NTSB Pipeline Accident Report

40

Figure 18. Schematic of accident pipe.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 1

of 101
NTSB Pipeline Accident Report

41

The length of pups 1–5 varied from 43.00–46.75 inches, and pup 6 measured 

54.25 inches. All six pups were nominal 0.375-inch wall thickness pipe, as was the south long 

joint. However, the north long joint was nominal 0.312-inch wall thickness pipe. The pipe 

material codes on documents associated with the 1956 relocation project specified 0.375-inch 

wall thickness pipe. The circumference of each length of pipe was consistent with nominal 

30-inch-diameter pipe.

There were no observed areas of preexisting external or internal corrosion on any surface 

of the pipe.

1.8.1 Welds

The longitudinal seam welds on pups 1–3 were fabricated using a fusion welding process 

that deposited weld metal along the outer portion of the seam, but left an unwelded region along 

the inner portion of the seam. (See figure 19a.) The weld reinforcement, as well as part of the 

pipe body for pup 1, had been removed by grinding. The unwelded region persisted along the 

entire length of each seam. The size of the unwelded region, combined with the grinding of the 

weld reinforcements (and the pipe body for pup 1), resulted in net intact seam thicknesses of 

0.162, 0.195, and 0.162 inch for pups 1, 2, and 3, respectively. The unwelded region defect was 

observed during a visual weld inspection of each pup. As shown in figure 19a, there was a 

15° difference in the orientation of the inner surface of the pipe across the pup 1 longitudinal 

seam (an angular misalignment). For pup 2, the difference was 0°; and for pup 3, the difference 

was between 7–10°.

The south and north long joints, as well as pup 6, were standard factory-made DSAW 

pipe, made by a submerged arc welding65 process on the outer- and inner-diameter surfaces. (See 

figure 19b.) The outer and inner weld passes overlapped, resulting in full penetration in the joint,

and each weld exhibited a raised weld reinforcement with a smooth surface. No cracks or 

surface-connected defects were observed on the longitudinal seam welds of the DSAW pipe 

sections.

 65 DSAW pipe has been arc welded on the outside and inside of the longitudinal seam.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 2

of 101
NTSB Pipeline Accident Report

42

Figure 19a. Picture showing cross section of longitudinal seam in pup 1.

Figure 19b. Picture showing cross section of longitudinal seam in typical DSAW pipe.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 3

of 101
NTSB Pipeline Accident Report

43

The longitudinal seam welds on pups 4 and 5 were fabricated using a fusion welding 

process that deposited weld metal down along the outer portion of the seam, as well as a manual 

arc welding process that deposited weld metal down along the inner portion of the seam. The 

weld reinforcement on the outer surface of each pup had been removed by grinding. The pup 4 

seam welds achieved near full penetration. The pup 5 outer and inner seam welds penetrated 

0.073 and 0.072 inch into the seam, respectively. X-ray examination of the pup 4 longitudinal 

seam indicated incomplete fusion,66 porosity, and undercutting67

The girth welds were fabricated using a shielded metal (manual) arc welding process

along the outside and inside of the joint.

defects. A similar examination 

of the pup 5 longitudinal seam indicated a lack of penetration defect along the entire length of 

the seam.

68 All girth welds exhibited incomplete fusion, slag 

inclusion,

69

1.8.2 Crack Initiation

and porosity defects at one or more locations. Except for C1 and C6, each girth weld 

exhibited lack of penetration defects, and all but the C2 and C3 welds exhibited undercutting 

defects. Each girth weld exhibited a raised weld reinforcement on the outer surface of the pipe. 

Square pipe ends, as opposed to beveled pipe ends, were observed along several welds.

Fracture features in the center section of pipe were consistent with the rupture initiating at 

a preexisting 2.4-inch-long crack in the pup 1 longitudinal seam 20.3–22.7 inches north of the 

C1 girth weld (approximately mid-span). The direction of crack propagation is indicated by the 

white arrows in figure 20. Optical and electron microscope examination of the fracture initiation 

site indicated that the preexisting crack grew by two different modes prior to the rupture. (See 

figure 21.) The crack first grew by ductile fracture70 starting at the root of the weld, reducing the 

area of the intact cross section, measured over the 2.4-inch-long initiation site, by approximately 

33 percent (stage 1). It subsequently grew by fatigue fracture,71 further reducing the area of the 

intact cross section by approximately 10 percent (stage 2). The ductile fracture and fatigue 

fracture regions are colored yellow and green, respectively, in figure 21. The fracture elsewhere 

along the seam was caused by the rupture (stage 3) and was primarily quasi-cleavage fracture.

72

 66 Incomplete fusion is indicated when weld metal penetrates into the seam but does not melt together with the 

base metal in the body of the pipe.

Occasional small thumbnail-shaped fatigue cracks were observed elsewhere along the pup 1 

weld root. The other pups with unwelded seam defects exhibited one or more ductile fracture 

67 Undercutting is indicated when, in the course of welding the seam, the adjacent pipe body is melted away, 

thereby reducing the wall thickness of the pipe.

68 Girth welds are typically fabricated from outside of the pipe. The pipe ends are beveled to enable complete 

weld penetration.

69 Slag inclusion is indicated when brittle particles are frozen and incorporated into the weld metal.

70 Ductile is a mode of fracture in which the metal ahead of the crack undergoes plastic deformation prior to the 

crack advancing. A plastic material undergoes permanent deformation (that is, strain) in response to an applied load. 

When the load is removed, the object does not return to its original shape. 

71 Fatigue is a mode of fracture, associated with alternating stresses, in which the crack advances with each 

alternating stress cycle. 

72 Quasi-cleavage is a mode of fracture, typically associated with high-deformation rates in otherwise ductile 

materials, that is similar in appearance to a cleavage fracture.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 4

of 101
NTSB Pipeline Accident Report

44

cracks that initiated from the root of the weld but did not exhibit fatigue at the ductile fracture

boundary. 

Figure 20. Picture of pipe section with white arrows showing direction of crack propagation.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 5

of 101
NTSB Pipeline Accident Report

45

Figure 21. Pictures highlighting rupture initiation site in pup 1 longitudinal seam.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 6

of 101
NTSB Pipeline Accident Report

46

1.8.3 Material Properties

The rolling direction of the steel used to fabricate each length of pipe was determined by 

evaluating the orientation and relative length of manganese sulfide inclusions (stringers) in the 

base metal of each length of pipe.

73

The chemical composition of pup 4 differed significantly from the other lengths of pipe. 

Pup 4 had elevated levels of phosphorous, copper, and tin, consistent with steel made from 

recycled scrap material.

Elongated stringers were observed in the longitudinal 

direction in the south and north long joints and pup 6, consistent with plate rolled in the 

longitudinal direction (the standard direction for manufactured pipe). Elongated stringers were 

observed in the transverse direction in pups 1, 2, 3, and 5, consistent with short widths of plate 

rolled in the transverse (nonstandard) direction. The long stringer orientation was undetermined 

for pup 4.

Pups 1, 2, 3, and 5 did not meet the X52 SMYS requirement according to the material 

specifications for pipe purchased by PG&E from Consolidated Western, nor did they meet the 

X42 SMYS requirement (Segment 180 was erroneously listed as X42 in PG&E’s GIS system). 

The yield strength for pups 4 and 6 met the X42 SMYS requirement but did not meet the 

X52 requirement. The yield strength for the south and north long joints met the requirements for 

all specifications.

Table 3 shows the yield strength and tensile strength for all pipe pieces. Table 4 shows 

PG&E 1948 pipe specifications and API pipe specifications in effect at the time of the 1956 pipe 

installation.

Table 3. Average and standard deviation of mechanical test data for all lengths of pipe.

Sample Yield Strengtha (ksib) Tensile Strength (ksi) Elongation (percent in 2 inch)

South long joint 57.0 ± 0.6 83.2 ± 0.3 30.0 ± 0.7

Pup 1 36.6 ± 0.3 63.6 ± 0.2 39.4 ± 0.5

Pup 2 32.0 ± 0.1 52.0 ± 0.0 48.8 ± 0.8

Pup 3 34.9 ± 0.5 60.3 ± 0.3 42.8 ± 0.4

Pup 4 48.3 ± 0.5 79.0 ± 0.0 34.0 ± 0.7

Pup 5 38.5 ± 0.3 71.8 ± 0.3 35.8 ± 1.1

Pup 6 50.5 ± 1.4 78.7 ± 0.3 30.8 ± 0.8

North long joint 54.0 ± 0.4 76.9 ± 0.2 30.4 ± 0.5

a Determined using the 0.5 percent extension under load method. b The abbreviation ksi indicates 1,000 psi.

 73 Stringers are manganese sulfide particles that elongate in the rolling direction when a thick slab of steel is 

reduced in thickness by passing it through a rolling stand at high temperatures.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 7

of 101
NTSB Pipeline Accident Report

47

Table 4. Minimum yield strength, tensile strength, and elongation requirements according to 

PG&E and API pipe specifications.

Specification

Minimum Yield 

Strength (ksi)

Minimum Tensile 

Strength (ksi)

Minimum Elongation

(percent in 2 inch)

7R-61963 PG&E material 

specification 52.0 72.0 22

API 5LX X52, 1954 52.0 66.0 20

API 5LX X42, 1954 42.0 60.0 25

The weld properties of the DSAW lengths of pipe (long joints and pup 6) were compared 

to the weld properties of the other pups. Examination showed that the DSAW seam welds had a 

much finer microstructure74 than the partial longitudinal seam welds in pups 1, 2, and 3 and that 

the lengths of DSAW pipe had heat-affected zones75 that conformed to the shape of the weld,

while pups 1, 2, and 3 each had a wide heat-affected zone of comparatively uniform width that 

extended from the outer surface to the inner surface of the pipe. The features indicated that the 

two sets of welds were fabricated using different rates of heat input and total heat input. The 

microhardness for the DSAW welds ranged from 191–192 HV500,

76

1.8.4 Historical Information About Steel Grades

whereas the microhardness 

for the pup 1, 2, and 3 welds ranged from 155–159 HV500. The microhardness for pup 4 was not 

constant but varied with distance from the pipe surface. The microhardness for the pup 5 welds 

was 191 HV500.

Prior to 1961 and the adoption of General Order 11277

 74 As the molten weld metal cools and freezes, it organizes into crystalline structures called grains. 

Microstructure is a description of the size, appearance, and orientation of the grains. 

by the CPUC, there was no 

regulation in the State of California that governed pipeline construction or the type and testing of 

pipe that PG&E could use for the conveyance of natural gas. Pipeline operators could write their 

own specifications for pipe or rely on consensus standards from organizations such as the 

American Standards Association, API, and the American Society for Testing and Materials 

(ASTM). ASME-sponsored code B31.1, American Tentative Standard Code for Pressure Piping, 

a standard covering pressure piping, was first issued in 1935. In 1952, sections relevant to the 

conveyance of natural gas were issued separately as ASME B31.1.8, Standard Code for Gas 

Transmission and Distribution Piping Systems. In 1955, the code was revised to include the 

four-tier construction type and population density-based class location system in use today. The 

ASME B31.1.8, 1955 edition, did not contain a specification for pipe, but referenced consensus 

standards such as API 5L, API 5LX, ASTM A134, and ASTM 139 (among others).

75 The heat-affected zone is the material next to the weld that reached a temperature high enough to produce 

changes in the structure of the metal. 

76 HV500 is an indentation hardness measurement unit, “HV” referring to the Vickers hardness test. The test was 

done by applying a 500 gram load to a diamond indenter and measuring the size of the resulting impression. Higher 

numbers indicate harder materials.

77 General Order 112 contained the state’s regulatory scheme for gas pipelines.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 8

of 101
NTSB Pipeline Accident Report

48

The API 5L specification was first issued in 1928 and is incorporated today by reference 

in 49 CFR Part 192, Appendix B. In the 1940s and 1950s, it classified pipe according to 

minimum yield strength using letter grades and number grades, and it listed approved welding 

processes. The SMYS for grades A and B was 30 and 35 ksi, respectively. According to the 

specification, the average length for a piece of 5L pipe was to be no less than 17.5 feet. 

In 1948, API issued Standard 5LX, “API Specification for High Test Line Pipe 

(Tentative).”78 Submerged arc welding was an approved process for welding 5LX line pipe. In 

1948, API 5LX mentioned X42, X46, and X52 pipe, but only fully specified X42 pipe.79 The 

specifications for higher grades, such as the X52 cold-expanded80

ASTM 134 and ASTM 139 were two other specifications that pertained to arc welded 

pipe.

pipe manufactured by 

Consolidated Western, were subject to agreement between purchaser and manufacturer. By 1954, 

API 5LX had incorporated X52 specifications, and a separate specification was not required by 

the purchaser. The specified minimum average length for 5LX pipe was 17.5 feet.

81 Whereas API 5L did not permit arc welding of grade A or B pipe during the 1940s and 

1950s, ASTM A134 and ASTM A139 did. Automated welding was specified, but manual 

welding by qualified procedure82

1.8.5 Burst Pressure Study and Finite Element Modeling 

could be substituted if agreed to by purchaser and 

manufacturer. Production weld test specimens with the weld reinforcement removed had to 

achieve 95 percent of the minimum tensile strength for the grade of steel specified or 100 percent

with the weld reinforcement intact. The specified minimum length of ASTM 134 or ASTM 139 

pipe was 20 feet. ASME B31.1.8, 1955 edition, specified a 20 percent lower design pressure for 

these grades of pipe. 

The NTSB conducted a study to estimate the internal pressure required to burst both a 

typical length of pipe and lengths of pipe with seam weld defects similar to those in pups 1, 2, 

and 3. For 30-inch-diameter X42 pipe with a wall thickness of 0.375 inch and no defect, the 

estimated burst pressure was calculated to be 1,300 psig. For pipe with incomplete seam weld 

penetration, such as seen in pups 1, 2, and 3 as fabricated (before the additional crack growth 

discussed in section 1.8.2, “Crack Initiation”), two different calculation methods were used:

 78 The minimum mill strength test requirement for 5LX line pipe was 85 percent of SMYS, whereas the 

minimum mill strength test requirement for API 5L line pipe was 60 percent of SMYS. The SMYS requirements for 

5LX line pipe were also higher than those for 5L line pipe.

79 The 5LX specification dispensed with the letter grade designations, instead designating pipe by an “X” 

followed by the SMYS in ksi. For instance, X52 indicated pipe with a SMYS of 52 ksi. 5LX was merged back into 

5L in the 1980s.

80 “Cold” refers to an operation performed at room temperature. The Consolidated Western process initially 

formed the pipe to a diameter of 29.6 inches and then cold-expanded the pipe to a diameter of 30 inches by placing it 

in a die, plugging the ends of the pipe, and pumping water into the pipe under high pressure.

81 These grades are no longer included in 49 CFR Part 192, Appendix B.

82 A qualified welding procedure is one that has passed a series of tests and inspections.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 9

of 101
NTSB Pipeline Accident Report

49

• Net yielding according to ASME-sponsored code B31G, 2009 edition, Manual for 

Determining the Remaining Strength of Corroded Pipelines.

• Propagation of a crack-like defect83

The seam welds for pups 1, 2, and 3 were fractured in the accident, and their mechanical 

properties could not be measured directly. Therefore, inferred values based on microhardness 

data were used to calculate the estimates. Further, the estimates do not take into account the 

additional effect of the angular misalignment of the pup 1 longitudinal seam, which (as discussed 

below) resulted in greater strains on pup 1. Calculated burst pressure estimates using these two 

methods were 594 and 515 psig for pup 1; 668 and 574 psig for pup 2; and 558 and 430 psig for 

pup 3, respectively. 

according to API 579-1/ASME FFS-1-2007, 

Fitness-for-Service. 

Finite element models were constructed to examine the stresses and strains in sections of 

pipe with differing longitudinal seam welds: (1) one model was based on the geometry of a 

section of pipe with a DSAW seam without defects; (2) one model was based on a section of 

pipe with a geometry similar to pup 1; (3) one model was based on a section of pipe with a 

geometry similar to pup 3 and an angular misalignment of 10°; and (4) one model was based on 

a circular section of pipe with a similarly sized weld defect, but without any angular 

misalignment. Internal pressures up to 400 psig were applied to the models. The material 

properties included elastic and plastic behavior84

The model with the DSAW seam had small stress concentrations at the corners where the 

weld reinforcement intersected the wall of the pipe (on the order of 2 percent of the pipe wall 

thickness in size), but the stress in the model did not reach the yield stress. The unwelded region 

and angular misalignment in the model based on the pup 1 seam created a crack-like geometry 

(that is, notch) leading to a severe stress and strain concentration.

consistent with X42 steel, which has a nominal 

yield stress of 42,000 psi.

85 In that model, at 375 psig, 

the zone of material beyond the yield stress was on the order of half the pipe wall thickness in 

size. (See figures 22a and 22b.) The plastic strains86 at the pup 1 notch tip were more than 100 

percent greater than those of the pipe with the similarly sized weld defect but no angular 

misalignment. The plastic strains were also as much as 40 percent greater than those for the pup 

3 weld geometry.

 83 API 579 defines a crack-like flaw as a flaw that may or may not be the result of linear rupture but has the 

physical characteristics of a crack when detected by a nondestructive evaluation technique. A flaw is defined as a 

discontinuity, irregularity, or defect that is detected by inspection.

84 A plastic material undergoes permanent deformation (that is, strain) in response to an applied load. When the 

load is removed, the object does not return to its original shape. 

85 The term “crack-like” is used to describe a feature that has the shape of a crack but where the material on 

opposite faces of the feature was never fused or bonded.

86 Plastic strain is permanent deformation that occurs when a material is stressed above its yield strength. It 

produces a change in shape that is not reversed when the load is removed.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 10

of 101
NTSB Pipeline Accident Report

50

Figure 22a. Stress contours at an internal pressure of 375 psig for the finite element model of 

the weld geometry similar to pup 1. Contour values are the same as in figure 22b.

Figure 22b. Stress contours at an internal pressure of 375 psig for the finite element model of a 

DSAW seam. Contour values are the same as in figure 22a.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 11

of 101
NTSB Pipeline Accident Report

51

1.9 Pipeline Operations and Management

PG&E was incorporated in California in 1905 and is based in Walnut Creek, California. 

The company—a subsidiary of the PG&E Corporation—provides natural gas and electric service 

to 15 million people throughout a 70,000-square-mile service area in northern and central 

California. This area stretches from Eureka in the north to Bakersfield in the south and from the 

Pacific Ocean to the Sierra Nevada Mountains. The PG&E gas facilities include 42,141 miles of 

natural gas distribution pipelines and 6,438 miles of transmission pipelines, 1,059 of which are 

located in HCAs.

87

PG&E also generates and provides hydroelectric and nuclear power. PG&E is an 

intrastate public utility and is regulated by the CPUC.

Of these 1,059 HCA pipeline miles, 50 miles are in class 1 areas, 29 miles 

are in class 2 areas, 945 miles are in class 3 areas, and 4 miles are in class 4 areas. 

1.9.1 SCADA System Operations

The PG&E SCADA center is located at PG&E headquarters in downtown San Francisco. 

The SCADA center manages the operations of PG&E’s entire gas transmission pipeline system,

including terminals and regulating stations. The center is staffed by three SCADA operators

during the day shift (6:00 a.m.–6:00 p.m.) and two operators during the evening shift

(6:00 p.m.–6:00 a.m.). Also working each shift are one coordinator and one senior coordinator. 

Prior to the shift change, the departing staff provides a verbal briefing to the incoming staff. The 

SCADA operators manage alarms and control set points as well as coordinating fieldwork on 

various pipelines.

The SCADA operators are not assigned specific regions on the pipelines but rather all 

oversee all transmission line operations. Therefore, the operator who acknowledges an alarm 

may not be the same operator working with the field personnel who generated the alarm. Further,

an operator who started as the point of contact for field operations may not be the operator who 

answers the telephone when there are additional questions from the field. All of the operators sit 

next to each another in a common area of the control center.

The SCADA operators have several screens and can select different views for controlling 

the system, starting with the entire peninsula system with a GIS overlay showing flows and 

pressures at key regulating stations and terminals. The operators can select a specific region,

which shows a smaller geographic area in greater detail with cross connects, pressure, flows, and 

status of valves. The operators are also capable of seeing any terminal or regulating station by 

clicking on the station or using a drop-down menu. They can change set points to the specific 

station valves as well as watch the incoming and outgoing line pressures and flows.

 87 Class location is defined in 49 CFR 192.5, and it refers to the number of buildings in an area that is 220 yards 

on either side of the centerline of a continuous 1-mile length of pipeline. Class 1 has 10 or fewer buildings, class 2 

has 10–46 buildings, class 3 has 46 or more buildings, and class 4 has a prevalence of buildings of 4 or more stories.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 12

of 101
NTSB Pipeline Accident Report

52

The PG&E procedure for responding to SCADA alarms requires that during the first 

10 minutes after any alarm, the SCADA operator must acknowledge, analyze, and respond by 

analyzing upstream and downstream points to help determine the system condition and cause of 

the alarm. An additional 10 minutes is allocated for determining the necessary next steps. If 

deemed necessary by the senior SCADA coordinator, an abnormal incident report is filed.

As a result of a rulemaking project initiated prior to the San Bruno accident in response to 

recommendations stemming from an NTSB safety study,

88 on November 20, 2009, PHMSA 

issued a regulation requiring pipeline operators that use SCADA systems to define the roles and 

responsibilities of pipeline controllers during normal, abnormal, and emergency operating 

conditions, and to provide them with the necessary information, training, and processes to fulfill 

those responsibilities. (See 49 CFR 192.631.

89

1.9.1.1 Milpitas Terminal

) In addition, the rule requires operators to have 

written alarm management plans, have a controller training program, and implement methods to 

prevent controller fatigue. Operators are required to develop the procedures by August 1, 2011,

and to implement some of the procedures—including those related to roles and responsibilities 

and fatigue mitigation—by October 1, 2011; and others—including those related to adequate 

information and alarm management—by August 1, 2012. PG&E met the August 1, 2011,

deadline for developing its procedures.

The Milpitas Terminal is located at the southernmost point of Line 132. This station, 

which is typically not staffed, consists of four incoming lines and five pressure-regulated 

outgoing lines. The specific lines, their dimensions at Milpitas Terminal, and their MAOPs and 

MOPs are listed in table 5.

 88 Supervisory Control and Data Acquisition (SCADA) in Liquid Pipelines, Safety Study NTSB/SS-05/02 

(Washington, DC: National Transportation Safety Board, 2005). 

