan will be assessed by December 17, 2007, and the remainder by December 17, 2012. RMP-06 section 4.5 notes that the methods chosen to assess a particular segment of pipe are based on the threats identified in the risk assessment procedure, and more than one assessment method may be required to adequately cover the potential risks of an HCA. PG&E’s baseline assessment plan includes 1,021 miles of HCA pipeline and about 500 miles of non-HCA pipeline. PG&E determined that 813 HCA miles would be assessed using direct assessment methodologies 101 (ECDA, internal corrosion, and stress corrosion cracking); 208 HCA miles would be assessed using in-line inspection tools or “pigs”;102 and 500 non-HCA miles would be assessed using in-line inspection tools. As of June 30, 2010, 749.35 HCA miles had been inspected; Line 132 had not yet been inspected. Concerning in-line inspection, RMP-06 section 5.4 states that “it is the company’s desire to inspect pipelines utilizing in-line inspection whenever it is physically and economically feasible.” Factors that PG&E considers in determining feasibility include whether the pipeline at issue is at least 10 miles long and predominately located in HCAs, whether less than 0.5 mile of 100 For more information on how PG&E addressed this issue, see section 1.7.5.3, “Periodic Pressure Increases to MAOP.” 101 According to the PG&E director of integrity management and technical support, PG&E has performed 500 digs since the start of the integrity management program. 102 A “pig” can be any of a variety of mechanical devices inserted into a pipeline to either clean or inspect the line to identify possible defects. Pigs that gather information as they travel through the line are referred to as “smart pigs.” A variety of physical obstacles can prevent a pig from successfully traveling through a pipeline, thus rendering that pipeline “unpiggable.” For more information about smart pigs, see section 1.13.1.2, “In-line Inspection.” 63#

PAR-11-01, page 77NTSB Pipeline Accident Report replacement is required to make the pipeline piggable, whether the pipeline at issue has adequate flow rates to enable successful in-line inspection, and whether the pipeline operates at more than 30 percent SMYS. Regarding pressure testing, RMP-06 section 5.5 states that PG&E— does not plan to use pressure testing to assess the integrity of its pipelines, unless it is a post installation test or up-rate for a new HCA. However, during the course of assessing data for ECDA or in-line inspection, it may become apparent that pressure testing is the only feasible option. RMP-06 section 10, “Performance Plan,” sets forth the program measurements that PG&E uses to evaluate the long-term effectiveness of its integrity management program. These measures, which are reported semiannually to PHMSA, include number of total system miles, number of total miles of pipelines inspected, number of HCA miles in the integrity management program, number of HCA miles inspected via integrity management assessments, number of immediate repairs103 completed in HCAs, number of scheduled repairs completed in HCAs, number of leaks104 in HCAs classified by cause, number of failures105 in HCAs classified by cause, and number of incidents106 in HCAs classified by cause. The combined number of leaks, failures, and incidents that PG&E reported for the years 2004–2010 is shown in table 7. 103 Immediate repair conditions, as defined in 49 CFR 192.933 (d)(1), include (i) an anomaly resulting in a calculated predicted failure pressure of 1.1 times the MAOP; (ii) a dent that has any indication of metal loss, cracking, or a stress riser; or (iii) any indication or anomaly that, in the judgment of the person designated by the operator to evaluate the assessment results, requires immediate action. Until the repair is completed, the operator is required to temporarily reduce the in pressure to no more than 80 percent of the operating pressure at the time the condition was discovered. 104 PHMSA defines a “leak” as an unintentional release of gas from a pipeline that is not an “incident,” including an unintentional release of gas that does not result in an injury, death, or $50,000 or more in property damage. 105 PHMSA defines “failure” as a general term used to imply that a part in service has become completely inoperable, is still operable but incapable of satisfactorily performing its intended function, or has deteriorated seriously to the point that it has become unreliable or unsafe for continued use. However, according to the definition, a “failure” does not involve a release of gas. 106 PHMSA defines “incident” as a release of gas from a pipeline causing death or personal injury necessitating inpatient hospitalization; as estimated property damage, including the cost of gas lost, for the operator or others or both, that is $50,000 or more; or as an event that is significant in the judgment of the operator, even though it does not meet the criteria above. 64#

PAR-11-01, page 78NTSB Pipeline Accident Report Table 7. PG&E’s reportable events by cause for 2004–2010. Cause 2004 2005 2006 2007 2008 2009 2010 All External corrosion 0 10 1 3 5 3 1 23 Internal corrosion 0 0 0 0 0 0 0 0 Stress corrosion cracking 0 0 0 0 0 0 0 0 Manufacturing 0 0 1 0 1 0 0 2 Construction 1 0 0 1 1 3 3 9 Equipment 0 7 1 1 1 4 3 17 Third party 0 4 0 3 1 2 1 11 Incorrect operations 0 1 0 0 0 3 1 5 Weather/outside force 0 0 0 0 0 0 0 0 Total 1 22 3 8 8 15 9 67 In addition to leaks, incidents, and failures, as defined by PHMSA, the CPUC also required pipeline operators such as PG&E to report “incidents which have either attracted public attention or have been given significant news media coverage, that are suspected to involve natural gas, which occur in the vicinity of the operator’s facilities; regardless of whether or not the operator’s facilities are involved.” RMP-06 section 13, “Quality Assurance,” indicates that PG&E will conduct periodic self assessments of its integrity management program to determine its effectiveness and specifies that internal or external audits will be performed every other year to ensure compliance with PG&E and regulatory requirements. Internal audits were conducted in 2007 and 2009. External audits were completed by the CPUC (with PHMSA) in 2005 and by the CPUC in 2010. (For more information on these audits and the PG&E response, see section 1.10.1, “State Oversight by CPUC.”) 1.9.4.3 Threats Identified for Line 132 Line 132 has about 322 pipeline segments. In 2009 and 2010 (prior to the accident), Segment 180 received the assessment scores shown in table 8. (For comparison, the scores for the Line 132 segment with the highest total risk in 2009 and 2010 are also provided. 107 ) 107 The highest ranking segments in 2009 and 2010 were Segments 106.7 and 189, respectively. 65#

PAR-11-01, page 79NTSB Pipeline Accident Report Table 8. Line 132 risk values. Line 132 Risk Values Segment 180 2009 2010 External corrosion (25 percent) 4.18 4.18 Third party (45 percent) 20.9 20.9 Ground movement (20 percent) 0.0 0.0 Design and materials (10 percent) 55.0 73.0a Total risk (Unweighted) 927.63 1036.0 Rank 69.0 80.0 Highest Ranking Segment 2009 2010 External corrosion (25 percent) 5.78 7.58 Third party (45 percent) 25.6 38.9 Ground movement (20 percent) 61.5 22.5 Design and materials (10 percent) 68.0 81.0 Total risk (Unweighted) 1878.8 2149.0 Rank 1.0 1.0 a The increased score in the “design and materials” category resulted from the discovery of miter bends in Segment 180. PG&E conducted ECDA to assess the corrosion and coating on numerous sections of Line 132 in 2005 and 2009. PG&E indicated that eight digs were conducted as a result of the 2009 survey of Line 132. Prior to the accident, no in-line inspections had been performed on Line 132 or the other two lines in the peninsula system (Lines 101 and 109). PG&E indicated that bends, valves, and variations in pipe diameter made in-line inspection impracticable on these lines. As part of its 2009 rate case, PG&E requested permission to replace sections and/or fittings on the segments that currently prevent Lines 101, 109, and 132 from accepting smart pigs. The cost to make Line 132 piggable is estimated to be $13 million; and, according to a PG&E supervising engineer for gas transmission and distribution, PG&E plans to perform in-line inspection on Line 132 by 2014. He further stated that preparing an older line for an in-line inspection process requires 3–4 years to engineer upgrades, replace components such as valves and fittings, and clean the pipeline. 66#

PAR-11-01, page 80NTSB Pipeline Accident Report 1.10 Oversight 1.10.1 State Oversight by CPUC As an intrastate gas transmission pipeline operator, PG&E is regulated by the CPUC, whose rules governing gas pipelines are codified in General Order 112E, State of California Rules Governing Design, Construction, Testing, Operation, and Maintenance of Gas Gathering, Transmission, and Distribution Piping Systems, dated September 11, 1995. General Order 112E requires PG&E to comply with the Federal pipeline safety regulations in 49 CFR Part 192. PHMSA oversees interstate pipelines but does not directly oversee intrastate pipeline operators. However, PHMSA conducts annual on-site evaluations and scores state regulators to determine how closely the programs align with PHMSA standards. PHMSA certifies state regulatory agencies such as the CPUC annually and grants Federal funds as an incentive to improve program performance and to encourage states to take on more responsibility for pipeline safety. PHMSA is authorized to reimburse a state agency up to 80 percent of the actual cost of carrying out its pipeline safety program, including the cost of personnel and equipment, depending on the state agency’s score and subject to the availability of Federal funds. Federal funding is determined through an allocation formula based on factors such as the extent to which the state has asserted safety jurisdiction, whether the state has adopted all Federal requirements, and the number and qualifications of inspectors. PHMSA also reviews state regulator audits of operator integrity management programs and enters certain information from these audits into its database to analyze trends. In 2006–2008, the CPUC received 37–40 percent of its annual funding from PHMSA. During that time, the maximum that any state agency received was 40–50 percent. In 2009 and 2010, the CPUC received about 64 percent of its annual funding from PHMSA; the maximum any state agency received during those years was about 70 percent. Data reported by the CPUC to PHMSA showed that as of March 2011, it had 19 inspectors and 6 supervisors supporting pipeline safety, some of which were only dedicated part-time to pipeline safety duties, for a total of about 12 person-years. In July 2011, the CPUC reported to the NTSB that it had the equivalent of 11 full-time gas inspection staff positions and 2.5 supervisory level positions funded by PHMSA. The CPUC has audited the PG&E integrity management program twice, once between October and December 2005 and again in May 2010, following the PHMSA integrity management audit protocol. The director of the CPUC consumer product and safety division stated that the agency lacks sufficient resources to conduct annual audits of the PG&E integrity management program. PHMSA participated in the CPUC 2005 audit, which was intended as a training audit for CPUC personnel. One of the issues noted during this audit was that PG&E did not have a process to evaluate the use of ASVs and RCVs. (For more information about PG&E’s subsequently drafted memorandum discussing the use of ASVs and RCVs, see section 1.9.2, “Use of Automatic Shutoff Valves and Remote Control Valves. ”) 67#

PAR-11-01, page 81NTSB Pipeline Accident Report The results of the second CPUC audit of the PG&E integrity management program transmitted to PG&E in a letter dated October 21, 2010, included numerous findings. The CPUC letter highlighted two areas of particular concern. The first concern was that PG&E may be “diluting the requirements of the [integrity management program] through its exception process and appears to be allocating insufficient resources to carry out and complete assessments in a timely manner.” The letter noted that in-line inspections scheduled for several pipelines had been delayed from the schedule set forth in the baseline assessment plan and, in some cases, had been changed to ECDAs. In addition, exception reports had been used to justify not excavating several immediate repair indications that vendors had reported after conducting other in-line inspections. The second concern was that “PG&E needs to analyze, review, and formulate appropriate actions or responses to the results of its internal audits in a timely manner.” Specifically, the CPUC pointed out that PG&E had conducted an internal audit in December 2007 but had not formulated a response until December 2009; the letter further noted that PG&E had conducted another internal audit in October 2009, but as of May 2010 PG&E still had not formulated a response. PG&E submitted a response to each of the CPUC findings and concerns in a letter dated December 16, 2010. Regarding the CPUC’s two primary concerns, PG&E stated that its integrity staff “tended to use the exception report process to document more than just procedural exceptions and have issued exception reports when they weren’t necessarily needed…. PG&E agrees that this is an over-use of exception reports and we will take steps to reduce this practice.” Concerning its response to internal audits, PG&E acknowledged that— RMP-06 does not provide clear direction regarding a formal response and closure of any issues identified. PG&E agrees … that addressing this concern will add additional rigor and clarity and will improve our overall process…. All corrective actions resulting from future audits will be tracked via PG&E’s established commitment tracking process managed by PG&E Gas Engineering Regulatory Support. In addition to the two audits of the overall integrity management program, the CPUC conducted focused audits of the division responsible for the PG&E peninsula lines in July 2008 and August 2010. For the 2008 audit, the CPUC noted two violations and listed several observations.108 After the 2010 audit, the CPUC noted two violations109 and observed that many of the PG&E internal audit findings were violations of its own standards. The CPUC also noted that PG&E had corrected most of the internal audit findings from 2007 and 2009. At the NTSB investigative hearing, a CPUC supervisory engineer testified that CPUC audits did not comment on PG&E’s ranking of its highest risk segments or on the assignment of weights to the various risk categories. Further, although he stated that the auditors did not 108 The violations related to employee qualifications, and the observations related to missing MAOP documentation. In addition, a “field observation” noted that a monitor valve at a regulator station was set at too high a pressure and did not take over to avoid MAOP. 109 The violations related to insufficient leakage surveys and regulating valve pressure ratings being too low. 68#

PAR-11-01, page 82NTSB Pipeline Accident Report examine GIS data in detail, they did random spot checks of GIS data and verified that when data were unknown, PG&E was using appropriately conservative values. The director of the CPUC acknowledged that audits and inspections are primarily a paperwork exercise, but that inspectors also sometimes “go out and look over the shoulder of the person who’s doing the inspection … or the maintenance work” to verify that what they “see in the records is … happening on the ground.” However, he noted that it is difficult to enforce performance-based regulations, such as integrity management rules, “because the case that you have to bring to bear becomes quite complex. It’s just easier when you have a linear violation of a prescriptive statute.” 1.10.2 Federal Oversight by PHMSA In 1968, Congress passed the Natural Gas Pipeline Safety Act of 1968, which created the Office of Pipeline Safety within the DOT to implement and oversee pipeline safety regulations. Subsequently, the Pipeline Safety Improvement Act of 2002 called for mandatory risk analysis and integrity management programs, and PHMSA promulgated standards for gas transmission pipelines at 49 CFR Part 192 Subpart O, which became effective in January 2004. The integrity management rules in Subpart O include a mix of performance-based and prescriptive requirements. As explained in the preamble to the final rule110 — [RSPA’s Office of Pipeline Safety] believes that performance-based regulation will result in effective integrity management programs that are sufficiently flexible to reflect pipeline-specific conditions and risks. Pipeline conditions vary. It is impractical to specify requirements that will address all circumstances. In some cases, they would impose unnecessary burdens. In others, they might not achieve the desired level of safety. Including performance-based requirements is the best means to ensure that each pipeline develops and implements effective integrity management programs that address the risks of each pipeline segment. The elements of an integrity management program, specified in 49 CFR 192.911, include identification of all HCAs; a baseline assessment plan; threats to each covered111 pipeline segment, including data integration and a risk assessment to prioritize segments and evaluate the merits of additional preventative and mitigative measures; a direct assessment plan; provisions for remediating conditions found during integrity assessments; a process for continual evaluation and assessment; a plan for confirmatory direct assessment; additional preventative and mitigative measures to protect the HCA; performance measures; record-keeping provisions; a management-of-change process; a quality assurance process; and a communication plan. With regard to self-assessment, 49 CFR 192.945 requires operators to measure on a semiannual basis, “whether the program is effective in assessing and evaluating the integrity of each covered pipeline segment and in protecting the high consequence areas.” The measures must include (1) number of miles of pipeline inspected versus program requirements; (2) number 110 Federal Register, vol. 68, no. 240 (December 15, 2003), pp. 69817, 69783. 111 A covered segment is one that is located in an HCA. 69#

PAR-11-01, page 83NTSB Pipeline Accident Report of immediate repairs completed; (3) number of scheduled repairs completed; and (4) number of leaks, failures, and incidents, classified by cause. In addition, operators must use the specific measures listed in ASME B31.8S, 2004 edition, appendix A, for each identified threat. For pipe seam and pipe manufacturing threats, ASME B31.8S, 2004 edition, appendix A, lists the following measures for establishing the effectiveness of the program and confirming the inspection interval: number of hydrostatic test failures caused by manufacturing defects and number of leaks due to manufacturing defects. The PHMSA deputy associate administrator for policy and programs testified at the NTSB investigative hearing that performance-based regulations such as the integrity management rules are very difficult for operators to implement and for regulators to oversee because there is no “one-size-fits-all answer to integrity issues.” She stated that, “every operator is expected to thoroughly understand their system” and “assess for the threats to that pipe… then you must address them.” She noted that overseeing operator compliance with the integrity management rules is very different from overseeing compliance with more clear-cut prescriptive regulations because “now they are required to think in a totally different manner. They have to evaluate the adequacy of an operator’s technical justification. It is difficult. It’s a difficult way of evaluating a program, but it’s effective.” The PHMSA gas integrity management inspection protocol, which is also used by CPUC auditors in their integrity management audits, addresses the 16 elements of integrity management plans. Section C.02 of the protocol, on data gathering and integration, states in item C.02.d: “verify that the operator has checked the data for accuracy. If the operator lacks sufficient data or where data quality is suspect, verify that the operator has followed the requirements in ASME B31.8S [2004 edition, Managing System Integrity of Gas Pipelines]. ”112 Section C.03 of the protocol addresses risk assessment and states in item 3.03.d.4 that the auditor should verify that “the operator uses a feedback mechanism to ensure that the risk model is subject to continuous validation and improvement.” As noted in section 1.10.1, “State Oversight by CPUC,” PHMSA does not directly oversee intrastate pipeline operators, but it evaluates and scores state regulators annually. According to the PHMSA director of state programs, in the area of program evaluation, the CPUC auditing score was 99.5 in 2009, 99 in 2008, and 100 in the preceding years. The overall score for the CPUC (which included several areas in addition to program evaluation) is about 90 due to its jurisdictional status and the lack of legislation giving it full authority over all gas pipelines. The director also stated that the CPUC “has a good inspection program. They have good qualified engineers that are quite capable of doing inspections [and] investigations.” 112 The ASME B31.8S standard states that “all of the specified data elements shall be available for each threat in order to perform the risk assessment. If such data are not available, it shall be assumed that the particular threat applies to the pipeline segment being evaluated.” 70#

PAR-11-01, page 84NTSB Pipeline Accident Report 1.11 Postaccident Actions 1.11.1 Actions Taken by PG&E As a result of the accident, a portion of Line 132, including Segment 180, is no longer in service. According to PG&E, a 1.5-mile section of Line 132 between MP 38.49 and 40.05 has not operated since the San Bruno accident. At MP 40.05, Line 132 is fed by Line 109 through crossties. Following the accident, PG&E took many actions ordered by the CPUC, including reducing the operating pressure on Line 132 to 20 percent below the operating pressure at the time of the failure. Another action ordered by the CPUC was to review the classifications of transmission lines to determine if they had changed since initial designation. (The class refers to the population density in the immediate area; class 1 areas have the lowest density and class 4 areas have the highest.) On June 30, 2011, PG&E reported to the CPUC that it had discovered classification errors on 550 miles of pipeline. Of those, 173 miles had increased in class and 378 miles had decreased in class. About 1 month after the accident, PG&E conducted a camera inspection of a 1.5-mile- long portion of Line 132. The results of the inspection showed that the longitudinal welds appeared to be standard DSAW. Several areas of pups were found, but no partial or incomplete welds were noted. In addition, the camera inspection showed that there was some water in the pipe as well as oil or condensate. In October 2010, PG&E announced its Pipeline 2020 program “for enhancing natural gas pipeline safety and reliability.” According to PG&E, the program’s five major areas of focus are: (1) modernizing critical pipeline infrastructure, (2) expanding the use of automatic or remotely operated shutoff valves, (3) spurring the development of next-generation inspection technologies, 113 (4) developing industry-leading best practices, and (5) enhancing public safety partnerships. Since the accident, PG&E has conducted numerous excavations to verify the pipe’s condition. In May 2011, it began hydrostatic pressure testing of its older transmission lines. According to PG&E, it has done camera inspections of segments before they are hydrostatically tested and has removed any pipe pieces that show indications of concern. PG&E has contracted for laboratory examination of those removed pieces. PG&E states it has installed automated valves and SCADA capability on multiple regulator and monitor valves that control Line 132 and Line 109 crossties, and it is installing, replacing, or upgrading numerous automated valves in locations throughout its system. 113 PG&E reports that it is creating and funding a nonprofit entity to encourage and fund research and development proposals. 71#

PAR-11-01, page 85NTSB Pipeline Accident Report In an effort to validate the information in its GIS in response to the NTSB’s January 3, 2011, safety recommendations and the CPUC’s directive to comply with those recommendations, PG&E is collecting, scanning, and indexing an estimated 1.25 million individual records associated with about 2,750 job numbers from hard copy records. PG&E states that it is using those records to verify the pipeline segments for which it has complete, verifiable, and traceable records of prior pressure tests and to compile a segment-by-segment pipeline features list. PG&E began by reviewing all the project folders for the 150 miles of transmission pipelines in the peninsula system. According to the PG&E manager of engineering support services, errors were found in other segments of Line 132 (some 30-inch pipeline segments were listed as seamless, and others had incorrect wall thickness values). PG&E also reports that it is in the process of validating GIS records for all 30-inch pipe installed prior to 1962, for all three peninsula lines, and for all lines in densely populated areas. PG&E expects to eventually validate GIS records for the entire pipeline network. PG&E has employed an outside expert to evaluate its integrity management program. In addition, the company has ceased its practice of raising the MAOP on certain lines every 5 years to preserve the current MAOP. PG&E also performed testing at the Milpitas Terminal to determine the cause of the erratic power to the instrumentation. The supervising engineer of the SCADA controls group reported to NTSB investigators that the results of that testing showed that the line pressure increase was due to low output voltages from two power supplies that supported pressure transmitters and other instrumentation required to operate the regulating valves. The testing revealed that one of the power supplies had failed, and the other was generating an output of less than the rated 24 volts. Both power supplies have been replaced and are supported from separate circuit breakers at the distribution panel. In addition, PG&E has modified its website to allow the location of gas transmission lines relative to any address. The website also provides safety information related to gas transmission systems and material regarding the resources PG&E has made available to support San Bruno residents and the rebuilding process. In April 2011, PG&E sent notifications to 2.5 million homes and businesses within 2,000 feet of PG&E natural gas transmission pipelines notifying them of their proximity to the pipeline. 1.11.2 Actions Taken by CPUC On September 13, 2010, the CPUC ordered PG&E to take several actions, including lowering the operating pressure on Line 132 to 20 percent below that at the time of failure; conducting an integrity assessment of all gas facilities in the impacted area; conducting an accelerated leak survey of all transmission lines; evaluating customer leak complaint response times and response effectiveness; preparing a plan for a complete safety inspection of the entire PG&E gas transmission system; reviewing valve locations to identify where it would be prudent to replace manually operated valves with automated valves; and reviewing the classifications of transmission lines to determine if they have changed since the initial designation. 72#

