NTSB Safety Recommendation Letter P-11-008 through P-11-020

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: September 26, 2011 In reply refer to: P-11-8 through -20 and P-11-1 and P-11-2 (Reclassification) The Honorable Cynthia L. Quarterman Administrator Pipeline and Hazardous Materials Safety Administration Washington, DC 20590 On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.1 The NTSB determined that the probable cause of the accident was PG&E’s (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also 1 For additional information, see Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010, Pipeline Accident Report NTSB/PAR-11/01 (Washington, DC: National Transportation Safety Board, 2011), which is available on the National Transportation Safety Board (NTSB) website at <http://www.ntsb.gov/>. 8275C#

Page 22 contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. Notifying Emergency Responders The NTSB noted that PG&E did not notify emergency officials that the accident involved the rupture of one of PG&E’s pipelines, even after they had deduced this to be the case. On June 8, 2011, the NTSB made the following recommendations to address these issues. Specifically, the NTSB recommended that the Pipeline and Hazardous Materials Safety Administration (PHMSA) do the following: Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of sharing system-specific information, including pipe diameter, operating pressure, product transported, and potential impact radius, about their pipeline systems with the emergency response agencies of the communities and jurisdictions in which those pipelines are located. (P-11-1) Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of control room operators immediately and directly notifying the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-2) To PG&E, NTSB recommended the following: Require your control room operators to notify, immediately and directly, the 911 emergency call center(s) for the communities and jurisdictions in which your transmission and/or distribution pipelines are located, when a possible rupture of any pipeline is indicated. (P-11-3) Because of emergency response awareness issues discovered in the Carmichael, Mississippi,2 and San Bruno investigations, the NTSB is concerned that similar problems may exist with other pipeline operators and believes that the guidance recommended in Safety Recommendations P-11-1 and -2 should be codified as requirements. To address these concerns, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-1 is classified 2 See Rupture of Hazardous Liquid Pipeline With Release and Ignition of Propane, Carmichael, Mississippi, November 1, 2007, Pipeline Accident Report NTSB/PAR-09/01 (Washington, DC: National Transportation Safety Board, 2009).#

Page 33 “Closed—Superseded.” Further, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that their control room operators immediately and directly notify the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-2 is classified “Closed—Superseded.” Line Break Recognition Although supervisory control and data acquisition (SCADA) staff quickly realized that there had been a gas line break in San Bruno, they were slow to recognize the connection between the line break and the overpressure at the Milpitas Terminal, and some staff were initially unsure of whether the break was in a transmission or a distribution line. In a postaccident interview, SCADA operator B3 stated that within 7 minutes of the rupture, he knew there had been a break in Line 132, and that by 6:30 p.m., he knew it was within a 12-mile corridor in the vicinity of San Bruno. At 6:53 p.m., SCADA operator D indicated that he knew the break was in Line 132, telling the on-scene SCADA transmission and regulation supervisor, “Yeah, absolutely we believe it’s a break on Line 132.” However, at about that time, there was still confusion among other employees as indicated by comments made at 6:51 p.m. by SCADA operator C to a PG&E pipeline engineer, indicating that although the engineer said he thought there was a PG&E transmission line close to the area of the fire, SCADA operator C did not think the break was in a transmission line. At 6:55 p.m., in a telephone discussion between SCADA operator C and the on-scene PG&E gas maintenance and construction superintendent, both indicated that they believed a distribution line and not a transmission line had been breached. SCADA staff also had difficulties determining the exact location of the rupture. At 6:49 p.m., the SCADA center 4 was still uncertain of the rupture point, as illustrated by the comment of the senior SCADA coordinator to a dispatch employee, “We are going to feed the line break at this pressure but I would take the pressure down if I knew more about what was feeding it… .” The PG&E SCADA system lacked several tools that could have assisted the staff in recognizing and pinpointing the location of the rupture, such as real-time leak or line break detection models, and closely spaced flow and pressure transmitters. A real-time leak detection application is a computer-based model of the transmission system that runs simultaneously with SCADA and provides greater feedback to SCADA operators when a large scale leak, line break, or system anomaly is present. Such models use actual SCADA pressures and flows to calculate actual and expected hydraulic performance; when the values do not match, an alarm is generated. 3 SCADA operators B, C, and D referenced in this letter were all working at the SCADA center in San Francisco. Operator D became the primary point of contact for workers at the Milpitas Terminal on the evening of the accident. 4 In this letter, SCADA center refers to PG&E’s gas control center.#

