{"operation":"document","citation":"P-11-008 through P-11-020","title":"NTSB Safety Recommendation Letter P-11-008 through P-11-020","source_type":"guidance","agency":"National Transportation Safety Board","status":"guidance","official":true,"published_on":"2011-09-26","effective_on":"2011-09-26","summary":"Official NTSB transmittal letter for safety recommendations P-11-008 through P-11-020, issued 2011-09-26.","machine_formats":{"json":"https://regulus.evalyn.ai/document/ntsb-transmittal-letter-p-11-008-020.json","markdown":"https://regulus.evalyn.ai/document/ntsb-transmittal-letter-p-11-008-020.md"},"app_url":"https://regulus.evalyn.ai/document/ntsb-transmittal-letter-p-11-008-020","source_url":"https://www.ntsb.gov/safety/safety-recs/recletters/P-11-008-020.pdf","body":"Page 1\nNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: September 26, 2011 In reply refer to: P-11-8 through -20 and P-11-1 and P-11-2 (Reclassification) The Honorable Cynthia L. Quarterman Administrator Pipeline and Hazardous Materials Safety Administration Washington, DC 20590 On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.1 The NTSB determined that the probable cause of the accident was PG&E’s (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the California Public Utilities Commission’s (CPUC) and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also 1 For additional information, see Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010, Pipeline Accident Report NTSB/PAR-11/01 (Washington, DC: National Transportation Safety Board, 2011), which is available on the National Transportation Safety Board (NTSB) website at <http://www.ntsb.gov/>. 8275C\n\nPage 2\n2 contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. Notifying Emergency Responders The NTSB noted that PG&E did not notify emergency officials that the accident involved the rupture of one of PG&E’s pipelines, even after they had deduced this to be the case. On June 8, 2011, the NTSB made the following recommendations to address these issues. Specifically, the NTSB recommended that the Pipeline and Hazardous Materials Safety Administration (PHMSA) do the following: Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of sharing system-specific information, including pipe diameter, operating pressure, product transported, and potential impact radius, about their pipeline systems with the emergency response agencies of the communities and jurisdictions in which those pipelines are located. (P-11-1) Issue guidance to operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines regarding the importance of control room operators immediately and directly notifying the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. (P-11-2) To PG&E, NTSB recommended the following: Require your control room operators to notify, immediately and directly, the 911 emergency call center(s) for the communities and jurisdictions in which your transmission and/or distribution pipelines are located, when a possible rupture of any pipeline is indicated. (P-11-3) Because of emergency response awareness issues discovered in the Carmichael, Mississippi,2 and San Bruno investigations, the NTSB is concerned that similar problems may exist with other pipeline operators and believes that the guidance recommended in Safety Recommendations P-11-1 and -2 should be codified as requirements. To address these concerns, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to provide system-specific information about their pipeline systems to the emergency response agencies of the communities and jurisdictions in which those pipelines are located. This information should include pipe diameter, operating pressure, product transported, and potential impact radius. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-1 is classified 2 See Rupture of Hazardous Liquid Pipeline With Release and Ignition of Propane, Carmichael, Mississippi, November 1, 2007, Pipeline Accident Report NTSB/PAR-09/01 (Washington, DC: National Transportation Safety Board, 2009).