PAR-11-01, page 86NTSB Pipeline Accident Report On December 16, 2010, the CPUC ordered PG&E to reduce the pressure to 20 percent below MAOP for all 30-inch pipelines with DSAW welds that were installed prior to 1962 and are located in HCAs or certain other areas and have not undergone hydrostatic pressure testing. The CPUC also ordered PG&E to assess the integrity of these pipelines by using either hydrostatic or other appropriate pressure tests; X-ray or camera examination of the interior of the pipe; or in-line inspection using a smart pig or other technology appropriate to assessing pipeline seam integrity. The CPUC subsequently ordered PG&E to comply with the NTSB’s January 3, 2011, urgent safety recommendations and ordered that the records review be completed by March 15, 2011. On February 24, 2011, the CPUC required PG&E to limit operating pressures to 80 percent of the MOP recorded between February 15, 2006, and February 15, 2011, on any transmission line installed before 1970 located in a HCA or certain other areas if “reliable, verifiable, and complete records of strength testing in accord with 49 CFR subpart J are not available for inspection.” In its February 24, 2011, rulemaking, the CPUC also indicated that it would likely propose future new rules on retrofitting of transmission lines to allow in-line inspections; requiring operators to perform evaluations for installing ASVs or RCVs on transmission pipelines; requiring operators to strengthen emergency response procedures; requiring gas quality monitoring, testing for pipelines operating below 100 psig and service lines, and clearance between gas pipelines and other subsurface structures; incorporating one-call law requirements for marking underground facilities; reporting cathodic protection deficiencies and providing a timetable for remedial actions; establishing cover requirements for transmission lines; reporting problems associated with mechanical/compression fittings; assessing existing meter set assemblies and other pipeline components to protect them from excessive snow and ice loading; and requiring operators to identify threats along their pipelines and develop mitigation plans. On June 9, 2011, the CPUC issued an order requiring PG&E and other gas transmission operators regulated by the CPUC to either hydrostatically pressure test or replace transmission pipelines with “grandfathered” MAOPs that have not been pressure tested or for which reliable records are not available. The CPUC concluded that all California natural gas transmission pipelines “must be brought into compliance with modern standards for safety,” and that “[h]istoric exemptions must come to an end.” The order requires operators to develop and file with the CPUC implementation plans to achieve orderly and cost-effective replacement or hydrostatic pressure testing of all gas transmission pipelines that have not been pressure tested. The proposed decision also provides requested guidance to PG&E in how it should complete its records-based MAOP determination and the limited uses for engineering assumptions. Two weeks after the accident, the CPUC formed an independent review panel of experts to gather and review facts and make recommendations for improvement of safe management of the PG&E natural gas transmission lines. In its 204-page final report, dated June 8, 2011, the 73#

PAR-11-01, page 87NTSB Pipeline Accident Report panel addressed the PG&E performance and company culture; risk, data, and integrity management; emergency response, capital investments, and the PG&E Pipeline 2020 program; CPUC oversight; and public policies in the state of California.114 1.11.3 Actions Taken by PHMSA On January 4, 2011, in response to Safety Recommendation P-10-01, issued on January 3, 2011, PHMSA issued Advisory Bulletin 11-01 to owners and operators of hazardous liquid and gas pipeline systems. The advisory states that operators relying on the review of design, construction, inspection, testing, and other related data to calculate MAOP (for gas pipelines) or MOP (for liquid pipelines) must diligently search for relevant records and ensure that the records are traceable, verifiable, and complete. If such a search and verification cannot be completed, the operator cannot rely on this method for calculating MAOP. The advisory also reminded operators of their responsibilities to identify pipeline integrity threats; perform rigorous risk analyses; integrate information; and identify, evaluate, and implement preventative and mitigative measures. The advisory further suggested that an operator lacking information on key risk factors should strongly consider reducing pressure to 80 percent of operating pressure for the previous month, hydrostatic testing, or creating a remediation program to identify threat risks. The preamble to Advisory Bulletin 11-01 pointed out that one of the— fundamental tenets of the [integrity management] program is that pipeline operators must be aware of the physical attributes of their pipelines as well as the physical environment that it transverses. …This information is a vital component in an operator’s ability to identify and evaluate the risks to its pipeline and identify the appropriate assessment tools, set the schedule for assessments of the integrity of the pipeline segments and identify the need for additional preventative and mitigative measures such as lowering the operating pressures. If this information is unknown, or unknowable, a more conservative approach to operations is dictated. On April 18, 2011, PHMSA held a pipeline safety forum with the stated goal of “accelerating the rehabilitation, repair, and replacement of critical pipeline infrastructure with known integrity risks.” Participants in the forum included pipeline safety experts, researchers, industry representatives, state regulators, other Federal agency officials, and members of the public. 1.11.4 Actions Taken by Congress Since the San Bruno accident, Congress has held three hearings in the 111th Congress on pipeline issues at which the NTSB testified. The House Transportation and Infrastructure Committee held a hearing in September 2010 during which the San Bruno accident was 114 The full report, Report of the Independent Review Panel, San Bruno Explosion, June 8, 2011, revised copy June 24, 2011, is available on the CPUC website <http://www.cpuc.ca.gov/NR/rdonlyres/85E17CDA-7CE2-4D2D- 93BA-B95D25CF98B2/0/cpucfinalreportrevised62411.pdf> (accessed August 29, 2011). 74#

PAR-11-01, page 88NTSB Pipeline Accident Report addressed, and the House Energy and Commerce Committee heard testimony on pipeline safety, with a focus on the San Bruno rupture. The Senate Commerce Committee held a hearing specifically on the San Bruno accident. Several bills have been introduced in the 112th Congress containing provisions related to the San Bruno accident. H.R. 22, the Pipeline Safety and Community Empowerment Act of 2011, strengthens notification and mapping requirements, requires in-line inspections of pipelines on a regular basis, and requires ASVs and RCVs on newly constructed pipelines and pipelines in class 3 and 4 areas. The House Energy and Commerce Committee passed the Pipeline Infrastructure and Community Protection Act of 2011 through the committee. Among its provisions are requirements to provide public access to pipeline mapping information, an examination of the integrity management system, and requirements for ASVs and RCVs on newly constructed pipelines. In the Senate, S. 234, the Strengthening Pipeline Safety and Enforcement Act of 2011, is pending. This legislation requires the production of information on transmission lines through classes 3 and 4 areas and HCAs in classes 1 and 2 that have not had an MAOP previously established via hydrostatic testing, directs the U.S. Secretary of Transportation to develop regulations for the installation of ASVs and RCVs, and requires the regular use of in-line inspection tools. S. 275, the Pipeline Transportation Safety Improvement Act of 2011, requires ASVs and RCVs on newly constructed pipelines, directs the U.S. Secretary of Transportation to examine the integrity management oversight program, and requires public access to pipeline mapping information and operator emergency response plans. 1.12 Previous NTSB Safety Recommendations 1.12.1 January 3, 2011, Safety Recommendations to PG&E, CPUC, and PHMSA Regarding Record-keeping and Hydrostatic Pressure Testing On January 3, 2011, based on the discovery of inaccuracies in PG&E records for the accident pipe, the NTSB issued three safety recommendations to PG&E, two of which were designated “urgent.” Aggressively and diligently search for all as-built drawings, alignment sheets, and specifications, and all design, construction, inspection, testing, maintenance, and other related records, including those records in locations controlled by personnel or firms other than Pacific Gas and Electric Company, relating to pipeline system components, such as pipe segments, valves, fittings, and weld seams for Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4 [footnote removed] locations and class 1 and class 2 [footnote removed] high consequence areas [footnote removed] that have not had a maximum allowable operating pressure established through prior hydrostatic testing. These records should be traceable, verifiable, and complete. (P-10-2) (Urgent) 75#

PAR-11-01, page 89NTSB Pipeline Accident Report Use the traceable, verifiable, and complete records located by implementation of Safety Recommendation P-10-2 (Urgent) to determine the valid maximum allowable operating pressure, based on the weakest section of the pipeline or component to ensure safe operation, of Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior hydrostatic testing. (P-10-3) (Urgent) If you are unable to comply with Safety Recommendations P-10-2 (Urgent) and P-10-3 (Urgent) to accurately determine the maximum allowable operating pressure of Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior hydrostatic testing, determine the maximum allowable operating pressure with a spike test followed by a hydrostatic pressure test. (P-10-4) In a letter dated February 2, 2011, PG&E responded to the NTSB, stating that it was in the process of verifying underlying records for the more than 1,800 miles of pipeline covered by the recommendations. PG&E indicated that a team of over 50 engineers, estimators, mappers, information technology specialists, and managers were dedicated exclusively to the project, and that it had also contracted for outside assistance with document management, process controls, engineering, pipeline pressure calculations, and auditing. PG&E stated that it had collected hundreds of boxes of original records that were being scanned and indexed in round-the-clock operations. On March 14, 2011, Safety Recommendations P-10-2, -3, and -4 were classified “Open—Acceptable Response.” On January 3, 2011, the NTSB issued the following safety recommendations to the CPUC: Develop an implementation schedule for the requirements of Safety Recommendation P-10-2 (Urgent) to Pacific Gas and Electric Company (PG&E) and ensure, through adequate oversight, that PG&E has aggressively and diligently searched documents and records relating to pipeline system components, such as pipe segments, valves, fittings, and weld seams, for PG&E natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior hydrostatic testing as outlined in Safety Recommendation P-10-2 (Urgent) to PG&E. These records should be traceable, verifiable, and complete; should meet your regulatory intent and requirements; and should have been considered in determining maximum allowable operating pressures for PG&E pipelines. (P-10-5) (Urgent) If such a document and records search cannot be satisfactorily completed, provide oversight to any spike and hydrostatic tests that Pacific Gas and Electric Company is required to perform according to Safety Recommendation P-10-4. (P-10-6) (Urgent) 76#

PAR-11-01, page 90NTSB Pipeline Accident Report Through appropriate and expeditious means, including posting on your website, immediately inform California intrastate natural gas transmission operators of the circumstances leading up to and the consequences of the September 9, 2010, pipeline rupture in San Bruno, California, and the National Transportation Safety Board’s urgent safety recommendations to Pacific Gas and Electric Company so that pipeline operators can proactively implement corrective measures as appropriate for their pipeline systems. (P-10-7) (Urgent) The CPUC response, dated February 2, 2011, states that the CPUC directed PG&E to undertake a plan of action to comply with Safety Recommendation P-10-2 and to provide a status report by February 1, 2011. The CPUC stated that it had also informed California’s three other intrastate natural gas transmission pipeline operators of the NTSB recommendations and directed them to comply. All of the California intrastate operators provided the CPUC with an implementation schedule by the February 1, 2011 deadline. On March 29, 2011, Safety Recommendations P-10-5 and -6 were classified “Open—Acceptable Response, ” and Safety Recommendation P-10-7 was classified “Closed—Acceptable Action.” On January 3, 2011, the NTSB also issued the following safety recommendation to PHMSA: Through appropriate and expeditious means such as advisory bulletins and posting on your website, immediately inform the pipeline industry of the circumstances leading up to and the consequences of the September 9, 2010, pipeline rupture in San Bruno, California, and the National Transportation Safety Board’s urgent safety recommendations to Pacific Gas and Electric Company so that pipeline operators can proactively implement corrective measures as appropriate for their pipeline systems. (P-10-1) (Urgent) In response, on January 4, 2011, PHMSA issued Advisory Bulletin 11-01 to owners and operators of hazardous liquid and gas pipeline systems. (The advisory is discussed earlier in section 1.11.3, “Actions Taken by PHMSA.”) On February 14, 2011, Safety Recommendation P-10-1 was classified “Closed—Acceptable Action.” 1.12.2 June 8, 2011, Safety Recommendations to PHMSA and PG&E Concerning Emergency Response At the investigative hearing on this accident, the NTSB learned that the SBFD chief was unaware of the presence of Line 132 prior to the accident and that the PG&E public awareness program did not identify pipeline locations. After the accident, PG&E provided the SBFD with maps showing the location of its gas transmission pipelines. The NTSB was concerned that without system-specific information for pipelines, local emergency responders would be at risk and the effectiveness of the emergency response effort could be adversely affected. As a result, on June 8, 2011, the NTSB issued the following safety recommendation to PHMSA: Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of sharing 77#

PAR-11-01, page 91NTSB Pipeline Accident Report system-specific information, including pipe diameter, operating pressure, product transported, and potential impact radius, about their pipeline systems with the emergency response agencies of the communities and jurisdictions in which those pipelines are located. (P-11-1) During the investigation, the NTSB also learned that PG&E procedures do not require SCADA operators to immediately notify the applicable 911 emergency call center in the event of a possible pipeline rupture. They require only that a field employee be dispatched to the gas incident location to evaluate the danger to life and property, assess damage, and make or ensure that conditions are safe. The procedure also requires field personnel to notify a field service supervisor, a dispatcher, a gas maintenance and construction supervisor, or an on-call gas supervisor. The procedure does not instruct field personnel, the dispatch center, or the control center to contact emergency services through 911 or other means. The procedure does not discuss the involvement of city or emergency officials. Notifications outlined in the procedure are focused on company personnel and supervisors only. The NTSB was concerned that this could adversely affect the timeliness and effectiveness of an emergency response effort. Therefore, on June 8, 2011, the NTSB issued the following safety recommendation to PG&E: Require your control room operators to notify, immediately and directly, the 911 emergency call center(s) for the communities and jurisdictions in which your transmission and/or distribution pipelines are located, when a possible rupture of any pipeline is indicated. (P-11-3) Based on the same concerns, on June 8, 2011, the NTSB also issued the following safety recommendation to PHMSA: Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of control room operators immediately and directly notifying the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-2) Safety Recommendations P-11-1, -2, and -3, are currently classified “Open—Await Response. ” 1.12.3 Other Relevant Recommendations 1.12.3.1 Grandfathering of Higher Permissible Stress Levels for Pre-1970 Pipelines In its 1987 final report on two corrosion-related gas pipeline ruptures in Beaumont and Lancaster, Kentucky,115 the NTSB noted that the operating pressure on those pipelines (both of 115 Texas Eastern Gas Pipeline Company Ruptures and Fires at Beaumont, Kentucky, on April 27, 1985, and Lancaster, Kentucky, on February 21, 1986, Pipeline Accident Report NTSB/PAR-87/01 (Washington DC: National Transportation Safety Board, 1987). 78#

PAR-11-01, page 92NTSB Pipeline Accident Report which dated to the 1950s) was in excess of what would have been allowed for pipelines constructed after 1970—which are limited to a MAOP of no more than 72 percent SMYS in class 1 locations. The report stated that the NTSB “does not believe it is sound engineering practice to allow older pipelines, constructed with materials and procedures inferior to those used in new pipelines, to operate at SMYS levels greater than those new pipelines.” While acknowledging that, in 1970, “it may not have been practical to have required all existing pipelines to immediately conform to the new maximum pressure standard,” the NTSB expressed its belief that a reasonable approach would have been to allow operation at higher pressures until a specified time, “by which all existing pipelines would be required to adhere to the new standard.” Accordingly, the NTSB recommended that RSPA— Revise 49 CFR 192 and, if necessary, request legislative authority to amend 49 CFR 192 to eliminate the “grandfather clause” which permits operators of pipelines installed before November 12, 1970, to operate at levels of stress that exceed those levels permitted for pipeline installed after the effective date of 49 CFR 192. (P-87-9) RSPA published an ANPRM on December 11, 1989, asking for public comment on whether it should repeal, modify, or retain the grandfather clause.116 The ANPRM pointed out that the grandfather clause was adopted “primarily so that gas transmission lines that had not been pressure tested to a level of at least 1.1 times their operating pressure could continue to operate in [c]lass 1 locations without retesting or reducing pressure.” However, RSPA found that its own research into grandfathered lines operating above 72 percent showed that all the lines examined “had been tested well above that level. …Thus, insufficient qualifying test levels do not appear to be a problem for grandfathered pipelines operating above 72 [percent] of SMYS.” Nonetheless, RSPA indicated that it was “concerned about the prudence of continuing to allow grandfathered lines to operate above 72 percent of SMYS.” In a letter dated September 2, 1992, RSPA advised the NTSB that, based on the comments received and on the results of its own research, it could not conclude that grandfathered lines require special treatment when operating above 72 percent SMYS. On April 22, 1994, the NTSB classified Safety Recommendation P-87-9 “Closed—Reconsidered.” 1.12.3.2 Constructing and Modifying Pipelines to Accommodate Use of In-Line Inspection Equipment The 1987 final report on the gas pipeline ruptures in Beaumont and Lancaster, Kentucky, discussed in section 1.12.3.1, “Grandfathering of Higher Permissible Stress Levels for Pre-1970s Pipelines,” also presented the safety benefits of in-line inspections for identifying corrosion and other deficiencies. The NTSB recommended that RSPA— 116 Federal Register, vol. 54 (December 11, 1989), p. 50780. 79#

PAR-11-01, page 93NTSB Pipeline Accident Report Require existing natural gas transmission and liquid petroleum pipeline operators when repairing or modifying their systems, to install facilities to incorporate the use of in-line inspection equipment. (P-87-6) Require that all new gas and liquid transmission pipelines be constructed to facilitate the use of in-line instrument inspection equipment. (P-87-7) On February 7, 1995, based on RSPA’s then-ongoing rulemaking to require newly constructed pipelines to be piggable (discussed further in section 1.13.1.2, “In-line Inspection”), Safety Recommendations P-87-6 and -7 were classified “Closed—Acceptable Action.” 1.12.3.3 Rapid Shutdown and ASVs and RCVs In December 1970, the NTSB completed a special study examining the effects of delay in shutting down failed pipeline systems and methods of providing rapid shutdown.117 The study concluded that a large proportion of the damage from several recent pipeline accidents could have been minimized or eliminated if the time between failure and shutdown had been reduced. The study noted that there were no Federal requirements for rapid shutdown and no standards defining a reasonable period of time to shut down a failed system. Accordingly, the NTSB recommended that the DOT Office of Pipeline Safety— Conduct a study to develop standards for the rapid shutdown of failed natural gas pipelines and work in conjunction with the Federal Railroad Administration[ 118 ] to develop similar standards for liquid pipelines. (P-71-1) The DOT conducted the study; and, on September 30, 1976, the NTSB classified Safety Recommendation P-71-1 “Closed—Acceptable Action.” However, the DOT did not issue regulations requiring the use of ASVs or RCVs. In its 1995 report on the natural gas explosion in Edison, New Jersey,119 the NTSB noted that a number of accidents since 1971 had illustrated the need to require ASVs and/or RCVs to facilitate rapid shutdown of failed pipelines. The NTSB recommended that RSPA— Expedite requirements for installing automatic- or remote-operated mainline valves on high-pressure pipelines in urban and environmentally sensitive areas to provide for rapid shutdown of failed pipeline segments. (P-95-1) On April 21, 2004, the NTSB classified Safety Recommendation P-95-1 “Closed—Acceptable Action,” based on RSPA’s 2004 integrity management rulemaking 117 Effects of Delay in Shutting Down Failed Pipeline Systems and Methods of Providing Rapid Shutdown, Pipeline Safety Study NTSB/PSS-71/01 (Washington, DC: National Transportation Safety Board, 1970). 118 At that time, the Federal Railroad Administration was responsible for setting liquid pipeline safety standards. 119 Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New Jersey, March 23, 1994, Pipeline Accident Report NTSB/PAR-95/01 (Washington, DC: National Transportation Safety Board, 1995.) 80#

PAR-11-01, page 94NTSB Pipeline Accident Report requiring that each gas transmission operator determine whether installing ASVs or RCVs would be an efficient means of adding protection to an HCA. In 1982, the NTSB issued a recommendation regarding emergency shutdown to PG&E following a pipeline investigation. On August 25, 1981, a PG&E excavation contractor punctured a 16-inch natural gas main in San Francisco, California. The PG&E personnel who first arrived on scene were not trained or equipped to close the valves, and specially trained valve crews were dispatched. That was one of several factors that delayed PG&E in accurately locating and shutting off the valves necessary to isolate the rupture. The flow of gas was not stopped until 9 hours 10 minutes after the puncture. In its final report,120 the NTSB determined that the probable cause of that accident was the failure of the general contractor to comply fully with the terms of the excavation permit which required him to verify the location of underground facilities that might be affected by the project. Contributing to the accident was the failure of the subcontractor, who knew of the existence of the gas main, but not its precise location, to ascertain that the gas company had been notified before commencing excavation. Contributing to the duration of the gas leakage was the gas company’s inability to locate one emergency valve because of inaccurate recordkeeping, and because it had been paved over; and to close another valve which was inoperative because of inadequate maintenance. As a result of the 1981 accident, the NTSB made several recommendations, including that PG&E— Train and equip company personnel who respond to emergency conditions in the operation of emergency shutdown valves. (P-82-1) PG&E responded on June 21, 1982, that special attention was being directed to training personnel about the location and operation of emergency shutdown valves, and that additional valve keys were being provided to crews who could be called in an emergency. Safety Recommendation P-82-1 was subsequently classified “Closed—Acceptable Action.” 1.13 Other Information 1.13.1 Pipeline Assessment Methods for Integrity Management The Pipeline Safety Improvement Act of 2002 and the integrity management rules in 49 CFR Part 192 specify three primary types of assessment methods for in-service gas transmission pipelines: pressure testing, in-line inspection, and direct assessment.121 An operator 120 Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 (Washington, DC: National Transportation Safety Board, 1982). 121 Title 49 CFR Part 192 also allows for the use of other technology if the operator can demonstrate that it provides an equivalent assessment of the condition of the pipe. 81#