89 The substance of the final rule is published at Federal Register, vol. 74, no. 231 (December 3, 2009), 

p. 63310; and the expedited implementation deadlines are published at Federal Register, vol. 76, no. 116 

(June 16, 2011), p. 35130.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 13

of 101
NTSB Pipeline Accident Report

53

Table 5. Incoming and outgoing lines at Milpitas Terminal.

Incoming Lines at Milpitas Terminal 

Line Number Diameter (inches) MAOP (psig) MOP (psig)

107 36 720 477

131 30 595 590

300A 34 558 558

300B 34 600 600

Outgoing Lines at Milpitas Terminal 

Line Number Diameter (inches) MAOP (psig) MOP (psig)

132 30 400 375

101 36 400 375

109 24 375 375

100 20 400 375

San Jose Distribution Feeder Main 24 200 200

Within the Milpitas Terminal, the incoming lines are routed through a separator and 

several common headers before splitting into multiple regulating control valve sets. Each of the 

four incoming lines is pressure controlled through two sets of regulating valves, with each set 

consisting of a trim and load control valve preceded by a monitor valve upstream. The 

Milpitas Terminal also has a 20-inch-diameter mixer bypass90

The regulating valves are programmed by SCADA operators with pressure set points. In 

the case of Line 132, they were set to maintain pressure at less than 375 psig. Regulating valves 

are electrically actuated and will remain in their last position if they lose power but will open if 

they lose a control signal. The regulating valves can be placed in manual operation at the 

Milpitas electronic controller, which disables the SCADA center’s ability to control the valve. 

line and a 24-inch-diameter station 

bypass line, each of which was outfitted with regulating and monitor valves. Each of the 

regulating valves is operated through an independent electronic controller connected to the 

programmable logic controller (PLC). 

The monitor valves are stand-alone pneumatically actuated control valves with position 

monitoring wired to the PLC. They address the regulatory requirements (in 49 CFR 192.195) for 

pressure relieving or limiting devices to protect against accidental overpressure. In accordance 

with PG&E procedures, the pneumatic controller on the monitor valves is set to 10 psig above 

the MOP but below the MAOP of the line they are protecting. A SCADA operator can control 

the percent open on a monitor valve as long as it does not cause the valve to open further than 

 90 As noted earlier, in the 1980s a mixer was used at the Milpitas Terminal to mix several gas grades from 

multiple sources. Although the mixer has since been removed, the terminology “mixer bypass” is still used.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 14

of 101
NTSB Pipeline Accident Report

54

required to maintain the set point. Thus, a SCADA operator is not capable of overriding the local 

pressure set point of the pneumatic controller.

The monitor valve is normally fully open and will only begin to close when downstream 

pressure, read through a sensing line connected to the pipeline, exceeds its set point. In the case 

of Line 132, the monitor valves at the Milpitas Terminal were set at a pressure of 386 psig on the 

day of the accident. However, due to a typical lag in the monitor valves response time, the 

pressure in Line 132 at the Milpitas Terminal reached 396 psig just prior to the accident.

1.9.1.2 Work Clearance Procedures

According to PG&E procedures, whenever planned work on a gas line operating at more 

than 60 psig may impact gas pressure, flow, quality, or SCADA monitoring, a system clearance 

form must be completed and submitted to the SCADA center for approval. PG&E procedures 

require that the form be submitted at least 10 days prior to the planned work. The form must 

completely describe the work and include start and end times, as well as the name of the 

clearance supervisor (the person filling out the form or that person’s designee). The clearance 

form must also include any necessary special instructions, sequence of operations, and operating 

maps and diagrams. The form designates certain milestones (such as starting work, finishing 

work, and operation of equipment that will affect flow, pressure, or monitoring) at which the 

clearance supervisor is required to notify the SCADA center of work progress.

Prior to starting work, the clearance supervisor is required to conduct an on-site briefing 

about how the work will be done with all individuals performing work under the clearance.

According to workers at the Milpitas Terminal, work safety briefings were held at 6:00 a.m. and 

1:00 p.m. However, those briefings focused on general safety issues and did not discuss the 

possible impacts of planned work on the SCADA system. At 1:30 p.m., the contractor held a 

briefing to discuss the order in which the planned work would be performed.

The September 9, 2010, UPS work at the Milpitas Terminal was documented and 

approved as a one-time project. The form was submitted on August 19, 2010, and approved by 

the SCADA center on August 27, listing a start date of August 30 and a completion date of 

September 9. The checkbox under “service interruptions” was marked “no.” The checkbox under 

special instructions was marked “yes,” and the special instructions worksheet listed two items: 

(1) a notation explaining that the Milpitas technician was to contact the SCADA center prior to 

work and at the completion of work, and that he would be accompanied during the work by a 

contractor and a PG&E technician, and (2) the names and phone numbers of two of the 

technicians working on the project. The checkbox under “Will normal function of the facility be 

maintained” was marked “no,” but where the form reads “If no please explain,” there was no 

explanation included. The form did not indicate that any regulating valves at the 

Milpitas Terminal would be placed in manual control or that there could be interruptions to the 

instrumentation or impacts to the regulating valves and downstream pressures. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 15

of 101
NTSB Pipeline Accident Report

55

1.9.1.3 Emergency Response Procedures

PG&E’s emergency response procedures are outlined in the following diagram (figure 

23), taken from PG&E’s Company Gas Emergency Plan.

91

Figure 23. Flowchart of PG&E’s emergency response procedures.

PG&E summarized the role and interaction between its SCADA center and its dispatch 

center during an emergency as follows:

Dispatch will notify [the SCADA center] of a gas event as noticed in the Utility 

Standard TD-4413S (Gas Event Reporting Requirements). Dispatch will send a 

field employee to the location of the gas incident per Utility Procedure 

TD-6436P-12 (Handling Emergency Conditions Reported by Outside Agencies 

and Company Personnel). Depending on the actual field condition observed, [the 

SCADA center] and Dispatch may have further interaction to dispatch additional 

field personnel or exchange information regarding the event.

 91 PG&E Academy, Company Gas Emergency Plan (CGEP), GAS_0910WBT Dispatchers, Version 1, 

January 2010, web-based training module.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 16

of 101
NTSB Pipeline Accident Report

56

Utility procedure TD-6436P-12 states that the dispatched field employee is responsible 

for evaluating danger to life and property, ensuring that conditions are safe, and assessing 

damage. It also provides guidance for handling incoming calls from emergency service providers 

to the dispatch center, but does not discuss whether field personnel, the dispatch center, or the 

SCADA center are to directly initiate contact with emergency services through 911 or other 

means. The standard does not address the timeliness of response or the involvement of city or 

emergency officials. Notifications outlined in the procedure are limited to PG&E employees and 

supervisors. The procedure does not distinguish between a transmission line break and a 

distribution line leak.

1.9.2 Use of Automatic Shutoff Valves and Remote Control Valves

According to Federal pipeline integrity management regulations at 49 CFR 192.935(a), 

an operator “must take additional measures beyond those already required by Part 192 to prevent 

a pipeline failure and to mitigate the consequences of a pipeline failure in a [HCA].” The 

additional measures must be based on the threats the operator has identified to each pipeline 

segment, and the operator must conduct a risk analysis of its pipeline to identify additional 

measures, including but not limited to, installing automatic shutoff valves (ASV) or remote 

control valves (RCV), installing computerized monitoring and leak detection systems, replacing 

pipe segments with pipe of heavier wall thickness, providing additional training to personnel on 

response procedures, conducting drills with local emergency responders, and implementing 

additional inspection and maintenance programs.

Pursuant to 49 CFR 192.935(c), “[i]f an operator determines, based on a risk analysis, 

that an ASV or RCV would be an efficient means of adding protection to a high consequence 

area in the event of a gas release, an operator must install the ASV or RCV.” Similarly, the 

PG&E gas transmission integrity management program (discussed in more detail below) states

that PG&E will consider the addition of ASVs or RCVs if they would be an efficient means of 

adding protection to an HCA.

The regulation further states that in making the determination regarding use of an ASV or 

RCV, “an operator must at least consider the following factors—swiftness of leak detection and 

pipe shutdown capabilities, the type of gas being transported, operating pressure, the rate of 

potential release, pipeline profile, the potential for ignition, and location of nearest response 

personnel.”

PG&E’s consideration of this issue is documented in an internal memorandum dated 

June 14, 2006, and summarized in its integrity management program. The memorandum, drafted 

by a PG&E senior consulting gas engineer following the CPUC’s 2005 audit,

92

 92 See section 1.10.1, “State Oversight by CPUC” for more information about the findings of this audit.

states that 

industry references have indicated that most of the damage from a pipeline rupture occurs within 

the first 30 seconds and that the duration of the resulting fire “has (little or) nothing to do with 

human safety and property damage.” The memorandum concluded that the use of an ASV or 

RCV as a prevention and mitigation measure in an HCA would have “little or no effect on 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 17

of 101
NTSB Pipeline Accident Report

57

increasing human safety or protecting properties,” and did not recommend using either as a 

general mitigation measure. The senior consulting gas engineer later testified at the NTSB 

investigative hearing that his research was limited to industry papers and that he had not 

reviewed studies conducted by PHMSA or other safety groups that had reached different 

conclusions. (Some of those studies are discussed later in this section.)

The NTSB notes that in written comments submitted to RSPA for a 1997 public meeting 

on ASVs and RCVs, PG&E stated that it had “no objection to installing RCVs” and had “found 

them reliable, [and] install[ed] them when upgrading existing major control stations or installing 

new stations.” In the comments, PG&E also stated that safety would be enhanced by reducing 

the volume of flammable gas released, that a “major technical advantage is the ability to isolate

the pipeline break quickly without requiring personnel to be sent to operate any mainline 

valve(s),” and that another advantage is being able to monitor valve positions remotely from the 

SCADA center. The PG&E manager of gas system operations stated at the NTSB investigative 

hearing that in the case of the San Bruno pipeline rupture, the use of RCVs could have reduced 

the time it took to isolate the rupture by about 1 hour.

In addition, PG&E stated in both the June 14, 2006, memorandum and an earlier 

memorandum, dated June 24, 1996, that ASVs have proven to be unreliable for most 

applications due to the likelihood that normal operational conditions could trip sensors and result 

in unintended closures. Therefore, PG&E concluded that RCVs were preferable to ASVs and 

could contribute to a reduction in the effects of a pipeline rupture.

Studies have indicated that a prolonged gas-fed fire leads to increased property damage.93

Further, in 1996, Congress ordered a study on the feasibility of installing RCVs on interstate 

natural gas pipelines. In its 1999 report on this issue,94

1.9.3 Public Awareness

RSPA listed several benefits of using 

RCVs, including reduced property damage, reduced public disruption, reduced damage to other 

utilities, and allowing emergency responders to gain faster access to an accident site. Although 

these benefits could not be quantified, the report concluded that RCVs may provide the best 

means for achieving them.

Title 49 CFR 192.616 requires natural gas pipeline operators to develop and implement 

written continuing public education programs that adhere to the guidance provided in

API Recommended Practice 1162, Public Awareness Programs for Pipeline Operators, which is 

incorporated by reference.

 93 (a) M. Stephens, A Model for Sizing High Consequence Areas Associated with Natural Gas Pipelines, GRI-00/0189, Gas Research Institute, October 2000. (b) C.R. Sparks, Remote and Automatic Main Line Valve 

Technology Assessment, Gas Research Institute, July 1995.

94 Remotely Controlled Valves on Interstate Natural Gas Pipelines (Feasibility Determination Mandated by the 

Accountable Pipeline Safety and Partnership Act of 1996) (Washington, DC: U.S. Department of Transportation 

Research and Special Programs Administration, 1999).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 18

of 101
NTSB Pipeline Accident Report

58

API Recommended Practice 1162 provides specific guidelines for natural gas pipeline 

operators to develop, manage, and evaluate public awareness programs directed to stakeholder 

audiences, including the affected public, emergency officials, local public officials, and 

excavators. The recommended practice discusses the content of baseline outreach messages, 

frequency of distribution, and delivery methods; and requires pipeline operators to evaluate their 

public awareness programs annually. And, at least once every 4 years, operators must evaluate 

the effectiveness of their programs. Using the results of these evaluations, operators are expected 

to continuously improve their programs and implement necessary changes.

The PG&E annual public awareness program review period is from June to June. During 

this time, the company documents baseline and supplemental program events that occurred 

during the review period, such as mailings and meetings, and reviews website content. In the 

program evaluation and effectiveness section of its program plan,95

The most recent reports of the PG&E annual reviews prior to the accident were dated 

June 2010 and December 2009. Both reviews noted that all mailings had occurred in accordance 

with the PG&E plan; however, the quality of the content conveyed in the mailings was not 

considered. The corrective action items in both self-evaluation reviews pertained primarily to 

supplemental messages and strategies and did not significantly differ.

PG&E states that the annual 

review will be conducted using the guidelines of the program plan. However, no specific 

guidelines for annual evaluations are defined.

In its 2009 report, the PG&E review noted the following action item for its emergency 

official audience, “Develop educational seminars to be offered at locations throughout the 

service territory in which local emergency response agencies would be invited to attend.” The

2010 review noted an action item for the same audience to “Continue to provide educational 

seminars throughout the service territory in which local emergency response agencies would be 

invited to attend.” No assessment of the quality of materials is noted.

In 2010, PG&E also hired Paradigm Alliance, Inc., to conduct a program documentation 

review of its public awareness program for noncustomers along the pipeline right-of-way. The 

Paradigm report is dated June 2010. As a program effectiveness measure, Paradigm mailed 

public awareness brochures with detachable business reply mail survey postcards to 

15,302 addresses. The addresses were near the right-of-way and included the other stakeholder 

audiences defined in API Recommended Practice 1162. Eight weeks after the mailing, Paradigm 

received 20 survey postcards in response. Table 6 below summarizes the responses.

 95 Pacific Gas and Electric Company, Pipeline Public Awareness Plan, Procedure No. RMP-12, dated 

January 26, 2010.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 19

of 101
NTSB Pipeline Accident Report

59

Table 6. Survey postcard responses to public awareness brochures.

Question Yes No Blank

Do you or someone you know work or live near a pipeline? 7 9 4

Have you seen any information about pipeline safety within the last two 

years? 3 14 3

If you noticed what appears to be a pipeline leak, would you call 911? 17 0 3

Have you or anyone you know ever discovered a buried pipeline while 

digging? 17 0 3

Have you ever heard of the “One-Call” system before reading this 

brochure? 2 14 3a

a In Paradigm’s report, only 19 responses to this question were documented.

In 2007, PG&E participated in an API survey to evaluate the effectiveness of its public 

awareness program via the Public Awareness Program Effectiveness Research Survey 

(PAPERS). The survey, which evaluated 18 operators, including PG&E, measured retention and 

comprehension of awareness messages by the audiences defined in API Recommended Practice

1162. The survey found that the affected public96

1.9.4 PG&E Risk Management/Integrity Management Program

was PG&E’s least informed audience, with 

89 percent of the 155 respondents reporting that they did not recall receiving information from 

PG&E and 34 percent reporting that they considered themselves somewhat or very well 

informed. The 50 emergency responders that responded to the survey reported the highest 

awareness level; 85 percent of these indicated that they were somewhat or very well informed 

about pipelines. However, the survey also found the emergency official audience indicating a 

need for more information about potential pipeline hazards and appropriate training and 

response. 

In October 2001, PG&E developed a risk management program presented in a series of 

risk management procedures (RMP). The current version of RMP-01, which has been revised 

several times, states that the risk management program was designed to provide a process for 

complying with the requirements for risk calculation and an integrity management program.

97

1.9.4.1 Geographic Information System

PG&E states in RMP-01 that it will develop and maintain an inventory of all pipeline 

design attributes, operating conditions, environment (structure, faults, etc.), threats to structural 

integrity, leak experience, and inspection findings. This inventory is maintained in the PG&E

GIS database. GIS data are used to calculate risk for each pipeline segment. (According to 

PG&E, a pipeline segment is a length of pipe that differs from adjacent pipe in some way, such 

as its material properties, age, manufacture, pressure test history, coating type or age, or leak 

 96 In the 2007 PAPERS, the affected public surveyed did not include PG&E distribution line customers, only 

the residents along its transmission line right-of-way.

97 For more information about the required elements of pipeline integrity management programs, see section 

1.10.2, “Federal Oversight by PHMSA.”

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 20

of 101
NTSB Pipeline Accident Report

60

survey history.) PG&E then selects a target threshold, segments above that threshold are

reviewed for significant risk drivers, and some segments are selected for investigation and 

mitigation.

Although the Federal integrity management regulations do not explicitly list all of the 

information that must be maintained for each segment, they state (at 49 CFR 192.917(b)) that to 

identify and evaluate the potential threats to a covered pipeline segment, an operator must gather

and integrate existing data on the entire pipeline that could be relevant to the covered segment, 

including, at a minimum, the information specified in ASME B31.8S, 2004 edition, and 

“consider on both the covered segment and similar noncovered segments, past incident history, 

corrosion control records, continuing surveillance records, patrolling records, maintenance 

history, internal inspection records and all other conditions specific to each pipeline.” In 

addition, ASME B31.8S, 2004 edition, which is incorporated by reference into Part 192, notes 

that “[c]omprehensive pipeline and facility knowledge is an essential component of a 

performance-based integrity management program” and states, if an operator “lacks sufficient 

data or where data quality is below requirements, the operator shall follow the prescriptive-based 

processes [outlined in appendix A to ASME B31.8S, 2004 edition].” It further states that when 

all of the specified data elements98

The PG&E GIS was implemented in the 1990s and was populated with data from 

preexisting pipeline survey sheets. If information was missing, assumed values were entered,

preceded by a negative sign to indicate they were assumed values. According to PG&E, the GIS 

was fully populated in 1998. If discrepancies between GIS data and actual conditions are 

discovered by field personnel, PG&E procedures require field engineers to report them to the 

PG&E mapping department, which validates the information by checking the original job 

package paperwork for that segment of pipeline. If the mapping department concludes that a 

change is warranted, it is made. 

for the prescriptive-based process are not available for each 

threat to perform the risk assessment, “it shall be assumed that the particular threat applies to the 

pipeline segment being evaluated.” ASME B31.8S, 2004 edition, also states that data applied in a 

risk assessment process should be verified and checked for accuracy and for missing or 

questionable data, and that the operator should choose values that conservatively reflect the 

values of other similar segments on the pipeline or in the operator’s system.

NTSB investigators reviewed PG&E GIS data and pipeline survey sheets for Line 132 to 

determine how often assumed or unknown values were entered. They found that—

• The pipe wall thickness was an assumed value for 21.5 miles (41.75 percent) of 

Line 132.

• The manufacturer of the pipe was unknown (“NA”) for 40.6 miles (78.81 percent) of 

Line 132.

 98 The required data for each segment include pipe material, year of installation, manufacturing process (or age 

of manufacture as an alternative), seam type, joint factor, and operating pressure history.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 21

of 101
NTSB Pipeline Accident Report

61

• The pipeline depth of ground cover was also unknown for 42.7 miles (82.79 percent) 

of Line 132.

• Three values were used for the SMYS of grade B pipe: 35,000 psi (consistent with the 

value given in ASME B31.1.8, 1955 edition), 40,000 psi, and 45,000 psi.

• Two segments with unknown SMYS were assigned values of 33,000 psi and 

52,000 psi, whereas 49 CFR 192.107 requires operators to use a value of 24,000 psi 

when SMYS is unknown.

• Six consecutive segments, totaling 3,649 feet, specified an erroneous minimum depth 

of cover of 40 feet.

• Several segments, including Segment 180, specified 30-inch-diameter seamless pipe, 

although there was no API-qualified domestic manufacturer of such pipe when the 

line was constructed. 

• The GIS did not reflect the presence of the six pups in Segment 180.

1.9.4.2 Risk Management Procedures

PG&E defines risk as the product of the likelihood of failure (LOF) and the consequence 

of failure (COF), each of which is determined by PG&E steering committees. Failure is defined 

as a breach of the structural integrity of the pipe. LOF is derived from combining the risks of the 

following threats, which, according to RMP-01, are weighted in proportion to PG&E and 

industry failure experience: 25 percent for external corrosion, 45 percent for third-party damage, 

20 percent for ground movement, and 10 percent for design and material characteristics. For the 

integrity management program only, COF is a function of the potential impact radius. PG&E 

developed individual RMPs (as discussed below) for each of the perceived threats to the system:

• RMP-02 contains an algorithm to calculate the risk of external corrosion, detailing

possible threats to the pipeline caused by items such as soil resistivity, coating age, 

coating design, and d.c./a.c. interference. It considers the results of pressure tests (if 

any were conducted), visual inspections of the coating, casing surveys, corrosion leak 

rate, and external corrosion direct assessment (ECDA99

• RMP-03 contains the algorithm for third-party threats. It accounts for the likelihood 

of excavation frequency, class location, ground cover protection, damage prevention, 

pipe diameter, and wall thickness, among other factors, to rank the vulnerability of 

the pipeline. 

) data, if available, to develop 

a ranking of coated piping. 

• RMP-04 contains the algorithm for ground movement and natural forces threat, such 

as seismic activity.

• RMP-05 contains the algorithm for design/material threats and also addresses 

construction threats. It includes weighted factors for pipe seam design, girth weld

 99 ECDA is a method of surveying a pipeline by first selecting likely areas of potential corrosion for assessment 

and then excavating and physically examining these areas.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 22

of 101
NTSB Pipeline Accident Report

62

condition, material flaws or unique joints (such as pre-1950 miter bends), pipe age, 

MOP versus pipe strength, leak history, and test pressure. Points are assigned for 

various risk factors so that higher scores indicate a higher threat. The maximum score 

that a segment can receive is 135. Pre-1970 pipes are assigned 30 points for pipe 

seam design and 10 points for pipe age. Pipe segments that have not been pressure 

tested are assigned 30 points; conversely, pipes that have undergone pressure testing 

receive a 30 or 40 point deduction, depending on the recency of the test. (The scores 

assigned to Segment 180 are discussed in section 1.9.4.3, “Threats Identified for 

Line 132.”)

• RMP-06 contains the PG&E gas transmission integrity management program and is 

discussed below.

• RMP-08 contains the procedure for identification, location, and documentation of 

HCAs. PG&E uses the potential impact circle method, described in 49 CFR 192.903, 

to determine HCAs. Pipe diameter and MAOP are used to calculate the potential 

impact circle, which designates an HCA according to whether the area within the 

potential impact circle contains 20 or more buildings intended for human occupancy. 