Page 44 Appropriate spacing of pressure transmitters at regular intervals5 quickly identify pressure decreases that point toward a leak or line break. allows SCADA operators to The NTSB concludes that PG&E’s SCADA system limitations contributed to the delay in recognizing that there had been a transmission line break and quickly pinpointing its location. Therefore, the NTSB recommends that PHMSA require that all operators of natural gas transmission and distribution pipelines equip their SCADA systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. Rapid Shutdown, Automatic Shutoff Valves, and Remote Control Valves Two mechanics had self-reported to the Colma yard at 6:35 p.m., and they decided to depart the yard at 7:06 p.m. to shut off the valves. Because gas was being supplied to the break from both the north and the south, shutdown and isolation of the rupture required closure of manual shutoff valves closest to the break, which were located about 1.5 miles apart, on either end of the break. The mechanics identified and manually closed those valves at 7:30 p.m. (south valve) and 7:46 p.m. (north valve). Also, about 7:29 p.m., the SCADA center remotely closed valves at the Martin Station in response to a request from a SCADA transmission and regulation supervisor who had joined the mechanics. The NTSB is concerned that the mechanics were unnecessarily held at the Colma yard and that the response could have been delayed even longer if the two mechanics had waited for official orders from PG&E. Further, the SCADA center staff could have reduced the flow sooner by shutting the remote valves at the Martin Station sooner, but they did not. These delays needlessly prolonged the release of gas and prevented emergency responders from accessing the area. The total heat and radiant energy released by the burning gas was directly proportional to the time gas flowed freely from the ruptured pipeline. Therefore, as vegetation and homes ignited, the fire would have spread and led to a significant increase in property damage. The pressurized flow from the south resulted in an intense flame front similar to a blowtorch, and emergency responders were unable to gain access to the area. If the gas had been shut off earlier, removing fuel flow, the fire would likely have been smaller and resulted in less damage. Also, buildings that would have provided protection to residents in a shorter duration fire were compromised because of the elevated heat. In addition to exposing residents and their property to increased risk, the prolonged fire also negatively affected emergency responders, who were put at increased risk by having to be in close proximity to fire for a longer time and were not available to respond to other potential emergencies while they were waiting for the fire to subside. 5 SCADA data on Line 132 are currently received from only a few transmitters at randomly spaced intervals.#

Page 55 The NTSB concludes that the 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was excessive. This delay, which contributed to the severity and extent of property damage and increased risk to the residents and emergency responders, in combination with the failure of the SCADA center to expedite shutdown of the remote valves at the Martin Station, contributed to the severity of the accident. The NTSB has long been concerned about the lack of standards for rapid shutdown and the lack of requirements for automatic shutoff valves (ASV) or remote control valves (RCV) in high consequence areas (HCA). As far back as 1971, the NTSB recommended, in Safety Recommendation P-71-1, the development of standards for rapid shutdown of failed natural gas pipelines. In 1995, the NTSB recommended, in Safety Recommendation P-95-1, that the Research and Special Programs Administration (RSPA), the predecessor agency of PHMSA, expedite requirements for installing automatic- or remote-operated mainline valves on high-pressure pipelines in urban and environmentally sensitive areas to provide for rapid shutdown of failed pipeline segments. The NTSB classified Safety Recommendation P-95-1 “Closed—Acceptable Action,” believing that the RSPA 2004 integrity management rulemaking (requiring that each gas transmission operator determine whether installing ASVs or RCVs would be an efficient means of adding protection to an HCA) would lead to a more widespread use of ASVs and RCVs. However, it did not. Federal regulations prescribe, at Title 49 Code of Federal Regulations (CFR) 192.179, the spacing of valves on a transmission line based on class location. However, other than for pipelines with alternative maximum allowable operating pressures (MAOP), 6 the regulations do not require a response time to isolate a ruptured gas line, nor do they explicitly require the use of ASVs or RCVs. The regulations give the pipeline operator discretion to decide whether ASVs or RCVs are needed in HCAs as long as they consider the factors listed under 49 CFR 192.935(c).7 Therefore, there is little incentive for an operator to perform an objective risk analysis, as illustrated by PG&E’s June 14, 2006, memorandum—which was issued after the CPUC 2005 audit identified PG&E’s failure to consider the issue and does not directly discuss any of the factors listed in section 192.935(c). Rather, it cites industry references to support the conclusion that most of the damage from a pipeline rupture occurs within the first 30 seconds, and that the duration of the resulting fire “has (little or) nothing to do with human safety and property damage.” The memorandum concludes that the use of an ASV or an RCV as a prevention and mitigation measure in an HCA would have “little or no effect on increasing human safety or protecting properties.” In the case of the San Bruno transmission line break, nearby RCVs could have significantly reduced the amount of time the fire burned, and thus the severity of the accident. Had the two isolation valves, located 1.5 miles apart, been outfitted with remote closure 6 Under 49 CFR 192.620, “Alternative Maximum Allowable Operating Pressure for Certain Steel Pipelines, ” issued in 2008, an operator is allowed to operate a pipeline at up to 80 percent specified minimum yield strength (SMYS) in class 2 locations as long as it meets a very specific and stringent set of criteria. Section 192.620(c)(3) states that an RCV or ASV is required for such pipelines if the response time to mainline valves exceeds 1 hour under normal driving conditions and speed limits. 7 Those factors are (1) the swiftness of leak detection and pipe shutdown capabilities; (2) the type of gas being transported; (3) the operating pressure; (4) the rate of potential release; (5) the pipeline profile; (6) the potential for ignition; and (7) the location of nearest response personnel.#