PAR-11-01, page 95NTSB Pipeline Accident Report is required to apply one or more of these methods to each covered segment, depending on the threats to which the segment is susceptible. The 2002 act also charged PHMSA with conducting a research and development program, with annual funding of $10 million. The PHMSA manager of research and development testified at the NTSB’s investigative hearing that the program objectives are to develop technology, strengthen consensus standards, and promote knowledge. He reported that the program has awarded $62 million to 171 projects since 2002, and noted that those projects were also supported by $79 million of industry and other Federal cofunding. About 69 of those projects (which received $34.59 million from PHMSA and $41.92 million from other sources) relate to developing new pipeline assessment technologies. 1.13.1.1 Pressure Testing As previously discussed in section 1.7.5.1, “Grandfather Clause,” since 1970, Federal regulations at 49 CFR 192.505 have required hydrostatic pressure testing of newly installed pipelines at levels above the intended MAOP. Pressure testing of newly constructed pipelines is designed to identify critical manufacturing and construction defects. However, it may not test the ability of a pipe to withstand the combination of threats (for example, seismic and utility work) to which it may be subjected. Pressure testing of existing in-service pipelines is designed to find critical seam defects—as well as other defects caused by corrosion, stress corrosion cracking, and fatigue—by causing the pipe to fail at these critical defect locations. According to testimony at the NTSB investigative hearing, there are several limitations to pressure testing of in-service pipelines: • Pressure testing identifies only the most severe defects; it does not indicate whether or how many other defects might exist. • The pipeline must be taken out of service during the pressure test, which causes inconvenience to the customers and a loss of revenue to the operator. • Water used during a pressure test can be difficult to completely remove from the pipe, and residual water can cause internal corrosion. In addition, the water can be hazardous after the test and must be treated before disposal. Finally, in limited cases, some pipelines may be susceptible to a pressure reversal failure after pressure testing. PHMSA defines a pressure reversal as the failure of a pipeline at a latent defect that survived a pressure test but subsequently failed at a lower repressurization pressure.122 Pressure reversal research suggests that a pressure spike test protocol123 may be used to manage 122 Information obtained from PHMSA website: < http://primis.phmsa.dot.gov/comm/FactSheets/FSHydrostaticTesting022607.htm?nocache=766> (accessed August 8, 2011). 123 (a) J.F. Kiefner and W.A. Maxey, “The Benefits and Limitations of Hydrostatic Testing,” in E.W. McAllister, ed., Pipeline Rules of Thumb Handbook, 6th ed. (Boston: Elsevier, 2005), pp. 139–162. (b) Information obtained from PHMSA website: <http://primis.phmsa.dot.gov/comm/FactSheets/FSHydrostaticTesting022607.htm?nocache=766> (accessed August 8, 2011). 82#

PAR-11-01, page 96NTSB Pipeline Accident Report pressure reversals. In a spike test, the pipe is pressurized beyond the MAOP for a short time period. The Pipeline Rules of Thumb Handbook, 124 an industry reference text, states that new pipelines should be tested to at least 100 percent of SMYS, but that in-line inspection is preferable for older lines for locating time-dependent defects if there is sufficient confidence in the ability of the tool to find significant defects. Regarding pressure reversals, this text states, “if a hydrostatic test can be successfully accomplished without the failure of any defect, the likelihood of a pressure reversal will be extremely small. It is the tests in which numerous failures occur that have the highest probabilities of reversals.” The handbook further recommends conducting an integrity test as a spike test in which the pipeline is pressurized to as high a level as possible for a short period of time. PHMSA regulatory evaluation prepared in connection with the gas integrity management rulemaking indicated that, based on estimates provided by the Interstate Natural Gas Association of America (INGAA) and the American Gas Association (AGA), the cost per mile for hydrostatic testing of a gas transmission pipeline was $29,700–$40,000 in 2001. The regulatory evaluation noted that informal discussion with pipeline operators indicated that hydrostatic testing was the least preferred method for assessing pipeline integrity because it could be destructive, whereas the other two methods (in-line inspection and direct assessment) were not; because it required taking a line out of service; and because it could result in moisture remaining in the line. 1.13.1.2 In-line Inspection As already noted, in-line inspection is accomplished using a mechanical device known as a “smart pig,” which is inserted into and travels through the pipeline. A variety of in-line inspection technologies exist to inspect for various types of defects. On gas pipelines, these technologies include deformation or geometry tools, magnetic flux leakage tools, and ultrasonic tools. Deformation or geometry tools are used to detect construction damage, dents, third-party damage, and wrinkles or buckles. Magnetic flux leakage tools vary based on the orientation of the sensors; some are optimized to find circumferentially oriented defects such as girth weld defects, while others are optimized to find longitudinally oriented defects such as seam defects. Ultrasonic tools can be used to detect corrosion and cracks, but they require either a liquid couplant or a wheel-coupled system, which limits their use in gas pipelines. Electromagnetic acoustic transducer is a type of ultrasonic inspection that is being adapted for use in gas pipelines. It is currently in the demonstration phase of research and is not yet widely available. In-line inspection technologies can be effective at finding flaws and providing data for comparison over time. Another advantage is that in-line inspection is a nondestructive test method. However, there are some limitations to the technology. There is generally at best a 124 Kiefner and Maxey, 2005, pp. 139–162. 83#

PAR-11-01, page 97NTSB Pipeline Accident Report 90 percent probability in-line tools will detect a certain type of known defect. (The probability of detecting a crack can be improved with multiple runs.) In addition, a specific pressure or flow is required to propel the in-line inspection device through the pipeline. Furthermore, according to the AGA, about 61 percent of transmission pipelines are not piggable—meaning they cannot accommodate current gas-driven in-line inspection devices. A variety of physical obstacles—such as bends, valves, fittings, and diameter changes—can prevent in-line inspection tools from moving through a pipeline. According to information presented by the AGA at the NTSB investigative hearing, the estimated cost to retrofit all intrastate gas transmission lines to make them piggable is $12 billion. A battery-operated self-propelled robotic tool has recently been developed to inspect unpiggable 20- to 26-inch-diameter natural gas pipelines. It is currently in the demonstration phase of research and is not yet widely available. In 1994, in response to a congressional mandate in the Pipeline Safety Reauthorization Act of 1988, RSPA amended Federal pipeline safety regulations to require that newly installed pipelines be designed and constructed to accommodate the passage of smart pigs. The 1994 rulemaking required that whenever any line pipe or component was replaced, the operator must design and construct the entire line section125 containing the replacement to accommodate the passage of a smart pig. However, in response to industry petitions for reconsideration objecting to this replacement provision, enforcement of this aspect of the 1994 rule was suspended shortly after its issuance. The replacement provision was amended in 2004 to apply only to replacements of pipe or components, not the entire section. In relaxing the 1994 replacement requirement, RSPA noted that the then-new integrity management regulations had “reduced the significance of the replacement provision in reaching the piggability goal,” because comments on the integrity management rulemaking had “indicated that operators strongly prefer to use smart pigs as the method of assessment and will modify their transmission lines as necessary to accommodate smart pigs.” The preamble to the 2004 amendment noted that, therefore, “regardless of the replacement provision, the new integrity management regulations should result in increased piggability of existing transmission lines in and near areas of high population, areas where the risk of damage from a pipeline rupture is the greatest.” 126 However, at the NTSB’s investigative hearing, the deputy director of the CPUC consumer product safety division testified that “in PG&E’s service territory… we haven’t seen an aggressive effort to make their pipes piggable… and we haven’t seen a program to take the grandfathered pipe and either… hydro test it or replace it. We haven’t seen, in the integrity management program, thus far, any aggressive efforts in those areas.” The PHMSA regulatory evaluation indicated that, based on estimates provided by INGAA and AGA, the cost per mile of in-line inspection was $3,700–$9,600 in 2001. The regulatory evaluation noted that much natural gas transmission pipeline was not currently piggable and that INGAA estimated the cost per mile of adding pig launchers and receivers and making other necessary modifications was $11,750–$76,500, again in 2001 dollars. 125 “Line section” was defined in the 1994 rule as “a continuous run of transmission line between adjacent compressor stations, between a compressor station and storage facilities, between a compressor station and a block valve, or between adjacent block valves.” 126 Federal Register, vol. 69, no. 123 (June 28, 2004), p. 36029. 84#

PAR-11-01, page 98NTSB Pipeline Accident Report The regulatory evaluation further noted that in-line inspection appeared to be the preferred method of assessment because the per-mile cost was less than for hydrostatic testing or direct assessment (discussed below). However, the PHMSA evaluation cautioned that “the choice between direct assessment and in-line inspection is not so obvious for pipeline that must be modified to be made piggable.” Nonetheless, PHMSA concluded that “while the direct assessment process produces a significant amount of information about the pipeline, pigging still provides operators the most information from actual examination of the pipe wall.” At the time of the accident, 945.28 miles of PG&E gas transmission lines could accommodate in-line inspection tools, and 713.09 of those miles had been inspected using in-line inspection tools. As of the date of this report, 987.98 miles of PG&E gas transmission lines could accommodate in-line inspection tools, and 742.42 of those miles have been inspected using those tools. 1.13.1.3 Direct Assessment Direct assessment is used to evaluate pipeline corrosion threats. The methodology relies on a variety of techniques—including records review, indirect inspection, mathematical models, and environmental surveys—to identify likely locations on the pipeline where corrosion may be occurring. In the case of ECDA, remote electric field measurements can identify coating flaws in buried pipelines. Likely locations of corrosion are then excavated and directly examined. A feedback mechanism is used to validate and improve the indirect assessment based on direct assessment findings. In the preamble to the 2004 integrity management rules,127 indirect examination as part of the direct assessment process as follows, RSPA explained the use of Pipeline operators have used indirect examination tools in [direct assessment] for many years, and there is a wealth of experience. Although exposing a pipeline for direct observation and evaluation of potential problems is the most reliable means of understanding pipeline condition, it is not practical to excavate and examine entire pipelines. The [direct assessment] process is a method that involves structured use of the time-tested indirect examination tools, and integration of the information gained from use of those tools with other information about the pipeline, to determine where it is necessary to excavate and examine the pipe. As originally proposed, the integrity management rules would not have allowed direct assessment as a primary assessment method except in certain circumstances (where in-line inspection and pressure testing were not possible or economically feasible or for low stress pipelines) and would have established shorter assessment intervals for direct assessment than for other assessment methods. However, based on numerous comments from the pipeline industry, the final rule eliminated these restrictions. In the preamble to the final rule, RSPA explained that many distribution companies operating transmission pipelines would need to rely heavily on 127 Federal Register, vol. 68, no. 240 (December 15, 2003), pp. 69778, 69791. 85#

PAR-11-01, page 99NTSB Pipeline Accident Report direct assessment because such pipelines “are generally not amenable to in-line inspection, and are often impractical to remove from service for pressure testing.” In addition, RSPA noted that most of these pipelines “also operate at low pressures, presenting relatively smaller risks than other transmission pipelines.” Therefore, “[p]lacing more restrictive requirements on use of [direct assessment] would increase the burden, and costs, for operators of these low-risk pipelines without commensurate benefits.” The integrity management rules at 49 CFR 192.923 state that an operator may use only direct assessment as the primary assessment method to address the identified threats of external corrosion, internal corrosion, and stress corrosion cracking. In testimony at the NTSB investigative hearing, the PHMSA deputy associate administrator for field operations cautioned that direct assessment would not be appropriate for a seam threat. In other hearing testimony, a PHMSA materials engineer stated that the advantages of direct assessment include the ability to compare data from sequential assessments over time to identify changes in pipeline condition. According to 49 CFR 192.925, ECDA is a four-step process involving preassessment, indirect examination, direct examination, and postassessment and continuing evaluation. Internal corrosion direct assessment, according to 49 CFR 192.927, consists of a similar process involving preassessment, region identification, excavation and direct examination, and postassessment evaluation and monitoring. Stress corrosion cracking direct assessment involves data gathering and integration and use of an appropriate assessment method and remediation, as described at 49 CFR 192.929. The PHMSA regulatory evaluation for the gas integrity management rule indicated that, according to INGAA estimates, the cost per mile of performing direct assessment was $15,000 in 2001. AGA estimated the cost as $7,000–$8,000 per mile without any verification digs and stated that excavation digs could cost from $2,500–$250,000, with an average of $40,000 for a typical large transmission line. 1.13.2 Automatic Shutoff Valve Technology Newer ASV technologies address previously recognized shortcomings such as false or nuisance trips (closures) from normal pressure transients. Newer ASV models incorporate “smart” technology while combining the features of both a line break device and a remote control valve. Such newer models sense pressure transients and trend the typical high and low operating pressures. They also record the pressures prior to an event for later analysis. The newer ASVs are solar powered with battery backup and can be programmed to send an alarm before tripping and closing. This alarm gives SCADA operators the opportunity to override an impending valve closure. The alarm can also be outfitted with a delay that allows the valve to trip locally if the operator does not override the alarm within a specified amount of time. 86#

PAR-11-01, page 100NTSB Pipeline Accident Report 1.13.3 2008 Natural Gas Explosion in Rancho Cordova, California The NTSB investigated a natural gas explosion involving a PG&E distribution line that occurred on December 24, 2008.128 The explosion and fire, which was caused by a natural gas leak, destroyed a house in Rancho Cordova, California. One person was killed, and five other people, including one utility employee and one firefighter, were hospitalized as a result of the explosion. Two adjacent homes were severely damaged, and several homes received minor damage. The NTSB determined that the probable cause of the accident was the use of a section of unmarked and out-of-specification polyethylene pipe with inadequate wall thickness that allowed gas to leak from a mechanical coupling installed on September 21, 2006. Contributing to the accident was the 2-hour 47-minute delay in the arrival at the job site of a PG&E crew that was properly trained and equipped to identify and classify outdoor leaks and to begin response activities to ensure the safety of the residents and public. The investigation found that at least one PG&E facility stored unmarked (nonspecification) pipe lengths that were delivered as part of packing material and later used them for stub markers. Such packing pipe was not intended for use as a specification pipe product. The NTSB report stated that the accident also highlighted shortcomings in PG&E’s response procedures. First, at the time of the accident, PG&E did not require any of the responders to periodically check in with their dispatch offices to communicate delays in responding. Second, PG&E sent GSRs as the first responders to leak complaints. The report noted that GSRs are neither trained in grading outdoor leaks nor equipped with the equipment required to do so under PG&E’s operator qualification program. A GSR who encountered an outdoor leak was required to call PG&E’s dispatch center and have a leak inspector sent to grade the leak. Prior to the Rancho Cordova accident, as a result of a May 2008 audit, the CPUC had ordered PG&E to review its response procedures to ensure that personnel responding to reports of gas leaks had the proper training and equipment. The CPUC order noted that PG&E’s procedures, “wherein events requiring immediate attention are identified and classified by persons not qualified to make such decisions, has the real potential to prevent or delay qualified personnel from timely responding to, and correcting what can be very hazardous conditions.” 128 Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010). 87#

PAR-11-01, page 101NTSB Pipeline Accident Report 2. Analysis 2.1 Introduction This analysis explains the probable cause of the accident and includes discussion of the following safety issues identified in this report: • Multiple deficiencies in PG&E’s operations, including its practices and procedures regarding emergency response, SCADA employees’ roles and duties, SCADA work, postaccident toxicological testing, isolation and shutdown after the rupture, public awareness, quality control, and integrity management. • Ineffectiveness of the CPUC’s oversight of PG&E. • Ineffectiveness of PHMSA’s oversight and inadequacy of current Federal pipeline safety rules, including those governing MAOP and integrity management programs, and ineffective implementation and execution of performance-based pipeline safety programs. The remainder of this introductory section discusses those elements of the investigation that the NTSB was able to determine did not affect the cause of the accident or the extent of its outcome. Segment 180 of Line 132 did not cross any known fault lines, and there were no reports of ground shifts in the accident area. A 1992 geologic hazard report prepared by PG&E indicated that the ground around Segment 180 had a low-to-moderate seismic risk, and a 2011 report by a company specializing in measuring ground deformation over time using satellite imagery indicated that fill beneath the Earl Avenue and Glenview Drive area of San Bruno did not experience any significant vertical movement between May 1992 and August 2010, indicating the area had a low seismic risk. U.S. Army Corps of Engineers (the Corps) geotechnical engineers evaluated seismic data and concurred that seismic loading was not a significant external force on the pipeline. Therefore, seismic activity can be ruled out as a factor in the failure of the pipeline. Laboratory examination of the accident pipe revealed no areas of preexisting external or internal corrosion, or stress corrosion cracking. Therefore, corrosion was eliminated as a factor in the pipeline rupture. Further, the laboratory examination revealed no evidence of preexisting damage or direct third-party damage. Therefore, direct third-party damage also was eliminated as a factor. (For additional analysis of activities surrounding the 2008 sewer replacement project, see section 2.3.4, “2008 Sewer Pipe Bursting Operation.”) Drug test results for workers at the Milpitas Terminal were negative. Alcohol tests were administered too late to be considered valid under DOT regulations. PG&E did no drug or alcohol testing of the SCADA center staff because PG&E did not believe that their actions had 88#

PAR-11-01, page 102NTSB Pipeline Accident Report contributed to the rupture. (For more information, see section 2.4.5, “Deficiencies in Postaccident Drug and Alcohol Testing.”) Fatigue was evaluated as a possible human performance issue. A variety of fatigue factors, including sleep (acute sleep loss, cumulative sleep debt, and sleep quality), continuous hours awake, circadian disruption, sleep disorders, medication use, disruptive environmental factors, and shift work considerations were examined. None of the fatigue factors emerged as an indication of significant physiological fatigue at the time of the accident, although one factor (continuous hours awake) was noteworthy. The accident occurred during the beginning of a new shift for SCADA operators who had arrived by 6:00 p.m. However, the day shift operators remained past their normal duty times in order to address the problems associated with the Milpitas Terminal and pressure anomalies. Thus, they continued working beyond their normal 12-hour shifts with the response lasting about 95 minutes beyond the shift’s end before the gas flow was shut down. The overall duty times at the time of the accident for the nine interviewed employees ranged from 12–13 hours. Their potential continuous hours awake ranged from about 13–15 hours at the time of the accident. The employees’ involvement in the subsequent response lasted at least 95 minutes immediately following the accident and occurred beyond the duty and continuous hours of awake times provided earlier. Therefore, some or all of the nine employees could have been functioning at 14.5–16.5 continuous hours of wakefulness during the subsequent response to the accident. Although continuous hours awake beyond 16 hours has been demonstrated to degrade operator performance substantially, 12-hour shifts also have been associated with fatigue-related performance decrements. In its 2005 safety study of SCADA systems, 129 the NTSB cited a variety of research studies showing fatigue-related performance deficits associated with 12-hour shifts. One article cited in the study found “a decreased performance (187 percent more errors) and increased sleepiness (66 percent) for workers of a 12-hour shift during their last 4 hours on shift.” The nine PG&E employees interviewed were involved with varied aspects of the postrupture and emergency response activities (such as decision-making, communication, and coordination) and had extended amounts of continuous hours of wakefulness. Given the diversity of tasks, collective involvement in the response activities and number of individuals involved, it was not possible to connect an individual’s potential fatigue-related performance decrements to a specific outcome or action. Given this situation, it was not possible to include or exclude fatigue associated with the extended continuous hours of wakefulness as a factor in the accident or during the subsequent emergency response. Accordingly, the NTSB concludes that the following were not factors in this accident: seismic activity, corrosion, direct third-party damage, or drug use by the workers at the Milpitas Terminal. 129 NTSB/SS-05/02, p. 52. 89#

PAR-11-01, page 103NTSB Pipeline Accident Report Over 900 emergency response personnel responded to the accident. The first police department and fire department resources arrived on scene within minutes of the explosion. Mutual aid personnel and resources were requested from surrounding jurisdictions. Firefighters and police officers conducted door-to-door searches in the surrounding neighborhoods and evacuated about 300 houses. A medical group was established, and medical units were located north and south of the explosion site. Logistics, planning, communications, finance, and damage assessment groups were formed as part of the organized emergency response. The city of San Bruno activated its emergency operations center and opened a facility staffed by the American Red Cross for evacuees. Because of the flow of natural gas from the pipeline during the first 95 minutes after the rupture, firefighters conducted defensive operations until the pipeline valves were closed, at which time they were able to access the area. The NTSB concludes that, considering the challenges of the prolonged fire fueled by natural gas, the emergency response was well coordinated and effectively managed by local responders. 2.2 Preaccident Events 2.2.1 Work Clearance Procedures for Electrical Work at Milpitas Terminal Because electrical work at the Milpitas Terminal resulted in the inadvertent pressure increases that preceded the rupture, the NTSB examined the procedures relating to this work. The investigation identified several deficiencies in the work clearance process used for the Milpitas Terminal electrical work. First, the system clearance form did not adequately detail the work to be performed. It did not discuss the equipment being worked on or the equipment that would be affected. The form indicated that normal function at the terminal would not be maintained, but there was no explanation, although the form called for such an explanation. The work clearance form also lacked any entries under “Sequence of Operations.” By contrast, NTSB investigators noted that the clearance form for the 2008 pressure increase to 400 psig130 was highly detailed, with a step-by-step sequence of operations. Due to the lack of detail on the work clearance form for the September 9, 2010, work, the SCADA operators would not have been aware of the scope and magnitude of the work being performed at the Milpitas Terminal. If the form had included the necessary information, the SCADA operators would have at least been aware that power interruptions were planned to specific instrumentation at the Milpitas Terminal and might have taken steps to mitigate the risk. This assumption was also illustrated when, after the rupture (at 7:05 p.m.), a SCADA operator incorrectly stated, “it was a regular scheduled clearance, it wasn’t supposed to affect anything.” In fact, the clearance form indicated that the work was expected to affect the normal functioning of equipment at the Milpitas Terminal. However, the form lacked clarity regarding how, and the extent to which, the normal functioning of equipment would be affected. 130 For more information about this pressure increase, see section 1.7.5.3. “Periodic Pressure Increases to MAOP.” 90#