If it does, the area is classified as an HCA, regardless of class designation. PG&E 

records specify Line 132 from MP 8.39–40.08, which includes the location of the 

rupture, as a class 3 location.

• RMP-09 includes requirements for performing ECDA, which consists of

preassessment, including data collection; indirect inspections; prioritizing excavation 

locations and examinations; and postassessment, including data analysis. RMP-09 

requires the collection of data that could be used for validating assumed values or 

determining unknown values in the GIS and calls for updating pipeline records with 

data collected during the preassessment process. 

• RMP-10 contains requirements for performing internal corrosion direct assessment, 

which consists of preassessments, including data collection and identifying sites; 

prioritizing excavation locations and examinations; and postassessment, including 

data and analysis. Dry gas internal corrosion is not included in the PG&E equation for 

calculating LOF because PG&E automatically classifies the few pipelines it has with 

the threat of internal corrosion as high risk.

• RMP-11 contains procedures and requirements for performing in-line inspections. It

includes steps for performing a preassessment, including data collection and work 

necessary to allow the line to accommodate in-line inspection tools; in-line

inspection, including internal cleaning and inspection tool running; direct 

examination of identified anomalies; and postassessment, including data analysis and 

mitigation planning. 

• RMP-12 contains the PG&E pipeline public awareness plan. (See section 1.9.3, 

“Public Awareness,” in this report.)

• RMP-13 contains requirements for performing stress corrosion cracking direct 

assessment. The procedures include preassessment, including data collection; indirect 

inspections; prioritizing excavation locations and examinations; and postassessment, 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 23

of 101
NTSB Pipeline Accident Report

63

including data analysis. Stress corrosion cracking is not included in LOF calculations 

because PG&E classifies the few pipelines it has with this threat as high risk.

1.9.4.2.1 Integrity Management Plan

The PG&E gas transmission integrity management program is set forth in RMP-06. It

was developed to meet the requirements of 49 CFR Part 192 Subpart O, which became 

effective in 2004. RMP-06 identifies 22 potential threats to HCAs, which fall into 

4 categories: time dependent, stable, time independent, and unknown. Manufacturing- and 

welding/fabrication-related defects are listed as stable defects (that is, they are not expected to 

grow in service). However, under 49 CFR 192.917(e)(3), such defects would not be considered 

stable in the event of certain increases in operating pressure.100

RMP-06 section 4, “Baseline Assessment Plan,” addresses the initial evaluation of the 

condition of the pipeline, which is used as a baseline for further inspections. This section 

specifies that all HCAs will be assessed in accordance with the schedule set forth in the baseline 

assessment plan and that HCAs with the highest potential for risk are given priority. Consistent 

with 49 CFR 192.921, it specifies that at least 50 percent of the HCAs identified in the plan 

will be assessed by December 17, 2007, and the remainder by December 17, 2012. RMP-06 

section 4.5 notes that the methods chosen to assess a particular segment of pipe are based on the 

threats identified in the risk assessment procedure, and more than one assessment method may be 

required to adequately cover the potential risks of an HCA. PG&E’s baseline assessment plan 

includes 1,021 miles of HCA pipeline and about 500 miles of non-HCA pipeline. PG&E 

determined that 813 HCA miles would be assessed using direct assessment methodologies

RMP-06 section 3.5, “Threat 

Analysis,” states that a manufacturing threat is assumed to exist in pipe segments installed before 

1970. Under the heading “Insufficient Data or Poor Quality Data,” RMP-06 states that the 

integrity management program “avoids the use of data assumptions to identify applicable 

threats.”

101

(ECDA, internal corrosion, and stress corrosion cracking); 208 HCA miles would be assessed 

using in-line inspection tools or “pigs”;

102

Concerning in-line inspection, RMP-06 section 5.4 states that “it is the company’s desire 

to inspect pipelines utilizing in-line inspection whenever it is physically and economically 

feasible.” Factors that PG&E considers in determining feasibility include whether the pipeline at 

issue is at least 10 miles long and predominately located in HCAs, whether less than 0.5 mile of 

and 500 non-HCA miles would be assessed 

using in-line inspection tools. As of June 30, 2010, 749.35 HCA miles had been inspected; 

Line 132 had not yet been inspected. 

 100 For more information on how PG&E addressed this issue, see section 1.7.5.3, “Periodic Pressure Increases 

to MAOP.”

101 According to the PG&E director of integrity management and technical support, PG&E has performed 

500 digs since the start of the integrity management program. 

102 A “pig” can be any of a variety of mechanical devices inserted into a pipeline to either clean or inspect the 

line to identify possible defects. Pigs that gather information as they travel through the line are referred to as “smart 

pigs.” A variety of physical obstacles can prevent a pig from successfully traveling through a pipeline, thus 

rendering that pipeline “unpiggable.” For more information about smart pigs, see section 1.13.1.2, “In-line 

Inspection.” 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 24

of 101
NTSB Pipeline Accident Report

64

replacement is required to make the pipeline piggable, whether the pipeline at issue has adequate 

flow rates to enable successful in-line inspection, and whether the pipeline operates at more than 

30 percent SMYS.

Regarding pressure testing, RMP-06 section 5.5 states that PG&E—

does not plan to use pressure testing to assess the integrity of its pipelines, unless 

it is a post installation test or up-rate for a new HCA. However, during the course 

of assessing data for ECDA or in-line inspection, it may become apparent that 

pressure testing is the only feasible option.

RMP-06 section 10, “Performance Plan,” sets forth the program measurements that 

PG&E uses to evaluate the long-term effectiveness of its integrity management program. These 

measures, which are reported semiannually to PHMSA, include number of total system miles,

number of total miles of pipelines inspected, number of HCA miles in the integrity management 

program, number of HCA miles inspected via integrity management assessments, number of 

immediate repairs103 completed in HCAs, number of scheduled repairs completed in HCAs,

number of leaks104 in HCAs classified by cause, number of failures105 in HCAs classified by 

cause, and number of incidents106

 103 Immediate repair conditions, as defined in 49 CFR 192.933 (d)(1), include (i) an anomaly resulting in a 

calculated predicted failure pressure of 1.1 times the MAOP; (ii) a dent that has any indication of metal loss, 

cracking, or a stress riser; or (iii) any indication or anomaly that, in the judgment of the person designated by the 

operator to evaluate the assessment results, requires immediate action. Until the repair is completed, the operator is 

required to temporarily reduce the in pressure to no more than 80 percent of the operating pressure at the time the 

condition was discovered.

in HCAs classified by cause. The combined number of leaks, 

failures, and incidents that PG&E reported for the years 2004–2010 is shown in table 7.

104 PHMSA defines a “leak” as an unintentional release of gas from a pipeline that is not an “incident,” 

including an unintentional release of gas that does not result in an injury, death, or $50,000 or more in property 

damage.

105 PHMSA defines “failure” as a general term used to imply that a part in service has become completely 

inoperable, is still operable but incapable of satisfactorily performing its intended function, or has deteriorated 

seriously to the point that it has become unreliable or unsafe for continued use. However, according to the definition, 

a “failure” does not involve a release of gas. 

106 PHMSA defines “incident” as a release of gas from a pipeline causing death or personal injury necessitating 

inpatient hospitalization; as estimated property damage, including the cost of gas lost, for the operator or others or 

both, that is $50,000 or more; or as an event that is significant in the judgment of the operator, even though it does 

not meet the criteria above.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 25

of 101
NTSB Pipeline Accident Report

65

Table 7. PG&E’s reportable events by cause for 2004–2010.

Cause 2004 2005 2006 2007 2008 2009 2010 All

External corrosion 0 10 1 3 5 3 1 23

Internal corrosion 0 0 0 0 0 0 0 0

Stress corrosion cracking 0 0 0 0 0 0 0 0

Manufacturing 0 0 1 0 1 0 0 2

Construction 1 0 0 1 1 3 3 9

Equipment 0 7 1 1 1 4 3 17

Third party 0 4 0 3 1 2 1 11

Incorrect operations 0 1 0 0 0 3 1 5

Weather/outside force 0 0 0 0 0 0 0 0

Total 1 22 3 8 8 15 9 67

In addition to leaks, incidents, and failures, as defined by PHMSA, the CPUC also 

required pipeline operators such as PG&E to report “incidents which have either attracted public 

attention or have been given significant news media coverage, that are suspected to involve 

natural gas, which occur in the vicinity of the operator’s facilities; regardless of whether or not 

the operator’s facilities are involved.”

RMP-06 section 13, “Quality Assurance,” indicates that PG&E will conduct periodic self 

assessments of its integrity management program to determine its effectiveness and specifies that 

internal or external audits will be performed every other year to ensure compliance with PG&E 

and regulatory requirements. Internal audits were conducted in 2007 and 2009. External audits 

were completed by the CPUC (with PHMSA) in 2005 and by the CPUC in 2010. (For more 

information on these audits and the PG&E response, see section 1.10.1, “State Oversight by 

CPUC.”)

1.9.4.3 Threats Identified for Line 132

Line 132 has about 322 pipeline segments. In 2009 and 2010 (prior to the accident), 

Segment 180 received the assessment scores shown in table 8. (For comparison, the scores for 

the Line 132 segment with the highest total risk in 2009 and 2010 are also provided.

107

 107 The highest ranking segments in 2009 and 2010 were Segments 106.7 and 189, respectively. 

)

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 26

of 101
NTSB Pipeline Accident Report

66

Table 8. Line 132 risk values.

Line 132 Risk Values

Segment 180 2009 2010

External corrosion (25 percent) 4.18 4.18

Third party (45 percent) 20.9 20.9

Ground movement (20 percent) 0.0 0.0

Design and materials (10 percent) 55.0 73.0a

Total risk (Unweighted) 927.63 1036.0

Rank 69.0 80.0

Highest Ranking Segment 2009 2010

External corrosion (25 percent) 5.78 7.58

Third party (45 percent) 25.6 38.9

Ground movement (20 percent) 61.5 22.5

Design and materials (10 percent) 68.0 81.0

Total risk (Unweighted) 1878.8 2149.0

Rank 1.0 1.0

a The increased score in the “design and materials” category resulted from the discovery of miter bends in Segment 180.

PG&E conducted ECDA to assess the corrosion and coating on numerous sections of 

Line 132 in 2005 and 2009. PG&E indicated that eight digs were conducted as a result of the 

2009 survey of Line 132. 

Prior to the accident, no in-line inspections had been performed on Line 132 or the other 

two lines in the peninsula system (Lines 101 and 109). PG&E indicated that bends, valves, and 

variations in pipe diameter made in-line inspection impracticable on these lines. As part of its 

2009 rate case, PG&E requested permission to replace sections and/or fittings on the segments 

that currently prevent Lines 101, 109, and 132 from accepting smart pigs. The cost to make 

Line 132 piggable is estimated to be $13 million; and, according to a PG&E supervising engineer 

for gas transmission and distribution, PG&E plans to perform in-line inspection on Line 132 by 

2014. He further stated that preparing an older line for an in-line inspection process requires 

3–4 years to engineer upgrades, replace components such as valves and fittings, and clean the 

pipeline.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 27

of 101
NTSB Pipeline Accident Report

67

1.10 Oversight

1.10.1 State Oversight by CPUC 

As an intrastate gas transmission pipeline operator, PG&E is regulated by the CPUC, 

whose rules governing gas pipelines are codified in General Order 112E, State of California 

Rules Governing Design, Construction, Testing, Operation, and Maintenance of Gas Gathering, 

Transmission, and Distribution Piping Systems, dated September 11, 1995. General Order 112E 

requires PG&E to comply with the Federal pipeline safety regulations in 49 CFR Part 192.

PHMSA oversees interstate pipelines but does not directly oversee intrastate pipeline operators. 

However, PHMSA conducts annual on-site evaluations and scores state regulators to determine 

how closely the programs align with PHMSA standards. PHMSA certifies state regulatory 

agencies such as the CPUC annually and grants Federal funds as an incentive to improve 

program performance and to encourage states to take on more responsibility for pipeline safety.

PHMSA is authorized to reimburse a state agency up to 80 percent of the actual cost of 

carrying out its pipeline safety program, including the cost of personnel and equipment, 

depending on the state agency’s score and subject to the availability of Federal funds. Federal 

funding is determined through an allocation formula based on factors such as the extent to which 

the state has asserted safety jurisdiction, whether the state has adopted all Federal requirements, 

and the number and qualifications of inspectors. PHMSA also reviews state regulator audits of 

operator integrity management programs and enters certain information from these audits into its 

database to analyze trends. In 2006–2008, the CPUC received 37–40 percent of its annual 

funding from PHMSA. During that time, the maximum that any state agency received was 

40–50 percent. In 2009 and 2010, the CPUC received about 64 percent of its annual funding 

from PHMSA; the maximum any state agency received during those years was about 70 percent.

Data reported by the CPUC to PHMSA showed that as of March 2011, it had 

19 inspectors and 6 supervisors supporting pipeline safety, some of which were only dedicated 

part-time to pipeline safety duties, for a total of about 12 person-years. In July 2011, the CPUC 

reported to the NTSB that it had the equivalent of 11 full-time gas inspection staff positions and 

2.5 supervisory level positions funded by PHMSA.

The CPUC has audited the PG&E integrity management program twice, once between

October and December 2005 and again in May 2010, following the PHMSA integrity 

management audit protocol. The director of the CPUC consumer product and safety division 

stated that the agency lacks sufficient resources to conduct annual audits of the PG&E integrity 

management program.

PHMSA participated in the CPUC 2005 audit, which was intended as a training audit for 

CPUC personnel. One of the issues noted during this audit was that PG&E did not have a process 

to evaluate the use of ASVs and RCVs. (For more information about PG&E’s subsequently

drafted memorandum discussing the use of ASVs and RCVs, see section 1.9.2, “Use of 

Automatic Shutoff Valves and Remote Control Valves.”)

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 28

of 101
NTSB Pipeline Accident Report

68

The results of the second CPUC audit of the PG&E integrity management program

transmitted to PG&E in a letter dated October 21, 2010, included numerous findings. The CPUC

letter highlighted two areas of particular concern. The first concern was that PG&E may be 

“diluting the requirements of the [integrity management program] through its exception process 

and appears to be allocating insufficient resources to carry out and complete assessments in a 

timely manner.” The letter noted that in-line inspections scheduled for several pipelines had been 

delayed from the schedule set forth in the baseline assessment plan and, in some cases, had been 

changed to ECDAs. In addition, exception reports had been used to justify not excavating several 

immediate repair indications that vendors had reported after conducting other in-line inspections. 

The second concern was that “PG&E needs to analyze, review, and formulate appropriate 

actions or responses to the results of its internal audits in a timely manner.” Specifically, the 

CPUC pointed out that PG&E had conducted an internal audit in December 2007 but had not 

formulated a response until December 2009; the letter further noted that PG&E had conducted 

another internal audit in October 2009, but as of May 2010 PG&E still had not formulated a 

response.

PG&E submitted a response to each of the CPUC findings and concerns in a letter dated 

December 16, 2010. Regarding the CPUC’s two primary concerns, PG&E stated that its integrity 

staff “tended to use the exception report process to document more than just procedural 

exceptions and have issued exception reports when they weren’t necessarily needed.... PG&E 

agrees that this is an over-use of exception reports and we will take steps to reduce this practice.” 

Concerning its response to internal audits, PG&E acknowledged that—

RMP-06 does not provide clear direction regarding a formal response and closure 

of any issues identified. PG&E agrees ... that addressing this concern will add 

additional rigor and clarity and will improve our overall process.... All corrective 

actions resulting from future audits will be tracked via PG&E’s established 

commitment tracking process managed by PG&E Gas Engineering Regulatory 

Support.

In addition to the two audits of the overall integrity management program, the CPUC 

conducted focused audits of the division responsible for the PG&E peninsula lines in July 2008 

and August 2010. For the 2008 audit, the CPUC noted two violations and listed several 

observations.108 After the 2010 audit, the CPUC noted two violations109

At the NTSB investigative hearing, a CPUC supervisory engineer testified that CPUC 

audits did not comment on PG&E’s ranking of its highest risk segments or on the assignment of 

weights to the various risk categories. Further, although he stated that the auditors did not 

and observed that many 

of the PG&E internal audit findings were violations of its own standards. The CPUC also noted

that PG&E had corrected most of the internal audit findings from 2007 and 2009.

 108 The violations related to employee qualifications, and the observations related to missing MAOP 

documentation. In addition, a “field observation” noted that a monitor valve at a regulator station was set at too high 

a pressure and did not take over to avoid MAOP.

109 The violations related to insufficient leakage surveys and regulating valve pressure ratings being too low.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 29

of 101
NTSB Pipeline Accident Report

69

examine GIS data in detail, they did random spot checks of GIS data and verified that when data 

were unknown, PG&E was using appropriately conservative values. The director of the CPUC 

acknowledged that audits and inspections are primarily a paperwork exercise, but that inspectors 

also sometimes “go out and look over the shoulder of the person who’s doing the inspection ... 

or the maintenance work” to verify that what they “see in the records is ... happening on the 

ground.” However, he noted that it is difficult to enforce performance-based regulations, such as 

integrity management rules, “because the case that you have to bring to bear becomes quite 

complex. It’s just easier when you have a linear violation of a prescriptive statute.”

1.10.2 Federal Oversight by PHMSA

In 1968, Congress passed the Natural Gas Pipeline Safety Act of 1968, which created the 

Office of Pipeline Safety within the DOT to implement and oversee pipeline safety regulations. 

Subsequently, the Pipeline Safety Improvement Act of 2002 called for mandatory risk analysis 

and integrity management programs, and PHMSA promulgated standards for gas transmission 

pipelines at 49 CFR Part 192 Subpart O, which became effective in January 2004.

The integrity management rules in Subpart O include a mix of performance-based and 

prescriptive requirements. As explained in the preamble to the final rule110

[RSPA’s Office of Pipeline Safety] believes that performance-based regulation 

will result in effective integrity management programs that are sufficiently 

flexible to reflect pipeline-specific conditions and risks. Pipeline conditions vary. 

It is impractical to specify requirements that will address all circumstances. In 

some cases, they would impose unnecessary burdens. In others, they might not 

achieve the desired level of safety. Including performance-based requirements is 

the best means to ensure that each pipeline develops and implements effective 

integrity management programs that address the risks of each pipeline segment.

—

The elements of an integrity management program, specified in 49 CFR 192.911, include 

identification of all HCAs; a baseline assessment plan; threats to each covered111

With regard to self-assessment, 49 CFR 192.945 requires operators to measure on a 

semiannual basis, “whether the program is effective in assessing and evaluating the integrity of 

each covered pipeline segment and in protecting the high consequence areas.” The measures 

must include (1) number of miles of pipeline inspected versus program requirements; (2) number 

pipeline 

segment, including data integration and a risk assessment to prioritize segments and evaluate the 

merits of additional preventative and mitigative measures; a direct assessment plan; provisions 

for remediating conditions found during integrity assessments; a process for continual evaluation 

and assessment; a plan for confirmatory direct assessment; additional preventative and mitigative 

measures to protect the HCA; performance measures; record-keeping provisions; a 

management-of-change process; a quality assurance process; and a communication plan. 

 110 Federal Register, vol. 68, no. 240 (December 15, 2003), pp. 69817, 69783.

111 A covered segment is one that is located in an HCA.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 30

of 101
NTSB Pipeline Accident Report

70

of immediate repairs completed; (3) number of scheduled repairs completed; and (4) number of 

leaks, failures, and incidents, classified by cause. In addition, operators must use the specific 

measures listed in ASME B31.8S, 2004 edition, appendix A, for each identified threat. For pipe 

seam and pipe manufacturing threats, ASME B31.8S, 2004 edition, appendix A, lists the 

following measures for establishing the effectiveness of the program and confirming the 

inspection interval: number of hydrostatic test failures caused by manufacturing defects and 

number of leaks due to manufacturing defects.

The PHMSA deputy associate administrator for policy and programs testified at the 

NTSB investigative hearing that performance-based regulations such as the integrity 

management rules are very difficult for operators to implement and for regulators to oversee 

because there is no “one-size-fits-all answer to integrity issues.” She stated that, “every operator 

is expected to thoroughly understand their system” and “assess for the threats to that pipe... then 

you must address them.” She noted that overseeing operator compliance with the integrity 

management rules is very different from overseeing compliance with more clear-cut prescriptive 

regulations because “now they are required to think in a totally different manner. They have to 

evaluate the adequacy of an operator’s technical justification. It is difficult. It’s a difficult way of 

evaluating a program, but it’s effective.”

The PHMSA gas integrity management inspection protocol, which is also used by 

CPUC auditors in their integrity management audits, addresses the 16 elements of integrity 

management plans. Section C.02 of the protocol, on data gathering and integration, states in item 

C.02.d: “verify that the operator has checked the data for accuracy. If the operator lacks 

sufficient data or where data quality is suspect, verify that the operator has followed the 

requirements in ASME B31.8S [2004 edition, Managing System Integrity of Gas Pipelines].”112

As noted in section 1.10.1, “State Oversight by CPUC,” PHMSA does not directly 

oversee intrastate pipeline operators, but it evaluates and scores state regulators annually. 

According to the PHMSA director of state programs, in the area of program evaluation, the 

CPUC auditing score was 99.5 in 2009, 99 in 2008, and 100 in the preceding years. The overall 

score for the CPUC (which included several areas in addition to program evaluation) is about 

90 due to its jurisdictional status and the lack of legislation giving it full authority over all gas 

pipelines. The director also stated that the CPUC “has a good inspection program. They have 

good qualified engineers that are quite capable of doing inspections [and] investigations.” 

Section C.03 of the protocol addresses risk assessment and states in item 3.03.d.4 that the auditor 

should verify that “the operator uses a feedback mechanism to ensure that the risk model is 

subject to continuous validation and improvement.” 

 112 The ASME B31.8S standard states that “all of the specified data elements shall be available for each threat 

in order to perform the risk assessment. If such data are not available, it shall be assumed that the particular threat 

applies to the pipeline segment being evaluated.”

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 31

of 101
NTSB Pipeline Accident Report

71

1.11 Postaccident Actions

1.11.1 Actions Taken by PG&E

As a result of the accident, a portion of Line 132, including Segment 180, is no longer in 

service. According to PG&E, a 1.5-mile section of Line 132 between MP 38.49 and 40.05 has 

not operated since the San Bruno accident. At MP 40.05, Line 132 is fed by Line 109 through 

crossties.