Page 66 capability, prompt closure of those valves would have reduced the amount of fuel burned by the fire and allowed firefighters to enter the affected area sooner. The PG&E manager of gas system operations acknowledged at the NTSB’s investigative hearing held on March 1–3, 2011, that the use of RCVs could have reduced the time it took to isolate the rupture by about 1 hour. Damage from the pipeline rupture could have been reduced significantly if the valves on either end of the rupture point had been equipped with ASVs. Analysis of pressure differentials indicated that the San Bruno rupture would have resulted in the closure of an ASV at the downstream location8 and would likely also have resulted in the closure of an ASV at the upstream location.9 Even the closing of a downstream ASV alone would have been beneficial in that it would have immediately alerted SCADA to a more precise location of the break. Concerns about ASVs have focused on the cost of installation and their susceptibility to inadvertently trip based on pressure transients in the system. However, vendors have developed newer models that address these shortcomings by combining the features of traditional ASVs with RCVs. These “smart” valves include sensors that can trend the pressure transients on a line to identify what constitutes normal operation, thereby lessening the chances of an inappropriate shutdown. Also, the newer models can alert a SCADA center when the valve hits a trip point, allowing SCADA operators the option of overriding the valve closure and precluding an undesired shutdown. The NTSB concludes that the use of ASVs or RCVs along the entire length of Line 132 would have significantly reduced the amount of time taken to stop the flow of gas and to isolate the rupture. The NTSB is aware that PG&E is in the process of expanding its use of ASVs and RCVs and has added this capability to some valve locations since the accident. Still, the NTSB recommends that PHMSA amend 49 CFR 192.935(c) to directly require that ASVs or RCVs in HCAs and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. Deficiencies in Postaccident Drug and Alcohol Testing After the accident, PG&E identified four employees at the Milpitas Terminal for postaccident toxicological testing pursuant to 49 CFR 199.105 and 49 CFR 199.225. Test results were negative for the presence of specified drugs. Testing for drugs was accomplished successfully within the time constraints defined in 49 CFR 199.105; that is, within 32 hours of the accident. However, alcohol testing was not conducted properly in accordance with 49 CFR 199.225, which requires that testing be administered within 8 hours of an accident, and, 8 The pressure decay at the Martin Station showed a decrease from 386 to 200 pounds per square inch, gauge (psig) in the course of 3 minutes (62 psig per minute), beginning at 6:11 p.m. This drop would have been more than sufficient to trip an ASV located at the downstream valve near the rupture point. 9 The pressure decay in Line 132 was not captured because the transmitter at that location was not installed directly on the main line but on a smaller transmission line (at Half Moon Bay) that branched off from Lines 132 and 109. Although the Half Moon Bay pressure readings cannot be used past 6:11 p.m. to approximate the Line 132 pressures upstream of the rupture, because the differential pressure was great enough to trip an ASV on the smaller line branching off Line 132 at Half Moon Bay, an ASV located on Line 132 likely would have tripped as well. (The smaller line crossed the San Andreas fault and, therefore, was equipped with an ASV to address seismic risk.)#

Page 77 if it is not, the operator shall cease attempts to do so. Results for the alcohol tests were invalid and therefore, the use of alcohol cannot be excluded. Alcohol testing of the four Milpitas Terminal employees commenced at 3:10 a.m. and concluded at 5:02 a.m. on September 10, 2010. The accident occurred at about 6:11 p.m. on the previous evening. Therefore, alcohol testing should have been completed by 2:11 a.m. on September 10, at the latest. PG&E officials explained that toxicological testing was delayed because the decision to perform testing was not made until approximately midnight and that the request for testing was made at 12:30 a.m. The NTSB is concerned by PG&E’s delay in contacting the toxicological testing contractor until 12:30 a.m., more than 6 hours after the rupture. Further, upon arrival at the Milpitas Terminal about 2:00 a.m., the contractor should have determined the time of the rupture and attempted to expedite alcohol testing, given that only minutes remained before the regulations prohibited testing. The NTSB is concerned that the alcohol testing was conducted after the prescribed 8 hours following an accident. Further, the NTSB is concerned that PG&E did not perform any drug or alcohol testing of its SCADA staff. The regulations in 49 CFR 199.105 and 49 CFR 199.225 require testing of any employee whose performance cannot be discounted completely as a contributing factor to the accident and that a decision not to administer a test must be based on a determination that the employee’s performance “could not have contributed to the accident.” The SCADA personnel were directly involved in monitoring and controlling the events that unfolded during the accident scenario. Therefore, the SCADA personnel should have been tested. The NTSB concludes that the 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to properly record an explanation for the delay, and the failure to conduct drug or alcohol testing on the SCADA center staff all demonstrate that the PG&E postaccident toxicological program was ineffective. The NTSB is concerned that the regulations requiring operators to conduct postaccident drug and alcohol testing give operators too much discretion in deciding which employees to test, because it states that the decision not to administer a drug test “…must be based on the best information available immediately after the accident that the employee’s performance could not have contributed to the accident…”, and the decision not to administer an alcohol test “…shall be based on the operator’s determination, using the best available information at the time of the determination, that the covered employee’s performance could not have contributed to the accident.” Therefore, the NTSB recommends that PHMSA amend 49 CFR 199.105 and 49 CFR 199.225 to eliminate operator discretion with regard to testing of covered employees. The revised language should require drug and alcohol testing of each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. The NTSB also recommends that PHMSA issue immediate guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially involved personnel despite uncertainty about the circumstances of the accident.#