PAR-11-01, page 104NTSB Pipeline Accident Report Second, the preparation and contingency planning for the September 9, 2010, electrical work was inadequate as illustrated by the Milpitas technician’s queries to SCADA operators about whether the valves on the incoming lines would fail closed and whether the station could be placed in bypass during the work. The fact that he needed to ask what impact certain steps in the work process would have on the equipment (as he did during phone calls at 3:36 p.m. and 4:03 p.m.) indicates that these issues were not evaluated in advance. Because of the lack of contingency planning, employees at both facilities were unprepared, as evidenced by the fact that workers at the Milpitas Terminal did not even realize that the regulator valves had opened at 5:22 p.m. until a SCADA operator informed them at 5:25 p.m. When the first unexpected power losses occurred at the Milpitas Terminal, the workers there decided to deviate from the assigned work and begin troubleshooting without stopping to notify the SCADA center or to assess the potential risk. By doing so, the workers at the Milpitas Terminal put themselves and the SCADA center in a reactive mode. Had a formal risk assessment been performed in advance, the SCADA staff might have taken precautionary measures to reduce the upstream pressures or have locked the regulating valves in a set position in advance, and retained those settings for the duration of the work, thus avoiding the accidental pressure increase. When work could potentially affect critical pipeline components, the involved personnel need to consider during the planning phase what failures might occur and be prepared to respond appropriately. The NTSB is concerned that the SCADA center approved an incomplete and inadequate system clearance form that did not address any such considerations. The NTSB concludes that had a properly prepared contingency plan for the Milpitas Terminal electrical work been in place and been executed, the loss of pressure control could have been anticipated and planned for, thereby minimizing or avoiding the pressure deviations. Accordingly, the NTSB recommends that PG&E revise its work clearance procedures to include requirements for identifying the likelihood and consequence of failure associated with the planned work and for developing contingency plans. 2.2.2 Internal Line Pressure Prior to Failure Sensors on either side of the rupture point showed that the internal line pressure at the time and location of the rupture was between 386–386.4 psig. Although this pressure was 11 psi greater than the MOP and higher than any confirmed pressure at the rupture site,131 it was still 14 psi below the PG&E-specified MAOP of 400 psig. Segment 180 was erroneously listed as having a SMYS of 42,000 psi. A 400-psig operating pressure would be expected to stress the pipe to about 38 percent of SMYS, less than 50 percent of the design limit for a class 3 location and well below that required to burst the pipe. For DSAW pipe with a SMYS of 52,000 psi, as 131 In previous instances, when the pressure at the Milpitas Terminal was increased to 400 psig, the pressure at the rupture location was less than 386 psig. Because downstream demand draws gas from the system, the pressure downstream of the terminal will be less than the pressure at the terminal. During the 2008 pressure increase at the Milpitas Terminal to 400 psig (to maintain MAOP pursuant to the PG&E interpretation of 49 CFR 192.917(e)), the pressure downstream of the rupture location at the Martin Station and upstream of the rupture location at Half Moon Bay reached only 382 psig, and in 2003 it reached only 383 psig. On October 16, 1968, a pressure of 400 psig was recorded at the Milpitas Terminal, but the downstream pressure at the rupture location is not known. 91#

PAR-11-01, page 105NTSB Pipeline Accident Report most of Segment 180 was, the calculated burst pressure would have been even higher and the stress an even lower percent of SMYS. The calculated estimated burst pressure for a 30-inch-diameter X42 pipe built to PG&E and industry specifications is 1,300 psig. Nonetheless, Segment 180 ruptured at only 386 psig. The NTSB concludes that the internal line pressure preceding the rupture did not exceed the PG&E MAOP for Line 132 and would not have posed a safety hazard for a properly constructed pipe. Accordingly, the investigation examined why a pressure of only 386 psig was sufficient to rupture the pipe. 2.3 Cause of Pipeline Rupture Four of the six pups at the rupture location did not conform to any known specification for pipe, including PG&E and API specifications. Pups 1, 2, 3, and 5 had a yield strength below the SMYS for grade X42 and X52 pipe, the lowest (in pup 2) being 32,000 psi. In addition, the longitudinal seams on pups 1, 2, and 3 were partially welded from the outside only; and the longitudinal seam welds were ground down, thereby removing the weld reinforcement and, in some instances, external pipe material. The external grinding of the weld reinforcement combined with the size of the unwelded region resulted in a significantly reduced net cross-sectional area along the pup 1, 2, and 3 longitudinal seams, which resulted in higher stresses than in the rest of the pipe. Furthermore, the shape of the unwelded portion along each longitudinal seam formed a notch, the shape of which further concentrated the stresses at the root of the weld. Finally, the angular misalignment along pup 1 and pup 3 added additional bending stresses and strains. The finite element analysis models and the burst pressure calculations illustrated the effect of the notch in the longitudinal seams of pups 1, 2, and 3. The finite element models showed that for a length of typical DSAW pipe with an internal pressure of 400 psig, the stresses in the vicinity of the weld remained well below the pipe’s yield strength. For a length of pipe with a notch similar to pup 1, the finite element model indicated that at 375 psig, approximately half the pipe wall thickness exceeded the yield stress. As noted in section 1.8.5, “Burst Pressure Study and Finite Element Modeling,” the results of the burst pressure calculations indicated that a length of typical pipe with a yield strength of 42,000 psi had an estimated burst pressure of 1,300 psig. By contrast, the estimated burst pressures for pups 1, 2, and 3, as fabricated (before the additional crack growth discussed in the next section), were as low as 515, 574, and 430 psig, respectively. Thus, the weld defects reduced the weld strength for pups 1, 2, and 3 by as much as 66 percent. However, it should be noted that the burst pressure calculation methods cannot account for the effect of the weld misalignment angle observed on pups 1 and 3. Finite element models based on the observed geometry of the pup 1 and pup 3 welds were constructed and their responses to internal pressure were compared. The stresses and deformations associated with the pup 1 weld defect were greater than for the pup 3 weld defect. Thus, the pup 1 burst pressure was likely less than the pup 3 burst pressure. 92#

PAR-11-01, page 106NTSB Pipeline Accident Report Based on these results, the NTSB concludes that the combination of the size and shape of the weld defect significantly reduced the strength of the pup 1 longitudinal seam, making it susceptible to unstable crack growth under internal gas pressure. 2.3.1 Fracture Origin and Failure Laboratory examination revealed that the rupture initiated approximately mid-length in the pup 1 longitudinal seam. A crack was observed that first formed in a manner consistent with ductile fracture into the welded portion of the seam, followed by additional crack growth by fatigue. The subcritical132 crack that formed along the root of the weld further weakened the pup 1 longitudinal seam. When the pipeline pressure at the accident location reached 386 psig, the longitudinal crack began to propagate upstream and downstream of the initiation site, rupturing the east side of the pipe. Gas began to exit the pipe on the east side, creating a lateral force that pushed the pipe to the west and gave rise to a large longitudinal tensile stress on the east side of the pipe. The force of the exiting gas also excavated the surrounding soil, forming a crater. Girth weld C5 (which joined pup 4 to pup 5) was the weakest location along the east side of the pipe. The girth weld contained a lack of fusion/lack of penetration defect, the size and shape of which concentrated the stresses at the weld. In addition, pup 4 contained phosphorous and copper, which are known to cause brittle welds. Once the girth weld fractured, the center section was attached only at the south end. The center section of pipe twisted and rotated out of the ground about the southern end, separated from the pipeline, and came to rest about 100 feet south of its origin. (See figure 2.) The NTSB investigation was unable to determine when or how the preexisting crack along the intact portion of the pup 1 longitudinal seam initiated. This uncertainty was due in large part to the fact that the pressure of 386 psig on the day of the rupture was the highest confirmed pressure at the rupture location. Previous pressure increases to 400 psig at the Milpitas Terminal in 2003 and 2008 resulted in downstream pressure increases to only 383 psig and 382 psig, respectively, at the rupture location. One other documented instance of a pressure increase to 400 psig at the Milpitas Terminal was recorded on October 16, 1968; however, downstream pressure data for that date are not available. Therefore, it is possible that— 132 Subcritical refers to a crack that can grow by some means without rupturing the pipe. 93#

PAR-11-01, page 107NTSB Pipeline Accident Report 1. The pup 1 longitudinal seam was progressively weakened by internal pressure/pressure cycling. 2. Prior to installation, pup 1 was used for a purpose or fabricated in a way that initiated and grew the crack along the weld. 3. The pup 1 longitudinal seam was weakened due to construction or utility activities after 1956. However, the investigation determined that the 2008 sewer replacement project did not progressively weaken the pup 1 longitudinal seam, as discussed in section 2.3.4, “2008 Sewer Pipe Bursting Operation.” Based on this analysis, the NTSB concludes that the fracture of Line 132 Segment 180 originated in the partially welded longitudinal seam of pup 1, which was progressively weakened due to ductile crack growth and fatigue crack growth. 2.3.2 Deficiencies in Fabrication of Accident Pipe Segment Owing to the lack of documentation, it could not be determined if the use of the pups in Segment 180 was a part of the original pipeline design or a field modification. The investigation attempted to determine whether the pups could have originated from mill-produced lengths of pipe. Investigators noted that manganese sulfide inclusions (known as stringers) in those pups were elongated in the transverse direction, indicating that the rolling direction of the steel was in the transverse direction.133 By contrast, the rolling direction for mill-produced pipe is in the longitudinal direction. Research into steel-making practices in the 1940s indicated that state-of-the-art rolling mills could produce plate only up to 11 feet wide.134 Pipe formed with the rolling direction aligned in the transverse direction would not have been capable of meeting the minimum length requirements for PG&E or other known pipe specifications and, therefore, would not have been used for such a purpose. In addition, the assembly of pups did not meet PG&E or API requirements for a factory jointer (two or more pipe pieces joined by welding). PG&E and API specifications required the minimum length of each joined length of pipe to be at least 5 feet. However, pups 1, 2, 3, 4, and 5 were all less than 4 feet in length. Moreover, according to API specifications, the ends of the pipe to be welded together were to be “prepared in accordance with the requirements of the process used,” meaning the ends of each length of pipe would have been prepared with an external bevel, yet no external bevels were observed. 133 Steel plate is formed from an ingot by passing it through a series of rollers that reduce the thickness and increase the length. The inclusions start as round particles and elongate primarily in the rolling direction as the thickness of the steel plate is reduced. 134 Unites States Steel, The Making, Shaping and Treating of Steel, 7th ed. (Pittsburgh, Pennsylvania: United States Steel Corporation, 1957). 94#

PAR-11-01, page 108NTSB Pipeline Accident Report The investigation also determined, based on differences in weld microstructure, weld penetration, microhardness, and shape of the heat-affected zone, that pups 1 through 5 were not fabricated according to the Consolidated Western DSAW process. The differences indicated that the welds on pups 1, 2, and 3 were performed at a lower power and at a slower deposition rate than the Consolidated Western process, resulting in a lower rate of heat input but a greater amount of total heat. The microhardness of the pup 4 seam weld and the manual shielded metal arc welds on pups 4 and 5 were also inconsistent with the Consolidated Western DSAW process.135 Other inconsistencies with the Consolidated Western process were noted. For instance, pups 1, 2, 3, and 5 were not likely subject to the Consolidated Western cold-expansion process. For a finished pipe diameter of 30 inches, the preexpanded pipe would be about 29.6 inches in diameter. Had the pups been fabricated to 29.6 inches, the unwelded seam geometry on pups 1, 2, and 3 would not have survived the hydraulic expansion process, and the pups would have ruptured. According to the 1949 report by Moody Engineering, Consolidated Western also subjected all jointers to this process “after the girth weld has been completed and chipped flush on the outside.” In other words, the girth welds would have been ground flush with the outer surface prior to fitting into the expander. However, all girth welds exhibited a weld reinforcement, and there was no evidence that the girth welds had been ground flush with the outer surface of the pipe. Therefore, pups 1, 2, 3, and 5 were likely fabricated to 30-inch diameter. Similarly, the pups would not have been able to withstand the mill proof test to 90 percent of SMYS, which was part of the Consolidated Western quality control process. The mill proof-test pressure was 1,170 psig. The calculated burst pressures of pups 1, 2, and 3 were well below the proof-test pressure. In sum, at least four of the six pups in the accident pipe were rolled in a manner inconsistent with industry standard line pipe, at least five were not fabricated using Consolidated Western’s DSAW process, and the assembly of pups did not meet the requirements of a mill-produced jointer. Therefore, the NTSB concludes that the accident pipe comprising the pups did not conform to PG&E or other known specifications for pipe and was fabricated at an undetermined facility to no known specification. 2.3.3 Deficiencies in Quality Control Associated with 1956 Relocation Project Given the identified weld and pipe deficiencies, NTSB investigators sought to understand how the substandard pipe piece could have been installed and remain in service undetected until the accident, 54 years later. The investigation revealed no records of radiography for the 1956 relocation project. (By contrast, the PG&E requirements called for radiography of 10 percent of the welds for the original construction of Line 132 in 1948.) Nor were there records of hydrostatic testing, which might have ruptured the pipe at the time of installation. The 135 Both welds along the pup 5 longitudinal seam were manual shielded metal arc welds performed by hand. It would not have been possible to produce those welds with the filler wire used in the Consolidated Western process. Attempting to do so would have resulted in an unstable arc and an unsuccessful weld operation. 95#

PAR-11-01, page 109NTSB Pipeline Accident Report estimated burst pressure of pup 3 (which, according to the NTSB’s burst pressure calculations, had the weakest longitudinal seam as fabricated) was 430–558 psig. Industry consensus standards at the time of installation136 specified hydrostatic testing at 1.25 times the MAOP for class 2 locations (which the accident location was in 1956)—which for a MAOP of 400 psig corresponds to a hydrostatic test pressure of 500 psig. However, those standards were voluntary, not mandatory, and PG&E chose not to follow them, thereby missing an opportunity to discover the defect at the time of commissioning. Further, a visual examination of the pipe would have detected the anomalous welds and defective welds. The unwelded seam defects and manual arc welds ran the entire length of each pup and were detectable by the unaided eye and/or by touch. If, as part of the 1956 relocation project, PG&E personnel had visually examined the inside of the pipe (a requirement of the PG&E specification for the 1948 construction project), the nonconforming and defective seam welds would have been readily detectable. Therefore, either a visual examination of the pipe was never performed, or it was performed but the observations were misinterpreted or ignored. The presence of 0.312-inch wall thickness pipe (the north long joint near the rupture location) was another indicator of inadequate quality control. All of the material procurement orders for Segment 180 listed material codes for bare or wrapped 0.375-inch wall thickness pipe. There were no records indicating 0.312-inch wall thickness pipe was sent to the job site. In sum, quality control for the 1956 relocation project was insufficient to prevent the defective pipe from entering service. The NTSB concludes that the accident pipe would not have met generally accepted industry quality control and welding standards in 1956, indicating that those standards were overlooked or ignored. The NTSB further concludes that PG&E’s inadequate quality control during the 1956 relocation project led to the installation and commissioning of a defective pipe that remained undetected until the accident, 54 years later. 2.3.4 2008 Sewer Pipe Bursting Operation In 2008, pneumatic pipe bursting was used to shatter and expand an existing 6-inch vitrified clay sewer pipe that passed under Line 132. The pipe was replaced with a 10-inch polyethylene sewer pipe. Investigators considered: (1) the possibility that vibratory forces from the pneumatic bursting head could have caused fatigue crack growth along the pup 1 longitudinal seam; and (2) the possibility that constant soil bearing loads or variations in soil bearing loads developed at the sidewall of the exit pit could have caused ductile crack growth or fatigue crack growth along the pup 1 longitudinal seam. Regarding the first scenario, NTSB investigators conducted calculations and reviewed studies137 that quantify the safe operating distances for pipe bursting adjacent to utilities, premised on the assumption that nearby utility pipes are properly constructed and nondefective. Investigators determined that the contractor maintained the recommended minimum safe 136 See ASME B31.1.8, 1955 edition. 137 (a) Simicevic and Sterling, 2001. (b) Atalah, 2004. 96#

PAR-11-01, page 110NTSB Pipeline Accident Report distance between the bursting head and the pipe. A potholing excavation on either side of Line 132 ensured that no soil displacements would be transmitted to Line 132. It also eliminated the need for pneumatic bursting from the west end of the excavation, under Line 132, and into the exit pit to minimize the vibratory forces on Line 132. (See figure 17.) According to the NTSB study, the vibrations from the bursting head would have had less effect on the stress state of the pup 1 longitudinal seam weld than a 6-psi change in internal gas pressure. By comparison, the internal gas pressure in Line 132 fluctuated by as much as 110 psi in the course of normal operations. Regarding the second scenario, it was determined that the sewer replacement contractor used a constant tension winch and steel cable to pull the bursting head toward the exit pit. The winch was braced against sheet piling at the bottom of the exit pit, about 10 feet from where the rupture initiated on pup 1. Calculations indicated that at this distance, the effect of external soil pressure on the stress state of the pup 1 longitudinal seam weld was less than a 2.5-psi increase in internal gas pressure. This pressure increase was too small to cause the ductile crack growth along the pup 1 longitudinal seam weld. Similarly, because of the constant tension design of the winch and the compliance of the cable,138 calculations indicated that the variations in external soil pressure were one-tenth of the static pressure. Because the pressure variations were so low, they could not have caused the fatigue crack growth observed on pup 1. The Corps geotechnical engineers evaluated data, reports, and studies concerning the 2008 pipe bursting operation in the area of the pipeline rupture. Based on the review of key factors, the Corps concurred that the 2008 pipe bursting operation was not a significant external force on the pipeline. In sum, the NTSB concludes that the 2008 sewer line installation did not damage the defective pipe that later ruptured. 2.4 Adequacy of PG&E Emergency Response The NTSB found that PG&E operating procedures hindered the communications between the PG&E SCADA and dispatch centers. In addition, there were problems related to locating the actual leak location. Questions were raised soon after the accident about the time (95 minutes) that elapsed after the rupture before the transmission line was isolated. Under PG&E’s emergency response plan, although the PG&E SCADA center personnel were responsible for pipeline monitoring and operations, the PG&E dispatch center personnel were responsible for sending first responders. Therefore, personnel at these two facilities were required to coordinate with each other to effect PG&E’s overall response to the emergency. 138 Compliance is a measure of how much a cable elongates in response to an applied load. The compliance of the cable is determined by the choice of material and its diameter. 97#

PAR-11-01, page 111NTSB Pipeline Accident Report 2.4.1 Internal Communication and Coordination The SCADA operators’ initial response to the high pressure alarms at 5:25 p.m. was appropriate, and the required analysis took place within the first 10 minutes. After analyzing the alarms, the SCADA operator and the Milpitas technician agreed on a corrective action to reduce the monitor valve pressure set points back to within the MOP, which was initiated within about 20 minutes of the alarms. When high pressure persisted and control could not be restored at the Milpitas Terminal, the SCADA center took further action and reduced the upstream pressure set points for the gas lines coming into the Milpitas Terminal. However, after the rupture, about 6:15 p.m., as the staff was confronted with both the Milpitas Terminal anomalies, as well as the low pressure alarms at the Martin Station coupled with the reports of a fire in San Bruno, it was evident from the communications between the SCADA center staff, the dispatch center, and various other PG&E employees that the roles and responsibilities for dealing with such emergencies were poorly defined. The SCADA operators and coordinators sat near each other in the SCADA center and communicated frequently throughout the evening, exchanging operational information among themselves about the ongoing electrical work at the Milpitas Terminal and its impact on the rest of the system. However, the NTSB notes that the lack of assigned roles and responsibilities resulted in SCADA staff not allocating their time and attention in the most effective manner. They did not initially notice the dropping pressures at the Martin Station after the rupture, but rather were alerted by staff at the Brentwood SCADA facility. Also, there was unnecessary overlap and duplication of their efforts. Several SCADA operators contacted the same SCADA transmission and regulation supervisor (supervisor 6), but seemed unaware that the senior SCADA coordinator had already made contact with the supervisor. Further, the low pressure alarms at Martin Station were initially acknowledged by two SCADA coordinators. SCADA center staff provided many telephone briefings and updates to various PG&E employees and officials, occupying a significant portion of staff time during the first 90 minutes after the rupture. In addition, the SCADA staff received multiple calls from other PG&E employees and officials regarding the opening of various emergency response centers. These incoming and outgoing calls were handled by whichever SCADA staff member was available, without any command structure. It would have been beneficial to have had one SCADA operator designated as the sole point of contact for the workers at the Milpitas Terminal so that others could handle and monitor the remainder of the system. Such staff allocation would have permitted a direct exchange of information aimed at resolving the issue, while permitting other SCADA personnel to continue monitoring the entire system, maintain situational awareness, and communicate with internal and external entities, as needed. The lack of a centralized command structure was also evident in that key information was not disseminated in a reliable manner. Each SCADA staff member was left to form his or her own impression as to the nature and severity of the rupture based on the information they had, resulting in some conflicting and erroneous assessments (which are discussed in more detail in section 2.4.3, “Line Break Recognition”). The lack of a centralized command structure was also 98#

PAR-11-01, page 112NTSB Pipeline Accident Report reflected in the conflicting instructions regarding whether to remotely close valves at the Martin Station. At 7:25 p.m., an on-call supervisor called the SCADA center to ask whether mechanics should manually close the valves or whether the SCADA center could close them remotely. SCADA operator D responded that they would prefer to lose as few customers as possible and would rather have mechanics manually close the line valves. However, at 7:27 p.m., an on-scene SCADA transmission and regulation supervisor (supervisor 6) called the SCADA center and requested that they close the remote valves at Martin Station, which SCADA operator D did. Finally, the supervising engineer for the SCADA controls group seemed slow to get involved, despite the fact that he is responsible for all SCADA and control systems throughout the PG&E gas transmission pipeline system. His first contact with the SCADA center was at 6:51 p.m., requesting information. (By that time, he had already left the office for the day.) At 7:19 p.m., he called again to inform the senior SCADA coordinator that the workers at the Milpitas Terminal had said they did not need his help; he asked the senior SCADA coordinator to call him in a half hour if SCADA was still not working. The senior SCADA coordinator responded by suggesting to the supervising engineer that he go to the Milpitas Terminal to help with restoring SCADA functionality, noting that technicians had already been working on the problem for 2 hours without success, but the supervising engineer said he would wait and asked that the SCADA center call him with updates. He arrived at the Milpitas Terminal about 9:00 p.m. The PG&E dispatch center learned of the explosion at 6:18 p.m. The dispatch center initially dispatched only a single service representative (at 6:23 p.m.) to assess the scene and did not immediately dispatch a qualified crew to shut off valves. At 6:27 p.m., the dispatch center informed SCADA operator C of the fire in San Bruno. At 6:31 p.m., SCADA operator B informed the dispatch center that there was a possibility the fire was being fed by a PG&E gas line. At 6:35 p.m., mechanic 1 informed the dispatch center that there was a PG&E transmission line in the area and that the flame seemed consistent with a transmission line fire. At 6:48 p.m., supervisor 1 called the dispatch center to request “gas crews to cut off distribution.” At 6:54 p.m., the San Bruno Police Department informed the dispatch center that they needed the gas shut off. At 6:55 p.m., SCADA operator B informed the dispatch center that the fire was being fed by Line 132. However, no one had yet been officially dispatched to shut off the valves and isolate the rupture. Further, no one within PG&E was compiling and assessing the information generated from the SCADA system and telephone communications from outside sources or between the SCADA center and dispatch. In summary, PG&E’s response to the Line 132 break lacked a command structure with defined leadership and support responsibilities within the SCADA center. Execution of the PG&E emergency plan resulted in delays that could have been avoided by better utilizing the SCADA center’s capability. The NTSB concludes that PG&E lacked detailed and comprehensive procedures for responding to a large-scale emergency such as a transmission line break, including a defined command structure that clearly assigns a single point of leadership and allocates specific duties to SCADA staff and other involved employees. Therefore, the NTSB recommends that PG&E establish a comprehensive emergency response procedure for responding to large-scale emergencies on transmission lines; the procedure should (1) identify a 99#