Following the accident, PG&E took many actions ordered by the CPUC, including 

reducing the operating pressure on Line 132 to 20 percent below the operating pressure at the 

time of the failure. Another action ordered by the CPUC was to review the classifications of 

transmission lines to determine if they had changed since initial designation. (The class refers 

to the population density in the immediate area; class 1 areas have the lowest density and 

class 4 areas have the highest.) On June 30, 2011, PG&E reported to the CPUC that it had 

discovered classification errors on 550 miles of pipeline. Of those, 173 miles had increased in 

class and 378 miles had decreased in class.

About 1 month after the accident, PG&E conducted a camera inspection of a

1.5-mile- long portion of Line 132. The results of the inspection showed that the longitudinal 

welds appeared to be standard DSAW. Several areas of pups were found, but no partial or 

incomplete welds were noted. In addition, the camera inspection showed that there was some 

water in the pipe as well as oil or condensate.

In October 2010, PG&E announced its Pipeline 2020 program “for enhancing natural gas 

pipeline safety and reliability.” According to PG&E, the program’s five major areas of focus are: 

(1) modernizing critical pipeline infrastructure, (2) expanding the use of automatic or remotely 

operated shutoff valves, (3) spurring the development of next-generation inspection 

technologies,

113

Since the accident, PG&E has conducted numerous excavations to verify the pipe’s

condition. In May 2011, it began hydrostatic pressure testing of its older transmission lines.

According to PG&E, it has done camera inspections of segments before they are hydrostatically 

tested and has removed any pipe pieces that show indications of concern. PG&E has contracted 

for laboratory examination of those removed pieces. 

(4) developing industry-leading best practices, and (5) enhancing public safety 

partnerships.

PG&E states it has installed automated valves and SCADA capability on multiple

regulator and monitor valves that control Line 132 and Line 109 crossties, and it is installing, 

replacing, or upgrading numerous automated valves in locations throughout its system.

 113 PG&E reports that it is creating and funding a nonprofit entity to encourage and fund research and 

development proposals.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 32

of 101
NTSB Pipeline Accident Report

72

In an effort to validate the information in its GIS in response to the NTSB’s 

January 3, 2011, safety recommendations and the CPUC’s directive to comply with those 

recommendations, PG&E is collecting, scanning, and indexing an estimated 1.25 million 

individual records associated with about 2,750 job numbers from hard copy records. PG&E 

states that it is using those records to verify the pipeline segments for which it has complete, 

verifiable, and traceable records of prior pressure tests and to compile a segment-by-segment 

pipeline features list. PG&E began by reviewing all the project folders for the 150 miles of 

transmission pipelines in the peninsula system. According to the PG&E manager of engineering 

support services, errors were found in other segments of Line 132 (some 30-inch pipeline 

segments were listed as seamless, and others had incorrect wall thickness values). PG&E also 

reports that it is in the process of validating GIS records for all 30-inch pipe installed prior to 

1962, for all three peninsula lines, and for all lines in densely populated areas. PG&E expects to

eventually validate GIS records for the entire pipeline network.

PG&E has employed an outside expert to evaluate its integrity management program. In 

addition, the company has ceased its practice of raising the MAOP on certain lines every 5 years 

to preserve the current MAOP.

PG&E also performed testing at the Milpitas Terminal to determine the cause of the 

erratic power to the instrumentation. The supervising engineer of the SCADA controls group 

reported to NTSB investigators that the results of that testing showed that the line pressure 

increase was due to low output voltages from two power supplies that supported pressure 

transmitters and other instrumentation required to operate the regulating valves. The testing

revealed that one of the power supplies had failed, and the other was generating an output of less 

than the rated 24 volts. Both power supplies have been replaced and are supported from separate 

circuit breakers at the distribution panel.

In addition, PG&E has modified its website to allow the location of gas transmission 

lines relative to any address. The website also provides safety information related to gas 

transmission systems and material regarding the resources PG&E has made available to support 

San Bruno residents and the rebuilding process. In April 2011, PG&E sent notifications to 

2.5 million homes and businesses within 2,000 feet of PG&E natural gas transmission pipelines

notifying them of their proximity to the pipeline.

1.11.2 Actions Taken by CPUC

On September 13, 2010, the CPUC ordered PG&E to take several actions, including

lowering the operating pressure on Line 132 to 20 percent below that at the time of failure;

conducting an integrity assessment of all gas facilities in the impacted area; conducting an 

accelerated leak survey of all transmission lines; evaluating customer leak complaint response 

times and response effectiveness; preparing a plan for a complete safety inspection of the entire 

PG&E gas transmission system; reviewing valve locations to identify where it would be prudent 

to replace manually operated valves with automated valves; and reviewing the classifications of 

transmission lines to determine if they have changed since the initial designation.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 33

of 101
NTSB Pipeline Accident Report

73

On December 16, 2010, the CPUC ordered PG&E to reduce the pressure to 20 percent

below MAOP for all 30-inch pipelines with DSAW welds that were installed prior to 1962 and

are located in HCAs or certain other areas and have not undergone hydrostatic pressure testing.

The CPUC also ordered PG&E to assess the integrity of these pipelines by using either 

hydrostatic or other appropriate pressure tests; X-ray or camera examination of the interior 

of the pipe; or in-line inspection using a smart pig or other technology appropriate to assessing 

pipeline seam integrity.

The CPUC subsequently ordered PG&E to comply with the NTSB’s January 3, 2011,

urgent safety recommendations and ordered that the records review be completed by 

March 15, 2011.

On February 24, 2011, the CPUC required PG&E to limit operating pressures to 

80 percent of the MOP recorded between February 15, 2006, and February 15, 2011, on any 

transmission line installed before 1970 located in a HCA or certain other areas if “reliable, 

verifiable, and complete records of strength testing in accord with 49 CFR subpart J are not 

available for inspection.” 

In its February 24, 2011, rulemaking, the CPUC also indicated that it would likely 

propose future new rules on retrofitting of transmission lines to allow in-line inspections;

requiring operators to perform evaluations for installing ASVs or RCVs on transmission 

pipelines; requiring operators to strengthen emergency response procedures; requiring gas 

quality monitoring, testing for pipelines operating below 100 psig and service lines, and 

clearance between gas pipelines and other subsurface structures; incorporating one-call law 

requirements for marking underground facilities; reporting cathodic protection deficiencies and 

providing a timetable for remedial actions; establishing cover requirements for transmission 

lines; reporting problems associated with mechanical/compression fittings; assessing existing 

meter set assemblies and other pipeline components to protect them from excessive snow and ice 

loading; and requiring operators to identify threats along their pipelines and develop mitigation 

plans.

On June 9, 2011, the CPUC issued an order requiring PG&E and other gas transmission 

operators regulated by the CPUC to either hydrostatically pressure test or replace transmission 

pipelines with “grandfathered” MAOPs that have not been pressure tested or for which reliable 

records are not available. The CPUC concluded that all California natural gas transmission 

pipelines “must be brought into compliance with modern standards for safety,” and that 

“[h]istoric exemptions must come to an end.” The order requires operators to develop and file 

with the CPUC implementation plans to achieve orderly and cost-effective replacement or 

hydrostatic pressure testing of all gas transmission pipelines that have not been pressure tested. 

The proposed decision also provides requested guidance to PG&E in how it should complete its 

records-based MAOP determination and the limited uses for engineering assumptions. 

Two weeks after the accident, the CPUC formed an independent review panel of experts 

to gather and review facts and make recommendations for improvement of safe management of 

the PG&E natural gas transmission lines. In its 204-page final report, dated June 8, 2011, the 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 34

of 101
NTSB Pipeline Accident Report

74

panel addressed the PG&E performance and company culture; risk, data, and integrity 

management; emergency response, capital investments, and the PG&E Pipeline 2020 program; 

CPUC oversight; and public policies in the state of California.114

1.11.3 Actions Taken by PHMSA

On January 4, 2011, in response to Safety Recommendation P-10-01, issued on 

January 3, 2011, PHMSA issued Advisory Bulletin 11-01 to owners and operators of hazardous 

liquid and gas pipeline systems. The advisory states that operators relying on the review of 

design, construction, inspection, testing, and other related data to calculate MAOP (for gas 

pipelines) or MOP (for liquid pipelines) must diligently search for relevant records and ensure 

that the records are traceable, verifiable, and complete. If such a search and verification cannot 

be completed, the operator cannot rely on this method for calculating MAOP. The advisory also 

reminded operators of their responsibilities to identify pipeline integrity threats; perform rigorous 

risk analyses; integrate information; and identify, evaluate, and implement preventative and 

mitigative measures. The advisory further suggested that an operator lacking information on key 

risk factors should strongly consider reducing pressure to 80 percent of operating pressure for the 

previous month, hydrostatic testing, or creating a remediation program to identify threat risks. 

The preamble to Advisory Bulletin 11-01 pointed out that one of the—

fundamental tenets of the [integrity management] program is that pipeline 

operators must be aware of the physical attributes of their pipelines as well as the 

physical environment that it transverses. ...This information is a vital component 

in an operator’s ability to identify and evaluate the risks to its pipeline and 

identify the appropriate assessment tools, set the schedule for assessments of the 

integrity of the pipeline segments and identify the need for additional preventative 

and mitigative measures such as lowering the operating pressures. If this 

information is unknown, or unknowable, a more conservative approach to 

operations is dictated.

On April 18, 2011, PHMSA held a pipeline safety forum with the stated goal of 

“accelerating the rehabilitation, repair, and replacement of critical pipeline infrastructure with 

known integrity risks.” Participants in the forum included pipeline safety experts, researchers, 

industry representatives, state regulators, other Federal agency officials, and members of the 

public.

1.11.4 Actions Taken by Congress

Since the San Bruno accident, Congress has held three hearings in the 111th Congress on 

pipeline issues at which the NTSB testified. The House Transportation and Infrastructure 

Committee held a hearing in September 2010 during which the San Bruno accident was 

 114 The full report, Report of the Independent Review Panel, San Bruno Explosion, June 8, 2011, revised copy 

June 24, 2011, is available on the CPUC website <http://www.cpuc.ca.gov/NR/rdonlyres/85E17CDA-7CE2-4D2D93BA-B95D25CF98B2/0/cpucfinalreportrevised62411.pdf> (accessed August 29, 2011).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 35

of 101
NTSB Pipeline Accident Report

75

addressed, and the House Energy and Commerce Committee heard testimony on pipeline safety, 

with a focus on the San Bruno rupture. The Senate Commerce Committee held a hearing 

specifically on the San Bruno accident.

Several bills have been introduced in the 112th Congress containing provisions related to 

the San Bruno accident. H.R. 22, the Pipeline Safety and Community Empowerment Act of 2011, 

strengthens notification and mapping requirements, requires in-line inspections of pipelines on a 

regular basis, and requires ASVs and RCVs on newly constructed pipelines and pipelines in 

class 3 and 4 areas. The House Energy and Commerce Committee passed the Pipeline 

Infrastructure and Community Protection Act of 2011 through the committee. Among its 

provisions are requirements to provide public access to pipeline mapping information, an 

examination of the integrity management system, and requirements for ASVs and RCVs on 

newly constructed pipelines. 

In the Senate, S. 234, the Strengthening Pipeline Safety and Enforcement Act of 2011, is 

pending. This legislation requires the production of information on transmission lines through 

classes 3 and 4 areas and HCAs in classes 1 and 2 that have not had an MAOP previously 

established via hydrostatic testing, directs the U.S. Secretary of Transportation to develop 

regulations for the installation of ASVs and RCVs, and requires the regular use of in-line 

inspection tools. S. 275, the Pipeline Transportation Safety Improvement Act of 2011, requires 

ASVs and RCVs on newly constructed pipelines, directs the U.S. Secretary of Transportation to 

examine the integrity management oversight program, and requires public access to pipeline 

mapping information and operator emergency response plans. 

1.12 Previous NTSB Safety Recommendations

1.12.1 January 3, 2011, Safety Recommendations to PG&E, CPUC, and PHMSA

Regarding Record-keeping and Hydrostatic Pressure Testing

On January 3, 2011, based on the discovery of inaccuracies in PG&E records for the 

accident pipe, the NTSB issued three safety recommendations to PG&E, two of which were 

designated “urgent.” 

Aggressively and diligently search for all as-built drawings, alignment sheets, and 

specifications, and all design, construction, inspection, testing, maintenance, and 

other related records, including those records in locations controlled by personnel 

or firms other than Pacific Gas and Electric Company, relating to pipeline system 

components, such as pipe segments, valves, fittings, and weld seams for

Pacific Gas and Electric Company natural gas transmission lines in class 3 and 

class 4 [footnote removed] locations and class 1 and class 2 [footnote removed]

high consequence areas [footnote removed] that have not had a maximum 

allowable operating pressure established through prior hydrostatic testing. These 

records should be traceable, verifiable, and complete. (P-10-2) (Urgent) 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 36

of 101
NTSB Pipeline Accident Report

76

Use the traceable, verifiable, and complete records located by implementation of 

Safety Recommendation P-10-2 (Urgent) to determine the valid maximum 

allowable operating pressure, based on the weakest section of the pipeline or 

component to ensure safe operation, of Pacific Gas and Electric Company natural 

gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high 

consequence areas that have not had a maximum allowable operating pressure 

established through prior hydrostatic testing. (P-10-3) (Urgent)

If you are unable to comply with Safety Recommendations P-10-2 (Urgent) and 

P-10-3 (Urgent) to accurately determine the maximum allowable operating 

pressure of Pacific Gas and Electric Company natural gas transmission lines in 

class 3 and class 4 locations and class 1 and class 2 high consequence areas that 

have not had a maximum allowable operating pressure established through prior 

hydrostatic testing, determine the maximum allowable operating pressure with a 

spike test followed by a hydrostatic pressure test. (P-10-4)

In a letter dated February 2, 2011, PG&E responded to the NTSB, stating that it was in 

the process of verifying underlying records for the more than 1,800 miles of pipeline covered by 

the recommendations. PG&E indicated that a team of over 50 engineers, estimators, mappers, 

information technology specialists, and managers were dedicated exclusively to the project, and 

that it had also contracted for outside assistance with document management, process controls, 

engineering, pipeline pressure calculations, and auditing. PG&E stated that it had collected 

hundreds of boxes of original records that were being scanned and indexed in round-the-clock 

operations. On March 14, 2011, Safety Recommendations P-10-2, -3, and -4 were classified 

“Open—Acceptable Response.”

On January 3, 2011, the NTSB issued the following safety recommendations to the 

CPUC:

Develop an implementation schedule for the requirements of Safety 

Recommendation P-10-2 (Urgent) to Pacific Gas and Electric Company (PG&E) 

and ensure, through adequate oversight, that PG&E has aggressively and 

diligently searched documents and records relating to pipeline system 

components, such as pipe segments, valves, fittings, and weld seams, for PG&E 

natural gas transmission lines in class 3 and class 4 locations and class 1 and 

class 2 high consequence areas that have not had a maximum allowable operating 

pressure established through prior hydrostatic testing as outlined in Safety 

Recommendation P-10-2 (Urgent) to PG&E. These records should be traceable, 

verifiable, and complete; should meet your regulatory intent and requirements; 

and should have been considered in determining maximum allowable operating 

pressures for PG&E pipelines. (P-10-5) (Urgent)

If such a document and records search cannot be satisfactorily completed, provide 

oversight to any spike and hydrostatic tests that Pacific Gas and Electric Company 

is required to perform according to Safety Recommendation P-10-4. (P-10-6) 

(Urgent)

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 37

of 101
NTSB Pipeline Accident Report

77

Through appropriate and expeditious means, including posting on your website, 

immediately inform California intrastate natural gas transmission operators of the 

circumstances leading up to and the consequences of the September 9, 2010, 

pipeline rupture in San Bruno, California, and the National Transportation Safety 

Board’s urgent safety recommendations to Pacific Gas and Electric Company so 

that pipeline operators can proactively implement corrective measures as 

appropriate for their pipeline systems. (P-10-7) (Urgent)

The CPUC response, dated February 2, 2011, states that the CPUC directed PG&E to 

undertake a plan of action to comply with Safety Recommendation P-10-2 and to provide a 

status report by February 1, 2011. The CPUC stated that it had also informed California’s three 

other intrastate natural gas transmission pipeline operators of the NTSB recommendations and 

directed them to comply. All of the California intrastate operators provided the CPUC with an 

implementation schedule by the February 1, 2011 deadline. On March 29, 2011, Safety

Recommendations P-10-5 and -6 were classified “Open—Acceptable Response,” and Safety 

Recommendation P-10-7 was classified “Closed—Acceptable Action.”

On January 3, 2011, the NTSB also issued the following safety recommendation to 

PHMSA:

Through appropriate and expeditious means such as advisory bulletins and 

posting on your website, immediately inform the pipeline industry of the 

circumstances leading up to and the consequences of the September 9, 2010, 

pipeline rupture in San Bruno, California, and the National Transportation Safety 

Board’s urgent safety recommendations to Pacific Gas and Electric Company so 

that pipeline operators can proactively implement corrective measures as 

appropriate for their pipeline systems. (P-10-1) (Urgent)

In response, on January 4, 2011, PHMSA issued Advisory Bulletin 11-01 to owners and 

operators of hazardous liquid and gas pipeline systems. (The advisory is discussed earlier in 

section 1.11.3, “Actions Taken by PHMSA.”) On February 14, 2011, Safety Recommendation 

P-10-1 was classified “Closed—Acceptable Action.” 

1.12.2 June 8, 2011, Safety Recommendations to PHMSA and PG&E Concerning

Emergency Response

At the investigative hearing on this accident, the NTSB learned that the SBFD chief was 

unaware of the presence of Line 132 prior to the accident and that the PG&E public awareness 

program did not identify pipeline locations. After the accident, PG&E provided the SBFD with 

maps showing the location of its gas transmission pipelines. The NTSB was concerned that 

without system-specific information for pipelines, local emergency responders would be at risk 

and the effectiveness of the emergency response effort could be adversely affected. As a result, 

on June 8, 2011, the NTSB issued the following safety recommendation to PHMSA:

Issue guidance to operators of natural gas transmission and distribution 

pipelines and hazardous liquid pipelines regarding the importance of sharing 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 38

of 101
NTSB Pipeline Accident Report

78

system-specific information, including pipe diameter, operating pressure, product 

transported, and potential impact radius, about their pipeline systems with the 

emergency response agencies of the communities and jurisdictions in which those 

pipelines are located. (P-11-1)

During the investigation, the NTSB also learned that PG&E procedures do not require 

SCADA operators to immediately notify the applicable 911 emergency call center in the event of 

a possible pipeline rupture. They require only that a field employee be dispatched to the gas 

incident location to evaluate the danger to life and property, assess damage, and make or ensure 

that conditions are safe. The procedure also requires field personnel to notify a field service 

supervisor, a dispatcher, a gas maintenance and construction supervisor, or an on-call gas 

supervisor. The procedure does not instruct field personnel, the dispatch center, or the control 

center to contact emergency services through 911 or other means. The procedure does not 

discuss the involvement of city or emergency officials. Notifications outlined in the procedure

are focused on company personnel and supervisors only. The NTSB was concerned that this 

could adversely affect the timeliness and effectiveness of an emergency response effort. 

Therefore, on June 8, 2011, the NTSB issued the following safety recommendation to PG&E:

Require your control room operators to notify, immediately and directly, the 

911 emergency call center(s) for the communities and jurisdictions in which your 

transmission and/or distribution pipelines are located, when a possible rupture of 

any pipeline is indicated. (P-11-3)

Based on the same concerns, on June 8, 2011, the NTSB also issued the following safety 

recommendation to PHMSA:

Issue guidance to operators of natural gas transmission and distribution pipelines 

and hazardous liquid pipelines regarding the importance of control room operators

immediately and directly notifying the 911 emergency call center(s) for the 

communities and jurisdictions in which those pipelines are located when a 

possible rupture of any pipeline is indicated. (P-11-2)

Safety Recommendations P-11-1, -2, and -3, are currently classified “Open—Await 

Response.”

1.12.3 Other Relevant Recommendations 

1.12.3.1 Grandfathering of Higher Permissible Stress Levels for Pre-1970 

Pipelines 

In its 1987 final report on two corrosion-related gas pipeline ruptures in Beaumont and 

Lancaster, Kentucky,115

 115 Texas Eastern Gas Pipeline Company Ruptures and Fires at Beaumont, Kentucky, on April 27, 1985, and 

Lancaster, Kentucky, on February 21, 1986, Pipeline Accident Report NTSB/PAR-87/01 (Washington DC: National 

Transportation Safety Board, 1987).

the NTSB noted that the operating pressure on those pipelines (both of 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 39

of 101
NTSB Pipeline Accident Report

79

which dated to the 1950s) was in excess of what would have been allowed for pipelines 

constructed after 1970—which are limited to a MAOP of no more than 72 percent SMYS in 

class 1 locations. The report stated that the NTSB “does not believe it is sound engineering 

practice to allow older pipelines, constructed with materials and procedures inferior to those used 

in new pipelines, to operate at SMYS levels greater than those new pipelines.” While 

acknowledging that, in 1970, “it may not have been practical to have required all existing 

pipelines to immediately conform to the new maximum pressure standard,” the NTSB expressed 

its belief that a reasonable approach would have been to allow operation at higher pressures until 

a specified time, “by which all existing pipelines would be required to adhere to the new 

standard.” Accordingly, the NTSB recommended that RSPA—

Revise 49 CFR 192 and, if necessary, request legislative authority to amend 

49 CFR 192 to eliminate the “grandfather clause” which permits operators of 

pipelines installed before November 12, 1970, to operate at levels of stress that 

exceed those levels permitted for pipeline installed after the effective date of 

49 CFR 192. (P-87-9)

RSPA published an ANPRM on December 11, 1989, asking for public comment on 

whether it should repeal, modify, or retain the grandfather clause.116

In a letter dated September 2, 1992, RSPA advised the NTSB that, based on the 

comments received and on the results of its own research, it could not conclude that 

grandfathered lines require special treatment when operating above 72 percent SMYS. On 

April 22, 1994, the NTSB classified Safety Recommendation P-87-9 “Closed—Reconsidered.” 

The ANPRM pointed out 

that the grandfather clause was adopted “primarily so that gas transmission lines that had not 

been pressure tested to a level of at least 1.1 times their operating pressure could continue to 

operate in [c]lass 1 locations without retesting or reducing pressure.” However, RSPA found that 

its own research into grandfathered lines operating above 72 percent showed that all the lines 

examined “had been tested well above that level. ...Thus, insufficient qualifying test levels do 

not appear to be a problem for grandfathered pipelines operating above 72 [percent] of SMYS.” 

Nonetheless, RSPA indicated that it was “concerned about the prudence of continuing to allow 

grandfathered lines to operate above 72 percent of SMYS.”