Page 88 Grandfathering of Pre-1970 Pipelines Of broader concern is the exemption of pre-1970 pipelines nationwide from the requirement for a postconstruction hydrostatic pressure test. This exemption was added at the final stage of rulemaking, not having been subject to public comment as part of the original notice of proposed rulemaking (NPRM). It was based on an assertion from the Federal Power Commission that, “there are thousands of miles of jurisdictional interstate pipelines installed prior to 1952 [when the voluntary industry pressure test standards incorporated in section 192.619 were established], in compliance with the then existing codes, which could not continue to operate at their present pressure levels and be in compliance with” the proposed standard in the NPRM calling for the MAOP to be limited to a percentage of the pressure to which it was tested after construction. It is not clear from the preamble to the final rule what rationale, if any, the Federal Power Commission or the U.S. Department of Transportation (DOT) pipeline staff relied on to justify exempting pipelines such as Line 132, which were constructed without complying with the voluntary hydrostatic pressure testing standards of then-existing codes. Grandfathering of Line 132 by the CPUC in 1961 and then by RSPA in 1970 resulted in missed opportunities to detect the defective pipe. In 1961, the CPUC began requiring a postconstruction hydrostatic test to 1.5 times MAOP for newly constructed pipelines in class 3 areas. In 1970, RSPA began requiring a postconstruction hydrostatic test to 1.5 times MAOP in class 3 locations. For a MAOP of 400 psig, this corresponds to a hydrostatic test pressure of 600 psig. However, pursuant to the 1970 grandfather clause, Line 132 and other existing gas transmission pipelines with no prior hydrostatic test were permitted to use as their MAOP the highest operating pressure recorded during the previous 5 years (that is, between 1965–1970) and allowed to continue operating with no further testing. Thus, the NTSB concludes that if the grandfathering of older pipelines had not been permitted since 1961 by the CPUC and since 1970 by the DOT, Line 132 would have undergone a hydrostatic pressure test that would likely have exposed the defective pipe that led to this accident. Other examples of how the grandfather clause results in reduced safety margins include the following: • Title 49 CFR 192.195, “Protection Against Accidental Overpressuring,” which requires that pressure relieving or limiting devices ensure that pipeline pressure (for pipelines operated at 60 psig or higher) does not exceed MAOP plus 10 percent or the pressure that produces a hoop stress of 75 percent of SMYS, whichever is lower. However, for a pipeline whose MAOP was established in accordance with the grandfather clause, this pressure (MAOP plus 10 percent) may be greater than any pressure it was subjected to in its lifetime. • Title 49 CFR 192.933(d)(1), “Immediate Repair Conditions,” which allows operators to continue operating a gas pipeline with a known defect unless “a calculation of the remaining strength of the pipe shows a predicted failure pressure less than or equal to 1.1 times the maximum allowable operating pressure.” Again, this pressure (1.1 times the MAOP) may be greater than any pressure a grandfathered pipeline was subjected to in its lifetime.#

Page 99 More than half of the nation’s onshore gas transmission pipelines (about 180,000 miles) were installed prior to the effective date of the 1970 requirement for hydrostatic pressure testing. PHMSA does not keep track of how many of these pipelines have had their MAOP established under the grandfather clause. The state of California has already taken action to address grandfathering for pipelines within its jurisdiction. In its June 9, 2011, order requiring PG&E and other gas transmission operators regulated by the CPUC to either hydrostatically pressure test or replace certain transmission pipelines with grandfathered MAOPs, the CPUC stated that natural gas transmission pipelines “must be brought into compliance with modern standards for safety” and “historic exemptions must come to an end.” The NTSB agrees and concludes that there is no safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement for postconstruction hydrostatic pressure testing. Studies have shown that hydrostatic pressure testing is most effective when it incorporates a spike test in which the pipeline is initially pressurized to a higher level for a short time. Accordingly, the NTSB recommends that PHMSA amend 49 CFR 192.619 to delete the grandfather clause and require that all gas transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that incorporates a spike test. Regulatory Assumption of Stable Manufacturing- and Construction-Related Defects In accordance with 49 CFR 192.917 (e)(3), an operator may consider manufacturing- and construction-related defects to be stable defects not requiring assessment so long as operating pressure has not increased over the maximum operating pressure (MOP) experienced during the preceding 5 years. When a pipeline with a manufacturing- or construction-related defect is operated above the highest pressure recorded in the preceding 5 years, it must be prioritized as a high risk segment for assessment. According to section 6.3.2 of the integrity management supplement American Society of Mechanical Engineers (ASME)-sponsored code B31.8S,10 2004 edition, in that case, “pressure testing must be performed to address the seam issue.” PG&E raised the pressure at the Milpitas Terminal to 400 psig in 2003 and 2008 to set a 5-year MOP for Line 132. The PG&E director of integrity management and technical support acknowledged at the NTSB investigative hearing that this practice allowed PG&E to regard manufacturing threats as stable, thereby continuing to use only external corrosion direct assessment as the assessment method. Thus, this practice allowed PG&E to avoid seam integrity inspections it might otherwise have been required to conduct. However, the PHMSA deputy associate administrator for field operations testified at the investigative hearing that it was not the intent for this rule to be used to avoid an assessment. (PG&E has discontinued this practice since the accident.) 10 ASME-sponsored code B31.8S, 2004 edition, Managing System Integrity of Gas Pipelines: ASME Code for Pressure Piping, B31 Supplement to ASME B31.8.#