PAR-11-01, page 113NTSB Pipeline Accident Report single person to assume command and designate specific duties for SCADA staff and all other potentially involved company employees; (2) include the development and use of trouble-shooting protocols and checklists; and (3) include a requirement for periodic tests and/or drills to demonstrate the procedure can be effectively implemented. 2.4.2 Notifying Emergency Responders The NTSB noted that PG&E did not notify emergency officials that the accident involved the rupture of one of PG&E’s pipelines, even after they had deduced this to be the case. On June 8, 2011, the NTSB made the following recommendations to address these issues. Specifically, the NTSB recommended that PHMSA do the following: Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of sharing system-specific information, including pipe diameter, operating pressure, product transported, and potential impact radius, about their pipeline systems with the emergency response agencies of the communities and jurisdictions in which those pipelines are located. (P-11-1) Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of control room operators immediately and directly notifying the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-2) To PG&E, NTSB recommended the following: Require your control room operators to notify, immediately and directly, the 911 emergency call center(s) for the communities and jurisdictions in which your transmission and/or distribution pipelines are located, when a possible rupture of any pipeline is indicated. (P-11-3) Because of emergency response awareness issues discovered in the Carmichael, Mississippi,139 and San Bruno investigations, the NTSB is concerned that similar problems may exist with other pipeline operators and believes that the guidance recommended in Safety Recommendations P-11-1 and -2 should be codified as requirements. To address these concerns, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-1 is classified 139 See Rupture of Hazardous Liquid Pipeline With Release and Ignition of Propane, Carmichael, Mississippi, November 1, 2007, Pipeline Accident Report NTSB/PAR-09/01 (Washington, DC: National Transportation Safety Board, 2009). 100#

PAR-11-01, page 114NTSB Pipeline Accident Report “Closed—Superseded.” Further, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that their control room operators immediately and directly notify the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-2 is classified “Closed—Superseded.” 2.4.3 Line Break Recognition Although SCADA staff quickly realized that there had been a gas line break in San Bruno, they were slow to recognize the connection between the line break and the overpressure at the Milpitas Terminal, and some staff were initially unsure of whether the break was in a transmission or a distribution line. In a postaccident interview, SCADA operator B stated that within 7 minutes of the rupture, he knew there had been a break in Line 132, and that by 6:30 p.m., he knew it was within a 12-mile corridor in the vicinity of San Bruno. At 6:53 p.m., SCADA operator D indicated that he knew the break was in Line 132, telling the on-scene SCADA transmission and regulation supervisor, “Yeah, absolutely we believe it’s a break on Line 132.” However, at about that time, there was still confusion among other employees as indicated by comments made at 6:51 p.m. by SCADA operator C to a PG&E pipeline engineer, indicating that although the engineer said he thought there was a PG&E transmission line close to the area of the fire, SCADA operator C did not think the break was in a transmission line. At 6:55 p.m., in a telephone discussion between SCADA operator C and the on-scene PG&E gas maintenance and construction superintendent (supervisor 3), both indicated that they believed a distribution line and not a transmission line had been breached. SCADA staff also had difficulties determining the exact location of the rupture. At 6:49 p.m., the SCADA center was still uncertain of the rupture point, as illustrated by the comment of the senior SCADA coordinator to a dispatch employee, “We are going to feed the line break at this pressure but I would take the pressure down if I knew more about what was feeding it… . ” The PG&E SCADA system lacked several tools that could have assisted the staff in recognizing and pinpointing the location of the rupture, such as real-time leak or line break detection models, and closely spaced flow and pressure transmitters. A real-time leak detection application is a computer-based model of the transmission system that runs simultaneously with SCADA and provides greater feedback to SCADA operators when a large scale leak, line break, or system anomaly is present. Such models use actual SCADA pressures and flows to calculate actual and expected hydraulic performance; when the values do not match, an alarm is generated. Appropriate spacing of pressure transmitters at regular intervals140 allows SCADA operators to quickly identify pressure decreases that point toward a leak or line break. 140 SCADA data on Line 132 are currently received from only a few transmitters at randomly spaced intervals. 101#

PAR-11-01, page 115NTSB Pipeline Accident Report The NTSB concludes that PG&E’s SCADA system limitations contributed to the delay in recognizing that there had been a transmission line break and quickly pinpointing its location. Accordingly, the NTSB recommends that PG&E equip its SCADA system with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. The NTSB further recommends that PHMSA require that all operators of natural gas transmission and distribution pipelines equip their SCADA systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. 2.4.4 Rapid Shutdown, ASVs, and RCVs Mechanics 1 and 2 had self-reported to the Colma yard at 6:35 p.m., and they decided to depart the yard at 7:06 p.m. to shut off the valves. Because gas was being supplied to the break from both the north and the south, shutdown and isolation of the rupture required closure of manual shutoff valves closest to the break, which were located about 1.5 miles apart, on either end of the break. The mechanics identified and manually closed those valves at 7:30 p.m. (south valve) and 7:46 p.m. (north valve). Also, about 7:29 p.m., the SCADA center remotely closed valves at the Martin Station in response to a request from a SCADA supervisor (supervisor 6) who had joined the mechanics. The NTSB is concerned that mechanics 1 and 2 were unnecessarily held at the Colma yard and that the response could have been delayed even longer if the two mechanics had waited for official orders from PG&E. Further, the SCADA center staff could have reduced the flow sooner by shutting the remote valves at the Martin Station sooner, but they did not. These delays needlessly prolonged the release of gas and prevented emergency responders from accessing the area. The total heat and radiant energy released by the burning gas was directly proportional to the time gas flowed freely from the ruptured pipeline. Therefore, as vegetation and homes ignited, the fire would have spread and led to a significant increase in property damage. The pressurized flow from the south resulted in an intense flame front similar to a blowtorch, and emergency responders were unable to gain access to the area. If the gas had been shut off earlier, removing fuel flow, the fire would likely have been smaller and resulted in less damage. Also, buildings that would have provided protection to residents in a shorter duration fire were compromised because of the elevated heat. In addition to exposing residents and their property to increased risk, the prolonged fire also negatively affected emergency responders, who were put at increased risk by having to be in close proximity to fire for a longer time and were not available to respond to other potential emergencies while they were waiting for the fire to subside. The NTSB concludes that the 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was excessive. This delay, which contributed to the severity and extent of property damage and increased risk to the residents and emergency responders, in 102#

PAR-11-01, page 116NTSB Pipeline Accident Report combination with the failure of the SCADA center to expedite shutdown of the remote valves at the Martin Station, contributed to the severity of the accident. The NTSB has long been concerned about the lack of standards for rapid shutdown and the lack of requirements for ASVs or RCVs in HCAs. As far back as 1971, the NTSB recommended, in Safety Recommendation P-71-1, the development of standards for rapid shutdown of failed natural gas pipelines. In 1995, the NTSB recommended, in Safety Recommendation P-95-1, that RSPA expedite requirements for installing automatic- or remote-operated mainline valves on high-pressure pipelines in urban and environmentally sensitive areas to provide for rapid shutdown of failed pipeline segments. The NTSB classified Safety Recommendation P-95-1 “Closed—Acceptable Action,” believing that the RSPA 2004 integrity management rulemaking (requiring that each gas transmission operator determine whether installing ASVs or RCVs would be an efficient means of adding protection to an HCA) would lead to a more widespread use of ASVs and RCVs. However, it did not. Federal regulations prescribe, at 49 CFR 192.179, the spacing of valves on a transmission line based on class location. However, other than for pipelines with alternative MAOPs,141 the regulations do not require a response time to isolate a ruptured gas line, nor do they explicitly require the use of ASVs or RCVs. The regulations give the pipeline operator discretion to decide whether ASVs or RCVs are needed in HCAs as long as they consider the factors listed under 49 CFR 192.935(c).142 Therefore, there is little incentive for an operator to perform an objective risk analysis, as illustrated by PG&E’s June 14, 2006, memorandum—which was issued after the CPUC 2005 audit identified PG&E’s failure to consider the issue but does not directly discuss any of the factors listed in section 192.935(c). Rather, it cites industry references to support the conclusion that most of the damage from a pipeline rupture occurs within the first 30 seconds, and that the duration of the resulting fire “has (little or) nothing to do with human safety and property damage.” The memorandum concludes that the use of an ASV or an RCV as a prevention and mitigation measure in an HCA would have “little or no effect on increasing human safety or protecting properties.” In the case of the San Bruno transmission line break, nearby RCVs could have significantly reduced the amount of time the fire burned, and thus the severity of the accident. Had the two isolation valves, located 1.5 miles apart, been outfitted with remote closure capability, prompt closure of those valves would have reduced the amount of fuel burned by the fire and allowed firefighters to enter the affected area sooner. The PG&E manager of gas system operations acknowledged at the NTSB’s investigative hearing that the use of RCVs could have reduced the time it took to isolate the rupture by about 1 hour. 141 Under 49 CFR 192.620, “Alternative Maximum Allowable Operating Pressure for Certain Steel Pipelines,” issued in 2008, an operator is allowed to operate a pipeline at up to 80 percent SMYS in class 2 locations as long as it meets a very specific and stringent set of criteria. Section 192.620(c)(3) states that an RCV or ASV is required for such pipelines if the response time to mainline valves exceeds 1 hour under normal driving conditions and speed limits. 142As noted in section 1.9.2, “Use of Automatic Shutoff Valves and Remote Control Valves,” those factors are (1) the swiftness of leak detection and pipe shutdown capabilities; (2) the type of gas being transported; (3) the operating pressure; (4) the rate of potential release; (5) the pipeline profile; (6) the potential for ignition; and (7) the location of nearest response personnel. 103#

PAR-11-01, page 117NTSB Pipeline Accident Report Damage from the pipeline rupture could have been reduced significantly if the valves on either end of the rupture point had been equipped with ASVs. Analysis of pressure differentials indicated that the San Bruno rupture would have resulted in the closure of an ASV at the downstream location143 and would likely also have resulted in the closure of an ASV at the upstream location.144 Even the closing of a downstream ASV alone would have been beneficial in that it would have immediately alerted SCADA to a more precise location of the break. Concerns about ASVs have focused on the cost of installation and their susceptibility to inadvertently trip based on pressure transients in the system. However, vendors have developed newer models that address these shortcomings by combining the features of traditional ASVs with RCVs. These “smart” valves include sensors that can trend the pressure transients on a line to identify what constitutes normal operation, thereby lessening the chances of an inappropriate shutdown. Also, the newer models can alert a SCADA center when the valve hits a trip point, allowing SCADA operators the option of overriding the valve closure and precluding an undesired shutdown. The NTSB concludes that the use of ASVs or RCVs along the entire length of Line 132 would have significantly reduced the amount of time taken to stop the flow of gas and to isolate the rupture. The NTSB is aware that PG&E is in the process of expanding its use of ASVs and RCVs and has added this capability to some valve locations since the accident. However, the NTSB recommends that PG&E expedite the installation of ASVs and RCVs on transmission lines in HCAs and class 3 and 4 locations, and space them at intervals that consider the factors listed in 49 CFR 192.935(c). The NTSB also recommends that PHMSA amend 49 CFR 192.935(c) to directly require that ASVs or RCVs in HCAs and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. 2.4.5 Deficiencies in Postaccident Drug and Alcohol Testing After the accident, PG&E identified four employees at the Milpitas Terminal for postaccident toxicological testing pursuant to 49 CFR 199.105 and 49 CFR 199.225. As mentioned in section 2.1, “Introduction,” test results were negative for the presence of specified drugs. Testing for drugs was accomplished successfully within the time constraints defined in 49 CFR 199.105; that is, within 32 hours of the accident. However, alcohol testing was not conducted properly in accordance with 49 CFR 199.225, which requires that testing be administered within 8 hours of an accident, and, if it is not, the operator shall cease attempts to do so. Results for the alcohol tests were invalid and therefore, the use of alcohol cannot be excluded. 143 The pressure decay at the Martin Station showed a decrease from 386 to 200 psig in the course of 3 minutes (62 psig per minute), beginning at 6:11 p.m. This drop would have been more than sufficient to trip an ASV located at the downstream valve near the rupture point. 144 The pressure decay in Line 132 was not captured because the transmitter at that location was not installed directly on the main line but on a smaller transmission line (at Half Moon Bay) that branched off from Lines 132 and 109. Although the Half Moon Bay pressure readings cannot be used past 6:11 p.m. to approximate the Line 132 pressures upstream of the rupture, because the differential pressure was great enough to trip an ASV on the smaller line branching off Line 132 at Half Moon Bay, an ASV located on Line 132 likely would have tripped as well. (The smaller line crossed the San Andreas fault and, therefore, was equipped with an ASV to address seismic risk.) 104#

PAR-11-01, page 118NTSB Pipeline Accident Report Alcohol testing of the four Milpitas Terminal employees commenced at 3:10 a.m. and concluded at 5:02 a.m. on September 10, 2010. The accident occurred at about 6:11 p.m. on the previous evening. Therefore, alcohol testing should have been completed by 2:11 a.m. on September 10, at the latest. PG&E officials explained that toxicological testing was delayed because the decision to perform testing was not made until approximately midnight and that the request for testing was made at 12:30 a.m. The NTSB is concerned by PG&E’s delay in contacting the toxicological testing contractor until 12:30 a.m., more than 6 hours after the rupture. Further, upon arrival at the Milpitas Terminal about 2:00 a.m., the contractor should have determined the time of the rupture and attempted to expedite alcohol testing, given that only minutes remained before the regulations prohibited testing. The NTSB is concerned that the alcohol testing was conducted after the prescribed 8 hours following an accident. Further, the NTSB is concerned that PG&E did not perform any drug or alcohol testing of its SCADA staff. The regulations in 49 CFR 199.105 and 49 CFR 199.225 require testing of any employee whose performance cannot be discounted completely as a contributing factor to the accident and that a decision not to administer a test must be based on a determination that the employee’s performance “could not have contributed to the accident.” The SCADA personnel were directly involved in monitoring and controlling the events that unfolded during the accident scenario. Therefore, the SCADA personnel should have been tested. The NTSB concludes that the 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to properly record an explanation for the delay, and the failure to conduct drug or alcohol testing on the SCADA center staff all demonstrate that the PG&E postaccident toxicological program was ineffective. Therefore, the NTSB recommends that PG&E revise its postaccident toxicological testing program to ensure that testing is timely and complete. The NTSB is concerned that the regulations requiring operators to conduct postaccident drug and alcohol testing give operators too much discretion in deciding which employees to test, because it states that the decision not to administer a drug test “…must be based on the best information available immediately after the accident that the employee’s performance could not have contributed to the accident…”, and the decision not to administer an alcohol test “…shall be based on the operator’s determination, using the best available information at the time of the determination, that the covered employee’s performance could not have contributed to the accident.” Therefore, the NTSB recommends that PHMSA amend 49 CFR 199.105 and 49 CFR 199.225 to eliminate operator discretion with regard to testing of covered employees. The revised language should require drug and alcohol testing of each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. The NTSB also recommends that PHMSA issue immediate guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially involved personnel despite uncertainty about the circumstances of the accident. 105#

PAR-11-01, page 119NTSB Pipeline Accident Report 2.5 MAOP 2.5.1 MAOP of Line 132 The construction records provided by PG&E did not document the original MAOP for Line 132. However, in 1970, the specified MAOP for all of Line 132 was 400 psig pursuant to the grandfather clause, which allows pipelines constructed prior to 1970 to operate with a MAOP based on the highest actual operating pressure during the 5 years preceding July 1970. If the presence of the pups in Segment 180 had been considered in determining a design pressure, it would not have substantiated a MAOP of 400 psig. ASME B31.1.8, 1955 edition (paragraph 811.27) and present day 49 CFR 192.107 provide similar guidance for establishing the yield strength of pipe of unknown specification for the purpose of calculating design pressure (for example, a default strength is established by regulation when the type of pipe is unknown). Based on the yield strength test data, the MAOP for a class 3 location would have been 284 psig and the MAOP for a class 2 location (as the location of Segment 180 was in 1956) would have been 341 psig. 2.5.2 Grandfathering of Pre-1970 Pipelines Of broader concern is the exemption of pre-1970 pipelines nationwide from the requirement for a postconstruction hydrostatic pressure test. This exemption was added at the final stage of rulemaking, not having been subject to public comment as part of the original notice of proposed rulemaking (NPRM). It was based on an assertion from the Federal Power Commission that, “there are thousands of miles of jurisdictional interstate pipelines installed prior to 1952 [when the voluntary industry pressure test standards incorporated in section 192.619 were established], in compliance with the then existing codes, which could not continue to operate at their present pressure levels and be in compliance with” the proposed standard in the NPRM calling for the MAOP to be limited to a percentage of the pressure to which it was tested after construction. It is not clear from the preamble to the final rule what rationale, if any, the Federal Power Commission or the DOT pipeline staff relied on to justify exempting pipelines such as Line 132, which were constructed without complying with the voluntary hydrostatic pressure testing standards of then-existing codes. Grandfathering of Line 132 by the CPUC in 1961 and then by RSPA in 1970 resulted in missed opportunities to detect the defective pipe. In 1961, the CPUC began requiring a postconstruction hydrostatic test to 1.5 times MAOP for newly constructed pipelines in class 3 areas. In 1970, RSPA began requiring a postconstruction hydrostatic test to 1.5 times MAOP in class 3 locations. For a MAOP of 400 psig, this corresponds to a hydrostatic test pressure of 600 psig. However, pursuant to the 1970 grandfather clause, Line 132 and other existing gas transmission pipelines with no prior hydrostatic test were permitted to use as their MAOP the highest operating pressure recorded during the previous 5 years (that is, between 1965–1970) and allowed to continue operating with no further testing. Thus, the NTSB concludes that if the grandfathering of older pipelines had not been permitted since 1961 by the 106#

PAR-11-01, page 120NTSB Pipeline Accident Report CPUC and since 1970 by the DOT, Line 132 would have undergone a hydrostatic pressure test that would likely have exposed the defective pipe that led to this accident. Other examples of how the grandfather clause results in reduced safety margins include the following: • Title 49 CFR 192.195, “Protection Against Accidental Overpressuring,” which requires that pressure relieving or limiting devices ensure that pipeline pressure (for pipelines operated at 60 psig or higher) does not exceed MAOP plus 10 percent or the pressure that produces a hoop stress of 75 percent of SMYS, whichever is lower. However, for a pipeline whose MAOP was established in accordance with the grandfather clause, this pressure (MAOP plus 10 percent) may be greater than any pressure it was subjected to in its lifetime. • Title 49 CFR 192.933(d)(1), “Immediate Repair Conditions, ” which allows operators to continue operating a gas pipeline with a known defect unless “a calculation of the remaining strength of the pipe shows a predicted failure pressure less than or equal to 1.1 times the maximum allowable operating pressure.” Again, this pressure (1.1 times the MAOP) may be greater than any pressure a grandfathered pipeline was subjected to in its lifetime. More than half of the nation’s onshore gas transmission pipelines (about 180,000 miles) were installed prior to the effective date of the 1970 requirement for hydrostatic pressure testing. PHMSA does not keep track of how many of these pipelines have had their MAOP established under the grandfather clause. The state of California has already taken action to address grandfathering for pipelines within its jurisdiction. In its June 9, 2011, order requiring PG&E and other gas transmission operators regulated by the CPUC to either hydrostatically pressure test or replace certain transmission pipelines with grandfathered MAOPs, the CPUC stated that natural gas transmission pipelines “must be brought into compliance with modern standards for safety” and “historic exemptions must come to an end.” The NTSB agrees and concludes that there is no safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement for postconstruction hydrostatic pressure testing. Studies (discussed in section 1.13.1.1, “Pressure Testing”) have shown that hydrostatic pressure testing is most effective when it incorporates a spike test in which the pipeline is initially pressurized to a higher level for a short time. Accordingly, the NTSB recommends that PHMSA amend 49 CFR 192.619 to delete the grandfather clause and require that all gas transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that incorporates a spike test. 2.6 Integrity Management Program The elements of an effective integrity management program are accurate, complete, and verifiable data; threat identification and risk assessment; evaluation and correction; and self-assessment of program effectiveness. The NTSB investigation examined each of these elements and found issues of significant concern. 107#

