NTSB Safety Recommendation Letter P-11-022 through P-11-023

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: September 26, 2011 In reply refer to: P-11-22 and -23 Mr. Michael R. Peevey President California Public Utilities Commission 505 Van Ness Avenue, Room 5218 San Francisco, California 94102 The National Transportation Safety Board (NTSB) is an independent Federal agency charged by Congress with investigating transportation accidents, determining their probable cause, and making recommendations to prevent similar accidents from occurring. We are providing the following information to urge your organization to take action on the safety recommendations in this letter. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. These recommendations are derived from the NTSB’s investigation of the September 9, 2010, San Bruno, California, pipeline accident and are consistent with the evidence we found and the analysis we performed. As a result of this investigation, the NTSB has issued 29 safety recommendations, 2 of which are addressed to the California Public Utilities Commission (CPUC). Information supporting these recommendations is discussed below. The NTSB would appreciate a response from you within 90 days addressing the actions you have taken or intend to take to implement our recommendations. On September 9, 2010, about 6:11 p.m. Pacific daylight time, a 30-inch-diameter segment of an intrastate natural gas transmission pipeline known as Line 132, owned and operated by the Pacific Gas and Electric Company (PG&E), ruptured in a residential area in San Bruno, California. The rupture occurred at mile point 39.28 of Line 132, at the intersection of Earl Avenue and Glenview Drive. The rupture produced a crater about 72 feet long by 26 feet wide. The section of pipe that ruptured, which was about 28 feet long and weighed about 3,000 pounds, was found 100 feet south of the crater. PG&E estimated that 47.6 million standard cubic feet of natural gas was released. The released natural gas ignited, resulting in a fire that 8275C#

Page 22 destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area.1 The NTSB determined that the probable cause of the accident was PG&E’s (1) inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity management program, which failed to detect and repair or remove the defective pipe section. Contributing to the accident were the CPUC’s and the U.S. Department of Transportation’s exemptions of existing pipelines from the regulatory requirement for pressure testing, which likely would have detected the installation defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of PG&E’s pipeline integrity management program. Contributing to the severity of the accident were the lack of either automatic shutoff valves or remote control valves on the line and PG&E’s flawed emergency response procedures and delay in isolating the rupture to stop the flow of gas. Summary of PG&E Practices The NTSB accident investigation revealed multiple deficiencies with PG&E’s practices. To summarize, PG&E’s practices were revealed to be inadequate because— • The accident pipe segment did not meet any known pipeline specifications. • Construction and quality control measures for the 1956 relocation project were inadequate in that they did not identify visible defects. • The integrity management program, including self-assessment of that program, was ineffective. • Emergency response to the pipeline rupture was slow, and isolation and shutdown of gas flow were unacceptably delayed. • The postaccident drug and alcohol testing program had multiple deficiencies. • Supervisory center and data acquisition (SCADA) staff roles and duties were poorly defined. • SCADA work clearance procedures were inadequate. • Critical components at the Milpitas Terminal were susceptible to single-point failures. 1 For additional information, see Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010, Pipeline Accident Report NTSB/PAR-11/01 (Washington, DC: National Transportation Safety Board, 2011), which is available on the NTSB website at <http://www.ntsb.gov/>.#

Page 33 • The public awareness program, including self-assessment, was deficient and ineffective. Although PG&E has taken some corrective actions since the accident, many of these deficiencies should have been recognized and corrected before the accident. Further, the NTSB notes that several of the deficiencies revealed by this investigation, such as poor quality control during pipeline installation and inadequate emergency response, were also factors in the 2008 explosion of a PG&E gas distribution line in Rancho Cordova, California.2 That accident involved the inappropriate installation of a pipe piece that was not intended for operational use and did not meet applicable pipe specifications. The response to that event was inadequate in that an unqualified person was initially dispatched to respond to the emergency, and there was an unnecessary delay in dispatching a properly trained and equipped technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in San Francisco,3 which involved inaccurate record-keeping, the dispatch of first responders who were not trained or equipped to close valves, and unacceptable delays in shutting down the pipeline. Accident investigations often uncover a broad range of causal relationships or deficiencies that extend beyond the immediacy of components damaged or broken in a system failure. As indicated by the list above, a multitude of deficient operational procedures and management controls led to hazardous circumstances persisting and growing over time until the pipeline rupture occurred. These higher-order or organizational accident factors must be addressed to improve PG&E’s safety management practices. Organizational accidents have multiple contributing causes, involve people at numerous levels within a company, and are characterized by a pervasive lack of proactive measures to ensure adoption and compliance with a safety culture. Moreover, organizational accidents are catastrophic events with substantial loss of life, property, and environment; they also require complex organizational changes in order to avoid them in the future. In its report on the 2009 collision of two Washington Metropolitan Area Transit Authority trains near Fort Totten Station in Washington, DC,4 the NTSB stated that “the accident did not result from the actions of an individual but from the ‘accumulation of latent conditions within the maintenance, managerial and organizational spheres’ making it an example of a ‘quintessential organizational accident.’”5 The Chicago Transit Authority train derailment in 2006, 6 which caused injuries to 152 people 2 Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010). 3 Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 (Washington, DC: National Transportation Safety Board, 1982). 4 Collision of Two Washington Metropolitan Area Transit Authority Metrorail Trains Near Fort Totten Station, Washington D.C., June 22, 2009, Railroad Accident Report NTSB/RAR-10/02 (Washington, DC: National Transportation Safety Board, 2010). 5 (a) J. Reason, Managing the Risks of Organizational Accidents (Burlington, Vermont: Ashgate Publishing Company, 1997). (b) J. Reason, “Achieving a Safe Culture: Theory and Practice,” Work and Stress, vol. 12 (1998), p. 227. 6 Derailment of Chicago Transit Authority Train Number 220 Between Clark/Lake and Grand/Milwaukee Stations, Chicago, Illinois, July 11, 2006, Railroad Accident Report NTSB/RAR-07/02 (Washington, DC: National Transportation Safety Board, 2007).#