1.12.3.2 Constructing and Modifying Pipelines to Accommodate Use of In-Line 

Inspection Equipment

The 1987 final report on the gas pipeline ruptures in Beaumont and Lancaster, Kentucky,

discussed in section 1.12.3.1, “Grandfathering of Higher Permissible Stress Levels for Pre-1970s 

Pipelines,” also presented the safety benefits of in-line inspections for identifying corrosion and 

other deficiencies. The NTSB recommended that RSPA—

 116 Federal Register, vol. 54 (December 11, 1989), p. 50780.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 40

of 101
NTSB Pipeline Accident Report

80

Require existing natural gas transmission and liquid petroleum pipeline operators 

when repairing or modifying their systems, to install facilities to incorporate the 

use of in-line inspection equipment. (P-87-6) 

Require that all new gas and liquid transmission pipelines be constructed to 

facilitate the use of in-line instrument inspection equipment. (P-87-7)

On February 7, 1995, based on RSPA’s then-ongoing rulemaking to require newly

constructed pipelines to be piggable (discussed further in section 1.13.1.2, “In-line Inspection”),

Safety Recommendations P-87-6 and -7 were classified “Closed—Acceptable Action.”

1.12.3.3 Rapid Shutdown and ASVs and RCVs

In December 1970, the NTSB completed a special study examining the effects of delay in 

shutting down failed pipeline systems and methods of providing rapid shutdown.117

Conduct a study to develop standards for the rapid shutdown of failed natural gas 

pipelines and work in conjunction with the Federal Railroad Administration[

The study 

concluded that a large proportion of the damage from several recent pipeline accidents could 

have been minimized or eliminated if the time between failure and shutdown had been reduced. 

The study noted that there were no Federal requirements for rapid shutdown and no standards 

defining a reasonable period of time to shut down a failed system. Accordingly, the NTSB 

recommended that the DOT Office of Pipeline Safety—

118

The DOT conducted the study; and, on September 30, 1976, the NTSB classified Safety 

Recommendation P-71-1 “Closed—Acceptable Action.” However, the DOT did not issue 

regulations requiring the use of ASVs or RCVs.

] to 

develop similar standards for liquid pipelines. (P-71-1)

In its 1995 report on the natural gas explosion in Edison, New Jersey,119

Expedite requirements for installing automatic- or remote-operated mainline 

valves on high-pressure pipelines in urban and environmentally sensitive areas to 

provide for rapid shutdown of failed pipeline segments. (P-95-1)

the NTSB noted 

that a number of accidents since 1971 had illustrated the need to require ASVs and/or RCVs to 

facilitate rapid shutdown of failed pipelines. The NTSB recommended that RSPA—

On April 21, 2004, the NTSB classified Safety Recommendation P-95-1 

“Closed—Acceptable Action,” based on RSPA’s 2004 integrity management rulemaking 

 117 Effects of Delay in Shutting Down Failed Pipeline Systems and Methods of Providing Rapid Shutdown, 

Pipeline Safety Study NTSB/PSS-71/01 (Washington, DC: National Transportation Safety Board, 1970).

118 At that time, the Federal Railroad Administration was responsible for setting liquid pipeline safety 

standards.

119 Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New Jersey, 

March 23, 1994, Pipeline Accident Report NTSB/PAR-95/01 (Washington, DC: National Transportation Safety 

Board, 1995.) 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 41

of 101
NTSB Pipeline Accident Report

81

requiring that each gas transmission operator determine whether installing ASVs or RCVs would 

be an efficient means of adding protection to an HCA. 

In 1982, the NTSB issued a recommendation regarding emergency shutdown to PG&E 

following a pipeline investigation. On August 25, 1981, a PG&E excavation contractor 

punctured a 16-inch natural gas main in San Francisco, California. The PG&E personnel who 

first arrived on scene were not trained or equipped to close the valves, and specially trained valve 

crews were dispatched. That was one of several factors that delayed PG&E in accurately locating 

and shutting off the valves necessary to isolate the rupture. The flow of gas was not stopped until 

9 hours 10 minutes after the puncture. In its final report,120

the failure of the general contractor to comply fully with the terms of the 

excavation permit which required him to verify the location of underground 

facilities that might be affected by the project. Contributing to the accident was 

the failure of the subcontractor, who knew of the existence of the gas main, but 

not its precise location, to ascertain that the gas company had been notified before 

commencing excavation. Contributing to the duration of the gas leakage was the 

gas company’s inability to locate one emergency valve because of inaccurate 

recordkeeping, and because it had been paved over; and to close another valve 

which was inoperative because of inadequate maintenance.

the NTSB determined that the 

probable cause of that accident was

As a result of the 1981 accident, the NTSB made several recommendations, including 

that PG&E—

Train and equip company personnel who respond to emergency conditions in the 

operation of emergency shutdown valves. (P-82-1)

PG&E responded on June 21, 1982, that special attention was being directed to training 

personnel about the location and operation of emergency shutdown valves, and that additional 

valve keys were being provided to crews who could be called in an emergency. 

Safety Recommendation P-82-1 was subsequently classified “Closed—Acceptable Action.”

1.13 Other Information

1.13.1 Pipeline Assessment Methods for Integrity Management

The Pipeline Safety Improvement Act of 2002 and the integrity management rules in 

49 CFR Part 192 specify three primary types of assessment methods for in-service gas 

transmission pipelines: pressure testing, in-line inspection, and direct assessment.121

 120 Pacific Gas & Electric Company Natural Gas Pipeline Puncture, San Francisco, California, 

August 25, 1981, Pipeline Accident Report NTSB/PAR-82/01 (Washington, DC: National Transportation Safety 

Board, 1982).

An operator 

121 Title 49 CFR Part 192 also allows for the use of other technology if the operator can demonstrate that it 

provides an equivalent assessment of the condition of the pipe.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 42

of 101
NTSB Pipeline Accident Report

82

is required to apply one or more of these methods to each covered segment, depending on the 

threats to which the segment is susceptible.

The 2002 act also charged PHMSA with conducting a research and development 

program, with annual funding of $10 million. The PHMSA manager of research and 

development testified at the NTSB’s investigative hearing that the program objectives are to 

develop technology, strengthen consensus standards, and promote knowledge. He reported that 

the program has awarded $62 million to 171 projects since 2002, and noted that those projects 

were also supported by $79 million of industry and other Federal cofunding. About 69 of those 

projects (which received $34.59 million from PHMSA and $41.92 million from other sources) 

relate to developing new pipeline assessment technologies.

1.13.1.1 Pressure Testing

As previously discussed in section 1.7.5.1, “Grandfather Clause,” since 1970, Federal 

regulations at 49 CFR 192.505 have required hydrostatic pressure testing of newly installed 

pipelines at levels above the intended MAOP. Pressure testing of newly constructed pipelines is 

designed to identify critical manufacturing and construction defects. However, it may not test the 

ability of a pipe to withstand the combination of threats (for example, seismic and utility work) 

to which it may be subjected. Pressure testing of existing in-service pipelines is designed to find 

critical seam defects—as well as other defects caused by corrosion, stress corrosion cracking, 

and fatigue—by causing the pipe to fail at these critical defect locations. 

According to testimony at the NTSB investigative hearing, there are several limitations to 

pressure testing of in-service pipelines:

• Pressure testing identifies only the most severe defects; it does not indicate whether 

or how many other defects might exist. 

• The pipeline must be taken out of service during the pressure test, which causes 

inconvenience to the customers and a loss of revenue to the operator. 

• Water used during a pressure test can be difficult to completely remove from the pipe, 

and residual water can cause internal corrosion. In addition, the water can be 

hazardous after the test and must be treated before disposal.

Finally, in limited cases, some pipelines may be susceptible to a pressure reversal failure after 

pressure testing. PHMSA defines a pressure reversal as the failure of a pipeline at a latent defect 

that survived a pressure test but subsequently failed at a lower repressurization pressure.122

Pressure reversal research suggests that a pressure spike test protocol123

 122 Information obtained from PHMSA website:

<

may be used to manage 

http://primis.phmsa.dot.gov/comm/FactSheets/FSHydrostaticTesting022607.htm?nocache=766> (accessed 

August 8, 2011).

123 (a) J.F. Kiefner and W.A. Maxey, “The Benefits and Limitations of Hydrostatic Testing,” in 

E.W. McAllister, ed., Pipeline Rules of Thumb Handbook, 6th ed. (Boston: Elsevier, 2005), pp. 139–162. 

(b) Information obtained from PHMSA website:

<http://primis.phmsa.dot.gov/comm/FactSheets/FSHydrostaticTesting022607.htm?nocache=766> (accessed 

August 8, 2011).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 43

of 101
NTSB Pipeline Accident Report

83

pressure reversals. In a spike test, the pipe is pressurized beyond the MAOP for a short time 

period.

The Pipeline Rules of Thumb Handbook,

124

PHMSA regulatory evaluation prepared in connection with the gas integrity management 

rulemaking indicated that, based on estimates provided by the Interstate Natural Gas Association 

of America (INGAA) and the American Gas Association (AGA), the cost per mile for 

hydrostatic testing of a gas transmission pipeline was $29,700–$40,000 in 2001. The regulatory 

evaluation noted that informal discussion with pipeline operators indicated that hydrostatic 

testing was the least preferred method for assessing pipeline integrity because it could be 

destructive, whereas the other two methods (in-line inspection and direct assessment) were not;

because it required taking a line out of service; and because it could result in moisture remaining 

in the line. 

an industry reference text, states that new 

pipelines should be tested to at least 100 percent of SMYS, but that in-line inspection is 

preferable for older lines for locating time-dependent defects if there is sufficient confidence in 

the ability of the tool to find significant defects. Regarding pressure reversals, this text states, “if 

a hydrostatic test can be successfully accomplished without the failure of any defect, the 

likelihood of a pressure reversal will be extremely small. It is the tests in which numerous 

failures occur that have the highest probabilities of reversals.” The handbook further 

recommends conducting an integrity test as a spike test in which the pipeline is pressurized to as 

high a level as possible for a short period of time.

1.13.1.2 In-line Inspection 

As already noted, in-line inspection is accomplished using a mechanical device known as 

a “smart pig,” which is inserted into and travels through the pipeline. A variety of in-line

inspection technologies exist to inspect for various types of defects. On gas pipelines, these

technologies include deformation or geometry tools, magnetic flux leakage tools, and ultrasonic 

tools. Deformation or geometry tools are used to detect construction damage, dents, third-party 

damage, and wrinkles or buckles. 

Magnetic flux leakage tools vary based on the orientation of the sensors; some are 

optimized to find circumferentially oriented defects such as girth weld defects, while others are 

optimized to find longitudinally oriented defects such as seam defects. Ultrasonic tools can be 

used to detect corrosion and cracks, but they require either a liquid couplant or a wheel-coupled 

system, which limits their use in gas pipelines. Electromagnetic acoustic transducer is a type of 

ultrasonic inspection that is being adapted for use in gas pipelines. It is currently in the 

demonstration phase of research and is not yet widely available. 

In-line inspection technologies can be effective at finding flaws and providing data for 

comparison over time. Another advantage is that in-line inspection is a nondestructive test 

method. However, there are some limitations to the technology. There is generally at best a 

 124 Kiefner and Maxey, 2005, pp. 139–162.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 44

of 101
NTSB Pipeline Accident Report

84

90 percent probability in-line tools will detect a certain type of known defect. (The probability of 

detecting a crack can be improved with multiple runs.) In addition, a specific pressure or flow is 

required to propel the in-line inspection device through the pipeline. Furthermore, according to 

the AGA, about 61 percent of transmission pipelines are not piggable—meaning they cannot 

accommodate current gas-driven in-line inspection devices. A variety of physical 

obstacles—such as bends, valves, fittings, and diameter changes—can prevent in-line inspection 

tools from moving through a pipeline. According to information presented by the AGA at the

NTSB investigative hearing, the estimated cost to retrofit all intrastate gas transmission lines to 

make them piggable is $12 billion. A battery-operated self-propelled robotic tool has recently 

been developed to inspect unpiggable 20- to 26-inch-diameter natural gas pipelines. It is 

currently in the demonstration phase of research and is not yet widely available. 

In 1994, in response to a congressional mandate in the Pipeline Safety Reauthorization 

Act of 1988, RSPA amended Federal pipeline safety regulations to require that newly installed 

pipelines be designed and constructed to accommodate the passage of smart pigs. The 

1994 rulemaking required that whenever any line pipe or component was replaced, the operator 

must design and construct the entire line section125

In relaxing the 1994 replacement requirement, RSPA noted that the then-new integrity 

management regulations had “reduced the significance of the replacement provision in reaching 

the piggability goal,” because comments on the integrity management rulemaking had “indicated 

that operators strongly prefer to use smart pigs as the method of assessment and will modify their 

transmission lines as necessary to accommodate smart pigs.” The preamble to the 

2004 amendment noted that, therefore, “regardless of the replacement provision, the new 

integrity management regulations should result in increased piggability of existing transmission 

lines in and near areas of high population, areas where the risk of damage from a pipeline rupture 

is the greatest.”

containing the replacement to accommodate 

the passage of a smart pig. However, in response to industry petitions for reconsideration 

objecting to this replacement provision, enforcement of this aspect of the 1994 rule was 

suspended shortly after its issuance. The replacement provision was amended in 2004 to apply 

only to replacements of pipe or components, not the entire section.

126

The PHMSA regulatory evaluation indicated that, based on estimates provided by 

INGAA and AGA, the cost per mile of in-line inspection was $3,700–$9,600 in 2001. The 

regulatory evaluation noted that much natural gas transmission pipeline was not currently 

piggable and that INGAA estimated the cost per mile of adding pig launchers and receivers and 

making other necessary modifications was $11,750–$76,500, again in 2001 dollars.

However, at the NTSB’s investigative hearing, the deputy director of the 

CPUC consumer product safety division testified that “in PG&E’s service territory... we haven’t 

seen an aggressive effort to make their pipes piggable... and we haven’t seen a program to take 

the grandfathered pipe and either... hydro test it or replace it. We haven’t seen, in the integrity 

management program, thus far, any aggressive efforts in those areas.” 

 125 “Line section” was defined in the 1994 rule as “a continuous run of transmission line between adjacent 

compressor stations, between a compressor station and storage facilities, between a compressor station and a block 

valve, or between adjacent block valves.”

126 Federal Register, vol. 69, no. 123 (June 28, 2004), p. 36029.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 45

of 101
NTSB Pipeline Accident Report

85

The regulatory evaluation further noted that in-line inspection appeared to be the 

preferred method of assessment because the per-mile cost was less than for hydrostatic testing or 

direct assessment (discussed below). However, the PHMSA evaluation cautioned that “the 

choice between direct assessment and in-line inspection is not so obvious for pipeline that must 

be modified to be made piggable.” Nonetheless, PHMSA concluded that “while the direct 

assessment process produces a significant amount of information about the pipeline, pigging still 

provides operators the most information from actual examination of the pipe wall.”

At the time of the accident, 945.28 miles of PG&E gas transmission lines could

accommodate in-line inspection tools, and 713.09 of those miles had been inspected using in-line 

inspection tools. As of the date of this report, 987.98 miles of PG&E gas transmission lines could

accommodate in-line inspection tools, and 742.42 of those miles have been inspected using those 

tools. 

1.13.1.3 Direct Assessment

Direct assessment is used to evaluate pipeline corrosion threats. The methodology relies 

on a variety of techniques—including records review, indirect inspection, mathematical models, 

and environmental surveys—to identify likely locations on the pipeline where corrosion may be 

occurring. In the case of ECDA, remote electric field measurements can identify coating flaws in 

buried pipelines. Likely locations of corrosion are then excavated and directly examined. A

feedback mechanism is used to validate and improve the indirect assessment based on direct 

assessment findings.

In the preamble to the 2004 integrity management rules,127

Pipeline operators have used indirect examination tools in [direct assessment] for 

many years, and there is a wealth of experience. Although exposing a pipeline for 

direct observation and evaluation of potential problems is the most reliable means 

of understanding pipeline condition, it is not practical to excavate and examine 

entire pipelines. The [direct assessment] process is a method that involves 

structured use of the time-tested indirect examination tools, and integration of the 

information gained from use of those tools with other information about the 

pipeline, to determine where it is necessary to excavate and examine the pipe.

RSPA explained the use of 

indirect examination as part of the direct assessment process as follows,

As originally proposed, the integrity management rules would not have allowed direct 

assessment as a primary assessment method except in certain circumstances (where in-line

inspection and pressure testing were not possible or economically feasible or for low stress 

pipelines) and would have established shorter assessment intervals for direct assessment than for 

other assessment methods. However, based on numerous comments from the pipeline industry, 

the final rule eliminated these restrictions. In the preamble to the final rule, RSPA explained that 

many distribution companies operating transmission pipelines would need to rely heavily on 

 127 Federal Register, vol. 68, no. 240 (December 15, 2003), pp. 69778, 69791.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 46

of 101
NTSB Pipeline Accident Report

86

direct assessment because such pipelines “are generally not amenable to in-line inspection, and 

are often impractical to remove from service for pressure testing.” In addition, RSPA noted that 

most of these pipelines “also operate at low pressures, presenting relatively smaller risks than 

other transmission pipelines.” Therefore, “[p]lacing more restrictive requirements on use of 

[direct assessment] would increase the burden, and costs, for operators of these low-risk 

pipelines without commensurate benefits.”

The integrity management rules at 49 CFR 192.923 state that an operator may use only 

direct assessment as the primary assessment method to address the identified threats of external 

corrosion, internal corrosion, and stress corrosion cracking. In testimony at the NTSB 

investigative hearing, the PHMSA deputy associate administrator for field operations cautioned 

that direct assessment would not be appropriate for a seam threat. In other hearing testimony, a 

PHMSA materials engineer stated that the advantages of direct assessment include the ability to 

compare data from sequential assessments over time to identify changes in pipeline condition.

According to 49 CFR 192.925, ECDA is a four-step process involving preassessment, 

indirect examination, direct examination, and postassessment and continuing evaluation. Internal 

corrosion direct assessment, according to 49 CFR 192.927, consists of a similar process 

involving preassessment, region identification, excavation and direct examination, and 

postassessment evaluation and monitoring. Stress corrosion cracking direct assessment involves 

data gathering and integration and use of an appropriate assessment method and remediation, as 

described at 49 CFR 192.929.

The PHMSA regulatory evaluation for the gas integrity management rule indicated that, 

according to INGAA estimates, the cost per mile of performing direct assessment was $15,000 in 

2001. AGA estimated the cost as $7,000–$8,000 per mile without any verification digs and 

stated that excavation digs could cost from $2,500–$250,000, with an average of $40,000 for a 

typical large transmission line.

1.13.2 Automatic Shutoff Valve Technology

Newer ASV technologies address previously recognized shortcomings such as false or 

nuisance trips (closures) from normal pressure transients. Newer ASV models incorporate 

“smart” technology while combining the features of both a line break device and a remote 

control valve. Such newer models sense pressure transients and trend the typical high and low 

operating pressures. They also record the pressures prior to an event for later analysis. The newer 

ASVs are solar powered with battery backup and can be programmed to send an alarm before 

tripping and closing. This alarm gives SCADA operators the opportunity to override an 

impending valve closure. The alarm can also be outfitted with a delay that allows the valve to 

trip locally if the operator does not override the alarm within a specified amount of time.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 47

of 101
NTSB Pipeline Accident Report

87

1.13.3 2008 Natural Gas Explosion in Rancho Cordova, California

The NTSB investigated a natural gas explosion involving a PG&E distribution line that 

occurred on December 24, 2008.128

The NTSB determined that the probable cause of the accident was the use of a section of 

unmarked and out-of-specification polyethylene pipe with inadequate wall thickness that allowed gas 

to leak from a mechanical coupling installed on September 21, 2006. Contributing to the accident 

was the 2-hour 47-minute delay in the arrival at the job site of a PG&E crew that was properly 

trained and equipped to identify and classify outdoor leaks and to begin response activities to ensure 

the safety of the residents and public.

The explosion and fire, which was caused by a natural gas leak, 

destroyed a house in Rancho Cordova, California. One person was killed, and five other people, 

including one utility employee and one firefighter, were hospitalized as a result of the explosion. 

Two adjacent homes were severely damaged, and several homes received minor damage. 

The investigation found that at least one PG&E facility stored unmarked 

(nonspecification) pipe lengths that were delivered as part of packing material and later used 

them for stub markers. Such packing pipe was not intended for use as a specification pipe 

product. 

The NTSB report stated that the accident also highlighted shortcomings in PG&E’s response 

procedures. First, at the time of the accident, PG&E did not require any of the responders to 

periodically check in with their dispatch offices to communicate delays in responding. Second, 

PG&E sent GSRs as the first responders to leak complaints. The report noted that GSRs are neither 

trained in grading outdoor leaks nor equipped with the equipment required to do so under PG&E’s 

operator qualification program. A GSR who encountered an outdoor leak was required to call 

PG&E’s dispatch center and have a leak inspector sent to grade the leak. Prior to the 

Rancho Cordova accident, as a result of a May 2008 audit, the CPUC had ordered PG&E to review 

its response procedures to ensure that personnel responding to reports of gas leaks had the proper 

training and equipment. The CPUC order noted that PG&E’s procedures, “wherein events requiring 

immediate attention are identified and classified by persons not qualified to make such decisions, has 

the real potential to prevent or delay qualified personnel from timely responding to, and correcting 

what can be very hazardous conditions.” 

 128 Explosion, Release, and Ignition of Natural Gas, Rancho Cordova, California, December 24, 2008, Pipeline 

Accident Brief NTSB/PAB-10/01 (Washington, DC: National Transportation Safety Board, 2010).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 48

of 101
NTSB Pipeline Accident Report

88

2. Analysis

2.1 Introduction

This analysis explains the probable cause of the accident and includes discussion of the 

following safety issues identified in this report: 

• Multiple deficiencies in PG&E’s operations, including its practices and procedures 

regarding emergency response, SCADA employees’ roles and duties, SCADA work, 

postaccident toxicological testing, isolation and shutdown after the rupture, public 

awareness, quality control, and integrity management.

• Ineffectiveness of the CPUC’s oversight of PG&E.

• Ineffectiveness of PHMSA’s oversight and inadequacy of current Federal pipeline 

safety rules, including those governing MAOP and integrity management programs, 

and ineffective implementation and execution of performance-based pipeline safety 

programs.

The remainder of this introductory section discusses those elements of the investigation 

that the NTSB was able to determine did not affect the cause of the accident or the extent of its 

outcome.