PAR-11-01, page 121NTSB Pipeline Accident Report 2.6.1 PG&E GIS and Pipeline Record-keeping As PHMSA emphasized in its advisory bulletin after PG&E record-keeping deficiencies first came to light, an operator’s awareness of the physical attributes of its pipelines “is a vital component in an operator’s ability to identify and evaluate the risks to its pipeline and identify the appropriate assessment tools, … [and] if this information is unknown, or unknowable, a more conservative approach to operations is dictated.” NTSB investigators examined the PG&E GIS and related records and found that, in many cases, PG&E used assumed values for key pipeline parameters. The records also included many obvious errors in key pipeline parameters, including but not limited to seam type, SMYS, and depth of cover. Many of these missing data and obvious errors could have been identified and been corrected by exposing the pipe. In fact, many of the pipe segments for which records had missing, assumed, or erroneous data had previously been exposed in connection with ECDA excavations as part of the integrity management program. Of 13 segments on Line 132 that were so exposed, two had an assumed wall thickness and four had an unknown depth of cover. Additionally, records of ECDA for one of the segments showing an erroneous 40-foot depth of cover indicated a correct depth of cover (5 feet 4 inches–6 feet 4 inches), yet this correction was not entered into the GIS. All of these ECDA digs predated the records that contained the missing, assumed, or erroneous values. When questioned concerning missing pipeline design-attribute data, PG&E told NTSB investigators— where other information is absent, PG&E utilizes similar conservative assumptions with respect to various data points, including pipe characteristics and construction methodologies, so that its integrity management assessments, relative risk prioritizations, strength and MAOP calculations and the like are founded on conservative values that ensure generous safety margins. However, in the following instances, investigators found that PG&E did not use conservative values for missing and assumed data, and excluded some threats in the risk algorithms145 used for segments in Line 132: • One segment used an assumed value for SMYS of 33,000 psi, and another used an assumed value of 52,000 psi—contrary to 49 CFR 192.107, which requires operators to use a value of 24,000 psi when the SMYS is unknown. • In the third-party threat algorithm, an unknown depth of cover is assigned the same value as ground cover meeting new construction depth requirements. As noted in section 1.9.4.1, “Geographic Information System,” the depth of cover for more than 82 percent of Line 132 is unknown. 145 Risk algorithms are discussed in more detail in the next report section. 108#

PAR-11-01, page 122NTSB Pipeline Accident Report • In several threat algorithms, nonconservative values are used for pipe wall thickness. PG&E uses MOP as a percent of pipe strength, calculated from the pipe diameter, pipe wall thickness, weld joint efficiency, and specified minimum wall thickness. As noted in section 1.9.4.1, “Geographic Information System,” the pipe wall thickness for Line 132 is an assumed value for 41.75 percent of Line 132. • The use of “wedding band” joints146 in place of a girth weld is not considered as an element of any of the threat algorithms, despite the fact that this type of joint is not as strong as a full penetration butt weld. 147 • Prior to the San Bruno accident, PG&E did not consider missing girth weld radiography records as an element of any of the threat algorithms. • Construction damage is not considered as an element of any of the threat algorithms. • Leaks resulting from manufacturing defects are only considered in threat algorithms if they occurred on the segment in question or on an adjacent segment with the same pipe properties and within 1 mile of the leak. Leaks on more distant pipe segments of the same vintage, same characteristics, and same manufacturer are not considered. These restrictions are a concern because PG&E used pipe of the same vintage, same characteristics, and same manufacturer in multiple noncontiguous segments, spanning multiple miles and separate lines. As recognized in ASME B31.8S, 2004 edition, a leak in one of those segments resulting from a manufacturing defect calls into question whether a related risk might exist on similar segments beyond the adjacent segments. As part of its ECDA procedure, PG&E requires the collection of data that could be used for validating assumed values and determining unknown values in the GIS; however, pipeline records must be updated only as part of the preassessment portion of the ECDA process. There is no requirement to update pipeline records with data collected from the excavation and examination portions of the ECDA process. At the NTSB investigative hearing, PG&E officials testified that if discrepancies between GIS data and actual conditions are discovered by field personnel, field engineers are required to report them to the mapping department, which validates the information. However, the documents provided to the NTSB indicate that PG&E does not use the ECDA process for validating assumed values, determining unknown values, or correcting erroneous values. Other inaccuracies noted in the PG&E GIS include the absence of any indication that Segment 180 contained six short pups welded together and the inaccurate identification of the cause of a longitudinal seam leak on Line 132, which was identified on October 27, 1988. Prior to the accident, the GIS only identified that a leak had occurred at MP 30.5 and did not provide any details. When questioned about the leak data, PG&E stated that when it transitioned to its GIS in the late 1990s, only open (that is, unresolved) leak information was transferred. Closed leak information—such as the October 27, 1988, leak, which had been repaired—was not transferred to the GIS. This situation suggests that additional leaks from the time prior to the late 146 A wedding band joint is a short sleeve fillet welded to the outside of two adjacent pipe ends. 147 A butt weld is a welded connection between two pipe ends that penetrates the full thickness of the pipe walls and is designed to be as strong as the pipes it is joining. 109#

PAR-11-01, page 123NTSB Pipeline Accident Report 1990s may not be not reflected in the GIS and thus not be considered as part of the risk assessment for the affected segments, despite PG&E’s stated intent to include leak history in its inventory of pipeline attributes. Another GIS inaccuracy came to light on June 30, 2011, when PG&E reported to the CPUC that 550 miles of its transmission pipelines had incorrect class locations, which indicates that such pipelines could have been operating with inappropriate MAOPs. The foundation of risk assessment is accurate information. The NTSB is concerned that the PG&E GIS still has a large percentage of assumed, unknown, or erroneous information for Line 132 and likely its other transmission pipelines as well. As stated earlier in this section, in many cases, accurate information could have easily been obtained during ECDA digs, but the information was either not obtained or not entered. The lack of complete and accurate pipeline information in the GIS prevented PG&E’s integrity management program from being effective. 2.6.2 Threat Identification and Risk Assessment 2.6.2.1 Weighting of Threats PG&E defines total risk as the product of LOF and COF. (See section 1.9.4.2, “Risk Management Procedures,” of this report.) LOF is defined as a weighted percentage of four threats: external corrosion, third-party damage, ground movement, and design and material. Although the relative weights used by PG&E to assess the four threats are generally consistent with industry averages for the prevalence of incidents caused by those threats, the weights are not consistent with PG&E’s own leak, failure, and incident experience as reflected in the statistics it reports semiannually to PHMSA. Specifically, the external corrosion threat is weighted by PG&E at 25 percent, but it actually accounted for 51 percent of the combined leaks, failures, and incidents from 2004–2010. Design and manufacturing threats are weighted at 10 percent, but they accounted for 24 percent of PG&E’s combined events during that time. Third-party threats are weighted at 45 percent, but they accounted for 24 percent of the combined events from 2004–2010; and the threat of ground movement is weighted at 20 percent, but it accounted for 0 percent of the events during the same time period. Thus, the PG&E integrity management program significantly understated the threats due to external corrosion and design and materials, and overstated the threats due to third-party damage and ground movement. PG&E established these weight factors in 2001, prior to the 2004 issuance of the integrity management rules. PG&E has not updated the relative weights even though data generated by PG&E and reported to PHMSA from 2004–2010 showed the threats to be significantly different. 2.6.2.2 Identification and Assessment of Design/Material and Construction Threats on Line 132 In addition to the defects in Segment 180 discovered during this investigation, several other known design/material and construction defects on Line 132, which were documented in 110#

PAR-11-01, page 124NTSB Pipeline Accident Report PG&E records, were not considered in its integrity management program. These defects include at least four longitudinal seam weld cracks found during radiography of the girth welds as part of the 1948 construction of Line 132 that were allowed to remain in service. Because only 10 percent of the welds were radiographed as part of the 1948 construction, and those radiographs captured only a few inches of each longitudinal seam weld, less than 0.2 percent of the longitudinal seams on pipe segments installed in 1948 were radiographed. In light of the fact that five rejectable defects were found in the small percentage of longitudinal seam welds that were so examined, it is probable that additional longitudinal seam weld defects have remained in service since 1948. Another defect not considered in the integrity management plan was the October 27, 1988, leak on a DSAW longitudinal seam caused by material failure. Additional defects on Line 132 and other PG&E transmission lines are discussed in section 1.7.6, “History of Seam Defects in PG&E Gas Transmission Pipelines.” PG&E did recognize that Segment 180 had some design and materials threats, as evidenced by the fact that it received 55 points in 2009 and 73 points in 2010148 for such threats. However, those threats were considered stable (that is, not anticipated to grow in service) under 49 CFR 192.917(e)(3), and PG&E selected only direct assessment (for the identified corrosion threat) for assessing Line 132. The integrity management rules require operators to assess the integrity of their pipelines using pressure testing, in-line inspection, direct assessment, or other technology that the operator demonstrates can provide an equivalent understanding of pipe condition. Pressure testing and in-line inspection both assess the integrity of the entire pipe section to which they are applied. However, direct assessment methodologies (ECDA, internal corrosion direct assessment, and stress corrosion cracking direct assessment) assess only the integrity of selected pipe areas where the operator suspects a problem. More to the point, direct assessment provides information only about threats that the operator is specifically looking for, while in-line inspection and hydrostatic testing can identify critical threats that the operator might not have been looking for. In this regard, the treatment of these three assessment methods (ECDA, in-line inspection, and hydrostatic pressure testing) as equally acceptable methods is flawed. Because PG&E could not provide engineering design documents for Segment 180, the NTSB could not determine whether PG&E design or construction practices were responsible for the use of the pups in the accident pipe. Because the material codes for the 1956 relocation project listed only X52 DSAW pipe yet many pipe pieces (the pups and the pipe piece with 0.312-inch wall thickness) installed at the job site did not match this code, the material codes on material procurement orders cannot be trusted to accurately reflect the type of pipe used in pipelines constructed prior to mandatory hydrostatic pressure testing. Because the nonconforming pipe may represent a small fraction of a pipeline segment and rupture of a pipeline will occur at its weakest link, validating the construction of an entire pipeline segment 148 As discussed in section 1.9.4.2, pursuant to the PG&E integrity management plan, points are assigned for various risk factors so that higher scores indicate a higher threat. The basis for the point values assigned to Segment 180 is unknown. Pre-1970 pipes are assigned 30 points for pipe seam design and 10 points for pipe age. Pipe segments that have not been pressure tested are assigned 30 points. Thus, segment 180 should have received at least 70 points for these factors alone. 111#

PAR-11-01, page 125NTSB Pipeline Accident Report by selective random sampling alone is insufficient. The only viable methods of validating a pipeline segment are those that examine or sample every length of pipe. The PG&E risk management plan asserts that the methods chosen to assess a particular segment of pipe are based on the threats identified in the risk assessment procedure, and acknowledges that more than one assessment method may be required to adequately cover the potential risks of an HCA. However, of the three available assessment methods (ECDA, in-line inspection, and hydrostatic pressure testing), PG&E used only one method (ECDA)—a method suitable only for assessing external corrosion—to assess all 322 segments on Line 132. Further, PG&E has used direct assessment methodologies on the majority of its other transmission pipelines. Of PG&E’s 1,021 miles of HCA pipeline, 813 miles are designated for direct assessment methodologies and only 208 miles are to be assessed using in-line inspection tools. Prior to the San Bruno accident, none of the PG&E HCA miles were designated for hydrostatic pressure testing. In summary, PG&E’s failure to consider evidence of seam defects discovered during both construction and operation of Line 132, as well as its weighting of factors so as to understate the threat of manufacturing defects, resulted in PG&E selecting an assessment technology (ECDA) that was incapable of detecting seam flaws like the one that led to this accident. 2.6.2.3 Regulatory Assumption of Stable Manufacturing- and Construction-Related Defects In accordance with 49 CFR 192.917 (e)(3), an operator may consider manufacturing- and construction-related defects to be stable defects not requiring assessment so long as operating pressure has not increased over the MOP experienced during the preceding 5 years. When a pipeline with a manufacturing- or construction-related defect is operated above the highest pressure recorded in the preceding 5 years, it must be prioritized as a high risk segment for assessment. According to section 6.3.2 of the integrity management supplement ASME B31.8S, 2004 edition, in that case, “pressure testing must be performed to address the seam issue.” PG&E raised the pressure at the Milpitas Terminal to 400 psig in 2003 and 2008 to set a 5-year MOP for Line 132. The PG&E director of integrity management and technical support acknowledged at the NTSB investigative hearing that this practice allowed PG&E to regard manufacturing threats as stable, thereby continuing to use only ECDA as the assessment method. Thus, this practice allowed PG&E to avoid seam integrity inspections it might otherwise have been required to conduct. However, the PHMSA deputy associate administrator for field operations testified at the investigative hearing that it was not the intent for this rule to be used to avoid an assessment. (PG&E has discontinued this practice since the accident.) Furthermore, studies have discredited the assumption that manufacturing- and construction-related defects are stable in pipelines that have not been hydrostatically pressure tested to an appropriate level. According to a GRI report dated September 17, 2004— 112#

PAR-11-01, page 126NTSB Pipeline Accident Report the risk of pressure-cycle-induced fatigue can be dismissed if and only if the pipeline has been subjected to a reasonably high-pressure hydrostatic test. Therefore, … eliminating the risk of failure from pressure-cycle-induced fatigue crack growth of defects that can survive an initial hydrostatic test of a pipeline requires that the test pressure level must be at least 1.25 times the [MAOP].149 Similarly, a 2007 PHMSA report concluded— experience and scientific analysis indicates that manufacturing defects in gas pipelines that have been subjected to a hydrostatic test to 1.25 times MAOP should be considered stable. No integrity assessment is necessary to address that particular threat in such pipelines. The principal challenge for deciding whether or not to consider manufacturing defects to be stable is associated with those gas pipelines that have never been subjected to a hydrostatic test to a minimum of 1.25 times MAOP.150 In summary, under 49 CFR 192.917(e)(3), operators are entitled to consider known manufacturing- and construction-related defects to be stable, even if a line has not been pressure tested to at least 1.25 times its MAOP. However, such defects may not, in actuality, be stable. The NTSB concludes that the premise in 49 CFR Part 192 of the Federal pipeline safety regulations that manufacturing- and construction-related defects can be considered stable even when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the MAOP is not supported by scientific studies. Therefore, the NTSB recommends that PHMSA amend 49 CFR Part 192 of the Federal pipeline safety regulations so that manufacturing- and construction-related defects can only be considered stable if a gas pipeline has been subjected to a postconstruction hydrostatic pressure test of at least 1.25 times the MAOP. 2.6.3 Self-Assessment of Program Effectiveness The PG&E integrity management program indicates that PG&E will conduct periodic self-assessments and sets forth the measurements to be used in evaluating the long-term effectiveness of the program. These measures, which are reported semiannually to PHMSA, include number of total system miles; number of total miles of pipelines inspected; number of HCA miles in the integrity management program; number of HCA miles inspected via integrity management assessments; number of immediate repairs completed in HCAs as a result of the program; number of scheduled repairs completed in HCAs as a result of the program; and number of leaks, failures, and incidents in HCAs classified by cause. On the surface, these measures are consistent with the requirements of 49 CFR 192.945 and ASME B31.8S, 2004 edition, appendix A. However, as discussed above, PG&E did not make use of this information to revise its threat weights so as to reflect its actual leak, failure, and incident 149 Effects of Pressure Cycles on Gas Pipelines, report GRI-04/0178 (Des Plaines, Illinois: Gas Research Institute, 2004). 150 Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines, No. 05-12R (Washington, DC: Pipeline and Hazardous Materials Safety Administration, 2007). 113#

PAR-11-01, page 127NTSB Pipeline Accident Report experience, even though the data reported to PHMSA from 2004–2010 showed the weight of those threats to be significantly different. Further, after the CPUC May 2010 audit of the PG&E integrity management plan, the CPUC expressed a concern that “PG&E needs to analyze, review, and formulate appropriate actions or responses to the results of its internal audits in a timely manner.” Specifically, the letter pointed out that PG&E had conducted an internal audit in December 2007151 but had not formulated a response until December 2009; the letter further noted that PG&E had conducted another internal audit in October 2009, but as of May 2010 PG&E still had not formulated a response. 2.6.4 Summary of PG&E Integrity Management Practices In summary, the PG&E gas transmission integrity management program (1) was based on a GIS that did not contain, and PG&E did not require it to contain, complete and accurate pipeline information; (2) significantly understated the threats due to external corrosion and design and manufacturing, and overstated the threats due to third-party damage and ground movement; (3) did not consider known longitudinal seam cracks in Line 132 dating to the 1948 construction and at least one longitudinal seam leak in a DSAW weld in its identification and assessment procedures; (4) allowed PG&E to chose an inappropriate assessment method for Line 132 that was inadequate to detect seam defects, such as the weld defect in the accident segment that led to the rupture; (5) considered known manufacturing- and construction-related defects on Line 132 to be stable even though the pipeline had not been pressure tested to at least 1.25 times its MAOP; and (6) included self-assessments that were superficial and resulted in no improvements to the integrity management program. Therefore, the NTSB concludes that the PG&E gas transmission integrity management program was deficient and ineffective. PG&E may already be addressing its GIS data deficiencies as part of its response to the NTSB’s January 3, 2011, safety recommendations, by beginning to verify the underlying records for the more than 1,800 miles of pipeline covered by the recommendations. Nevertheless, the NTSB is concerned that many unaddressed deficiencies still remain. Accordingly, the NTSB recommends that PG&E assess every aspect of its integrity management program, paying particular attention to the areas identified in this investigation, and implement a revised program that includes, at a minimum, (1) a revised risk model to reflect PG&E’s actual recent experience data on leaks, failures, and incidents; (2) consideration of all defect and leak data for the life of each pipeline, including its construction, in risk analysis for similar or related segments to ensure that all applicable threats are adequately addressed; (3) a revised risk analysis methodology to ensure that assessment methods are selected for each pipeline segment that address all applicable integrity threats, with particular emphasis on design/material and construction threats; and (4) an improved self-assessment that adequately measures whether the program is effectively assessing and evaluating the integrity of each 151 PG&E’s integrity management plan also specifies that internal or external audits will be performed every other year to ensure compliance with PG&E and regulatory requirements. Such audits were completed in 2007 and 2009. 114#

PAR-11-01, page 128NTSB Pipeline Accident Report covered pipeline segment. The NTSB further recommends that PG&E conduct threat assessments using the revised risk analysis methodology incorporated in its integrity management program, as recommended in Safety Recommendation P-11-29, and report the results of those assessments to the CPUC and PHMSA. 2.7 Adequacy of PG&E’s Public Awareness Program Evaluation The NTSB also examined how PG&E conducts its public awareness program evaluations. The NTSB reviewed PG&E’s annual self-evaluations for the two review periods before the accident, June 2008–June 2009 and June 2009–June 2010. The NTSB found that the reviews simply documented that all required mailings were issued. Further, the action items in both reviews were nearly identical. The reviews did not further evaluate the public awareness program, such as reviewing the content, quality, or effectiveness of the information delivered. In the program evaluation and effectiveness section of its program plan, PG&E states that the annual review will be conducted using the guidelines of the plan. However, no specific guidelines for annual evaluations are defined. Examples of measurement components might include documenting website traffic on the company’s awareness pages and documenting the numbers of actual attendees in classes and meetings for emergency officials. If the data from these two example measures were gathered and documented, the effectiveness of the program could be tracked through the years. However, the NTSB notes that capturing such numbers is only the first step toward gauging whether attending the classes or ordering the materials PG&E offers translates into understanding, retention, and changed behavior. In addition to its annual self-assessments, PG&E had its contractor Paradigm Alliance, Inc., conduct a separate program documentation review (dated 2010) of its public awareness program for noncustomers along the pipeline right-of-way. As a program effectiveness measure, Paradigm sent out brochures with detachable business reply mail survey postcards to 15,302 addresses. Paradigm received only 20 survey postcards in response. The answers received indicated that the majority of respondents did not recall seeing any recent pipeline safety information, and nearly half had low awareness about pipeline proximity. The lack of responses, the poor comprehension reflected in the responses received, and PG&E’s failure to make changes based on such dismal effectiveness data raise concerns about PG&E’s commitment to the quality of its public awareness program and to continuously improving it. API Recommended Practice 1162 specifies that operators continuously improve their public awareness programs. In 2007, PG&E participated in the API’s PAPERS program. This particular PAPERS surveyed only the affected public that lived along the right-of-way; PG&E’s customers were left out. The survey results showed that the affected public respondent pool had the lowest awareness about pipeline safety, whereas the emergency responder respondents had the highest awareness but also had indicated they needed more information and appropriate training. These 2007 results were still keenly reflective of PG&E’s public awareness program effectiveness on the day of the accident in 2010, showing that residents were unaware and emergency responders were in need of more information. Had PG&E interpreted the 2007 PAPERS effectiveness results and acted upon them 3 years prior, PG&E could have made 115#

PAR-11-01, page 129NTSB Pipeline Accident Report meaningful changes to its program and increased awareness in the San Bruno community. As of the date of this report, no program revisions have been noted as a result of the PAPERS. The NTSB concludes that PG&E’s public awareness program self-evaluation was ineffective at identifying and correcting deficiencies. Therefore, the NTSB recommends that PG&E develop, and incorporate into its public awareness program, written performance measurements and guidelines for evaluating the plan and for continuous program improvement. 2.8 Summary of PG&E Practices As discussed throughout this report, the NTSB accident investigation revealed multiple deficiencies with PG&E’s practices. To summarize, PG&E’s practices were revealed to be inadequate because— • The accident pipe segment did not meet any known pipeline specifications. • Construction and quality control measures for the 1956 relocation project were inadequate in that they did not identify visible defects. • The integrity management program, including self-assessment of that program, was ineffective. • Emergency response to the pipeline rupture was slow, and isolation and shutdown of gas flow were unacceptably delayed. • The postaccident drug and alcohol testing program had multiple deficiencies. • SCADA staff roles and duties were poorly defined. • SCADA work clearance procedures were inadequate. • Critical components at the Milpitas Terminal were susceptible to single-point failures. • The public awareness program, including self-assessment, was deficient and ineffective. Although PG&E has taken some corrective actions since the accident, many of these deficiencies should have been recognized and corrected before the accident. Further, the NTSB notes that several of the deficiencies revealed by this investigation, such as poor quality control during pipeline installation and inadequate emergency response, were also factors in the 2008 explosion of a PG&E gas distribution line in Rancho Cordova, California. That accident involved the inappropriate installation of a pipe piece that was not intended for operational use and did not meet applicable pipe specifications. The response to that event was inadequate in that an unqualified person was initially dispatched to respond to the emergency, and there was an unnecessary delay in dispatching a properly trained and equipped technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in San Francisco,152 which involved inaccurate record-keeping, the dispatch of first responders who 152 NTSB/PAR-82/01. 116#