Page 1010 Furthermore, studies have discredited the assumption that manufacturing- and construction-related defects are stable in pipelines that have not been hydrostatically pressure tested to an appropriate level. According to a Gas Research Institute (GRI)11 report dated September 17, 2004— the risk of pressure-cycle-induced fatigue can be dismissed if and only if the pipeline has been subjected to a reasonably high-pressure hydrostatic test. Therefore, … eliminating the risk of failure from pressure-cycle-induced fatigue crack growth of defects that can survive an initial hydrostatic test of a pipeline requires that the test pressure level must be at least 1.25 times the [MAOP]. 12 Similarly, a 2007 PHMSA report concluded— experience and scientific analysis indicates that manufacturing defects in gas pipelines that have been subjected to a hydrostatic test to 1.25 times MAOP should be considered stable. No integrity assessment is necessary to address that particular threat in such pipelines. The principal challenge for deciding whether or not to consider manufacturing defects to be stable is associated with those gas pipelines that have never been subjected to a hydrostatic test to a minimum of 1.25 times MAOP.13 In summary, under 49 CFR 192.917(e)(3), operators are entitled to consider known manufacturing- and construction-related defects to be stable, even if a line has not been pressure tested to at least 1.25 times its MAOP. However, such defects may not, in actuality, be stable. The NTSB concludes that the premise in 49 CFR Part 192 of the Federal pipeline safety regulations that manufacturing- and construction-related defects can be considered stable even when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the MAOP is not supported by scientific studies. Therefore, the NTSB recommends that PHMSA amend 49 CFR Part 192 of the Federal pipeline safety regulations so that manufacturing- and construction-related defects can only be considered stable if a gas pipeline has been subjected to a postconstruction hydrostatic pressure test of at least 1.25 times the MAOP. Summary of PG&E Practices The NTSB accident investigation revealed multiple deficiencies with PG&E’s practices. To summarize, PG&E’s practices were revealed to be inadequate because— • The accident pipe segment did not meet any known pipeline specifications. • Construction and quality control measures for the 1956 relocation project were inadequate in that they did not identify visible defects. 11 In 2000, the GRI combined with the Institute of Gas Technology to form the Gas Technology Institute (GTI), a nonprofit research and development organization that develops, demonstrates, and licenses new energy technologies for private and public clients, with a particular focus on the natural gas industry. PG&E is a member of the GTI. 12 Effects of Pressure Cycles on Gas Pipelines, report GRI-04/0178 (Des Plaines, Illinois: Gas Research Institute, 2004). 13 Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines, No. 05-12R (Washington, DC: Pipeline and Hazardous Materials Safety Administration, 2007).#

Page 1111 • The integrity management program, including self-assessment of that program, was ineffective. • Emergency response to the pipeline rupture was slow, and isolation and shutdown of gas flow were unacceptably delayed. • The postaccident drug and alcohol testing program had multiple deficiencies. • SCADA staff roles and duties were poorly defined. • SCADA work clearance procedures were inadequate. • Critical components at the Milpitas Terminal were susceptible to single-point failures. • The public awareness program, including self-assessment, was deficient and ineffective. Although PG&E has taken some corrective actions since the accident, many of these deficiencies should have been recognized and corrected before the accident. Further, the NTSB notes that several of the deficiencies revealed by this investigation, such as poor quality control during pipeline installation and inadequate emergency response, were also factors in the 2008 explosion of a PG&E gas distribution line in Rancho Cordova, California.14 That accident involved the inappropriate installation of a pipe piece that was not intended for operational use and did not meet applicable pipe specifications. The response to that event was inadequate in that an unqualified person was initially dispatched to respond to the emergency, and there was an unnecessary delay in dispatching a properly trained and equipped technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in San Francisco,15 which involved inaccurate record-keeping, the dispatch of first responders who were not trained or equipped to close valves, and unacceptable delays in shutting down the pipeline. Accident investigations often uncover a broad range of causal relationships or deficiencies that extend beyond the immediacy of components damaged or broken in a system failure. As indicated by the list above, a multitude of deficient operational procedures and management controls led to hazardous circumstances persisting and growing over time until the pipeline rupture occurred. These higher-order or organizational accident factors must be addressed to improve PG&E’s safety management practices. Organizational accidents have multiple contributing causes, involve people at numerous levels within a company, and are characterized by a pervasive lack of proactive measures to ensure adoption and compliance with a safety culture. Moreover, organizational accidents are catastrophic events with substantial loss of life, property, and environment; they also require complex organizational changes in order to avoid them in the future. In its report on the 14 Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010). 15 Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 (Washington, DC: National Transportation Safety Board, 1982).#