\n\nPage 3\n3 “Closed—Superseded.” Further, the NTSB recommends that PHMSA require operators of natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that their control room operators immediately and directly notify the 911 emergency call center(s) for the communities and jurisdictions in which those pipelines are located when a possible rupture of any pipeline is indicated. As a result of this new recommendation to PHMSA, Safety Recommendation P-11-2 is classified “Closed—Superseded.” Line Break Recognition Although supervisory control and data acquisition (SCADA) staff quickly realized that there had been a gas line break in San Bruno, they were slow to recognize the connection between the line break and the overpressure at the Milpitas Terminal, and some staff were initially unsure of whether the break was in a transmission or a distribution line. In a postaccident interview, SCADA operator B3 stated that within 7 minutes of the rupture, he knew there had been a break in Line 132, and that by 6:30 p.m., he knew it was within a 12-mile corridor in the vicinity of San Bruno. At 6:53 p.m., SCADA operator D indicated that he knew the break was in Line 132, telling the on-scene SCADA transmission and regulation supervisor, “Yeah, absolutely we believe it’s a break on Line 132.” However, at about that time, there was still confusion among other employees as indicated by comments made at 6:51 p.m. by SCADA operator C to a PG&E pipeline engineer, indicating that although the engineer said he thought there was a PG&E transmission line close to the area of the fire, SCADA operator C did not think the break was in a transmission line. At 6:55 p.m., in a telephone discussion between SCADA operator C and the on-scene PG&E gas maintenance and construction superintendent, both indicated that they believed a distribution line and not a transmission line had been breached. SCADA staff also had difficulties determining the exact location of the rupture. At 6:49 p.m., the SCADA center 4 was still uncertain of the rupture point, as illustrated by the comment of the senior SCADA coordinator to a dispatch employee, “We are going to feed the line break at this pressure but I would take the pressure down if I knew more about what was feeding it… .” The PG&E SCADA system lacked several tools that could have assisted the staff in recognizing and pinpointing the location of the rupture, such as real-time leak or line break detection models, and closely spaced flow and pressure transmitters. A real-time leak detection application is a computer-based model of the transmission system that runs simultaneously with SCADA and provides greater feedback to SCADA operators when a large scale leak, line break, or system anomaly is present. Such models use actual SCADA pressures and flows to calculate actual and expected hydraulic performance; when the values do not match, an alarm is generated. 3 SCADA operators B, C, and D referenced in this letter were all working at the SCADA center in San Francisco. Operator D became the primary point of contact for workers at the Milpitas Terminal on the evening of the accident. 4 In this letter, SCADA center refers to PG&E’s gas control center.\n\nPage 4\n4 Appropriate spacing of pressure transmitters at regular intervals5 quickly identify pressure decreases that point toward a leak or line break. allows SCADA operators to The NTSB concludes that PG&E’s SCADA system limitations contributed to the delay in recognizing that there had been a transmission line break and quickly pinpointing its location. Therefore, the NTSB recommends that PHMSA require that all operators of natural gas transmission and distribution pipelines equip their SCADA systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. Rapid Shutdown, Automatic Shutoff Valves, and Remote Control Valves Two mechanics had self-reported to the Colma yard at 6:35 p.m., and they decided to depart the yard at 7:06 p.m. to shut off the valves. Because gas was being supplied to the break from both the north and the south, shutdown and isolation of the rupture required closure of manual shutoff valves closest to the break, which were located about 1.5 miles apart, on either end of the break. The mechanics identified and manually closed those valves at 7:30 p.m. (south valve) and 7:46 p.m. (north valve). Also, about 7:29 p.m., the SCADA center remotely closed valves at the Martin Station in response to a request from a SCADA transmission and regulation supervisor who had joined the mechanics. The NTSB is concerned that the mechanics were unnecessarily held at the Colma yard and that the response could have been delayed even longer if the two mechanics had waited for official orders from PG&E. Further, the SCADA center staff could have reduced the flow sooner by shutting the remote valves at the Martin Station sooner, but they did not. These delays needlessly prolonged the release of gas and prevented emergency responders from accessing the area. The total heat and radiant energy released by the burning gas was directly proportional to the time gas flowed freely from the ruptured pipeline. Therefore, as vegetation and homes ignited, the fire would have spread and led to a significant increase in property damage. The pressurized flow from the south resulted in an intense flame front similar to a blowtorch, and emergency responders were unable to gain access to the area. If the gas had been shut off earlier, removing fuel flow, the fire would likely have been smaller and resulted in less damage. Also, buildings that would have provided protection to residents in a shorter duration fire were compromised because of the elevated heat. In addition to exposing residents and their property to increased risk, the prolonged fire also negatively affected emergency responders, who were put at increased risk by having to be in close proximity to fire for a longer time and were not available to respond to other potential emergencies while they were waiting for the fire to subside. 