PAR-11-01, page 130NTSB Pipeline Accident Report were not trained or equipped to close valves, and unacceptable delays in shutting down the pipeline. Accident investigations often uncover a broad range of causal relationships or deficiencies that extend beyond the immediacy of components damaged or broken in a system failure. As indicated by the list above, a multitude of deficient operational procedures and management controls led to hazardous circumstances persisting and growing over time until the pipeline rupture occurred. These higher-order or organizational accident factors must be addressed to improve PG&E’s safety management practices. Organizational accidents have multiple contributing causes, involve people at numerous levels within a company, and are characterized by a pervasive lack of proactive measures to ensure adoption and compliance with a safety culture. Moreover, organizational accidents are catastrophic events with substantial loss of life, property, and environment; they also require complex organizational changes in order to avoid them in the future. In its report on the 2009 collision of two Washington Metropolitan Area Transit Authority trains near Fort Totten Station in Washington, DC,153 the NTSB stated that “the accident did not result from the actions of an individual but from the ‘accumulation of latent conditions within the maintenance, managerial and organizational spheres’ making it an example of a ‘quintessential organizational accident.’”154 The Chicago Transit Authority train derailment in 2006, 155 which caused injuries to 152 people and over $1 million in damages, is another case study in organizational accidents. Similarly, the BP Texas City Refinery organizational accident in 2005156 killed 15 people, injured 180 others, and caused financial losses exceeding $1.5 billion. The character and quality of PG&E’s operation, as revealed by this investigation, indicate that the San Bruno pipeline rupture was an organizational accident. PG&E did not effectively utilize its resources to define, implement, train, and test proactive management controls to ensure the operational and sustainable safety of its pipelines. Moreover, many of the organizational deficiencies were known to PG&E, as a result of the previous pipeline accidents in San Francisco in 1981, 157 and in Rancho Cordova, California, in 2008. 158 As a lesson from those accidents, PG&E should have critically examined all components of its pipeline installation to identify and manage the hazardous risks, as well as to prepare its emergency response procedures. If this recommended approach had been applied within the PG&E organization after the San Francisco 153 Collision of Two Washington Metropolitan Area Transit Authority Metrorail Trains Near Fort Totten Station, Washington D.C., June 22, 2009, Railroad Accident Report NTSB/RAR-10/02 (Washington, DC: National Transportation Safety Board, 2010). 154 (a) J. Reason, Managing the Risks of Organizational Accidents (Burlington, Vermont: Ashgate Publishing Company, 1997). (b) J. Reason, “Achieving a Safe Culture: Theory and Practice,” Work and Stress, vol. 12 (1998), p. 227. 155 Derailment of Chicago Transit Authority Train Number 220 Between Clark/Lake and Grand/Milwaukee Stations, Chicago, Illinois, July 11, 2006, Railroad Accident Report NTSB/RAR-07/02 (Washington, DC: National Transportation Safety Board, 2007). 156 Refinery Explosion and Fire, Investigation Report, report No. 205-04-1-TX (Washington, DC: U.S. Chemical Safety and Hazard Investigation Board, 2007). 157 NTSB/PAR-82/01. 158 NTSB/PAB-10/01. 117#

PAR-11-01, page 131NTSB Pipeline Accident Report and Rancho Cordova accidents, the San Bruno accident might have been prevented. Therefore, based on the circumstances of this accident, the NTSB concludes that the deficiencies identified during this investigation are indicative of an organizational accident. The NTSB also concludes that the multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem. The NTSB recommends that the CPUC, with assistance from PHMSA, conduct a comprehensive audit of all aspects of PG&E operations, including control room operations, emergency planning, record-keeping, performance-based risk and integrity management programs, and public awareness programs. Further, the NTSB recommends that the CPUC require PG&E to correct all deficiencies identified as a result of the San Bruno, California, accident investigation, as well as any additional deficiencies identified through the comprehensive audit recommended in Safety Recommendation P-11-22, and verify that all corrective actions are completed. The NTSB also recommends that PHMSA assist the CPUC in conducting the comprehensive audit recommended in Safety Recommendation P-11-22. The NTSB urges the CPUC and PHMSA to complete this comprehensive audit and require PG&E to take corrective actions as soon as possible, to reap the maximum safety benefit. The NTSB believes that 6 months would be a reasonable time frame for conducting the audit and that an additional 6 months after the completion of the audit would be a reasonable deadline for PG&E to take action in response to audit findings. 2.9 Inspection Technology The detection, identification, and elimination of pipeline defects before they result in catastrophic failures is critical to a successful integrity management program for gas transmission pipelines. In the NTSB’s judgment, the use of specialized in-line inspection tools that identify and evaluate damage caused by corrosion, dents, gouges, and circumferential and longitudinal cracks is a uniquely promising option for identifying defects. Unlike other assessment techniques, in-line inspection is continuous throughout the entire pipeline segment and, when performed periodically, can provide useful information about defect growth. Although in-line inspection technology has detection limitations (generally at best a 90 percent probability that a certain type of known defect will be detected, although the probability of detecting a crack can be improved with multiple runs), it is nonetheless the most effective method for detecting internal pipeline defects. At the time Line 132 was constructed, in-line inspection tools had not been developed. Due to construction limitations such as sharp bends and the presence of plug valves, many older natural gas transmission pipelines, like Line 132, cannot accommodate modern in-line inspection tools without modifications. According to testimony provided during the NTSB investigative hearing, the technical challenges of conducting in-line inspections of older gas transmission pipelines relate not to the sensors, but to the platforms (the tool or pig) that need to move through the pipeline. Gas transmission pipeline operators have also asserted that, because of differences in the flow regimes between natural gas (a compressible fluid) and hazardous liquids (an incompressible fluid), the use of in-line inspection tools in gas transmission pipelines presents additional technical challenges, especially when the operating pressure many not be sufficiently high to push the tool through the pipeline. 118#

PAR-11-01, page 132NTSB Pipeline Accident Report According to testimony from the NTSB investigative hearing, current in-line inspection technology is advanced enough to have detected the defect that caused the rupture of Line 132, but it could not be used without significant modifications to the pipeline. The NTSB concludes that because in-line inspection technology is not available for use in all currently operating gas transmission pipeline systems, operators do not have the benefit of a uniquely effective assessment tool to identify and assess the threat from critical defects in their pipelines. Only in-line inspection can provide visualization of the internal pipe structure. The geometry of Segment 180, like many older pipelines, would not accommodate in-line inspection tools. The NTSB is concerned that in-line inspection is not possible in many of the nation’s pipelines, which—because of the date of their installation—have been subjected to less scrutiny than more recently installed lines. Therefore, the NTSB recommends that PHMSA require that all natural gas transmission pipelines be configured so as to accommodate in-line inspection tools, with priority given to older pipelines. The NTSB also recommends that the AGA and INGAA report to the NTSB on their progress to develop and introduce advanced in-line inspection platforms for use in gas transmission pipelines not currently accessible to existing in-line inspection platforms, including a timeline for implementation of these advanced platforms. 2.10 Oversight 2.10.1 Performance-Based Safety Programs Over the past few years, PHMSA, with the support and assistance of the pipeline industry, has added to its prescriptive regulatory scheme a performance-based regulatory scheme with broad performance goals as the basis for its pipeline safety program, most notably with respect to integrity management programs, and to a lesser extent, to public awareness programs. This new regulatory scheme applies to gas transmission and distribution systems and to hazardous liquid pipeline systems. Under performance-based regulations, the fundamental premise is that an individual pipeline operator knows its system best, and thereby is best able to develop, implement, execute, evaluate, and adjust its integrity management programs to ensure the safe maintenance and operation of its pipelines. Performance-based management systems include activities to ensure that goals are consistently being met in an effective and efficient manner. Performance management can focus on an organization, a department, an employee, or even the processes to build a product or service, among many other areas. Performance measurement involves determining what to measure, identifying data collection methods, and collecting the data. Evaluation involves assessing progress toward the performance goals, usually to explain the causal relationships between program activities and outcomes. Performance measurement and evaluation are components of performance-based management, the systematic application of information generated by performance plans, measurement, and evaluation to strategic planning and budget formulation. 119#

PAR-11-01, page 133NTSB Pipeline Accident Report The PG&E integrity management plan was audited by the CPUC in 2005, with PHMSA’s assistance, and again by the CPUC in 2010 using PHMSA’s inspection protocol. Almost none of the issues identified in this investigation were identified in either of these audits despite the fact that many of them should have been easy to detect. The deficiencies in the PG&E GIS data (described in sections 1.9.4.1 and 2.6.1) should have been readily apparent to CPUC and PHMSA inspectors during integrity management audits. However, the PHMSA integrity management audit protocol does not formally call for a check of the completeness and accuracy of information contained in the operator’s pipeline attribute database. The PHMSA inspection protocol includes only one inspection item (C.02.d), related to the completeness and accuracy of information used in developing integrity management programs. That item requires inspectors to verify that the operator has checked the data for accuracy, and if the operator lacks sufficient data or the data quality is suspect, instructs the inspector to verify that the operator has followed ASME B31.8S. At the NTSB investigative hearing, a CPUC supervisory engineer testified that CPUC auditors did not examine GIS data in detail; however, they did randomly spot check GIS data and verified that when data were unknown, PG&E was using appropriately conservative values. Furthermore, PHMSA regulations do not require an operator to supply missing data or assumed values within any time frame. This allows incomplete or erroneous information to continue in an operator’s records indefinitely, as was the case with the PG&E GIS, which continued to show Segment 180 as seamless X42 pipe until the time of the accident. PHMSA should require operators to correct data deficiencies within a specific time frame. Another deficiency not identified during the audits was the mismatch between PG&E’s threat weighting and its actual leak, failure, and incident experience. The PHMSA integrity management inspection protocol includes inspection item C.03.c for inspectors to verify that the operator uses a feedback mechanism to ensure that its risk model is subject to continuous validation and improvement. However, the PHMSA inspection protocol placed insufficient emphasis on continuous validation and improvement of risk models. Another concern is the fact that the CPUC did not follow up on its 2005 audit finding that PG&E lacked a process to evaluate the use of ASVs and RCVs, as required by 49 CFR 192.935(c). Although PG&E prepared a memorandum, dated June 14, 2006, addressing this issue, the CPUC apparently did not evaluate the adequacy of this response. If it did, it failed to identify the flawed analysis that concluded the use of ASVs would have little effect on increasing safety or protecting property. CPUC and PHMSA officials acknowledged at the NTSB investigative hearing that it is difficult to oversee performance-based regulations, such as the integrity management rules, because there is no “one-size-fits-all” standard against which to measure performance. Overseeing an operator’s compliance with the integrity management rules is very different from overseeing compliance with more clear-cut prescriptive regulations because integrity management requires the auditor to evaluate the adequacy of an operator’s technical justification rather than its compliance with a hard and fast standard. 120#

PAR-11-01, page 134NTSB Pipeline Accident Report The effectiveness of performance-based pipeline safety programs is dependent on the diligence and accountability of both the operator and the regulator—the operator for development and execution of its plan, and the regulator for oversight of the operators. However, as evident in this investigation, the PG&E integrity management and public awareness programs failed to achieve their stated goals because performance measures were neither well defined nor evaluated with respect to meeting performance goals. By overlooking the existence of, and the risk from, manufacturing and fabrication defects under its integrity management program, PG&E took no actions to assess risk and ultimately was unaware of the internal defects that caused the rupture of Line 132. Similarly, the CPUC and PHMSA continue to conduct audits that focus on verification of paper records and plans rather than on gathering information on how performance-based safety systems are implemented, executed, and evaluated, and whether problem areas are being detected and corrected. Critical to this process, for operator and regulator, is the selection of metrics that quantify results against a specified value to provide a rate of occurrence for either a desired or undesired outcome. For example, useful metrics might include the number of incidents from internal defects per mile of operating pipeline or the number of incidents in a specific location per total incidents on a specific pipeline. Such metrics can provide a basis for comparison of the frequency of various types of defects and identify specific problem locations on pipelines. Similar assessments of operator performance can be used by regulators to exercise more effective oversight by focusing on those operators with problems, and to identify the causes of critical safety problems. In summary, PHMSA should develop an oversight model that allows auditors to more accurately measure the success of a performance-based pipeline integrity management program. Specifically, PG&E should develop, and auditors should review, data that provide some quantification of performance improvements or deterioration, such as the number of incidents per pipeline mile or per 1,000 customers; the number of missing, incomplete, or erroneous data fields corrected in an operator’s database; the response time in minutes for leaks, ruptures, or other incidents; and the number of public responses received per thousands of postcards/surveys mailed. Such metrics would allow a comparison of current performance against previous performance. The NTSB concludes that the PHMSA integrity management inspection protocols are inadequate. Therefore, the NTSB recommends that PHMSA revise its integrity management inspection protocol to (1) incorporate a review of meaningful metrics; (2) require auditors to verify that the operator has a procedure in place for ensuring the completeness and accuracy of underlying information; (3) require auditors to review all integrity management performance measures reported to PHMSA and compare the leak, failure, and incident measures to the operator’s risk model; and (4) require setting performance goals for pipeline operators at each audit and follow up on those goals at subsequent audits. 121#

PAR-11-01, page 135NTSB Pipeline Accident Report The NTSB also concludes that because PG&E, as the operator of its pipeline system, and the CPUC, as the pipeline safety regulator within the state of California, have not incorporated the use of effective and meaningful metrics as part of their performance-based pipeline safety management programs, neither PG&E nor the CPUC is able to effectively evaluate or assess the integrity of PG&E’s pipeline system. The NTSB also concludes that, because PHMSA has not incorporated the use of effective and meaningful metrics as part of its guidance for effective performance-based pipeline safety management programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines needs improvement. Therefore, the NTSB recommends that PHMSA (1) develop and implement standards for integrity management and other performance-based safety programs that require operators of all types of pipeline systems to regularly assess the effectiveness of their programs using clear and meaningful metrics, and to identify and then correct deficiencies; and (2) make those metrics available in a centralized database. The NTSB also recommends that PHMSA work with state public utility commissions to (1) implement oversight programs that employ meaningful metrics to assess the effectiveness of their oversight programs and make those metrics available in a centralized database, and (2) identify and then correct deficiencies in those programs. Finally, the NTSB recommends that the U.S. Secretary of Transportation conduct an audit to assess the effectiveness of PHMSA’s oversight of performance-based safety programs. This audit should address the (1) need to expand the program’s use of meaningful metrics; (2) adequacy of its inspection protocols for ensuring the completeness and accuracy of pipeline operators’ integrity management program data; (3) adequacy of its inspection protocols for ensuring the incorporation of an operator’s leak, failure, and incident data in evaluations of the operator’s risk model; and (4) benefits of establishing performance goals for pipeline operators. 2.10.2 Authority and Enforcement The CPUC, as the regulator for pipeline safety within California, failed to uncover the pervasive and long-standing problems within PG&E. Consequently, this failure precluded the CPUC from taking any enforcement action against PG&E. The CPUC lost opportunities to identify needed corrective action and to follow through and ensure that PG&E completed the prescribed corrective actions in a timely manner. For its part, PHMSA rated the CPUC’s pipeline safety program in the mid- to high-90s in the years leading up to the San Bruno accident—a superior, if not outstanding, score. Furthermore, PHMSA’s participation in the 2005 joint audit with the CPUC of PG&E apparently did not make any difference in uncovering PG&E’s systemic problems or in accurately assessing the quality of oversight exercised by the CPUC. The quality of oversight exercised by any regulatory agency depends upon the quality of the regulations in force, the authority granted to the regulator, and the enforcement program implemented by the regulator. Despite deficiencies with specific regulatory requirements and integrity management programs as discussed previously, the CPUC’s failure to recognize PG&E’s corporate failures and PHMSA’s failure to recognize the CPUC’s ineffectiveness indicate that more fundamental problems exist, particularly with enforcement practices and policies. 122#

PAR-11-01, page 136NTSB Pipeline Accident Report The NTSB believes that Federal regulations for all types of pipeline systems provide sufficient authority to PHMSA to enforce the regulations and to take appropriate actions to address noncompliance by a pipeline operator. PHMSA can require an operator to take numerous corrective actions, such as reducing operating pressure, conducting inspections and tests, and, if necessary, suspending operation of a pipeline. PHMSA also can initiate enforcement actions leading to monetary civil penalties against an operator for safety violations. Most states either adopt or pattern state pipeline safety regulations after the Federal regulations. Because state pipeline regulatory agencies receiving Federal grants through PHMSA are monitored for alignment with PHMSA standards, most state regulators should be expected to have comparable enforcement authority. However, a state regulator’s authority will be affected by the organizational placement of the regulatory agency within the state government. In the case of the CPUC, pipeline safety is one of several utility programs under the CPUC’s jurisdiction. Further, the CPUC sets utility rates, which could potentially conflict with the enforcement of safety programs. Because of the lapses of oversight seen in this accident, the NTSB is concerned and has strong doubts about the quality and effectiveness of enforcement at both the Federal and state levels. Although the CPUC and PHMSA have authority to enforce pipeline safety regulations, the organizational failures of PG&E seen in this accident suggest that some operators are able to ignore certain standards without concern for meaningful enforcement action against them. Therefore, the NTSB concludes that the ineffective enforcement posture of the CPUC permitted PG&E’s organizational failures to continue over many years. The NTSB recommends that the governor of the state of California expeditiously evaluate the authority and ability of the pipeline safety division within the CPUC to effectively enforce state pipeline safety regulations, and, based on the results of this evaluation, grant the pipeline safety division within the CPUC the direct authority, including the assessment of fines and penalties, to correct noncompliance by state-regulated pipeline operators. The NTSB also concludes that PHMSA’s enforcement program and its monitoring of state oversight programs have been weak and have resulted in the lack of effective Federal oversight and state oversight exercised by the CPUC. The NTSB recommends that the U.S. Secretary of Transportation include in the audit conducted pursuant to Safety Recommendation P-11-4 a review of PHMSA’s enforcement policies and procedures, including, specifically, the standard of review for compliance with performance-based regulations. The NTSB also recommends that the U.S. Secretary of Transportation conduct an audit of PHMSA’s state pipeline safety program certification program to assess and ensure state pipeline safety programs and Federal pipeline safety grants are used effectively to conduct oversight of intrastate pipeline operations, including an evaluation of state inspection and enforcement activities. The NTSB further recommends that the U.S. Secretary of Transportation ensure that PHMSA amends the certification program, as appropriate, to comply with the findings of the audit recommended in Safety Recommendation P-11-6. 123#

PAR-11-01, page 137NTSB Pipeline Accident Report 3. Conclusions 3.1 Findings 1. The following were not factors in this accident: seismic activity, corrosion, direct third-party damage, or drug use by the workers at the Milpitas Terminal. 2. The accident pipe comprising the pups did not conform to Pacific Gas and Electric Company (PG&E) or other known specifications for pipe and was fabricated at an undetermined facility to no known specification. 3. The accident pipe would not have met generally accepted industry quality control and welding standards in 1956, indicating that those standards were overlooked or ignored. 4. PG&E’s inadequate quality control during the 1956 relocation project led to the installation and commissioning of a defective pipe that remained undetected until the accident, 54 years later. 5. The fracture of Line 132 Segment 180 originated in the partially welded longitudinal seam of pup 1, which was progressively weakened due to ductile crack growth and fatigue crack growth. 6. The combination of the size and shape of the weld defect significantly reduced the strength of the pup 1 longitudinal seam, making it susceptible to unstable crack growth under internal gas pressure. 7. The 2008 sewer line installation did not damage the defective pipe that later ruptured. 8. The internal line pressure preceding the rupture did not exceed the PG&E maximum allowable operating pressure for Line 132 and would not have posed a safety hazard for a properly constructed pipe. 9. Had a properly prepared contingency plan for the Milpitas Terminal electrical work been in place and been executed, the loss of pressure control could have been anticipated and planned for, thereby minimizing or avoiding the pressure deviations. 10. PG&E lacked detailed and comprehensive procedures for responding to a large-scale emergency such as a transmission line break, including a defined command structure that clearly assigns a single point of leadership and allocates specific duties to supervisory control and data acquisition staff and other involved employees. 11. PG&E’s supervisory control and data acquisition system limitations contributed to the delay in recognizing that there had been a transmission line break and quickly pinpointing its location. 12. The 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was excessive. 124#

PAR-11-01, page 138NTSB Pipeline Accident Report 13. Use of automatic shutoff valves or remote control valves along the entire length of Line 132 would have significantly reduced the amount of time taken to stop the flow of gas and to isolate the rupture. 14. Considering the challenges of the prolonged fire fueled by natural gas, the emergency response was well coordinated and effectively managed by local responders. 15. The 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to properly record an explanation for the delay, and the failure to conduct drug or alcohol testing on the supervisory control and data acquisition center staff all demonstrate that the PG&E postaccident toxicological program was ineffective. 16. If the grandfathering of older pipelines had not been permitted since 1961 by the California Public Utilities Commission and since 1970 by the U.S. Department of Transportation, Line 132 would have undergone a hydrostatic pressure test that would likely have exposed the defective pipe that led to this accident. 17. There is no safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement for postconstruction hydrostatic pressure testing. 18. The premise in Title 49 Code of Federal Regulations Part 192 of the Federal pipeline safety regulations that manufacturing- and construction-related defects can be considered stable even when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the maximum allowable operating pressure is not supported by scientific studies. 19. The PG&E gas transmission integrity management program was deficient and ineffective. 20. PG&E’s public awareness program self-evaluation was ineffective at identifying and correcting deficiencies. 21. The deficiencies identified during this investigation are indicative of an organizational accident. 22. The multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem. 23. Because in-line inspection technology is not available for use in all currently operating gas transmission pipeline systems, operators do not have the benefit of a uniquely effective assessment tool to identify and assess the threat from critical defects in their pipelines. 24. The Pipeline and Hazardous Materials Safety Administration integrity management inspection protocols are inadequate. 125#