Page 1212 2009 collision of two Washington Metropolitan Area Transit Authority trains near Fort Totten Station in Washington, DC,16 the NTSB stated that “the accident did not result from the actions of an individual but from the ‘accumulation of latent conditions within the maintenance, managerial and organizational spheres’ making it an example of a ‘quintessential organizational accident.’”17 The Chicago Transit Authority train derailment in 2006, 18 which caused injuries to 152 people and over $1 million in damages, is another case study in organizational accidents. Similarly, the BP Texas City Refinery organizational accident in 200519 killed 15 people, injured 180 others, and caused financial losses exceeding $1.5 billion. The character and quality of PG&E’s operation, as revealed by this investigation, indicate that the San Bruno pipeline rupture was an organizational accident. PG&E did not effectively utilize its resources to define, implement, train, and test proactive management controls to ensure the operational and sustainable safety of its pipelines. Moreover, many of the organizational deficiencies were known to PG&E, as a result of the previous pipeline accidents in San Francisco in 1981, 20 and in Rancho Cordova, California, in 2008.21 As a lesson from those accidents, PG&E should have critically examined all components of its pipeline installation to identify and manage the hazardous risks, as well as to prepare its emergency response procedures. If this recommended approach had been applied within the PG&E organization after the San Francisco and Rancho Cordova accidents, the San Bruno accident might have been prevented. Therefore, based on the circumstances of this accident, the NTSB concludes that the deficiencies identified during this investigation are indicative of an organizational accident. The NTSB also concludes that the multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem. Therefore, NTSB recommends that PHMSA assist the CPUC in conducting the comprehensive audit recommended in Safety Recommendation P-11-22. The NTSB urges the CPUC and PHMSA to complete this comprehensive audit and require PG&E to take corrective actions as soon as possible, to reap the maximum safety benefit. The NTSB believes that 6 months would be a reasonable time frame for conducting the audit and that an additional 6 months after the completion of the audit would be a reasonable deadline for PG&E to take action in response to audit findings. 16 Collision of Two Washington Metropolitan Area Transit Authority Metrorail Trains Near Fort Totten Station, Washington D.C., June 22, 2009, Railroad Accident Report NTSB/RAR-10/02 (Washington, DC: National Transportation Safety Board, 2010). 17 (a) J. Reason, Managing the Risks of Organizational Accidents (Burlington, Vermont: Ashgate Publishing Company, 1997). (b) J. Reason, “Achieving a Safe Culture: Theory and Practice,” Work and Stress, vol. 12 (1998), p. 227. 18 Derailment of Chicago Transit Authority Train Number 220 Between Clark/Lake and Grand/Milwaukee Stations, Chicago, Illinois, July 11, 2006, Railroad Accident Report NTSB/RAR-07/02 (Washington, DC: National Transportation Safety Board, 2007). 19 Refinery Explosion and Fire, Investigation Report, report No. 205-04-1-TX (Washington, DC: U.S. Chemical Safety and Hazard Investigation Board, 2007). 20 NTSB/PAR-82/01. 21 NTSB/PAB-10/01.#

Page 1313 Inspection Technology The detection, identification, and elimination of pipeline defects before they result in catastrophic failures is critical to a successful integrity management program for gas transmission pipelines. In the NTSB’s judgment, the use of specialized in-line inspection tools that identify and evaluate damage caused by corrosion, dents, gouges, and circumferential and longitudinal cracks is a uniquely promising option for identifying defects. Unlike other assessment techniques, in-line inspection is continuous throughout the entire pipeline segment and, when performed periodically, can provide useful information about defect growth. Although in-line inspection technology has detection limitations (generally at best a 90 percent probability that a certain type of known defect will be detected, although the probability of detecting a crack can be improved with multiple runs), it is nonetheless the most effective method for detecting internal pipeline defects. At the time Line 132 was constructed, in-line inspection tools had not been developed. Due to construction limitations such as sharp bends and the presence of plug valves, many older natural gas transmission pipelines, like Line 132, cannot accommodate modern in-line inspection tools without modifications. According to testimony provided during the NTSB investigative hearing, the technical challenges of conducting in-line inspections of older gas transmission pipelines relate not to the sensors, but to the platforms (the tool or pig) that need to move through the pipeline. Gas transmission pipeline operators have also asserted that, because of differences in the flow regimes between natural gas (a compressible fluid) and hazardous liquids (an incompressible fluid), the use of in-line inspection tools in gas transmission pipelines presents additional technical challenges, especially when the operating pressure many not be sufficiently high to push the tool through the pipeline. According to testimony from the NTSB investigative hearing, current in-line inspection technology is advanced enough to have detected the defect that caused the rupture of Line 132, but it could not be used without significant modifications to the pipeline. The NTSB concludes that because in-line inspection technology is not available for use in all currently operating gas transmission pipeline systems, operators do not have the benefit of a uniquely effective assessment tool to identify and assess the threat from critical defects in their pipelines. Only in-line inspection can provide visualization of the internal pipe structure. The geometry of NTSB is concerned that in-line inspection is not possible in many of the nation’s pipelines, which—because of the date of their installation—have been subjected to less scrutiny than more recently installed lines. Therefore, the NTSB recommends that PHMSA require that all natural gas transmission pipelines be configured so as to accommodate in-line inspection tools, with priority given to older pipelines. Segment 180,22 like many older pipelines, would not accommodate in-line inspection tools. The 22 In 1956, PG&E relocated 1,851 feet of Line 132 that had originally been installed in 1948. This relocation included the installation of the pipe at the accident location. In 1961, PG&E completed a second relocation project on a portion of Line 132 immediately to the south of the 1956 relocation. As a result, 1,742 feet of the original 1,851 feet of pipe from the 1956 relocation project, including the rupture location, remained in operation. In PG&E’s records, this segment is known as Segment 180.#