5 SCADA data on Line 132 are currently received from only a few transmitters at randomly spaced intervals.\n\nPage 5\n5 The NTSB concludes that the 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was excessive. This delay, which contributed to the severity and extent of property damage and increased risk to the residents and emergency responders, in combination with the failure of the SCADA center to expedite shutdown of the remote valves at the Martin Station, contributed to the severity of the accident. The NTSB has long been concerned about the lack of standards for rapid shutdown and the lack of requirements for automatic shutoff valves (ASV) or remote control valves (RCV) in high consequence areas (HCA). As far back as 1971, the NTSB recommended, in Safety Recommendation P-71-1, the development of standards for rapid shutdown of failed natural gas pipelines. In 1995, the NTSB recommended, in Safety Recommendation P-95-1, that the Research and Special Programs Administration (RSPA), the predecessor agency of PHMSA, expedite requirements for installing automatic- or remote-operated mainline valves on high-pressure pipelines in urban and environmentally sensitive areas to provide for rapid shutdown of failed pipeline segments. The NTSB classified Safety Recommendation P-95-1 “Closed—Acceptable Action,” believing that the RSPA 2004 integrity management rulemaking (requiring that each gas transmission operator determine whether installing ASVs or RCVs would be an efficient means of adding protection to an HCA) would lead to a more widespread use of ASVs and RCVs. However, it did not. Federal regulations prescribe, at Title 49 Code of Federal Regulations (CFR) 192.179, the spacing of valves on a transmission line based on class location. However, other than for pipelines with alternative maximum allowable operating pressures (MAOP), 6 the regulations do not require a response time to isolate a ruptured gas line, nor do they explicitly require the use of ASVs or RCVs. The regulations give the pipeline operator discretion to decide whether ASVs or RCVs are needed in HCAs as long as they consider the factors listed under 49 CFR 192.935(c).7 Therefore, there is little incentive for an operator to perform an objective risk analysis, as illustrated by PG&E’s June 14, 2006, memorandum—which was issued after the CPUC 2005 audit identified PG&E’s failure to consider the issue and does not directly discuss any of the factors listed in section 192.935(c). Rather, it cites industry references to support the conclusion that most of the damage from a pipeline rupture occurs within the first 30 seconds, and that the duration of the resulting fire “has (little or) nothing to do with human safety and property damage.” The memorandum concludes that the use of an ASV or an RCV as a prevention and mitigation measure in an HCA would have “little or no effect on increasing human safety or protecting properties.” In the case of the San Bruno transmission line break, nearby RCVs could have significantly reduced the amount of time the fire burned, and thus the severity of the accident. Had the two isolation valves, located 1.5 miles apart, been outfitted with remote closure 6 Under 49 CFR 192.620, “Alternative Maximum Allowable Operating Pressure for Certain Steel Pipelines, ” issued in 2008, an operator is allowed to operate a pipeline at up to 80 percent specified minimum yield strength (SMYS) in class 2 locations as long as it meets a very specific and stringent set of criteria. Section 192.620(c)(3) states that an RCV or ASV is required for such pipelines if the response time to mainline valves exceeds 1 hour under normal driving conditions and speed limits. 7 Those factors are (1) the swiftness of leak detection and pipe shutdown capabilities; (2) the type of gas being transported; (3) the operating pressure; (4) the rate of potential release; (5) the pipeline profile; (6) the potential for ignition; and (7) the location of nearest response personnel.