NTSB Safety Recommendation Letter P-11-004 through P-11-007

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: September 26, 2011 In reply refer to: P-11-4 through -7 The Honorable Ray H. LaHood Secretary U.S. Department of Transportation Washington, DC 20590 On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.1 The NTSB determined that the probable cause of the accident was PG&E’s (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. 1 For additional information, see Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010, Pipeline Accident Report NTSB/PAR-11/01 (Washington, DC: National Transportation Safety Board, 2011), which is available on the National Transportation Safety Board (NTSB) website at <http://www.ntsb.gov/>. 8275C#

Page 22 Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. Performance-Based Safety Programs Over the past few years, the Pipeline and Hazardous Materials Safety Administration (PHMSA), with the support and assistance of the pipeline industry, has added to its prescriptive regulatory scheme a performance-based regulatory scheme with broad performance goals as the basis for its pipeline safety program, most notably with respect to integrity management programs, and to a lesser extent, to public awareness programs. This new regulatory scheme applies to gas transmission and distribution systems and to hazardous liquid pipeline systems. Under performance-based regulations, the fundamental premise is that an individual pipeline operator knows its system best, and thereby is best able to develop, implement, execute, evaluate, and adjust its integrity management programs to ensure the safe maintenance and operation of its pipelines. Performance-based management systems include activities to ensure that goals are consistently being met in an effective and efficient manner. Performance management can focus on an organization, a department, an employee, or even the processes to build a product or service, among many other areas. Performance measurement involves determining what to measure, identifying data collection methods, and collecting the data. Evaluation involves assessing progress toward the performance goals, usually to explain the causal relationships between program activities and outcomes. Performance measurement and evaluation are components of performance-based management, the systematic application of information generated by performance plans, measurement, and evaluation to strategic planning and budget formulation. The PG&E integrity management plan was audited by the CPUC in 2005, with PHMSA’s assistance, and again by the CPUC in 2010 using PHMSA’s inspection protocol. Almost none of the issues identified in this investigation were identified in either of these audits despite the fact that many of them should have been easy to detect. The deficiencies in the PG&E geographic information system (GIS) data should have been readily apparent to CPUC and PHMSA inspectors during integrity management audits. However, the PHMSA integrity management audit protocol does not formally call for a check of the completeness and accuracy of information contained in the operator’s pipeline attribute database. The PHMSA inspection protocol includes only one inspection item (C.02.d), related to the completeness and accuracy of information used in developing integrity management programs. That item requires inspectors to verify that the operator has checked the data for accuracy, and if the operator lacks sufficient data or the data quality is suspect, instructs the inspector to verify that the operator has followed American Society of Mechanical Engineers (ASME)-sponsored code B31.8S.2 At the NTSB investigative hearing held on March 1–3, 2011, a CPUC supervisory engineer testified that CPUC auditors did not examine GIS data in detail; 2 ASME-sponsored code B31.8S, 2004 edition, Managing System Integrity of Gas Pipelines: ASME Code for Pressure Piping, B31 Supplement to ASME B31.8.#

Page 33 however, they did randomly spot check GIS data and verified that when data were unknown, PG&E was using appropriately conservative values. Furthermore, PHMSA regulations do not require an operator to supply missing data or assumed values within any time frame. This allows incomplete or erroneous information to continue in an operator’s records indefinitely, as was the case with the PG&E GIS, which continued to show Segment 1803 as seamless X42 pipe until the time of the accident. PHMSA should require operators to correct data deficiencies within a specific time frame. Another deficiency not identified during the audits was the mismatch between PG&E’s threat weighting and its actual leak, failure, and incident experience. The PHMSA integrity management inspection protocol includes inspection item C.03.c for inspectors to verify that the operator uses a feedback mechanism to ensure that its risk model is subject to continuous validation and improvement. However, the PHMSA inspection protocol placed insufficient emphasis on continuous validation and improvement of risk models. Another concern is the fact that the CPUC did not follow up on its 2005 audit finding that PG&E lacked a process to evaluate the use of automatic shutoff valves and remote control valves, as required by Title 49 Code of Federal Regulations 192.935(c). Although PG&E prepared a memorandum, dated June 14, 2006, addressing this issue, the CPUC apparently did not evaluate the adequacy of this response. If it did, it failed to identify the flawed analysis that concluded the use of automatic shutoff valves would have little effect on increasing safety or protecting property. CPUC and PHMSA officials acknowledged at the NTSB investigative hearing that it is difficult to oversee performance-based regulations, such as the integrity management rules, because there is no “one-size-fits-all” standard against which to measure performance. Overseeing an operator’s compliance with the integrity management rules is very different from overseeing compliance with more clear-cut prescriptive regulations because integrity management requires the auditor to evaluate the adequacy of an operator’s technical justification rather than its compliance with a hard and fast standard. The effectiveness of performance-based pipeline safety programs is dependent on the diligence and accountability of both the operator and the regulator—the operator for development and execution of its plan, and the regulator for oversight of the operators. However, as evident in this investigation, the PG&E integrity management and public awareness programs failed to achieve their stated goals because performance measures were neither well defined nor evaluated with respect to meeting performance goals. By overlooking the existence of, and the risk from, manufacturing and fabrication defects under its integrity management program, PG&E took no actions to assess risk and ultimately was unaware of the internal defects that caused the rupture of Line 132. 3 In 1956, PG&E relocated 1,851 feet of Line 132 that had originally been installed in 1948. This relocation included the installation of the pipe at the accident location. In 1961, PG&E completed a second relocation project on a portion of Line 132 immediately to the south of the 1956 relocation. As a result, 1,742 feet of the original 1,851 feet of pipe from the 1956 relocation project, including the rupture location, remained in operation. In PG&E’s records, this segment is known as Segment 180.#