Page 1414 Performance-Based Safety Programs Over the past few years, PHMSA, with the support and assistance of the pipeline industry, has added to its prescriptive regulatory scheme a performance-based regulatory scheme with broad performance goals as the basis for its pipeline safety program, most notably with respect to integrity management programs, and to a lesser extent, to public awareness programs. This new regulatory scheme applies to gas transmission and distribution systems and to hazardous liquid pipeline systems. Under performance-based regulations, the fundamental premise is that an individual pipeline operator knows its system best, and thereby is best able to develop, implement, execute, evaluate, and adjust its integrity management programs to ensure the safe maintenance and operation of its pipelines. Performance-based management systems include activities to ensure that goals are consistently being met in an effective and efficient manner. Performance management can focus on an organization, a department, an employee, or even the processes to build a product or service, among many other areas. Performance measurement involves determining what to measure, identifying data collection methods, and collecting the data. Evaluation involves assessing progress toward the performance goals, usually to explain the causal relationships between program activities and outcomes. Performance measurement and evaluation are components of performance-based management, the systematic application of information generated by performance plans, measurement, and evaluation to strategic planning and budget formulation. The PG&E integrity management plan was audited by the CPUC in 2005, with PHMSA’s assistance, and again by the CPUC in 2010 using PHMSA’s inspection protocol. Almost none of the issues identified in this investigation were identified in either of these audits despite the fact that many of them should have been easy to detect. The deficiencies in the PG&E geographic information system (GIS) data should have been readily apparent to CPUC and PHMSA inspectors during integrity management audits. However, the PHMSA integrity management audit protocol does not formally call for a check of the completeness and accuracy of information contained in the operator’s pipeline attribute database. The PHMSA inspection protocol includes only one inspection item (C.02.d), related to the completeness and accuracy of information used in developing integrity management programs. That item requires inspectors to verify that the operator has checked the data for accuracy, and if the operator lacks sufficient data or the data quality is suspect, instructs the inspector to verify that the operator has followed ASME B31.8S. At the NTSB investigative hearing, a CPUC supervisory engineer testified that CPUC auditors did not examine GIS data in detail; however, they did randomly spot check GIS data and verified that when data were unknown, PG&E was using appropriately conservative values.#

Page 1515 Furthermore, PHMSA regulations do not require an operator to supply missing data or assumed values within any time frame. This allows incomplete or erroneous information to continue in an operator’s records indefinitely, as was the case with the PG&E GIS, which continued to show Segment 180 as seamless X42 pipe until the time of the accident. PHMSA should require operators to correct data deficiencies within a specific time frame. Another deficiency not identified during the audits was the mismatch between PG&E’s threat weighting and its actual leak, failure, and incident experience. The PHMSA integrity management inspection protocol includes inspection item C.03.c for inspectors to verify that the operator uses a feedback mechanism to ensure that its risk model is subject to continuous validation and improvement. However, the PHMSA inspection protocol placed insufficient emphasis on continuous validation and improvement of risk models. Another concern is the fact that the CPUC did not follow up on its 2005 audit finding that PG&E lacked a process to evaluate the use of ASVs and RCVs, as required by 49 CFR 192.935(c). Although PG&E prepared a memorandum, dated June 14, 2006, addressing this issue, the CPUC apparently did not evaluate the adequacy of this response. If it did, it failed to identify the flawed analysis that concluded the use of ASVs would have little effect on increasing safety or protecting property. CPUC and PHMSA officials acknowledged at the NTSB investigative hearing that it is difficult to oversee performance-based regulations, such as the integrity management rules, because there is no “one-size-fits-all” standard against which to measure performance. Overseeing an operator’s compliance with the integrity management rules is very different from overseeing compliance with more clear-cut prescriptive regulations because integrity management requires the auditor to evaluate the adequacy of an operator’s technical justification rather than its compliance with a hard and fast standard. The effectiveness of performance-based pipeline safety programs is dependent on the diligence and accountability of both the operator and the regulator—the operator for development and execution of its plan, and the regulator for oversight of the operators. However, as evident in this investigation, the PG&E integrity management and public awareness programs failed to achieve their stated goals because performance measures were neither well defined nor evaluated with respect to meeting performance goals. By overlooking the existence of, and the risk from, manufacturing and fabrication defects under its integrity management program, PG&E took no actions to assess risk and ultimately was unaware of the internal defects that caused the rupture of Line 132. Similarly, the CPUC and PHMSA continue to conduct audits that focus on verification of paper records and plans rather than on gathering information on how performance-based safety systems are implemented, executed, and evaluated, and whether problem areas are being detected and corrected. Critical to this process, for operator and regulator, is the selection of metrics that quantify results against a specified value to provide a rate of occurrence for either a desired or undesired outcome. For example, useful metrics might include the number of incidents from internal defects per mile of operating pipeline or the number of incidents in a specific location per total#