\n\nPage 6\n6 capability, prompt closure of those valves would have reduced the amount of fuel burned by the fire and allowed firefighters to enter the affected area sooner. The PG&E manager of gas system operations acknowledged at the NTSB’s investigative hearing held on March 1–3, 2011, that the use of RCVs could have reduced the time it took to isolate the rupture by about 1 hour. Damage from the pipeline rupture could have been reduced significantly if the valves on either end of the rupture point had been equipped with ASVs. Analysis of pressure differentials indicated that the San Bruno rupture would have resulted in the closure of an ASV at the downstream location8 and would likely also have resulted in the closure of an ASV at the upstream location.9 Even the closing of a downstream ASV alone would have been beneficial in that it would have immediately alerted SCADA to a more precise location of the break. Concerns about ASVs have focused on the cost of installation and their susceptibility to inadvertently trip based on pressure transients in the system. However, vendors have developed newer models that address these shortcomings by combining the features of traditional ASVs with RCVs. These “smart” valves include sensors that can trend the pressure transients on a line to identify what constitutes normal operation, thereby lessening the chances of an inappropriate shutdown. Also, the newer models can alert a SCADA center when the valve hits a trip point, allowing SCADA operators the option of overriding the valve closure and precluding an undesired shutdown. The NTSB concludes that the use of ASVs or RCVs along the entire length of Line 132 would have significantly reduced the amount of time taken to stop the flow of gas and to isolate the rupture. The NTSB is aware that PG&E is in the process of expanding its use of ASVs and RCVs and has added this capability to some valve locations since the accident. Still, the NTSB recommends that PHMSA amend 49 CFR 192.935(c) to directly require that ASVs or RCVs in HCAs and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. Deficiencies in Postaccident Drug and Alcohol Testing After the accident, PG&E identified four employees at the Milpitas Terminal for postaccident toxicological testing pursuant to 49 CFR 199.105 and 49 CFR 199.225. Test results were negative for the presence of specified drugs. Testing for drugs was accomplished successfully within the time constraints defined in 49 CFR 199.105; that is, within 32 hours of the accident. However, alcohol testing was not conducted properly in accordance with 49 CFR 199.225, which requires that testing be administered within 8 hours of an accident, and, 8 The pressure decay at the Martin Station showed a decrease from 386 to 200 pounds per square inch, gauge (psig) in the course of 3 minutes (62 psig per minute), beginning at 6:11 p.m. This drop would have been more than sufficient to trip an ASV located at the downstream valve near the rupture point. 9 The pressure decay in Line 132 was not captured because the transmitter at that location was not installed directly on the main line but on a smaller transmission line (at Half Moon Bay) that branched off from Lines 132 and 109. Although the Half Moon Bay pressure readings cannot be used past 6:11 p.m. to approximate the Line 132 pressures upstream of the rupture, because the differential pressure was great enough to trip an ASV on the smaller line branching off Line 132 at Half Moon Bay, an ASV located on Line 132 likely would have tripped as well. (The smaller line crossed the San Andreas fault and, therefore, was equipped with an ASV to address seismic risk.)\n\nPage 7\n7 if it is not, the operator shall cease attempts to do so. Results for the alcohol tests were invalid and therefore, the use of alcohol cannot be excluded. Alcohol testing of the four Milpitas Terminal employees commenced at 3:10 a.m. and concluded at 5:02 a.m. on September 10, 2010. The accident occurred at about 6:11 p.m. on the previous evening. Therefore, alcohol testing should have been completed by 2:11 a.m. on September 10, at the latest. PG&E officials explained that toxicological testing was delayed because the decision to perform testing was not made until approximately midnight and that the request for testing was made at 12:30 a.m. The NTSB is concerned by PG&E’s delay in contacting the toxicological testing contractor until 12:30 a.m., more than 6 hours after the rupture. Further, upon arrival at the Milpitas Terminal about 2:00 a.m., the contractor should have determined the time of the rupture and attempted to expedite alcohol testing, given that only minutes remained before the regulations prohibited testing. The NTSB is concerned that the alcohol testing