Segment 180 of Line 132 did not cross any known fault lines, and there were no reports 

of ground shifts in the accident area. A 1992 geologic hazard report prepared by PG&E indicated 

that the ground around Segment 180 had a low-to-moderate seismic risk, and a 2011 report by a 

company specializing in measuring ground deformation over time using satellite imagery 

indicated that fill beneath the Earl Avenue and Glenview Drive area of San Bruno did not 

experience any significant vertical movement between May 1992 and August 2010, indicating 

the area had a low seismic risk. U.S. Army Corps of Engineers (the Corps) geotechnical 

engineers evaluated seismic data and concurred that seismic loading was not a significant 

external force on the pipeline. Therefore, seismic activity can be ruled out as a factor in the 

failure of the pipeline.

Laboratory examination of the accident pipe revealed no areas of preexisting external or 

internal corrosion, or stress corrosion cracking. Therefore, corrosion was eliminated as a factor in 

the pipeline rupture. Further, the laboratory examination revealed no evidence of preexisting 

damage or direct third-party damage. Therefore, direct third-party damage also was eliminated as 

a factor. (For additional analysis of activities surrounding the 2008 sewer replacement project,

see section 2.3.4, “2008 Sewer Pipe Bursting Operation.”)

Drug test results for workers at the Milpitas Terminal were negative. Alcohol tests were 

administered too late to be considered valid under DOT regulations. PG&E did no drug or 

alcohol testing of the SCADA center staff because PG&E did not believe that their actions had 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 49

of 101
NTSB Pipeline Accident Report

89

contributed to the rupture. (For more information, see section 2.4.5, “Deficiencies in 

Postaccident Drug and Alcohol Testing.”)

Fatigue was evaluated as a possible human performance issue. A variety of fatigue 

factors, including sleep (acute sleep loss, cumulative sleep debt, and sleep quality), continuous 

hours awake, circadian disruption, sleep disorders, medication use, disruptive environmental 

factors, and shift work considerations were examined. None of the fatigue factors emerged as an 

indication of significant physiological fatigue at the time of the accident, although one factor 

(continuous hours awake) was noteworthy. 

The accident occurred during the beginning of a new shift for SCADA operators who had 

arrived by 6:00 p.m. However, the day shift operators remained past their normal duty times in 

order to address the problems associated with the Milpitas Terminal and pressure anomalies. 

Thus, they continued working beyond their normal 12-hour shifts with the response lasting about 

95 minutes beyond the shift’s end before the gas flow was shut down. The overall duty times at 

the time of the accident for the nine interviewed employees ranged from 12–13 hours. Their 

potential continuous hours awake ranged from about 13–15 hours at the time of the accident. The 

employees’ involvement in the subsequent response lasted at least 95 minutes immediately 

following the accident and occurred beyond the duty and continuous hours of awake times 

provided earlier. Therefore, some or all of the nine employees could have been functioning at 

14.5–16.5 continuous hours of wakefulness during the subsequent response to the accident. 

Although continuous hours awake beyond 16 hours has been demonstrated to degrade operator 

performance substantially, 12-hour shifts also have been associated with fatigue-related 

performance decrements.

In its 2005 safety study of SCADA systems,

129

The nine PG&E employees interviewed were involved with varied aspects of the 

postrupture and emergency response activities (such as decision-making, communication, and 

coordination) and had extended amounts of continuous hours of wakefulness. Given the diversity 

of tasks, collective involvement in the response activities and number of individuals involved, it 

was not possible to connect an individual’s potential fatigue-related performance decrements to a 

specific outcome or action. Given this situation, it was not possible to include or exclude fatigue 

associated with the extended continuous hours of wakefulness as a factor in the accident or 

during the subsequent emergency response. 

the NTSB cited a variety of research 

studies showing fatigue-related performance deficits associated with 12-hour shifts. One article 

cited in the study found “a decreased performance (187 percent more errors) and increased 

sleepiness (66 percent) for workers of a 12-hour shift during their last 4 hours on shift.” 

Accordingly, the NTSB concludes that the following were not factors in this accident: 

seismic activity, corrosion, direct third-party damage, or drug use by the workers at the 

Milpitas Terminal.

 129 NTSB/SS-05/02, p. 52. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 50

of 101
NTSB Pipeline Accident Report

90

Over 900 emergency response personnel responded to the accident. The first police 

department and fire department resources arrived on scene within minutes of the explosion.

Mutual aid personnel and resources were requested from surrounding jurisdictions. Firefighters 

and police officers conducted door-to-door searches in the surrounding neighborhoods and 

evacuated about 300 houses. A medical group was established, and medical units were located 

north and south of the explosion site. Logistics, planning, communications, finance, and damage 

assessment groups were formed as part of the organized emergency response. The city of 

San Bruno activated its emergency operations center and opened a facility staffed by the 

American Red Cross for evacuees. 

Because of the flow of natural gas from the pipeline during the first 95 minutes after the 

rupture, firefighters conducted defensive operations until the pipeline valves were closed, at 

which time they were able to access the area. The NTSB concludes that, considering the

challenges of the prolonged fire fueled by natural gas, the emergency response was well

coordinated and effectively managed by local responders. 

2.2 Preaccident Events

2.2.1 Work Clearance Procedures for Electrical Work at Milpitas Terminal

Because electrical work at the Milpitas Terminal resulted in the inadvertent pressure 

increases that preceded the rupture, the NTSB examined the procedures relating to this work. 

The investigation identified several deficiencies in the work clearance process used for 

the Milpitas Terminal electrical work. First, the system clearance form did not adequately detail 

the work to be performed. It did not discuss the equipment being worked on or the equipment 

that would be affected. The form indicated that normal function at the terminal would not be 

maintained, but there was no explanation, although the form called for such an explanation. The 

work clearance form also lacked any entries under “Sequence of Operations.” By contrast, NTSB 

investigators noted that the clearance form for the 2008 pressure increase to 400 psig130

If the form had included the necessary information, the SCADA operators would have at 

least been aware that power interruptions were planned to specific instrumentation at the 

Milpitas Terminal and might have taken steps to mitigate the risk. This assumption was also 

illustrated when, after the rupture (at 7:05 p.m.), a SCADA operator incorrectly stated, “it was a 

regular scheduled clearance, it wasn’t supposed to affect anything.” In fact, the clearance form 

indicated that the work was expected to affect the normal functioning of equipment at the 

Milpitas Terminal. However, the form lacked clarity regarding how, and the extent to which, the 

normal functioning of equipment would be affected.

was 

highly detailed, with a step-by-step sequence of operations. Due to the lack of detail on the work 

clearance form for the September 9, 2010, work, the SCADA operators would not have been 

aware of the scope and magnitude of the work being performed at the Milpitas Terminal.

 130 For more information about this pressure increase, see section 1.7.5.3. “Periodic Pressure Increases to 

MAOP.”

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 51

of 101
NTSB Pipeline Accident Report

91

Second, the preparation and contingency planning for the September 9, 2010, electrical 

work was inadequate as illustrated by the Milpitas technician’s queries to SCADA operators 

about whether the valves on the incoming lines would fail closed and whether the station could 

be placed in bypass during the work. The fact that he needed to ask what impact certain steps in 

the work process would have on the equipment (as he did during phone calls at 3:36 p.m. and 

4:03 p.m.) indicates that these issues were not evaluated in advance. 

Because of the lack of contingency planning, employees at both facilities were 

unprepared, as evidenced by the fact that workers at the Milpitas Terminal did not even realize 

that the regulator valves had opened at 5:22 p.m. until a SCADA operator informed them at 

5:25 p.m. When the first unexpected power losses occurred at the Milpitas Terminal, the workers 

there decided to deviate from the assigned work and begin troubleshooting without stopping to 

notify the SCADA center or to assess the potential risk. By doing so, the workers at the 

Milpitas Terminal put themselves and the SCADA center in a reactive mode. Had a formal risk 

assessment been performed in advance, the SCADA staff might have taken precautionary 

measures to reduce the upstream pressures or have locked the regulating valves in a set position 

in advance, and retained those settings for the duration of the work, thus avoiding the accidental 

pressure increase. 

When work could potentially affect critical pipeline components, the involved personnel 

need to consider during the planning phase what failures might occur and be prepared to respond 

appropriately. The NTSB is concerned that the SCADA center approved an incomplete and 

inadequate system clearance form that did not address any such considerations. The NTSB 

concludes that had a properly prepared contingency plan for the Milpitas Terminal electrical 

work been in place and been executed, the loss of pressure control could have been anticipated 

and planned for, thereby minimizing or avoiding the pressure deviations. Accordingly, the NTSB 

recommends that PG&E revise its work clearance procedures to include requirements for 

identifying the likelihood and consequence of failure associated with the planned work and for 

developing contingency plans. 

2.2.2 Internal Line Pressure Prior to Failure

Sensors on either side of the rupture point showed that the internal line pressure at the 

time and location of the rupture was between 386–386.4 psig. Although this pressure was 11 psi 

greater than the MOP and higher than any confirmed pressure at the rupture site,131

 131 In previous instances, when the pressure at the Milpitas Terminal was increased to 400 psig, the pressure at 

the rupture location was less than 386 psig. Because downstream demand draws gas from the system, the pressure 

downstream of the terminal will be less than the pressure at the terminal. During the 2008 pressure increase at the 

Milpitas Terminal to 400 psig (to maintain MAOP pursuant to the PG&E interpretation of 49 CFR 192.917(e)), the 

pressure downstream of the rupture location at the Martin Station and upstream of the rupture location at 

Half Moon Bay reached only 382 psig, and in 2003 it reached only 383 psig. On October 16, 1968, a pressure of 

400 psig was recorded at the Milpitas Terminal, but the downstream pressure at the rupture location is not known.

it was still 

14 psi below the PG&E-specified MAOP of 400 psig. Segment 180 was erroneously listed as 

having a SMYS of 42,000 psi. A 400-psig operating pressure would be expected to stress the 

pipe to about 38 percent of SMYS, less than 50 percent of the design limit for a class 3 location 

and well below that required to burst the pipe. For DSAW pipe with a SMYS of 52,000 psi, as 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 52

of 101
NTSB Pipeline Accident Report

92

most of Segment 180 was, the calculated burst pressure would have been even higher and the 

stress an even lower percent of SMYS.

The calculated estimated burst pressure for a 30-inch-diameter X42 pipe built to PG&E 

and industry specifications is 1,300 psig. Nonetheless, Segment 180 ruptured at only 386 psig. 

The NTSB concludes that the internal line pressure preceding the rupture did not exceed the 

PG&E MAOP for Line 132 and would not have posed a safety hazard for a properly constructed 

pipe. Accordingly, the investigation examined why a pressure of only 386 psig was sufficient to 

rupture the pipe.

2.3 Cause of Pipeline Rupture

Four of the six pups at the rupture location did not conform to any known specification 

for pipe, including PG&E and API specifications. Pups 1, 2, 3, and 5 had a yield strength below 

the SMYS for grade X42 and X52 pipe, the lowest (in pup 2) being 32,000 psi. In addition, the 

longitudinal seams on pups 1, 2, and 3 were partially welded from the outside only; and the 

longitudinal seam welds were ground down, thereby removing the weld reinforcement and, in 

some instances, external pipe material. The external grinding of the weld reinforcement 

combined with the size of the unwelded region resulted in a significantly reduced net 

cross-sectional area along the pup 1, 2, and 3 longitudinal seams, which resulted in higher 

stresses than in the rest of the pipe. Furthermore, the shape of the unwelded portion along each 

longitudinal seam formed a notch, the shape of which further concentrated the stresses at the root 

of the weld. Finally, the angular misalignment along pup 1 and pup 3 added additional bending 

stresses and strains.

The finite element analysis models and the burst pressure calculations illustrated the 

effect of the notch in the longitudinal seams of pups 1, 2, and 3. The finite element models 

showed that for a length of typical DSAW pipe with an internal pressure of 400 psig, the stresses 

in the vicinity of the weld remained well below the pipe’s yield strength. For a length of pipe 

with a notch similar to pup 1, the finite element model indicated that at 375 psig, approximately 

half the pipe wall thickness exceeded the yield stress. As noted in section 1.8.5, “Burst Pressure 

Study and Finite Element Modeling,” the results of the burst pressure calculations indicated that 

a length of typical pipe with a yield strength of 42,000 psi had an estimated burst pressure of 

1,300 psig. By contrast, the estimated burst pressures for pups 1, 2, and 3, as fabricated (before 

the additional crack growth discussed in the next section), were as low as 515, 574, and 430 psig, 

respectively. Thus, the weld defects reduced the weld strength for pups 1, 2, and 3 by as much as 

66 percent. However, it should be noted that the burst pressure calculation methods cannot 

account for the effect of the weld misalignment angle observed on pups 1 and 3. Finite element 

models based on the observed geometry of the pup 1 and pup 3 welds were constructed and their 

responses to internal pressure were compared. The stresses and deformations associated with the 

pup 1 weld defect were greater than for the pup 3 weld defect. Thus, the pup 1 burst pressure was 

likely less than the pup 3 burst pressure. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 53

of 101
NTSB Pipeline Accident Report

93

Based on these results, the NTSB concludes that the combination of the size and shape of 

the weld defect significantly reduced the strength of the pup 1 longitudinal seam, making it 

susceptible to unstable crack growth under internal gas pressure. 

2.3.1 Fracture Origin and Failure

Laboratory examination revealed that the rupture initiated approximately mid-length in 

the pup 1 longitudinal seam. A crack was observed that first formed in a manner consistent with 

ductile fracture into the welded portion of the seam, followed by additional crack growth by 

fatigue. The subcritical132

Girth weld C5 (which joined pup 4 to pup 5) was the weakest location along the east side 

of the pipe. The girth weld contained a lack of fusion/lack of penetration defect, the size and 

shape of which concentrated the stresses at the weld. In addition, pup 4 contained phosphorous 

and copper, which are known to cause brittle welds. Once the girth weld fractured, the center 

section was attached only at the south end. The center section of pipe twisted and rotated out of 

the ground about the southern end, separated from the pipeline, and came to rest about 100 feet 

south of its origin. (See figure 2.)

crack that formed along the root of the weld further weakened the 

pup 1 longitudinal seam. When the pipeline pressure at the accident location reached 386 psig, 

the longitudinal crack began to propagate upstream and downstream of the initiation site, 

rupturing the east side of the pipe. Gas began to exit the pipe on the east side, creating a lateral 

force that pushed the pipe to the west and gave rise to a large longitudinal tensile stress on the 

east side of the pipe. The force of the exiting gas also excavated the surrounding soil, forming a 

crater. 

The NTSB investigation was unable to determine when or how the preexisting crack 

along the intact portion of the pup 1 longitudinal seam initiated. This uncertainty was due in 

large part to the fact that the pressure of 386 psig on the day of the rupture was the highest 

confirmed pressure at the rupture location. Previous pressure increases to 400 psig at the 

Milpitas Terminal in 2003 and 2008 resulted in downstream pressure increases to only 383 psig 

and 382 psig, respectively, at the rupture location. One other documented instance of a pressure 

increase to 400 psig at the Milpitas Terminal was recorded on October 16, 1968; however,

downstream pressure data for that date are not available. Therefore, it is possible that—

 132 Subcritical refers to a crack that can grow by some means without rupturing the pipe.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 54

of 101
NTSB Pipeline Accident Report

94

1. The pup 1 longitudinal seam was progressively weakened by internal 

pressure/pressure cycling.

2. Prior to installation, pup 1 was used for a purpose or fabricated in a way that initiated 

and grew the crack along the weld.

3. The pup 1 longitudinal seam was weakened due to construction or utility activities 

after 1956.

However, the investigation determined that the 2008 sewer replacement project did not 

progressively weaken the pup 1 longitudinal seam, as discussed in section 2.3.4, “2008 Sewer 

Pipe Bursting Operation.”

Based on this analysis, the NTSB concludes that the fracture of Line 132 Segment 180 

originated in the partially welded longitudinal seam of pup 1, which was progressively weakened 

due to ductile crack growth and fatigue crack growth.

2.3.2 Deficiencies in Fabrication of Accident Pipe Segment

Owing to the lack of documentation, it could not be determined if the use of the pups in 

Segment 180 was a part of the original pipeline design or a field modification. The investigation 

attempted to determine whether the pups could have originated from mill-produced lengths of 

pipe. Investigators noted that manganese sulfide inclusions (known as stringers) in those pups

were elongated in the transverse direction, indicating that the rolling direction of the steel was in 

the transverse direction.133 By contrast, the rolling direction for mill-produced pipe is in the 

longitudinal direction. Research into steel-making practices in the 1940s indicated that 

state-of-the-art rolling mills could produce plate only up to 11 feet wide.134

In addition, the assembly of pups did not meet PG&E or API requirements for a factory 

jointer (two or more pipe pieces joined by welding). PG&E and API specifications required the 

minimum length of each joined length of pipe to be at least 5 feet. However, pups 1, 2, 3, 4, and 

5 were all less than 4 feet in length. Moreover, according to API specifications, the ends of the 

pipe to be welded together were to be “prepared in accordance with the requirements of the 

process used,” meaning the ends of each length of pipe would have been prepared with an 

external bevel, yet no external bevels were observed.

Pipe formed with the 

rolling direction aligned in the transverse direction would not have been capable of meeting the 

minimum length requirements for PG&E or other known pipe specifications and, therefore,

would not have been used for such a purpose. 

 133 Steel plate is formed from an ingot by passing it through a series of rollers that reduce the thickness and 

increase the length. The inclusions start as round particles and elongate primarily in the rolling direction as the 

thickness of the steel plate is reduced.

134 Unites States Steel, The Making, Shaping and Treating of Steel, 7th ed. (Pittsburgh, Pennsylvania: 

United States Steel Corporation, 1957).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 55

of 101
NTSB Pipeline Accident Report

95

The investigation also determined, based on differences in weld microstructure, weld 

penetration, microhardness, and shape of the heat-affected zone, that pups 1 through 5 were not 

fabricated according to the Consolidated Western DSAW process. The differences indicated that 

the welds on pups 1, 2, and 3 were performed at a lower power and at a slower deposition rate 

than the Consolidated Western process, resulting in a lower rate of heat input but a greater 

amount of total heat. The microhardness of the pup 4 seam weld and the manual shielded metal 

arc welds on pups 4 and 5 were also inconsistent with the Consolidated Western DSAW 

process.135

Other inconsistencies with the Consolidated Western process were noted. For instance, 

pups 1, 2, 3, and 5 were not likely subject to the Consolidated Western cold-expansion process. 

For a finished pipe diameter of 30 inches, the preexpanded pipe would be about 29.6 inches in 

diameter. Had the pups been fabricated to 29.6 inches, the unwelded seam geometry on pups 1, 

2, and 3 would not have survived the hydraulic expansion process, and the pups would have 

ruptured. According to the 1949 report by Moody Engineering, Consolidated Western also 

subjected all jointers to this process “after the girth weld has been completed and chipped flush 

on the outside.” In other words, the girth welds would have been ground flush with the outer 

surface prior to fitting into the expander. However, all girth welds exhibited a weld 

reinforcement, and there was no evidence that the girth welds had been ground flush with the 

outer surface of the pipe. Therefore, pups 1, 2, 3, and 5 were likely fabricated to 30-inch 

diameter. 

Similarly, the pups would not have been able to withstand the mill proof test to 

90 percent of SMYS, which was part of the Consolidated Western quality control process. The 

mill proof-test pressure was 1,170 psig. The calculated burst pressures of pups 1, 2, and 3 were 

well below the proof-test pressure.

In sum, at least four of the six pups in the accident pipe were rolled in a manner 

inconsistent with industry standard line pipe, at least five were not fabricated using Consolidated 

Western’s DSAW process, and the assembly of pups did not meet the requirements of a 

mill-produced jointer. Therefore, the NTSB concludes that the accident pipe comprising the 

pups did not conform to PG&E or other known specifications for pipe and was fabricated at an 

undetermined facility to no known specification. 

2.3.3 Deficiencies in Quality Control Associated with 1956 Relocation Project

Given the identified weld and pipe deficiencies, NTSB investigators sought to understand 

how the substandard pipe piece could have been installed and remain in service undetected until 

the accident, 54 years later. The investigation revealed no records of radiography for the 

1956 relocation project. (By contrast, the PG&E requirements called for radiography of 

10 percent of the welds for the original construction of Line 132 in 1948.) Nor were there records

of hydrostatic testing, which might have ruptured the pipe at the time of installation. The 

 135 Both welds along the pup 5 longitudinal seam were manual shielded metal arc welds performed by hand. It 

would not have been possible to produce those welds with the filler wire used in the Consolidated Western process. 

Attempting to do so would have resulted in an unstable arc and an unsuccessful weld operation.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 56

of 101
NTSB Pipeline Accident Report

96

estimated burst pressure of pup 3 (which, according to the NTSB’s burst pressure calculations,

had the weakest longitudinal seam as fabricated) was 430–558 psig. Industry consensus 

standards at the time of installation136

Further, a visual examination of the pipe would have detected the anomalous welds and 

defective welds. The unwelded seam defects and manual arc welds ran the entire length of each 

pup and were detectable by the unaided eye and/or by touch. If, as part of the 1956 relocation 

project, PG&E personnel had visually examined the inside of the pipe (a requirement of the 

PG&E specification for the 1948 construction project), the nonconforming and defective seam

welds would have been readily detectable. Therefore, either a visual examination of the pipe was 

never performed, or it was performed but the observations were misinterpreted or ignored.

specified hydrostatic testing at 1.25 times the MAOP for 

class 2 locations (which the accident location was in 1956)—which for a MAOP of 400 psig 

corresponds to a hydrostatic test pressure of 500 psig. However, those standards were voluntary, 

not mandatory, and PG&E chose not to follow them, thereby missing an opportunity to discover 

the defect at the time of commissioning. 

The presence of 0.312-inch wall thickness pipe (the north long joint near the rupture 

location) was another indicator of inadequate quality control. All of the material procurement 

orders for Segment 180 listed material codes for bare or wrapped 0.375-inch wall thickness pipe. 

There were no records indicating 0.312-inch wall thickness pipe was sent to the job site. 

In sum, quality control for the 1956 relocation project was insufficient to prevent the 

defective pipe from entering service. The NTSB concludes that the accident pipe would not have 

met generally accepted industry quality control and welding standards in 1956, indicating that 

those standards were overlooked or ignored. The NTSB further concludes that PG&E’s 

inadequate quality control during the 1956 relocation project led to the installation and 

commissioning of a defective pipe that remained undetected until the accident, 54 years later. 