Page 1616 incidents on a specific pipeline. Such metrics can provide a basis for comparison of the frequency of various types of defects and identify specific problem locations on pipelines. Similar assessments of operator performance can be used by regulators to exercise more effective oversight by focusing on those operators with problems, and to identify the causes of critical safety problems. In summary, PHMSA should develop an oversight model that allows auditors to more accurately measure the success of a performance-based pipeline integrity management program. Specifically, PG&E should develop, and auditors should review, data that provide some quantification of performance improvements or deterioration, such as the number of incidents per pipeline mile or per 1,000 customers; the number of missing, incomplete, or erroneous data fields corrected in an operator’s database; the response time in minutes for leaks, ruptures, or other incidents; and the number of public responses received per thousands of postcards/surveys mailed. Such metrics would allow a comparison of current performance against previous performance. The NTSB concludes that the PHMSA integrity management inspection protocols are inadequate. Therefore, the NTSB recommends that PHMSA revise its integrity management inspection protocol to (1) incorporate a review of meaningful metrics; (2) require auditors to verify that the operator has a procedure in place for ensuring the completeness and accuracy of underlying information; (3) require auditors to review all integrity management performance measures reported to PHMSA and compare the leak, failure, and incident measures to the operator’s risk model; and (4) require setting performance goals for pipeline operators at each audit and follow up on those goals at subsequent audits. The NTSB also concludes that because PG&E, as the operator of its pipeline system, and the CPUC, as the pipeline safety regulator within the state of California, have not incorporated the use of effective and meaningful metrics as part of their performance-based pipeline safety management programs, neither PG&E nor the CPUC is able to effectively evaluate or assess the integrity of PG&E’s pipeline system. The NTSB also concludes that, because PHMSA has not incorporated the use of effective and meaningful metrics as part of its guidance for effective performance-based pipeline safety management programs, its oversight of state public utility commissions regulating gas transmission and hazardous liquid pipelines needs improvement. Therefore, the NTSB recommends that PHMSA (1) develop and implement standards for integrity management and other performance-based safety programs that require operators of all types of pipeline systems to regularly assess the effectiveness of their programs using clear and meaningful metrics, and to identify and then correct deficiencies; and (2) make those metrics available in a centralized database. The NTSB also recommends that PHMSA work with state public utility commissions to (1) implement oversight programs that employ meaningful metrics to assess the effectiveness of their oversight programs and make those metrics available in a centralized database, and (2) identify and then correct deficiencies in those programs. Therefore, the National Transportation Safety Board makes the following safety recommendations to the Pipeline and Hazardous Materials Safety Administration:#

Page 1717 Require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. (P-11-8) This recommendation supersedes Safety Recommendation P-11-1. Require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that their control room operators immediately and directly notify the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-9) This recommendation supersedes Safety Recommendation P-11-2. Require that all operators of natural gas transmission and distribution pipelines equip their supervisory control and data acquisition systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. (P-11-10) Amend Title 49 Code of Federal Regulations 192.935(c) to directly require that automatic shutoff valves or remote control valves in high consequence areas and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. (P-11-11) Amend Title 49 Code of Federal Regulations 199.105 and 49 Code of Federal Regulations 199.225 to eliminate operator discretion with regard to testing of covered employees. The revised language should require drug and alcohol testing of each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. (P-11-12) Issue immediate guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially involved personnel despite uncertainty about the circumstances of the accident. (P-11-13) Amend Title 49 Code of Federal Regulations 192.619 to delete the grandfather clause and require that all gas transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that incorporates a spike test. (P-11-14) Amend Title 49 Code of Federal Regulations Part 192 of the Federal pipeline safety regulations so that manufacturing- and construction-related defects can only be considered stable if a gas pipeline has been subjected to a postconstruction hydrostatic pressure test of at least 1.25 times the maximum allowable operating pressure. (P-11-15)#

Page 1818 Assist the California Public Utilities Commission in conducting the comprehensive audit recommended in Safety Recommendation P-11-22. (P-11-16) Require that all natural gas transmission pipelines be configured so as to accommodate in-line inspection tools, with priority given to older pipelines. (P-11-17) Revise your integrity management inspection protocol to (1) incorporate a review of meaningful metrics; (2) require auditors to verify that the operator has a procedure in place for ensuring the completeness and accuracy of underlying information; (3) require auditors to review all integrity management performance measures reported to the Pipeline and Hazardous Materials Safety Administration and compare the leak, failure, and incident measures to the operator’s risk model; and (4) require setting performance goals for pipeline operators at each audit and follow up on those goals at subsequent audits. (P-11-18) (1) Develop and implement standards for integrity management and other performance-based safety programs that require operators of all types of pipeline systems to regularly assess the effectiveness of their programs using clear and meaningful metrics, and to identify and then correct deficiencies; and (2) make those metrics available in a centralized database. (P-11-19) Work with state public utility commissions to (1) implement oversight programs that employ meaningful metrics to assess the effectiveness of their oversight programs and make those metrics available in a centralized database, and (2) identify and then correct deficiencies in those programs. (P-11-20) In addition, Safety Recommendations P-11-1 and -2 to PHMSA are classified “Closed—Superseded” in section 2.4.2, “Notifying Emergency Responders,” of the accident report. The NTSB also issued safety recommendations to the U.S. Secretary of Transportation, the governor of the state of California, the California Public Utilities Commission, the Pacific Gas and Electric Company, the American Gas Association, and the Interstate Natural Gas Association of America. In response to the recommendations in this letter, please refer to Safety Recommendations P-11-8 through -20. If you would like to submit your response electronically rather than in hard copy, you may send it to the following e-mail address: correspondence@ntsb.gov. If your response includes attachments that exceed 5 megabytes, please e-mail us asking for instructions on how to use our secure mailbox. To avoid confusion, please use only one method of submission (that is, do not submit both an electronic copy and a hard copy of the same response letter).#

Page 1919 Chairman HERSMAN, Vice Chairman HART, and Members SUMWALT, ROSEKIND, and WEENER concurred in these recommendations and the reclassification of Safety Recommendations P-11-1 and -2. Chairman HERSMAN filed a concurring statement and Vice Chairman HART filed a concurring and dissenting statement, both of which are attached to the pipeline accident report for this accident. [Original Signed] By: Deborah A.P. Hersman Chairman#

Page 20Safety Recommendation Reiteration List SR Number Reiteration Number Report Number Report Date P-11- 008 1 PAR- 12-01 7/10/2012 Accident Description Enbridsge Incorporated Hazardous Liquid Pipeline Rupture And Release Accident City Accident State Marshall MI Accident Date 7/25/2010#