Page 44 and over $1 million in damages, is another case study in organizational accidents. Similarly, the BP Texas City Refinery organizational accident in 20057 killed 15 people, injured 180 others, and caused financial losses exceeding $1.5 billion. The character and quality of PG&E’s operation, as revealed by this investigation, indicate that the San Bruno pipeline rupture was an organizational accident. PG&E did not effectively utilize its resources to define, implement, train, and test proactive management controls to ensure the operational and sustainable safety of its pipelines. Moreover, many of the organizational deficiencies were known to PG&E, as a result of the previous pipeline accidents in San Francisco in 1981, 8 and in Rancho Cordova, California, in 2008.9 As a lesson from those accidents, PG&E should have critically examined all components of its pipeline installation to identify and manage the hazardous risks, as well as to prepare its emergency response procedures. If this recommended approach had been applied within the PG&E organization after the San Francisco and Rancho Cordova accidents, the San Bruno accident might have been prevented. Therefore, based on the circumstances of this accident, the NTSB concludes that the deficiencies identified during this investigation are indicative of an organizational accident. The NTSB also concludes that the multiple and recurring deficiencies in PG&E operational practices indicate a systemic problem. The NTSB recommends that the CPUC, with assistance from the Pipeline and Hazardous Materials Safety Administration (PHMSA), conduct a comprehensive audit of all aspects of PG&E operations, including control room operations, emergency planning, record-keeping, performance-based risk and integrity management programs, and public awareness programs. Further, the NTSB recommends that the CPUC require PG&E to correct all deficiencies identified as a result of the San Bruno, California, accident investigation, as well as any additional deficiencies identified through the comprehensive audit recommended in Safety Recommendation P-11-22, and verify that all corrective actions are completed. The NTSB urges the CPUC and PHMSA to complete this comprehensive audit and require PG&E to take corrective actions as soon as possible, to reap the maximum safety benefit. The NTSB believes that 6 months would be a reasonable time frame for conducting the audit and that an additional 6 months after the completion of the audit would be a reasonable deadline for PG&E to take action in response to audit findings. Therefore, the National Transportation Safety Board makes the following recommendations to the California Public Utilities Commission: With assistance from the Pipeline and Hazardous Materials Safety Administration, conduct a comprehensive audit of all aspects of Pacific Gas and Electric Company operations, including control room operations, emergency planning, record-keeping, performance-based risk and integrity management programs, and public awareness programs. (P-11-22) 7 Refinery Explosion and Fire, Investigation Report, report No. 205-04-1-TX (Washington, DC: U.S. Chemical Safety and Hazard Investigation Board, 2007). 8 NTSB/PAR-82/01. 9 NTSB/PAB-10/01.#

Page 55 Require the Pacific Gas and Electric Company to correct all deficiencies identified as a result of the San Bruno, California, accident investigation, as well as any additional deficiencies identified through the comprehensive audit recommended in Safety Recommendation P-11-22, and verify that all corrective actions are completed. (P-11-23) The NTSB also issued safety recommendations to the U.S. Secretary of Transportation, the Pipeline and Hazardous Materials Safety Administration, the governor of the state of California, the Pacific Gas and Electric Company, the American Gas Association, and the Interstate Natural Gas Association of America. Additionally, the report reclassifies two previously issued recommendations to the Pipeline and Hazardous Materials Safety Administration. In response to the recommendations in this letter, please refer to Safety Recommendations P-11-22 and -23. If you would like to submit your response electronically rather than in hard copy, you may send it to the following e-mail address: correspondence@ntsb.gov. If your response includes attachments that exceed 5 megabytes, please e-mail us asking for instructions on how to use our secure mailbox. To avoid confusion, please use only one method of submission (that is, do not submit both an electronic copy and a hard copy of the same response letter). Chairman HERSMAN, Vice Chairman HART, and Members SUMWALT, ROSEKIND, and WEENER concurred in these recommendations. Chairman HERSMAN filed a concurring statement and Vice Chairman HART filed a concurring and dissenting statement, both of which are attached to the pipeline accident report for this accident. [Original Signed] By: Deborah A.P. Hersman Chairman#