2.3.4 2008 Sewer Pipe Bursting Operation

In 2008, pneumatic pipe bursting was used to shatter and expand an existing 6-inch 

vitrified clay sewer pipe that passed under Line 132. The pipe was replaced with a 10-inch 

polyethylene sewer pipe. Investigators considered: (1) the possibility that vibratory forces from 

the pneumatic bursting head could have caused fatigue crack growth along the pup 1 longitudinal 

seam; and (2) the possibility that constant soil bearing loads or variations in soil bearing loads 

developed at the sidewall of the exit pit could have caused ductile crack growth or fatigue crack 

growth along the pup 1 longitudinal seam. 

Regarding the first scenario, NTSB investigators conducted calculations and reviewed 

studies137

 136 See ASME B31.1.8, 1955 edition.

that quantify the safe operating distances for pipe bursting adjacent to utilities, 

premised on the assumption that nearby utility pipes are properly constructed and nondefective. 

Investigators determined that the contractor maintained the recommended minimum safe 

137 (a) Simicevic and Sterling, 2001. (b) Atalah, 2004.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 57

of 101
NTSB Pipeline Accident Report

97

distance between the bursting head and the pipe. A potholing excavation on either side of 

Line 132 ensured that no soil displacements would be transmitted to Line 132. It also eliminated 

the need for pneumatic bursting from the west end of the excavation, under Line 132, and into 

the exit pit to minimize the vibratory forces on Line 132. (See figure 17.) According to the 

NTSB study, the vibrations from the bursting head would have had less effect on the stress state 

of the pup 1 longitudinal seam weld than a 6-psi change in internal gas pressure. By comparison, 

the internal gas pressure in Line 132 fluctuated by as much as 110 psi in the course of normal 

operations. 

Regarding the second scenario, it was determined that the sewer replacement contractor 

used a constant tension winch and steel cable to pull the bursting head toward the exit pit. The 

winch was braced against sheet piling at the bottom of the exit pit, about 10 feet from where the 

rupture initiated on pup 1. Calculations indicated that at this distance, the effect of external soil 

pressure on the stress state of the pup 1 longitudinal seam weld was less than a 2.5-psi increase 

in internal gas pressure. This pressure increase was too small to cause the ductile crack growth 

along the pup 1 longitudinal seam weld. Similarly, because of the constant tension design of the 

winch and the compliance of the cable,138

The Corps geotechnical engineers evaluated data, reports, and studies concerning the 

2008 pipe bursting operation in the area of the pipeline rupture. Based on the review of key 

factors, the Corps concurred that the 2008 pipe bursting operation was not a significant external 

force on the pipeline.

calculations indicated that the variations in external 

soil pressure were one-tenth of the static pressure. Because the pressure variations were so low, 

they could not have caused the fatigue crack growth observed on pup 1.

In sum, the NTSB concludes that the 2008 sewer line installation did not damage the 

defective pipe that later ruptured.

2.4 Adequacy of PG&E Emergency Response

The NTSB found that PG&E operating procedures hindered the communications between 

the PG&E SCADA and dispatch centers. In addition, there were problems related to locating the 

actual leak location. Questions were raised soon after the accident about the time (95 minutes) 

that elapsed after the rupture before the transmission line was isolated. Under PG&E’s 

emergency response plan, although the PG&E SCADA center personnel were responsible for 

pipeline monitoring and operations, the PG&E dispatch center personnel were responsible for 

sending first responders. Therefore, personnel at these two facilities were required to coordinate 

with each other to effect PG&E’s overall response to the emergency.

 138 Compliance is a measure of how much a cable elongates in response to an applied load. The compliance of 

the cable is determined by the choice of material and its diameter.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 58

of 101
NTSB Pipeline Accident Report

98

2.4.1 Internal Communication and Coordination 

The SCADA operators’ initial response to the high pressure alarms at 5:25 p.m. was 

appropriate, and the required analysis took place within the first 10 minutes. After analyzing the 

alarms, the SCADA operator and the Milpitas technician agreed on a corrective action to reduce 

the monitor valve pressure set points back to within the MOP, which was initiated within about 

20 minutes of the alarms. When high pressure persisted and control could not be restored at the 

Milpitas Terminal, the SCADA center took further action and reduced the upstream pressure set 

points for the gas lines coming into the Milpitas Terminal.

However, after the rupture, about 6:15 p.m., as the staff was confronted with both the 

Milpitas Terminal anomalies, as well as the low pressure alarms at the Martin Station coupled 

with the reports of a fire in San Bruno, it was evident from the communications between the 

SCADA center staff, the dispatch center, and various other PG&E employees that the roles and 

responsibilities for dealing with such emergencies were poorly defined. 

The SCADA operators and coordinators sat near each other in the SCADA center and 

communicated frequently throughout the evening, exchanging operational information among 

themselves about the ongoing electrical work at the Milpitas Terminal and its impact on the rest 

of the system. However, the NTSB notes that the lack of assigned roles and responsibilities 

resulted in SCADA staff not allocating their time and attention in the most effective manner. 

They did not initially notice the dropping pressures at the Martin Station after the rupture, but 

rather were alerted by staff at the Brentwood SCADA facility. Also, there was unnecessary 

overlap and duplication of their efforts. Several SCADA operators contacted the same SCADA 

transmission and regulation supervisor (supervisor 6), but seemed unaware that the senior 

SCADA coordinator had already made contact with the supervisor. Further, the low pressure 

alarms at Martin Station were initially acknowledged by two SCADA coordinators. 

SCADA center staff provided many telephone briefings and updates to various PG&E 

employees and officials, occupying a significant portion of staff time during the first 90 minutes 

after the rupture. In addition, the SCADA staff received multiple calls from other PG&E 

employees and officials regarding the opening of various emergency response centers. These 

incoming and outgoing calls were handled by whichever SCADA staff member was available,

without any command structure. It would have been beneficial to have had one SCADA operator 

designated as the sole point of contact for the workers at the Milpitas Terminal so that others 

could handle and monitor the remainder of the system. Such staff allocation would have 

permitted a direct exchange of information aimed at resolving the issue, while permitting other 

SCADA personnel to continue monitoring the entire system, maintain situational awareness, and 

communicate with internal and external entities, as needed. 

The lack of a centralized command structure was also evident in that key information was 

not disseminated in a reliable manner. Each SCADA staff member was left to form his or her

own impression as to the nature and severity of the rupture based on the information they had, 

resulting in some conflicting and erroneous assessments (which are discussed in more detail in 

section 2.4.3, “Line Break Recognition”). The lack of a centralized command structure was also 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 59

of 101
NTSB Pipeline Accident Report

99

reflected in the conflicting instructions regarding whether to remotely close valves at the 

Martin Station. At 7:25 p.m., an on-call supervisor called the SCADA center to ask whether 

mechanics should manually close the valves or whether the SCADA center could close them 

remotely. SCADA operator D responded that they would prefer to lose as few customers as 

possible and would rather have mechanics manually close the line valves. However, at 7:27 p.m.,

an on-scene SCADA transmission and regulation supervisor (supervisor 6) called the 

SCADA center and requested that they close the remote valves at Martin Station, which SCADA 

operator D did. 

Finally, the supervising engineer for the SCADA controls group seemed slow to get 

involved, despite the fact that he is responsible for all SCADA and control systems throughout 

the PG&E gas transmission pipeline system. His first contact with the SCADA center was at 

6:51 p.m., requesting information. (By that time, he had already left the office for the day.) At 

7:19 p.m., he called again to inform the senior SCADA coordinator that the workers at the 

Milpitas Terminal had said they did not need his help; he asked the senior SCADA coordinator 

to call him in a half hour if SCADA was still not working. The senior SCADA coordinator 

responded by suggesting to the supervising engineer that he go to the Milpitas Terminal to help 

with restoring SCADA functionality, noting that technicians had already been working on the 

problem for 2 hours without success, but the supervising engineer said he would wait and asked 

that the SCADA center call him with updates. He arrived at the Milpitas Terminal about 

9:00 p.m.

The PG&E dispatch center learned of the explosion at 6:18 p.m. The dispatch center 

initially dispatched only a single service representative (at 6:23 p.m.) to assess the scene and did 

not immediately dispatch a qualified crew to shut off valves. At 6:27 p.m., the dispatch center 

informed SCADA operator C of the fire in San Bruno. At 6:31 p.m., SCADA operator B 

informed the dispatch center that there was a possibility the fire was being fed by a PG&E gas 

line. At 6:35 p.m., mechanic 1 informed the dispatch center that there was a PG&E transmission 

line in the area and that the flame seemed consistent with a transmission line fire. At 6:48 p.m.,

supervisor 1 called the dispatch center to request “gas crews to cut off distribution.” At 

6:54 p.m., the San Bruno Police Department informed the dispatch center that they needed the 

gas shut off. At 6:55 p.m., SCADA operator B informed the dispatch center that the fire was 

being fed by Line 132. However, no one had yet been officially dispatched to shut off the valves 

and isolate the rupture. Further, no one within PG&E was compiling and assessing the 

information generated from the SCADA system and telephone communications from outside 

sources or between the SCADA center and dispatch.

In summary, PG&E’s response to the Line 132 break lacked a command structure with 

defined leadership and support responsibilities within the SCADA center. Execution of the 

PG&E emergency plan resulted in delays that could have been avoided by better utilizing the 

SCADA center’s capability. The NTSB concludes that PG&E lacked detailed and 

comprehensive procedures for responding to a large-scale emergency such as a transmission line 

break, including a defined command structure that clearly assigns a single point of leadership 

and allocates specific duties to SCADA staff and other involved employees. Therefore, the 

NTSB recommends that PG&E establish a comprehensive emergency response procedure for 

responding to large-scale emergencies on transmission lines; the procedure should (1) identify a 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 60

of 101
NTSB Pipeline Accident Report

100

single person to assume command and designate specific duties for SCADA staff and all other 

potentially involved company employees; (2) include the development and use of 

trouble-shooting protocols and checklists; and (3) include a requirement for periodic tests and/or 

drills to demonstrate the procedure can be effectively implemented. 

2.4.2 Notifying Emergency Responders

The NTSB noted that PG&E did not notify emergency officials that the accident involved 

the rupture of one of PG&E’s pipelines, even after they had deduced this to be the case. On 

June 8, 2011, the NTSB made the following recommendations to address these issues. 

Specifically, the NTSB recommended that PHMSA do the following:

Issue guidance to operators of natural gas transmission and distribution pipelines 

and hazardous liquid pipelines regarding the importance of sharing 

system-specific information, including pipe diameter, operating pressure, product 

transported, and potential impact radius, about their pipeline systems with the 

emergency response agencies of the communities and jurisdictions in which those 

pipelines are located. (P-11-1)

Issue guidance to operators of natural gas transmission and distribution pipelines 

and hazardous liquid pipelines regarding the importance of control room operators 

immediately and directly notifying the 911 emergency call center(s) for the 

communities and jurisdictions in which those pipelines are located when a 

possible rupture of any pipeline is indicated. (P-11-2)

To PG&E, NTSB recommended the following:

Require your control room operators to notify, immediately and directly, the 

911 emergency call center(s) for the communities and jurisdictions in which your 

transmission and/or distribution pipelines are located, when a possible rupture of 

any pipeline is indicated. (P-11-3)

Because of emergency response awareness issues discovered in the Carmichael, 

Mississippi,139

 139 See Rupture of Hazardous Liquid Pipeline With Release and Ignition of Propane, Carmichael, Mississippi, 

November 1, 2007, Pipeline Accident Report NTSB/PAR-09/01 (Washington, DC: National Transportation Safety 

Board, 2009).

and San Bruno investigations, the NTSB is concerned that similar problems may 

exist with other pipeline operators and believes that the guidance recommended in 

Safety Recommendations P-11-1 and -2 should be codified as requirements. To address these 

concerns, the NTSB recommends that PHMSA require operators of natural gas transmission and 

distribution pipelines and hazardous liquid pipelines to provide system-specific information

about their pipeline systems to the emergency response agencies of the communities and 

jurisdictions in which those pipelines are located. This information should include pipe 

diameter, operating pressure, product transported, and potential impact radius. As a result of 

this new recommendation to PHMSA, Safety Recommendation P-11-1 is classified 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 61

of 101
NTSB Pipeline Accident Report

101

“Closed—Superseded.” Further, the NTSB recommends that PHMSA require operators of 

natural gas transmission and distribution pipelines and hazardous liquid pipelines to ensure that 

their control room operators immediately and directly notify the 911 emergency call center(s) for 

the communities and jurisdictions in which those pipelines are located when a possible rupture of 

any pipeline is indicated. As a result of this new recommendation to PHMSA, Safety

Recommendation P-11-2 is classified “Closed—Superseded.” 

2.4.3 Line Break Recognition

Although SCADA staff quickly realized that there had been a gas line break in 

San Bruno, they were slow to recognize the connection between the line break and the 

overpressure at the Milpitas Terminal, and some staff were initially unsure of whether the break 

was in a transmission or a distribution line.

In a postaccident interview, SCADA operator B stated that within 7 minutes of the 

rupture, he knew there had been a break in Line 132, and that by 6:30 p.m., he knew it was 

within a 12-mile corridor in the vicinity of San Bruno. At 6:53 p.m., SCADA operator D 

indicated that he knew the break was in Line 132, telling the on-scene SCADA transmission and 

regulation supervisor, “Yeah, absolutely we believe it’s a break on Line 132.” However, at about 

that time, there was still confusion among other employees as indicated by comments made at 

6:51 p.m. by SCADA operator C to a PG&E pipeline engineer, indicating that although the

engineer said he thought there was a PG&E transmission line close to the area of the fire, 

SCADA operator C did not think the break was in a transmission line. At 6:55 p.m., in a 

telephone discussion between SCADA operator C and the on-scene PG&E gas maintenance and 

construction superintendent (supervisor 3), both indicated that they believed a distribution line 

and not a transmission line had been breached.

SCADA staff also had difficulties determining the exact location of the rupture. At 

6:49 p.m., the SCADA center was still uncertain of the rupture point, as illustrated by the 

comment of the senior SCADA coordinator to a dispatch employee, “We are going to feed the 

line break at this pressure but I would take the pressure down if I knew more about what was 

feeding it... .”

The PG&E SCADA system lacked several tools that could have assisted the staff in 

recognizing and pinpointing the location of the rupture, such as real-time leak or line break

detection models, and closely spaced flow and pressure transmitters. A real-time leak detection

application is a computer-based model of the transmission system that runs simultaneously with 

SCADA and provides greater feedback to SCADA operators when a large scale leak, line break,

or system anomaly is present. Such models use actual SCADA pressures and flows to calculate 

actual and expected hydraulic performance; when the values do not match, an alarm is generated.

Appropriate spacing of pressure transmitters at regular intervals140

 140 SCADA data on Line 132 are currently received from only a few transmitters at randomly spaced intervals.

allows SCADA operators to 

quickly identify pressure decreases that point toward a leak or line break.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 62

of 101
NTSB Pipeline Accident Report

102

The NTSB concludes that PG&E’s SCADA system limitations contributed to the delay in 

recognizing that there had been a transmission line break and quickly pinpointing its location.

Accordingly, the NTSB recommends that PG&E equip its SCADA system with tools to assist in 

recognizing and pinpointing the location of leaks, including line breaks; such tools could include 

a real-time leak detection system and appropriately spaced flow and pressure transmitters along 

covered transmission lines. The NTSB further recommends that PHMSA require that all 

operators of natural gas transmission and distribution pipelines equip their SCADA systems with 

tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such 

tools could include a real-time leak detection system and appropriately spaced flow and pressure 

transmitters along covered transmission lines. 

2.4.4 Rapid Shutdown, ASVs, and RCVs

Mechanics 1 and 2 had self-reported to the Colma yard at 6:35 p.m., and they decided to 

depart the yard at 7:06 p.m. to shut off the valves. Because gas was being supplied to the break 

from both the north and the south, shutdown and isolation of the rupture required closure of 

manual shutoff valves closest to the break, which were located about 1.5 miles apart, on either 

end of the break. The mechanics identified and manually closed those valves at 7:30 p.m. (south 

valve) and 7:46 p.m. (north valve). Also, about 7:29 p.m., the SCADA center remotely closed 

valves at the Martin Station in response to a request from a SCADA supervisor (supervisor 6) 

who had joined the mechanics.

The NTSB is concerned that mechanics 1 and 2 were unnecessarily held at the 

Colma yard and that the response could have been delayed even longer if the two mechanics had 

waited for official orders from PG&E. Further, the SCADA center staff could have reduced the 

flow sooner by shutting the remote valves at the Martin Station sooner, but they did not. These 

delays needlessly prolonged the release of gas and prevented emergency responders from 

accessing the area. 

The total heat and radiant energy released by the burning gas was directly proportional to 

the time gas flowed freely from the ruptured pipeline. Therefore, as vegetation and homes 

ignited, the fire would have spread and led to a significant increase in property damage. The 

pressurized flow from the south resulted in an intense flame front similar to a blowtorch, and 

emergency responders were unable to gain access to the area. If the gas had been shut off earlier, 

removing fuel flow, the fire would likely have been smaller and resulted in less damage. Also, 

buildings that would have provided protection to residents in a shorter duration fire were 

compromised because of the elevated heat. In addition to exposing residents and their property to 

increased risk, the prolonged fire also negatively affected emergency responders, who were put 

at increased risk by having to be in close proximity to fire for a longer time and were not 

available to respond to other potential emergencies while they were waiting for the fire to 

subside.

The NTSB concludes that the 95 minutes that PG&E took to stop the flow of gas by 

isolating the rupture site was excessive. This delay, which contributed to the severity and extent 

of property damage and increased risk to the residents and emergency responders, in 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 63

of 101
NTSB Pipeline Accident Report

103

combination with the failure of the SCADA center to expedite shutdown of the remote valves at 

the Martin Station, contributed to the severity of the accident.

The NTSB has long been concerned about the lack of standards for rapid shutdown and 

the lack of requirements for ASVs or RCVs in HCAs. As far back as 1971, the NTSB 

recommended, in Safety Recommendation P-71-1, the development of standards for rapid 

shutdown of failed natural gas pipelines. In 1995, the NTSB recommended, in 

Safety Recommendation P-95-1, that RSPA expedite requirements for installing automatic- or 

remote-operated mainline valves on high-pressure pipelines in urban and environmentally 

sensitive areas to provide for rapid shutdown of failed pipeline segments. The NTSB classified 

Safety Recommendation P-95-1 “Closed—Acceptable Action,” believing that the RSPA 

2004 integrity management rulemaking (requiring that each gas transmission operator determine 

whether installing ASVs or RCVs would be an efficient means of adding protection to an HCA) 

would lead to a more widespread use of ASVs and RCVs. However, it did not. 

Federal regulations prescribe, at 49 CFR 192.179, the spacing of valves on a transmission 

line based on class location. However, other than for pipelines with alternative MAOPs,141 the 

regulations do not require a response time to isolate a ruptured gas line, nor do they explicitly 

require the use of ASVs or RCVs. The regulations give the pipeline operator discretion to decide 

whether ASVs or RCVs are needed in HCAs as long as they consider the factors listed under 

49 CFR 192.935(c).142

In the case of the San Bruno transmission line break, nearby RCVs could have 

significantly reduced the amount of time the fire burned, and thus the severity of the accident. 

Had the two isolation valves, located 1.5 miles apart, been outfitted with remote closure 

capability, prompt closure of those valves would have reduced the amount of fuel burned by the 

fire and allowed firefighters to enter the affected area sooner. The PG&E manager of gas system 

operations acknowledged at the NTSB’s investigative hearing that the use of RCVs could have 

reduced the time it took to isolate the rupture by about 1 hour.

Therefore, there is little incentive for an operator to perform an objective 

risk analysis, as illustrated by PG&E’s June 14, 2006, memorandum—which was issued after the 

CPUC 2005 audit identified PG&E’s failure to consider the issue but does not directly discuss 

any of the factors listed in section 192.935(c). Rather, it cites industry references to support the 

conclusion that most of the damage from a pipeline rupture occurs within the first 30 seconds, 

and that the duration of the resulting fire “has (little or) nothing to do with human safety and 

property damage.” The memorandum concludes that the use of an ASV or an RCV as a 

prevention and mitigation measure in an HCA would have “little or no effect on increasing 

human safety or protecting properties.” 

 141 Under 49 CFR 192.620, “Alternative Maximum Allowable Operating Pressure for Certain Steel Pipelines,”

issued in 2008, an operator is allowed to operate a pipeline at up to 80 percent SMYS in class 2 locations as long as 

it meets a very specific and stringent set of criteria. Section 192.620(c)(3) states that an RCV or ASV is required for 

such pipelines if the response time to mainline valves exceeds 1 hour under normal driving conditions and speed 

limits. 

142As noted in section 1.9.2, “Use of Automatic Shutoff Valves and Remote Control Valves,” those factors are 

(1) the swiftness of leak detection and pipe shutdown capabilities; (2) the type of gas being transported; (3) the 

operating pressure; (4) the rate of potential release; (5) the pipeline profile; (6) the potential for ignition; and (7) the 

location of nearest response personnel.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 64

of 101
NTSB Pipeline Accident Report

104

Damage from the pipeline rupture could have been reduced significantly if the valves on 

either end of the rupture point had been equipped with ASVs. Analysis of pressure differentials 

indicated that the San Bruno rupture would have resulted in the closure of an ASV at the 

downstream location143 and would likely also have resulted in the closure of an ASV at the 

upstream location.144

Concerns about ASVs have focused on the cost of installation and their susceptibility to 

inadvertently trip based on pressure transients in the system. However, vendors have developed 

newer models that address these shortcomings by combining the features of traditional ASVs 

with RCVs. These “smart” valves include sensors that can trend the pressure transients on a line 

to identify what constitutes normal operation, thereby lessening the chances of an inappropriate 

shutdown. Also, the newer models can alert a SCADA center when the valve hits a trip point, 

allowing SCADA operators the option of overriding the valve closure and precluding an 

undesired shutdown. 

Even the closing of a downstream ASV alone would have been beneficial 

in that it would have immediately alerted SCADA to a more precise location of the break.

The NTSB concludes that the use of ASVs or RCVs along the entire length of Line 132 

would have significantly reduced the amount of time taken to stop the flow of gas and to isolate 

the rupture. The NTSB is aware that PG&E is in the process of expanding its use of ASVs and 

RCVs and has added this capability to some valve locations since the accident. However, the 

NTSB recommends that PG&E expedite the installation of ASVs and RCVs on transmission 

lines in HCAs and class 3 and 4 locations, and space them at intervals that consider the factors 

listed in 49 CFR 192.935(c). The NTSB also recommends that PHMSA amend 

49 CFR 192.935(c) to directly require that ASVs or RCVs in HCAs and in class 3 and 

4 locations be installed and spaced at intervals that consider the factors listed in that regulation. 