Page 44 Similarly, the CPUC and PHMSA continue to conduct audits that focus on verification of paper records and plans rather than on gathering information on how performance-based safety systems are implemented, executed, and evaluated, and whether problem areas are being detected and corrected. Critical to this process, for operator and regulator, is the selection of metrics that quantify results against a specified value to provide a rate of occurrence for either a desired or undesired outcome. For example, useful metrics might include the number of incidents from internal defects per mile of operating pipeline or the number of incidents in a specific location per total incidents on a specific pipeline. Such metrics can provide a basis for comparison of the frequency of various types of defects and identify specific problem locations on pipelines. Similar assessments of operator performance can be used by regulators to exercise more effective oversight by focusing on those operators with problems, and to identify the causes of critical safety problems. In summary, PHMSA should develop an oversight model that allows auditors to more accurately measure the success of a performance-based pipeline integrity management program. Specifically, PG&E should develop, and auditors should review, data that provide some quantification of performance improvements or deterioration, such as the number of incidents per pipeline mile or per 1,000 customers; the number of missing, incomplete, or erroneous data fields corrected in an operator’s database; the response time in minutes for leaks, ruptures, or other incidents; and the number of public responses received per thousands of postcards/surveys mailed. Such metrics would allow a comparison of current performance against previous performance. The NTSB concludes that the PHMSA integrity management inspection protocols are inadequate. The NTSB also concludes that because PG&E, as the operator of its pipeline system, and the CPUC, as the pipeline safety regulator within the state of California, have not incorporated the use of effective and meaningful metrics as part of their performance-based pipeline safety management programs, neither PG&E nor the CPUC is able to effectively evaluate or assess the integrity of PG&E’s pipeline system. The NTSB also concludes that, because PHMSA has not incorporated the use of effective and meaningful metrics as part of its guidance for effective performance-based pipeline safety management programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines needs improvement. Therefore, the NTSB recommends that the U.S. Secretary of Transportation conduct an audit to assess the effectiveness of PHMSA’s oversight of performance-based safety programs. This audit should address the (1) need to expand the program’s use of meaningful metrics; (2) adequacy of its inspection protocols for ensuring the completeness and accuracy of pipeline operators’ integrity management program data; (3) adequacy of its inspection protocols for ensuring the incorporation of an operator’s leak, failure, and incident data in evaluations of the operator’s risk model; and (4) benefits of establishing performance goals for pipeline operators.#

Page 55 Authority and Enforcement The CPUC, as the regulator for pipeline safety within California, failed to uncover the pervasive and long-standing problems within PG&E. Consequently, this failure precluded the CPUC from taking any enforcement action against PG&E. The CPUC lost opportunities to identify needed corrective action and to follow through and ensure that PG&E completed the prescribed corrective actions in a timely manner. For its part, PHMSA rated the CPUC’s pipeline safety program in the mid- to high-90s in the years leading up to the San Bruno accident—a superior, if not outstanding, score. Furthermore, PHMSA’s participation in the 2005 joint audit with the CPUC of PG&E apparently did not make any difference in uncovering PG&E’s systemic problems or in accurately assessing the quality of oversight exercised by the CPUC. The quality of oversight exercised by any regulatory agency depends upon the quality of the regulations in force, the authority granted to the regulator, and the enforcement program implemented by the regulator. Despite deficiencies with specific regulatory requirements and integrity management programs as discussed previously, the CPUC’s failure to recognize PG&E’s corporate failures and PHMSA’s failure to recognize the CPUC’s ineffectiveness indicate that more fundamental problems exist, particularly with enforcement practices and policies. The NTSB believes that Federal regulations for all types of pipeline systems provide sufficient authority to PHMSA to enforce the regulations and to take appropriate actions to address noncompliance by a pipeline operator. PHMSA can require an operator to take numerous corrective actions, such as reducing operating pressure, conducting inspections and tests, and, if necessary, suspending operation of a pipeline. PHMSA also can initiate enforcement actions leading to monetary civil penalties against an operator for safety violations. Most states either adopt or pattern state pipeline safety regulations after the Federal regulations. Because state pipeline regulatory agencies receiving Federal grants through PHMSA are monitored for alignment with PHMSA standards, most state regulators should be expected to have comparable enforcement authority. However, a state regulator’s authority will be affected by the organizational placement of the regulatory agency within the state government. In the case of the CPUC, pipeline safety is one of several utility programs under the CPUC’s jurisdiction. Further, the CPUC sets utility rates, which could potentially conflict with the enforcement of safety programs. Because of the lapses of oversight seen in this accident, the NTSB is concerned and has strong doubts about the quality and effectiveness of enforcement at both the Federal and state levels. Although the CPUC and PHMSA have authority to enforce pipeline safety regulations, the organizational failures of PG&E seen in this accident suggest that some operators are able to ignore certain standards without concern for meaningful enforcement action against them. Therefore, the NTSB concludes that the ineffective enforcement posture of the CPUC permitted PG&E’s organizational failures to continue over many years. The NTSB also concludes that PHMSA’s enforcement program and its monitoring of state oversight programs have been weak and have resulted in the lack of effective Federal oversight and state oversight exercised by the CPUC. The NTSB recommends that the U.S. Secretary of Transportation#