was conducted after the prescribed 8 hours following an accident. Further, the NTSB is concerned that PG&E did not perform any drug or alcohol testing of its SCADA staff. The regulations in 49 CFR 199.105 and 49 CFR 199.225 require testing of any employee whose performance cannot be discounted completely as a contributing factor to the accident and that a decision not to administer a test must be based on a determination that the employee’s performance “could not have contributed to the accident.” The SCADA personnel were directly involved in monitoring and controlling the events that unfolded during the accident scenario. Therefore, the SCADA personnel should have been tested. The NTSB concludes that the 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to properly record an explanation for the delay, and the failure to conduct drug or alcohol testing on the SCADA center staff all demonstrate that the PG&E postaccident toxicological program was ineffective. The NTSB is concerned that the regulations requiring operators to conduct postaccident drug and alcohol testing give operators too much discretion in deciding which employees to test, because it states that the decision not to administer a drug test “…must be based on the best information available immediately after the accident that the employee’s performance could not have contributed to the accident…”, and the decision not to administer an alcohol test “…shall be based on the operator’s determination, using the best available information at the time of the determination, that the covered employee’s performance could not have contributed to the accident.” Therefore, the NTSB recommends that PHMSA amend 49 CFR 199.105 and 49 CFR 199.225 to eliminate operator discretion with regard to testing of covered employees. The revised language should require drug and alcohol testing of each employee whose performance either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. The NTSB also recommends that PHMSA issue immediate guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially involved personnel despite uncertainty about the circumstances of the accident.\n\nPage 8\n8 Grandfathering of Pre-1970 Pipelines Of broader concern is the exemption of pre-1970 pipelines nationwide from the requirement for a postconstruction hydrostatic pressure test. This exemption was added at the final stage of rulemaking, not having been subject to public comment as part of the original notice of proposed rulemaking (NPRM). It was based on an assertion from the Federal Power Commission that, “there are thousands of miles of jurisdictional interstate pipelines installed prior to 1952 [when the voluntary industry pressure test standards incorporated in section 192.619 were established], in compliance with the then existing codes, which could not continue to operate at their present pressure levels and be in compliance with” the proposed standard in the NPRM calling for the MAOP to be limited to a percentage of the pressure to which it was tested after construction. It is not clear from the preamble to the final rule what rationale, if any, the Federal Power Commission or the U.S. Department of Transportation (DOT) pipeline staff relied on to justify exempting pipelines such as Line 132, which were constructed without complying with the voluntary hydrostatic pressure testing standards of then-existing codes. Grandfathering of Line 132 by the CPUC in 1961 and then by RSPA in 1970 resulted in missed opportunities to detect the defective pipe. In 1961, the CPUC began requiring a postconstruction hydrostatic test to 1.5 times MAOP for newly constructed pipelines in class 3 areas. In 1970, RSPA began requiring a postconstruction hydrostatic test to 1.5 times MAOP in class 3 locations. For a MAOP of 400 psig, this corresponds to a hydrostatic test pressure of 600 psig. However, pursuant to the 1970 grandfather clause, Line 132 and other existing gas transmission pipelines with no prior hydrostatic test were permitted to use as their MAOP the highest operating pressure recorded during the previous 5 years (that is, between 1965–1970) and allowed to continue operating with no further testing. Thus, the NTSB concludes that if the grandfathering of older pipelines had not been permitted since 1961 by the CPUC and since 1970 by the DOT, Line 132 would have undergone a hydrostatic pressure test that would likely have exposed the defective pipe that led to this accident. Other examples of how the grandfather clause results in reduced safety margins include the following: • Title 49 CFR 192.195, “Protection Against Accidental Overpressuring,” which requires that pressure relieving or limiting devices ensure