PAR-11-01, page 139NTSB Pipeline Accident Report 25. Because PG&E, as the operator of its pipeline system, and the California Public Utilities Commission, as the pipeline safety regulator within the state of California, have not incorporated the use of effective and meaningful metrics as part of their performance-based pipeline safety management programs, neither PG&E nor the California Public Utilities Commission is able to effectively evaluate or assess the integrity of PG&E’s pipeline system. 26. Because the Pipeline and Hazardous Materials Safety Administration has not incorporated the use of effective and meaningful metrics as part of its guidance for effective performance-based pipeline safety management programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines needs improvement. 27. The ineffective enforcement posture of the California Public Utilities Commission permitted PG&E’s organizational failures to continue over many years. 28. The Pipeline and Hazardous Materials Safety Administration’s enforcement program and its monitoring of state oversight programs have been weak and have resulted in lack of effective Federal oversight and state oversight exercised by the California Public Utilities Commission. 126#

PAR-11-01, page 140NTSB Pipeline Accident Report 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the Pacific Gas and Electric Company’s (PG&E) (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. 127#

PAR-11-01, page 141NTSB Pipeline Accident Report 4. Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations: 4.1 New Recommendations To the U.S. Secretary of Transportation: Conduct an audit to assess the effectiveness of the Pipeline and Hazardous Materials Safety Administration’s oversight of performance-based safety programs. This audit should address the (1) need to expand the program’s use of meaningful metrics; (2) adequacy of its inspection protocols for ensuring the completeness and accuracy of pipeline operators’ integrity management program data; (3) adequacy of its inspection protocols for ensuring the incorporation of an operator’s leak, failure, and incident data in evaluations of the operator’s risk model; and (4) benefits of establishing performance goals for pipeline operators. (P-11-4) Include in the audit conducted pursuant to Safety Recommendation P-11-4 a review of the Pipeline and Hazardous Materials Safety Administration’s enforcement policies and procedures, including, specifically, the standard of review for compliance with performance-based regulations. (P-11-5) Conduct an audit of the Pipeline and Hazardous Materials Safety Administration’s state pipeline safety program certification program to assess and ensure state pipeline safety programs and Federal pipeline safety grants are used effectively to conduct oversight of intrastate pipeline operations, including an evaluation of state inspection and enforcement activities. (P-11-6) Ensure that the Pipeline and Hazardous Materials Safety Administration amends the certification program, as appropriate, to comply with the findings of the audit recommended in Safety Recommendation P-11-6. (P-11-7) To the Pipeline and Hazardous Materials Safety Administration: Require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. (P-11-8) This recommendation supersedes Safety Recommendation P-11-1. Require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that their control room operators immediately 128#

PAR-11-01, page 142NTSB Pipeline Accident Report and directly notify the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-9) This recommendation supersedes Safety Recommendation P-11-2. Require that all operators of natural gas transmission and distribution pipelines equip their supervisory control and data acquisition systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. (P-11-10) Amend Title 49 Code of Federal Regulations 192.935(c) to directly require that automatic shutoff valves or remote control valves in high consequence areas and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. (P-11-11) Amend Title 49 Code of Federal Regulations 199.105 and 49 Code of Federal Regulations 199.225 to eliminate operator discretion with regard to testing of covered employees. The revised language should require drug and alcohol testing of each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. (P-11-12) Issue immediate guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially involved personnel despite uncertainty about the circumstances of the accident. (P-11-13) Amend Title 49 Code of Federal Regulations 192.619 to delete the grandfather clause and require that all gas transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that incorporates a spike test. (P-11-14) Amend Title 49 Code of Federal Regulations Part 192 of the Federal pipeline safety regulations so that manufacturing- and construction-related defects can only be considered stable if a gas pipeline has been subjected to a postconstruction hydrostatic pressure test of at least 1.25 times the maximum allowable operating pressure. (P-11-15) Assist the California Public Utilities Commission in conducting the comprehensive audit recommended in Safety Recommendation P-11-22. (P-11-16) Require that all natural gas transmission pipelines be configured so as to accommodate in-line inspection tools, with priority given to older pipelines. (P-11-17) Revise your integrity management inspection protocol to (1) incorporate a review of meaningful metrics; (2) require auditors to verify that the operator has a procedure in place for ensuring the completeness and accuracy of underlying information; (3) require auditors to review all integrity management performance 129#

PAR-11-01, page 143NTSB Pipeline Accident Report measures reported to the Pipeline and Hazardous Materials Safety Administration and compare the leak, failure, and incident measures to the operator’s risk model; and (4) require setting performance goals for pipeline operators at each audit and follow up on those goals at subsequent audits. (P-11-18) (1) Develop and implement standards for integrity management and other performance-based safety programs that require operators of all types of pipeline systems to regularly assess the effectiveness of their programs using clear and meaningful metrics, and to identify and then correct deficiencies; and (2) make those metrics available in a centralized database. (P-11-19) Work with state public utility commissions to (1) implement oversight programs that employ meaningful metrics to assess the effectiveness of their oversight programs and make those metrics available in a centralized database, and (2) identify and then correct deficiencies in those programs. (P-11-20) To the Governor of the State of California: Expeditiously evaluate the authority and ability of the pipeline safety division within the California Public Utilities Commission to effectively enforce state pipeline safety regulations, and, based on the results of this evaluation, grant the pipeline safety division within the California Public Utilities Commission the direct authority, including the assessment of fines and penalties, to correct noncompliance by state regulated pipeline operators. (P-11-21) To the California Public Utilities Commission: With assistance from the Pipeline and Hazardous Materials Safety Administration, conduct a comprehensive audit of all aspects of Pacific Gas and Electric Company operations, including control room operations, emergency planning, record-keeping, performance-based risk and integrity management programs, and public awareness programs. (P-11-22) Require the Pacific Gas and Electric Company to correct all deficiencies identified as a result of the San Bruno, California, accident investigation, as well as any additional deficiencies identified through the comprehensive audit recommended in Safety Recommendation P-11-22, and verify that all corrective actions are completed. (P-11-23) To the Pacific Gas and Electric Company: Revise your work clearance procedures to include requirements for identifying the likelihood and consequence of failure associated with the planned work and for developing contingency plans. (P-11-24) Establish a comprehensive emergency response procedure for responding to large-scale emergencies on transmission lines; the procedure should (1) identify a single person to assume command and designate specific duties for supervisory 130#

PAR-11-01, page 144NTSB Pipeline Accident Report control and data acquisition staff and all other potentially involved company employees; (2) include the development and use of trouble-shooting protocols and checklists; and (3) include a requirement for periodic tests and/or drills to demonstrate the procedure can be effectively implemented. (P-11-25) Equip your supervisory control and data acquisition system with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. (P-11-26) Expedite the installation of automatic shutoff valves and remote control valves on transmission lines in high consequence areas and in class 3 and 4 locations, and space them at intervals that consider the factors listed in Title 49 Code of Federal Regulations 192.935(c). (P-11-27) Revise your postaccident toxicological testing program to ensure that testing is timely and complete. (P-11-28) Assess every aspect of your integrity management program, paying particular attention to the areas identified in this investigation, and implement a revised program that includes, at a minimum, (1) a revised risk model to reflect the Pacific Gas and Electric Company’s actual recent experience data on leaks, failures, and incidents; (2) consideration of all defect and leak data for the life of each pipeline, including its construction, in risk analysis for similar or related segments to ensure that all applicable threats are adequately addressed; (3) a revised risk analysis methodology to ensure that assessment methods are selected for each pipeline segment that address all applicable integrity threats, with particular emphasis on design/material and construction threats; and (4) an improved self-assessment that adequately measures whether the program is effectively assessing and evaluating the integrity of each covered pipeline segment. (P-11-29) Conduct threat assessments using the revised risk analysis methodology incorporated in your integrity management program, as recommended in Safety Recommendation P-11-29, and report the results of those assessments to the California Public Utilities Commission and the Pipeline and Hazardous Materials Safety Administration. (P-11-30) Develop, and incorporate into your public awareness program, written performance measurements and guidelines for evaluating the plan and for continuous program improvement. (P-11-31) To the American Gas Association and the Interstate Natural Gas Association of America: Report to the National Transportation Safety Board on your progress to develop and introduce advanced in-line inspection platforms for use in gas transmission 131#

PAR-11-01, page 145NTSB Pipeline Accident Report pipelines not currently accessible to existing in-line inspection platforms, including a timeline for implementation of these advanced platforms. (P-11-32) 4.2 Previously Issued Recommendations As a result of this accident investigation, the National Transportation Safety Board previously issued the following safety recommendations: To the Pipeline and Hazardous Materials Safety Administration: Through appropriate and expeditious means such as advisory bulletins and posting on your website, immediately inform the pipeline industry of the circumstances leading up to and the consequences of the September 9, 2010, pipeline rupture in San Bruno, California, and the National Transportation Safety Board’s urgent safety recommendations to Pacific Gas and Electric Company so that pipeline operators can proactively implement corrective measures as appropriate for their pipeline systems. (P-10-1) (Urgent) Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of sharing system-specific information, including pipe diameter, operating pressure, product transported, and potential impact radius, about their pipeline systems with the emergency response agencies of the communities and jurisdictions in which those pipelines are located. (P-11-1) Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of control room operators immediately and directly notifying the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-2) To the California Public Utilities Commission: Develop an implementation schedule for the requirements of Safety Recommendation P-10-2 (Urgent) to Pacific Gas and Electric Company (PG&E) and ensure, through adequate oversight, that PG&E has aggressively and diligently searched documents and records relating to pipeline system components, such as pipe segments, valves, fittings, and weld seams, for PG&E natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior hydrostatic testing as outlined in Safety Recommendation P-10-2 (Urgent) to PG&E. These records should be traceable, verifiable, and complete; should meet your regulatory intent and requirements; and should have been considered in determining maximum allowable operating pressures for PG&E pipelines. (P-10-5) (Urgent) 132#

PAR-11-01, page 146NTSB Pipeline Accident Report If such a document and records search cannot be satisfactorily completed, provide oversight to any spike and hydrostatic tests that Pacific Gas and Electric Company is required to perform according to Safety Recommendation P-10-4. (P-10-6) (Urgent) Through appropriate and expeditious means, including posting on your website, immediately inform California intrastate natural gas transmission operators of the circumstances leading up to and the consequences of the September 9, 2010, pipeline rupture in San Bruno, California, and the National Transportation Safety Board’s urgent safety recommendations to Pacific Gas and Electric Company so that pipeline operators can proactively implement corrective measures as appropriate for their pipeline systems. (P-10-7) (Urgent) To the Pacific Gas and Electric Company: Aggressively and diligently search for all as-built drawings, alignment sheets, and specifications, and all design, construction, inspection, testing, maintenance, and other related records, including those records in locations controlled by personnel or firms other than Pacific Gas and Electric Company, relating to pipeline system components, such as pipe segments, valves, fittings, and weld seams for Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4159 locations and class 1 and class 2160 high consequence areas161 that have not had a maximum allowable operating pressure established through prior hydrostatic testing. These records should be traceable, verifiable, and complete. (P-10-2) (Urgent) Use the traceable, verifiable, and complete records located by implementation of Safety Recommendation P-10-2 (Urgent) to determine the valid maximum allowable operating pressure, based on the weakest section of the pipeline or component to ensure safe operation, of Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior hydrostatic testing. (P-10-3) (Urgent) If you are unable to comply with Safety Recommendations P-10-2 (Urgent) and P-10-3 (Urgent) to accurately determine the maximum allowable operating pressure of Pacific Gas and Electric Company natural gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high consequence areas that have not had a maximum allowable operating pressure established through prior 159 Class 3 refers to any location unit that has 46 or more buildings intended for human occupancy. Class 4 refers to any class location unit where buildings with four or more stories above ground are prevalent. 160 Class 1 refers to an offshore area or any class location unit that has 10 or fewer buildings intended for human occupancy. A class 2 location is any class location unit that has more than 10 but fewer than 46 buildings intended for human occupancy. 161 A high consequence area is any class 3 or 4 location or any area where a potential impact radius of 660 feet would contain more than 20 buildings intended for human occupancy. 133#

PAR-11-01, page 147NTSB Pipeline Accident Report hydrostatic testing, determine the maximum allowable operating pressure with a spike test followed by a hydrostatic pressure test. (P-10-4) Require your control room operators to notify, immediately and directly, the 911 emergency call center(s) for the communities and jurisdictions in which your transmission and/or distribution pipelines are located, when a possible rupture of any pipeline is indicated. (P-11-3) 4.3 Previously Issued Recommendations Classified in This Report Safety Recommendations P-11-1 and P-11-2 to the Pipeline and Hazardous Materials Safety Administration are classified “Closed—Superseded” by Safety Recommendations P-11-8 and P-11-9, respectively, in this report (section 2.4.2, “Notifying Emergency Responders”). BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN Chairman Member ROBERT L. SUMWALT CHRISTOPHER A. HART Vice Chairman Member MARK R. ROSEKIND EARL F. WEENER Member Adopted: August 30, 2011 Chairman Hersman filed the following concurring statement on September 12, 2011, and was joined by Members Sumwalt and Rosekind. Vice Chairman Hart filed the following concurring and dissenting statement on September 12, 2011, and was joined by Member Weener. 134#

PAR-11-01, page 148NTSB Pipeline Accident Report Chairman Hersman, concurring: On August 30, 2011, by a vote of 5-0, the members of the National Transportation Safety Board adopted the final report on the most devastating pipeline accident in a decade, an accident which left the community of San Bruno, CA, asking, “Who is responsible for our safety?” The NTSB investigation revealed that for years, PG&E exploited weaknesses in a lax system of oversight. We also identified regulators that placed a blind trust in the companies that they were charged with overseeing – to the detriment of public safety. In the pipeline industry, there must be effective oversight and strong enforcement. With integrity management plans, oversight has shifted away from prescriptive regulations to performance standards. Yet, this approach, where companies effectively say, “These are our standards and we are meeting them,” is only as good as the companies’ commitment and their integrity. In too many instances, the regulators in this case didn’t really know what was going on or require the operator to live up to their commitments. For example, our investigators identified poor record-keeping, flawed assumptions in PG&E’s integrity management programs, a failure to increase safety on an aging pipe in a high-consequence area with remote control valves or in-line inspections, and inadequate drug and alcohol testing protocols. PHMSA testified at our March 2011 hearing that performance based regulations are very difficult for operators to implement and for regulators to oversee. Ronald Regan famously said, “Trust but verify.” For government to do its job – safeguard the public – it cannot trust alone. It must verify through effective oversight. That is why we have asked DOT to assess the effectiveness of the PHMSA’s oversight program and, in turn, the effectiveness of state programs funded with federal dollars. In essence, verify. And, where trust is not merited, they need to ensure that the penalty is high. It is critical for the pipeline industry to learn from this accident and take action in response to our recommendations. Because, when there’s an accident like San Bruno, it is too late. 135#

PAR-11-01, page 149NTSB Pipeline Accident Report Vice Chairman Hart, concurring and dissenting: This report is thorough and well done, and I concur with the findings, the probable cause, and all but one of the recommendations. Concurrence, In Part: This mishap involves two issues that will need more attention by the NTSB in the future, namely, (a) how industries will respond to the fact that safety regulator resources are not generally increasing as fast as the industry, and (b) what role the economic regulator will play in safety in industries that have both a safety regulator and an economic regulator. Regulator Resources. In many industries, safety regulator resources are not growing as rapidly as the industry they regulate. With respect to the number of safety inspectors, for example, the number of inspectors per regulated entity has been decreasing in many industries; and the response has generally been to expand the inspectors’ reach by transitioning them away from direct inspection of the end product and transitioning them toward inspection of the processes that create the end product. An example of that transition in relation to this mishap is the integrity management process. Given the difficulty of keeping the ratio of safety inspectors to inspected entities from declining further in many industries, the shift to process inspection is essential. The transition, however, is not a trivial one. For example, the inspector skill sets that are needed for direct inspection are somewhat different than the skill sets that are needed for process inspection. Moreover, no amount of process inspection will ensure that the process will work every time; the best that can generally be said about most processes, even if well designed and implemented, is that they usually work. Given that there will be times when a process does not work exactly as expected, more often than not when a safety inspector is not present because the frequency of inspector visits is declining, then the obligation falls upon the operator to do the right thing when the process doesn’t quite work and when no inspector is nearby to know that. This increased reliance upon the operator to do the right thing when no inspector is there to know otherwise is a very important aspect of the shift from direct inspection to process inspection, and this mishap, as well as several others the NTSB has investigated, illustrates that regulated industries need to come up with a better way to make that transition. In this instance, the situation is further complicated by the fact that there are two levels of safety regulation, federal and state, and in order for the transition from end result inspection to process inspection to be successful, the federal and state regulators will need to work in close coordination. Several of the recommendations in this report relate to the need for the federal and state safety regulators to work better together. A more difficult challenge is how to keep safety issues from “falling through the cracks” when increasing reliance must be placed upon the operator to do the right thing. Most regulated 136#

PAR-11-01, page 150NTSB Pipeline Accident Report industries are still on the learning curve on this issue, and it is an issue on which the NTSB will need to maintain close scrutiny in the future. Economic Regulator. Most of the industries in which the NTSB investigates mishaps do not have an economic regulator. In this instance, however, the intrastate natural gas pipeline operator had both a safety regulator and an economic regulator. If a safety improvement requires an expenditure by an operator in an industry with no economic regulator, the decision is largely up to the operator. If the industry has an economic regulator, however, the economic regulator plays an important role in the operator’s expenditure decisions. Hence, if an expenditure is necessitated because the industry’s safety regulator requires the operator to do something, or because the NTSB recommends a safety improvement, query what result if the economic regulator does not agree to some or all of the expenditure. This situation was mentioned in our Sunshine Meeting, but it was not addressed in the report. If the operator decides to implement any of our recommendations that necessitate expenditures, the NTSB will need to pay close attention to how this situation plays out. For example, we will need to pay attention to the extent, if any, to which safety improvements are encouraged or discouraged by the economic regulator; and we will need to look at this issue in situations in which the economic regulator and the safety regulator are in the same agency, as they are in this instance, as well as situations in which they are in different agencies. Query what effect, if any, that organizational difference may have upon the willingness of the economic regulator to approve the resources needed for safety improvements. While safety is and should be the NTSB’s only concern, both to satisfy our legislative mandate and to maximize the potential effectiveness of our recommendations, our analysis and recommendations in relation to regulated public utilities, such as intrastate natural gas pipeline companies, must be responsive to the reality that the resource allocation process involves more than just the operator. Dissent, In Part: Our report recommends that the American Gas Association and the Interstate Natural Gas Association of America give us a progress report about their development and introduction of advanced inline inspection platforms for use in gas transmission pipelines. Although the need for better inline inspection methods for gas transmission lines was abundantly highlighted by this mishap, I am opposed to this recommendation because it only asks for a report, which does not improve transportation safety; and it could adversely affect the NTSB’s relationships with the transportation community. I have these concerns for several reasons. First, the NTSB was created to determine the probable cause of mishaps and to make recommendations to recipients who can take actions that could help prevent those mishaps from occurring again. A recommendation to provide us a report is not the type of recommendation for which the NTSB was created because a recommendation to give 137#

PAR-11-01, page 151NTSB Pipeline Accident Report us a report does not ask a recipient to take any actions that would help prevent a mishap from occurring again or that would otherwise improve safety. Second, a recommendation to give us a report is satisfied by the report, irrespective of whether we like or agree with its content. Thus, a report that says, “We are not doing anything, and we do not intend to do anything, about that problem,” satisfies our recommendation to the same extent as a report that says, “We are aware of that problem, and we are taking steps to address it.” This undercuts the value of our recommendations because if we receive a report, we will have to classify the recommendation as “Closed Acceptable,” irrespective of what the report says, and despite the fact that a report does nothing to improve safety. Our pride in the fact that more than 80% of our recommendations have been favorably responded to is meaningful only to the extent that our recommendations seek actions that can improve safety. Third, the recommendation is being sent to two trade associations that have no legal duty or obligation to do what we are asking them to report about. To their credit, the trade associations are trying to address important issues, but they probably could not be held legally liable if they chose not to address them. Thus, rather than sending them a recommendation, we should be giving them kudos for going above and beyond by doing what they have no legal duty or obligation to do to improve transportation safety. Fourth, our mission is to improve transportation safety, and one of the very important ways we pursue that mission is by encouraging the transportation community to take actions that could improve safety even without being required to do so, and even without a recommendation from us. Hence, we should be very pleased that these trade associations took the initiative to pursue these important measures because it was the right thing to do, rather than because they were forced or required to do so – and also that they took the initiative to report it to us – and we should actively encourage such behaviors. Normally we send a recommendation because we are concerned that the recipient may not take the recommended actions without it, and the public has come to understand this as the reason we send recommendations. Thus, this recommendation sends the very inaccurate and misleading message to the public that these trade associations have been unwilling to pursue the very important measures about which we are asking them to report. Quite the contrary, the trade associations are already pursuing the measures, and they have already reported that to us, all on their own initiative. Expressing our appreciation for their proactive efforts by sending them a recommendation to report about what they have already started doing and have already been reporting to us is not, in my view, a way to encourage the transportation community to take proactive actions on their own initiative. Moreover, a telephone call or a meeting would have been a much more effective way for us to obtain a report from them, and a telephone call or a meeting would have caused less of a diversion of their resources from pursuing the measures we are asking them to report about. We often recommend that recipients take certain actions, and then send us a report to let us know what they have done, but a recommendation solely to report to us does nothing to improve transportation safety. For these reasons, I am very much opposed to this recommendation, and I 138#

PAR-11-01, page 152NTSB Pipeline Accident Report hope that henceforth we will avoid sending recommendations that only ask a recipient to provide us a report. 139#

PAR-11-01, page 153NTSB Pipeline Accident Report 5. Appendix Investigation and Hearing The NTSB was notified of the San Bruno pipeline rupture accident about 8:00 p.m. on September 9, 2010, the day of the accident. A go-team consisting of eight NTSB staff members was launched early the next morning. Vice Chairman Christopher Hart was the Board Member on scene. Investigative groups were formed for pipeline operations, SCADA operations, integrity management, metallurgy, human performance, survival factors, fire, and meteorology. Parties to the investigation included the Pipeline and Hazardous Materials Safety Administration, the Pacific Gas and Electric Company, the California Public Utilities Commission, the city of San Bruno, the Engineers and Scientists of California—Local 20, and the International Brotherhood of Electrical Workers—Local 1245. An en banc investigative hearing for this accident investigation was held at the NTSB Conference Center in Washington DC, on March 1–3, 2011. The transcript of the proceeding is available in the public docket. 140#