Page 66 include in the audit conducted pursuant to Safety Recommendation P-11-4 a review of PHMSA’s enforcement policies and procedures, including, specifically, the standard of review for compliance with performance-based regulations. The NTSB also recommends that the U.S. Secretary of Transportation conduct an audit of PHMSA’s state pipeline safety program certification program to assess and ensure state pipeline safety programs and Federal pipeline safety grants are used effectively to conduct oversight of intrastate pipeline operations, including an evaluation of state inspection and enforcement activities. The NTSB further recommends that the U.S. Secretary of Transportation ensure that PHMSA amends the certification program, as appropriate, to comply with the findings of the audit recommended in Safety Recommendation P-11-6. Therefore, the National Transportation Safety Board makes the following safety recommendations to the U.S. Secretary of Transportation: Conduct an audit to assess the effectiveness of the Pipeline and Hazardous Materials Safety Administration’s oversight of performance-based safety programs. This audit should address the (1) need to expand the program’s use of meaningful metrics; (2) adequacy of its inspection protocols for ensuring the completeness and accuracy of pipeline operators’ integrity management program data; (3) adequacy of its inspection protocols for ensuring the incorporation of an operator’s leak, failure, and incident data in evaluations of the operator’s risk model; and (4) benefits of establishing performance goals for pipeline operators. (P-11-4) Include in the audit conducted pursuant to Safety Recommendation P-11-4 a review of the Pipeline and Hazardous Materials Safety Administration’s enforcement policies and procedures, including, specifically, the standard of review for compliance with performance-based regulations. (P-11-5) Conduct an audit of the Pipeline and Hazardous Materials Safety Administration’s state pipeline safety program certification program to assess and ensure state pipeline safety programs and Federal pipeline safety grants are used effectively to conduct oversight of intrastate pipeline operations, including an evaluation of state inspection and enforcement activities. (P-11-6) Ensure that the Pipeline and Hazardous Materials Safety Administration amends the certification program, as appropriate, to comply with the findings of the audit recommended in Safety Recommendation P-11-6. (P-11-7) The NTSB also issued safety recommendations to the Pipeline and Hazardous Materials Safety Administration, the governor of the state of California, the California Public Utilities Commission, the Pacific Gas and Electric Company, the American Gas Association, and the Interstate Natural Gas Association of America. Additionally, the report reclassifies two previously issued recommendations to the Pipeline and Hazardous Materials Safety Administration.#

Page 77 In response to the recommendations in this letter, please refer to Safety Recommendations P-11-4 through -7. If you would like to submit your response electronically rather than in hard copy, you may send it to the following e-mail address: correspondence@ntsb.gov. If your response includes attachments that exceed 5 megabytes, please e-mail us asking for instructions on how to use our secure mailbox. To avoid confusion, please use only one method of submission (that is, do not submit both an electronic copy and a hard copy of the same response letter). Chairman HERSMAN, Vice Chairman HART, and Members SUMWALT, ROSEKIND, and WEENER concurred in these recommendations. Chairman HERSMAN filed a concurring statement and Vice Chairman HART filed a concurring and dissenting statement, both of which are attached to the pipeline accident report for this accident. [Original Signed] By: Deborah A.P. Hersman Chairman#

Page 8Safety Recommendation Reiteration List SR Numbe r Reiteratio n Number Report Number Report Date P-11- 007 1 NTSB/SS -15/01 1/27/201 5 Accident Description Integrity Management Of Gas Tramsission Pipelines In High Consequenc e Areas Acciden t City N/A Acciden t State N/A Acciden t Date N/A#