that pipeline pressure (for pipelines operated at 60 psig or higher) does not exceed MAOP plus 10 percent or the pressure that produces a hoop stress of 75 percent of SMYS, whichever is lower. However, for a pipeline whose MAOP was established in accordance with the grandfather clause, this pressure (MAOP plus 10 percent) may be greater than any pressure it was subjected to in its lifetime. • Title 49 CFR 192.933(d)(1), “Immediate Repair Conditions,” which allows operators to continue operating a gas pipeline with a known defect unless “a calculation of the remaining strength of the pipe shows a predicted failure pressure less than or equal to 1.1 times the maximum allowable operating pressure.” Again, this pressure (1.1 times the MAOP) may be greater than any pressure a grandfathered pipeline was subjected to in its lifetime.\n\nPage 9\n9 More than half of the nation’s onshore gas transmission pipelines (about 180,000 miles) were installed prior to the effective date of the 1970 requirement for hydrostatic pressure testing. PHMSA does not keep track of how many of these pipelines have had their MAOP established under the grandfather clause. The state of California has already taken action to address grandfathering for pipelines within its jurisdiction. In its June 9, 2011, order requiring PG&E and other gas transmission operators regulated by the CPUC to either hydrostatically pressure test or replace certain transmission pipelines with grandfathered MAOPs, the CPUC stated that natural gas transmission pipelines “must be brought into compliance with modern standards for safety” and “historic exemptions must come to an end.” The NTSB agrees and concludes that there is no safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement for postconstruction hydrostatic pressure testing. Studies have shown that hydrostatic pressure testing is most effective when it incorporates a spike test in which the pipeline is initially pressurized to a higher level for a short time. Accordingly, the NTSB recommends that PHMSA amend 49 CFR 192.619 to delete the grandfather clause and require that all gas transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that incorporates a spike test. Regulatory Assumption of Stable Manufacturing- and Construction-Related Defects In accordance with 49 CFR 192.917 (e)(3), an operator may consider manufacturing- and construction-related defects to be stable defects not requiring assessment so long as operating pressure has not increased over the maximum operating pressure (MOP) experienced during the preceding 5 years. When a pipeline with a manufacturing- or construction-related defect is operated above the highest pressure recorded in the preceding 5 years, it must be prioritized as a high risk segment for assessment. According to section 6.3.2 of the integrity management supplement American Society of Mechanical Engineers (ASME)-sponsored code B31.8S,10 2004 edition, in that case, “pressure testing must be performed to address the seam issue.” PG&E raised the pressure at the Milpitas Terminal to 400 psig in 2003 and 2008 to set a 5-year MOP for Line 132. The PG&E director of integrity management and technical support acknowledged at the NTSB investigative hearing that this practice allowed PG&E to regard manufacturing threats as stable, thereby continuing to use only external corrosion direct assessment as the assessment method. Thus, this practice allowed PG&E to avoid seam integrity inspections it might otherwise have been required to conduct. However, the PHMSA deputy associate administrator for field operations testified at the investigative hearing that it was not the intent for this rule to be used to avoid an assessment. (PG&E has discontinued this practice since the accident.) 10 ASME-sponsored code B31.8S, 2004 edition, Managing System Integrity of Gas Pipelines: ASME Code for Pressure Piping, B31 Supplement to ASME B31.8.\n\nPage 10\n10 Furthermore, studies have discredited the assumption that manufacturing- and construction-related defects are stable in pipelines that have not been hydrostatically pressure tested to an appropriate level. According to a Gas Research Institute (GRI)11 report dated September 17, 2004— the risk of pressure-cycle-induced fatigue can be dismissed if and only if the pipeline has been subjected to a reasonably high-pressure hydrostatic test. Therefore, … eliminating the risk of failure from pressure-cycle-induced fatigue crack growth of defects that can survive an initial hydrostatic test of a pipeline requires that the test pressure level must be at least 1.25 times the [MAOP]. 12 Similarly, a 2007 PHMSA report concluded— experience and scientific analysis indicates that manufacturing defects in gas pipelines that have been subjected to a hydrostatic test to 1.25 times MAOP should be considered stable. No integrity assessment is necessary to address that particular threat in such pipelines. The principal challenge for deciding whether or not to consider manufacturing defects to be stable is associated with those gas pipelines that have never been subjected to a hydrostatic test to a minimum of 1.25 times MAOP.13 In summary, under 49 CFR 192.917(e)(3), operators are entitled to consider known manufacturing- and construction-related defects to be stable, even if a line has not been pressure tested to at least 1.25 times its MAOP. However, such defects may not, in actuality, be stable. The NTSB concludes that the premise in 49 CFR Part 192 of the Federal pipeline safety regulations that manufacturing- and construction-related defects can be considered stable even when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the MAOP is not supported by scientific studies. Therefore, the NTSB recommends that PHMSA amend 49 CFR Part 192 of the Federal pipeline safety regulations so that manufacturing- and construction-related defects can only be considered stable if a gas pipeline has been subjected to a postconstruction hydrostatic pressure test of at least 1.25 times the MAOP. Summary of PG&E Practices The NTSB accident investigation revealed multiple deficiencies with PG&E’s practices. To summarize, PG&E’s practices were revealed to be inadequate because— • The accident pipe segment did not meet any known pipeline specifications. • Construction and quality control measures for the 1956 relocation project were inadequate in that they did not identify visible defects. 11 In 2000, the GRI combined with the Institute of Gas Technology to form the Gas Technology Institute (GTI), a nonprofit research and development organization that develops, demonstrates, and licenses new energy technologies for private and public clients, with a particular focus on the natural gas industry. PG&E is a member of the GTI. 12 Effects of Pressure Cycles on Gas Pipelines, report GRI-04/0178 (Des Plaines, Illinois: Gas Research Institute, 2004). 13 Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines, No. 05-12R (Washington, DC: Pipeline and Hazardous Materials Safety Administration, 2007).\n\nPage 11\n11 • The integrity management program, including self-assessment of that program, was ineffective. • Emergency response to the pipeline rupture was slow, and isolation and shutdown of gas flow were unacceptably delayed. • The postaccident drug and alcohol testing program had multiple deficiencies. • SCADA staff roles and duties were poorly defined. • SCADA work clearance procedures were inadequate. • Critical components at the Milpitas Terminal were susceptible to single-point failures. • The public awareness program, including self-assessment, was deficient and ineffective. Although PG&E has taken some corrective actions since the accident, many of these deficiencies should have been recognized and corrected before the accident. Further, the NTSB notes that several of the deficiencies revealed by this investigation, such as poor quality control during pipeline installation and inadequate emergency response, were also factors in the 2008 explosion of a PG&E gas distribution line in Rancho Cordova, California.14 That accident involved the inappropriate installation of a pipe piece that was not intended for operational use and did not meet applicable pipe specifications. The response to that event was inadequate in that an unqualified person was initially dispatched to respond to the emergency, and there was an unnecessary delay in dispatching a properly trained and equipped technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in San Francisco,15 which involved inaccurate record-keeping, the dispatch of first responders who were not trained or equipped to close valves, and unacceptable delays in shutting down the pipeline. Accident investigations often uncover a broad range of causal relationships or deficiencies that extend beyond the immediacy of components damaged or broken in a system failure. As indicated by the list above, a multitude of deficient operational procedures and management controls led to hazardous circumstances persisting and growing over time until the pipeline rupture occurred. These higher-order or organizational accident factors must be addressed to improve PG&E’s safety management practices. Organizational accidents have multiple contributing causes, involve people at numerous levels within a company, and are characterized by a pervasive lack of proactive measures to ensure adoption and compliance with a safety culture. Moreover, organizational accidents are catastrophic events with substantial loss of life, property, and environment; they also require complex organizational changes in order to avoid them in the future. In its report on the 14 Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010). 15 Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 (Washington, DC: National Transportation Safety Board, 1982).\n\nPage 12\n12 2009 collision of two Washington Metropolitan Area Transit Authority trains near Fort Totten Station in Washington, DC,16 the NTSB stated that “the accident did not result from the actions of an individual but from the ‘accumulation of latent conditions within the maintenance, managerial and organizational spheres’ making it an example of a ‘quintessential organizational accident.’”17 The Chicago Transit Authority train derailment in 2006, 18 which caused injuries to 152 people and over $1 million in damages, is another case study in organizational accidents. Similarly, the BP Texas City Refinery organizational accident in 200519 killed 15 people, injured 180 others, and caused financial losses exceeding $1.5 billion. The character and quality of PG&E’s operation, as revealed by this investigation, indicate that the San Bruno pipeline rupture was an organizational accident. PG&E did not effectively utilize its resources to define, implement, train, and test proactive management controls to ensure the operational and sustainable safety of its pipelines. Moreover, many of the organizational deficiencies were known to PG&E, as a result of the previous pipeline accidents in San Francisco in 1981, 20 and in Rancho Cordova, California, in 2008.21 As a lesson from those accidents, PG&E should have critically examined all components of its pipeline installation to identify and manage the hazardous risks, as well as to prepare its emergency response procedures. If this recommended approach had been applied within the PG&E organization after the San Francisco and Rancho Cordova accidents, the San Bruno accident might have been prevented. Therefore, based on the circumstances of this accident, the NTSB concludes that the deficiencies identified during this investigation are indicative of an organizational accident. The NTSB also concludes that the multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem. Therefore, NTSB recommends that PHMSA assist the CPUC in conducting the comprehensive audit recommended in Safety Recommendation P-11-22. The NTSB urges the CPUC and PHMSA to complete this comprehensive audit and require PG&E to take corrective actions as soon as possible, to reap the maximum safety benefit. The NTSB believes that 6 months would be a reasonable time frame for conducting the audit and that an additional 6 months after the completion of the audit would be a reasonable deadline for PG&E to take action in response to audit findings. 16 Collision of Two Washington Metropolitan Area Transit Authority Metrorail Trains Near Fort Totten Station, Washington D.C., June 22, 2009, Railroad Accident Report NTSB/RAR-10/02 (Washington, DC: National Transportation Safety Board, 2010). 17 (a) J. Reason, Managing the Risks of Organizational Accidents (Burlington, Vermont: Ashgate Publishing Company, 1997). (b) J. Reason, “Achieving a Safe Culture: Theory and Practice,” Work and Stress, vol. 12 (1998), p. 227. 18 Derailment of Chicago Transit Authority Train Number 220 Between Clark/Lake and Grand/Milwaukee Stations, Chicago, Illinois, July 11, 2006, Railroad Accident Report NTSB/RAR-07/02 (Washington, DC: National Transportation Safety Board, 2007). 19 Refinery Explosion and Fire, Investigation Report, report No. 205-04-1-TX (Washington, DC: U.S. Chemical Safety and Hazard Investigation Board, 2007). 20 NTSB/PAR-82/01. 21 NTSB/PAB-10/01.\n\nPage 13\n13 Inspection Technology The detection, identification, and elimination of pipeline defects before they result in catastrophic failures is critical to a successful integrity management program for gas transmission pipelines. In the NTSB’s judgment, the use of specialized in-line inspection tools that identify and evaluate damage caused by corrosion, dents, gouges, and circumferential and longitudinal cracks is a uniquely promising option for identifying defects. Unlike other assessment techniques, in-line inspection is continuous throughout the entire pipeline segment and, when performed periodically, can provide useful information about defect growth. Although in-line inspection technology has detection limitations (generally at best a 90 percent probability that a certain type of known defect will be detected, althou","truncated":true,"body_characters":58912}