2.4.5 Deficiencies in Postaccident Drug and Alcohol Testing

After the accident, PG&E identified four employees at the Milpitas Terminal for 

postaccident toxicological testing pursuant to 49 CFR 199.105 and 49 CFR 199.225. As 

mentioned in section 2.1, “Introduction,” test results were negative for the presence of specified 

drugs. Testing for drugs was accomplished successfully within the time constraints defined in 

49 CFR 199.105; that is, within 32 hours of the accident. However, alcohol testing was not 

conducted properly in accordance with 49 CFR 199.225, which requires that testing be 

administered within 8 hours of an accident, and, if it is not, the operator shall cease attempts to 

do so. Results for the alcohol tests were invalid and therefore, the use of alcohol cannot be 

excluded. 

 143 The pressure decay at the Martin Station showed a decrease from 386 to 200 psig in the course of 3 minutes 

(62 psig per minute), beginning at 6:11 p.m. This drop would have been more than sufficient to trip an ASV located 

at the downstream valve near the rupture point.

144 The pressure decay in Line 132 was not captured because the transmitter at that location was not installed 

directly on the main line but on a smaller transmission line (at Half Moon Bay) that branched off from Lines 132 

and 109. Although the Half Moon Bay pressure readings cannot be used past 6:11 p.m. to approximate the Line 132 

pressures upstream of the rupture, because the differential pressure was great enough to trip an ASV on the smaller 

line branching off Line 132 at Half Moon Bay, an ASV located on Line 132 likely would have tripped as well. (The 

smaller line crossed the San Andreas fault and, therefore, was equipped with an ASV to address seismic risk.)

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 65

of 101
NTSB Pipeline Accident Report

105

Alcohol testing of the four Milpitas Terminal employees commenced at 3:10 a.m. and 

concluded at 5:02 a.m. on September 10, 2010. The accident occurred at about 6:11 p.m. on the 

previous evening. Therefore, alcohol testing should have been completed by 2:11 a.m. on 

September 10, at the latest. PG&E officials explained that toxicological testing was delayed 

because the decision to perform testing was not made until approximately midnight and that the 

request for testing was made at 12:30 a.m.

The NTSB is concerned by PG&E’s delay in contacting the toxicological testing 

contractor until 12:30 a.m., more than 6 hours after the rupture. Further, upon arrival at the 

Milpitas Terminal about 2:00 a.m., the contractor should have determined the time of the rupture 

and attempted to expedite alcohol testing, given that only minutes remained before the 

regulations prohibited testing. 

The NTSB is concerned that the alcohol testing was conducted after the prescribed 

8 hours following an accident. Further, the NTSB is concerned that PG&E did not perform any 

drug or alcohol testing of its SCADA staff. The regulations in 49 CFR 199.105 and 

49 CFR 199.225 require testing of any employee whose performance cannot be discounted 

completely as a contributing factor to the accident and that a decision not to administer a test 

must be based on a determination that the employee’s performance “could not have contributed 

to the accident.” The SCADA personnel were directly involved in monitoring and controlling the 

events that unfolded during the accident scenario. Therefore, the SCADA personnel should have 

been tested. 

The NTSB concludes that the 6-hour delay before ordering drug and alcohol testing, the 

commencement of alcohol testing at the Milpitas Terminal 1 hour after it was no longer 

permitted, the failure to properly record an explanation for the delay, and the failure to conduct 

drug or alcohol testing on the SCADA center staff all demonstrate that the PG&E postaccident 

toxicological program was ineffective. Therefore, the NTSB recommends that PG&E revise its 

postaccident toxicological testing program to ensure that testing is timely and complete. 

The NTSB is concerned that the regulations requiring operators to conduct postaccident 

drug and alcohol testing give operators too much discretion in deciding which employees to test, 

because it states that the decision not to administer a drug test “...must be based on the best 

information available immediately after the accident that the employee’s performance could not 

have contributed to the accident...”, and the decision not to administer an alcohol test “...shall 

be based on the operator’s determination, using the best available information at the time of the 

determination, that the covered employee’s performance could not have contributed to the 

accident.” Therefore, the NTSB recommends that PHMSA amend 49 CFR 199.105 and 

49 CFR 199.225 to eliminate operator discretion with regard to testing of covered employees. 

The revised language should require drug and alcohol testing of each employee whose 

performance either contributed to the accident or cannot be completely discounted as a 

contributing factor to the accident. The NTSB also recommends that PHMSA issue immediate 

guidance clarifying the need to conduct postaccident drug and alcohol testing of all potentially 

involved personnel despite uncertainty about the circumstances of the accident. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 66

of 101
NTSB Pipeline Accident Report

106

2.5 MAOP

2.5.1 MAOP of Line 132

The construction records provided by PG&E did not document the original MAOP for 

Line 132. However, in 1970, the specified MAOP for all of Line 132 was 400 psig pursuant to 

the grandfather clause, which allows pipelines constructed prior to 1970 to operate with a MAOP 

based on the highest actual operating pressure during the 5 years preceding July 1970. 

If the presence of the pups in Segment 180 had been considered in determining a design 

pressure, it would not have substantiated a MAOP of 400 psig. ASME B31.1.8, 1955 edition

(paragraph 811.27) and present day 49 CFR 192.107 provide similar guidance for establishing 

the yield strength of pipe of unknown specification for the purpose of calculating design pressure

(for example, a default strength is established by regulation when the type of pipe is unknown). 

Based on the yield strength test data, the MAOP for a class 3 location would have been 284 psig 

and the MAOP for a class 2 location (as the location of Segment 180 was in 1956) would have 

been 341 psig.

2.5.2 Grandfathering of Pre-1970 Pipelines

Of broader concern is the exemption of pre-1970 pipelines nationwide from the 

requirement for a postconstruction hydrostatic pressure test. This exemption was added at the 

final stage of rulemaking, not having been subject to public comment as part of the original 

notice of proposed rulemaking (NPRM). It was based on an assertion from the Federal Power 

Commission that, “there are thousands of miles of jurisdictional interstate pipelines installed 

prior to 1952 [when the voluntary industry pressure test standards incorporated in section 

192.619 were established], in compliance with the then existing codes, which could not continue 

to operate at their present pressure levels and be in compliance with” the proposed standard in 

the NPRM calling for the MAOP to be limited to a percentage of the pressure to which it was 

tested after construction. It is not clear from the preamble to the final rule what rationale, if any, 

the Federal Power Commission or the DOT pipeline staff relied on to justify exempting pipelines 

such as Line 132, which were constructed without complying with the voluntary hydrostatic 

pressure testing standards of then-existing codes.

Grandfathering of Line 132 by the CPUC in 1961 and then by RSPA in 1970 resulted in 

missed opportunities to detect the defective pipe. In 1961, the CPUC began requiring a 

postconstruction hydrostatic test to 1.5 times MAOP for newly constructed pipelines in 

class 3 areas. In 1970, RSPA began requiring a postconstruction hydrostatic test to 1.5 times 

MAOP in class 3 locations. For a MAOP of 400 psig, this corresponds to a hydrostatic test 

pressure of 600 psig. However, pursuant to the 1970 grandfather clause, Line 132 and other 

existing gas transmission pipelines with no prior hydrostatic test were permitted to use as their 

MAOP the highest operating pressure recorded during the previous 5 years (that is, between 

1965–1970) and allowed to continue operating with no further testing. Thus, the NTSB 

concludes that if the grandfathering of older pipelines had not been permitted since 1961 by the 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 67

of 101
NTSB Pipeline Accident Report

107

CPUC and since 1970 by the DOT, Line 132 would have undergone a hydrostatic pressure test 

that would likely have exposed the defective pipe that led to this accident.

Other examples of how the grandfather clause results in reduced safety margins include

the following:

• Title 49 CFR 192.195, “Protection Against Accidental Overpressuring,” which 

requires that pressure relieving or limiting devices ensure that pipeline pressure (for 

pipelines operated at 60 psig or higher) does not exceed MAOP plus 10 percent or the 

pressure that produces a hoop stress of 75 percent of SMYS, whichever is lower.

However, for a pipeline whose MAOP was established in accordance with the 

grandfather clause, this pressure (MAOP plus 10 percent) may be greater than any 

pressure it was subjected to in its lifetime.

• Title 49 CFR 192.933(d)(1), “Immediate Repair Conditions,” which allows operators 

to continue operating a gas pipeline with a known defect unless “a calculation of the 

remaining strength of the pipe shows a predicted failure pressure less than or equal to 

1.1 times the maximum allowable operating pressure.” Again, this pressure (1.1 times 

the MAOP) may be greater than any pressure a grandfathered pipeline was subjected 

to in its lifetime.

More than half of the nation’s onshore gas transmission pipelines (about 180,000 miles) 

were installed prior to the effective date of the 1970 requirement for hydrostatic pressure testing. 

PHMSA does not keep track of how many of these pipelines have had their MAOP established 

under the grandfather clause. The state of California has already taken action to address 

grandfathering for pipelines within its jurisdiction. In its June 9, 2011, order requiring PG&E and 

other gas transmission operators regulated by the CPUC to either hydrostatically pressure test or 

replace certain transmission pipelines with grandfathered MAOPs, the CPUC stated that natural 

gas transmission pipelines “must be brought into compliance with modern standards for safety” 

and “historic exemptions must come to an end.” The NTSB agrees and concludes that there is no 

safety justification for the grandfather clause exempting pre-1970 pipelines from the requirement 

for postconstruction hydrostatic pressure testing. 

Studies (discussed in section 1.13.1.1, “Pressure Testing”) have shown that hydrostatic 

pressure testing is most effective when it incorporates a spike test in which the pipeline is 

initially pressurized to a higher level for a short time. Accordingly, the NTSB recommends that 

PHMSA amend 49 CFR 192.619 to delete the grandfather clause and require that all gas 

transmission pipelines constructed before 1970 be subjected to a hydrostatic pressure test that 

incorporates a spike test.

2.6 Integrity Management Program

The elements of an effective integrity management program are accurate, complete, and 

verifiable data; threat identification and risk assessment; evaluation and correction; and 

self-assessment of program effectiveness. The NTSB investigation examined each of these 

elements and found issues of significant concern.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 68

of 101
NTSB Pipeline Accident Report

108

2.6.1 PG&E GIS and Pipeline Record-keeping

As PHMSA emphasized in its advisory bulletin after PG&E record-keeping deficiencies 

first came to light, an operator’s awareness of the physical attributes of its pipelines “is a vital 

component in an operator’s ability to identify and evaluate the risks to its pipeline and identify 

the appropriate assessment tools, ... [and] if this information is unknown, or unknowable, a more 

conservative approach to operations is dictated.”

NTSB investigators examined the PG&E GIS and related records and found that, in many 

cases, PG&E used assumed values for key pipeline parameters. The records also included many 

obvious errors in key pipeline parameters, including but not limited to seam type, SMYS, and 

depth of cover. Many of these missing data and obvious errors could have been identified and 

been corrected by exposing the pipe. In fact, many of the pipe segments for which records had 

missing, assumed, or erroneous data had previously been exposed in connection with ECDA 

excavations as part of the integrity management program. Of 13 segments on Line 132 that were 

so exposed, two had an assumed wall thickness and four had an unknown depth of cover. 

Additionally, records of ECDA for one of the segments showing an erroneous 40-foot depth of 

cover indicated a correct depth of cover (5 feet 4 inches–6 feet 4 inches), yet this correction was 

not entered into the GIS. All of these ECDA digs predated the records that contained the missing, 

assumed, or erroneous values.

When questioned concerning missing pipeline design-attribute data, PG&E told NTSB 

investigators—

where other information is absent, PG&E utilizes similar conservative 

assumptions with respect to various data points, including pipe characteristics and 

construction methodologies, so that its integrity management assessments, relative 

risk prioritizations, strength and MAOP calculations and the like are founded on 

conservative values that ensure generous safety margins.

However, in the following instances, investigators found that PG&E did not use conservative 

values for missing and assumed data, and excluded some threats in the risk algorithms

145

• One segment used an assumed value for SMYS of 33,000 psi, and another used an 

assumed value of 52,000 psi—contrary to 49 CFR 192.107, which requires operators 

to use a value of 24,000 psi when the SMYS is unknown.

used 

for segments in Line 132:

• In the third-party threat algorithm, an unknown depth of cover is assigned the same 

value as ground cover meeting new construction depth requirements. As noted in 

section 1.9.4.1, “Geographic Information System,” the depth of cover for more than 

82 percent of Line 132 is unknown.

 145 Risk algorithms are discussed in more detail in the next report section. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 69

of 101
NTSB Pipeline Accident Report

109

• In several threat algorithms, nonconservative values are used for pipe wall thickness. 

PG&E uses MOP as a percent of pipe strength, calculated from the pipe diameter, 

pipe wall thickness, weld joint efficiency, and specified minimum wall thickness. As 

noted in section 1.9.4.1, “Geographic Information System,” the pipe wall thickness 

for Line 132 is an assumed value for 41.75 percent of Line 132.

• The use of “wedding band” joints146 in place of a girth weld is not considered as an 

element of any of the threat algorithms, despite the fact that this type of joint is not as 

strong as a full penetration butt weld.

147

• Prior to the San Bruno accident, PG&E did not consider missing girth weld 

radiography records as an element of any of the threat algorithms.

• Construction damage is not considered as an element of any of the threat algorithms.

• Leaks resulting from manufacturing defects are only considered in threat algorithms 

if they occurred on the segment in question or on an adjacent segment with the same 

pipe properties and within 1 mile of the leak. Leaks on more distant pipe segments of 

the same vintage, same characteristics, and same manufacturer are not considered. 

These restrictions are a concern because PG&E used pipe of the same vintage, same 

characteristics, and same manufacturer in multiple noncontiguous segments, spanning 

multiple miles and separate lines. As recognized in ASME B31.8S, 2004 edition, a 

leak in one of those segments resulting from a manufacturing defect calls into 

question whether a related risk might exist on similar segments beyond the adjacent 

segments.

As part of its ECDA procedure, PG&E requires the collection of data that could be used 

for validating assumed values and determining unknown values in the GIS; however, pipeline 

records must be updated only as part of the preassessment portion of the ECDA process. There is 

no requirement to update pipeline records with data collected from the excavation and 

examination portions of the ECDA process. At the NTSB investigative hearing, PG&E officials 

testified that if discrepancies between GIS data and actual conditions are discovered by field 

personnel, field engineers are required to report them to the mapping department, which 

validates the information. However, the documents provided to the NTSB indicate that PG&E 

does not use the ECDA process for validating assumed values, determining unknown values, or 

correcting erroneous values. 

Other inaccuracies noted in the PG&E GIS include the absence of any indication that 

Segment 180 contained six short pups welded together and the inaccurate identification of the 

cause of a longitudinal seam leak on Line 132, which was identified on October 27, 1988. Prior 

to the accident, the GIS only identified that a leak had occurred at MP 30.5 and did not provide 

any details. When questioned about the leak data, PG&E stated that when it transitioned to its 

GIS in the late 1990s, only open (that is, unresolved) leak information was transferred. Closed 

leak information—such as the October 27, 1988, leak, which had been repaired—was not 

transferred to the GIS. This situation suggests that additional leaks from the time prior to the late 

 146 A wedding band joint is a short sleeve fillet welded to the outside of two adjacent pipe ends.

147 A butt weld is a welded connection between two pipe ends that penetrates the full thickness of the pipe walls 

and is designed to be as strong as the pipes it is joining.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 70

of 101
NTSB Pipeline Accident Report

110

1990s may not be not reflected in the GIS and thus not be considered as part of the risk 

assessment for the affected segments, despite PG&E’s stated intent to include leak history in its 

inventory of pipeline attributes.

Another GIS inaccuracy came to light on June 30, 2011, when PG&E reported to the 

CPUC that 550 miles of its transmission pipelines had incorrect class locations, which indicates 

that such pipelines could have been operating with inappropriate MAOPs.

The foundation of risk assessment is accurate information. The NTSB is concerned that 

the PG&E GIS still has a large percentage of assumed, unknown, or erroneous information for 

Line 132 and likely its other transmission pipelines as well. As stated earlier in this section, in 

many cases, accurate information could have easily been obtained during ECDA digs, but the 

information was either not obtained or not entered. The lack of complete and accurate pipeline 

information in the GIS prevented PG&E’s integrity management program from being effective.

2.6.2 Threat Identification and Risk Assessment

2.6.2.1 Weighting of Threats

PG&E defines total risk as the product of LOF and COF. (See section 1.9.4.2, “Risk 

Management Procedures,” of this report.) LOF is defined as a weighted percentage of 

four threats: external corrosion, third-party damage, ground movement, and design and material.

Although the relative weights used by PG&E to assess the four threats are generally 

consistent with industry averages for the prevalence of incidents caused by those threats, the 

weights are not consistent with PG&E’s own leak, failure, and incident experience as reflected in 

the statistics it reports semiannually to PHMSA. Specifically, the external corrosion threat is 

weighted by PG&E at 25 percent, but it actually accounted for 51 percent of the combined leaks, 

failures, and incidents from 2004–2010. Design and manufacturing threats are weighted at 

10 percent, but they accounted for 24 percent of PG&E’s combined events during that time. 

Third-party threats are weighted at 45 percent, but they accounted for 24 percent of the combined 

events from 2004–2010; and the threat of ground movement is weighted at 20 percent, but it 

accounted for 0 percent of the events during the same time period. Thus, the PG&E integrity 

management program significantly understated the threats due to external corrosion and design 

and materials, and overstated the threats due to third-party damage and ground movement.

PG&E established these weight factors in 2001, prior to the 2004 issuance of the integrity 

management rules. PG&E has not updated the relative weights even though data generated by 

PG&E and reported to PHMSA from 2004–2010 showed the threats to be significantly different.

2.6.2.2 Identification and Assessment of Design/Material and Construction 

Threats on Line 132

In addition to the defects in Segment 180 discovered during this investigation, several

other known design/material and construction defects on Line 132, which were documented in 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 71

of 101
NTSB Pipeline Accident Report

111

PG&E records, were not considered in its integrity management program. These defects include

at least four longitudinal seam weld cracks found during radiography of the girth welds as part of 

the 1948 construction of Line 132 that were allowed to remain in service. Because only 

10 percent of the welds were radiographed as part of the 1948 construction, and those 

radiographs captured only a few inches of each longitudinal seam weld, less than 0.2 percent of 

the longitudinal seams on pipe segments installed in 1948 were radiographed. In light of the fact 

that five rejectable defects were found in the small percentage of longitudinal seam welds that 

were so examined, it is probable that additional longitudinal seam weld defects have remained in 

service since 1948. Another defect not considered in the integrity management plan was the

October 27, 1988, leak on a DSAW longitudinal seam caused by material failure. Additional 

defects on Line 132 and other PG&E transmission lines are discussed in section 1.7.6, “History 

of Seam Defects in PG&E Gas Transmission Pipelines.”

PG&E did recognize that Segment 180 had some design and materials threats, as 

evidenced by the fact that it received 55 points in 2009 and 73 points in 2010148

The integrity management rules require operators to assess the integrity of their pipelines

using pressure testing, in-line inspection, direct assessment, or other technology that the operator 

demonstrates can provide an equivalent understanding of pipe condition. Pressure testing 

and in-line inspection both assess the integrity of the entire pipe section to which they are 

applied. However, direct assessment methodologies (ECDA, internal corrosion direct 

assessment, and stress corrosion cracking direct assessment) assess only the integrity of selected 

pipe areas where the operator suspects a problem. More to the point, direct assessment provides 

information only about threats that the operator is specifically looking for, while in-line

inspection and hydrostatic testing can identify critical threats that the operator might not have 

been looking for. In this regard, the treatment of these three assessment methods (ECDA, in-line

inspection, and hydrostatic pressure testing) as equally acceptable methods is flawed.

for such threats. 

However, those threats were considered stable (that is, not anticipated to grow in service) under 

49 CFR 192.917(e)(3), and PG&E selected only direct assessment (for the identified corrosion 

threat) for assessing Line 132.

Because PG&E could not provide engineering design documents for Segment 180, the 

NTSB could not determine whether PG&E design or construction practices were responsible for 

the use of the pups in the accident pipe. Because the material codes for the 1956 relocation 

project listed only X52 DSAW pipe yet many pipe pieces (the pups and the pipe piece with 

0.312-inch wall thickness) installed at the job site did not match this code, the material codes on 

material procurement orders cannot be trusted to accurately reflect the type of pipe used in 

pipelines constructed prior to mandatory hydrostatic pressure testing. Because the 

nonconforming pipe may represent a small fraction of a pipeline segment and rupture of a 

pipeline will occur at its weakest link, validating the construction of an entire pipeline segment 

 148 As discussed in section 1.9.4.2, pursuant to the PG&E integrity management plan, points are assigned for 

various risk factors so that higher scores indicate a higher threat. The basis for the point values assigned to Segment 

180 is unknown. Pre-1970 pipes are assigned 30 points for pipe seam design and 10 points for pipe age. Pipe 

segments that have not been pressure tested are assigned 30 points. Thus, segment 180 should have received at least 

70 points for these factors alone.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 72

of 101
NTSB Pipeline Accident Report

112

by selective random sampling alone is insufficient. The only viable methods of validating a 

pipeline segment are those that examine or sample every length of pipe. 

The PG&E risk management plan asserts that the methods chosen to assess a particular 

segment of pipe are based on the threats identified in the risk assessment procedure, and 

acknowledges that more than one assessment method may be required to adequately cover the 

potential risks of an HCA. However, of the three available assessment methods (ECDA, in-line 

inspection, and hydrostatic pressure testing), PG&E used only one method (ECDA)—a method 

suitable only for assessing external corrosion—to assess all 322 segments on Line 132. Further, 

PG&E has used direct assessment methodologies on the majority of its other transmission 

pipelines. Of PG&E’s 1,021 miles of HCA pipeline, 813 miles are designated for direct 

assessment methodologies and only 208 miles are to be assessed using in-line inspection tools.

Prior to the San Bruno accident, none of the PG&E HCA miles were designated for hydrostatic 

pressure testing.

In summary, PG&E’s failure to consider evidence of seam defects discovered during both 

construction and operation of Line 132, as well as its weighting of factors so as to understate the 

threat of manufacturing defects, resulted in PG&E selecting an assessment technology (ECDA)

that was incapable of detecting seam flaws like the one that led to this accident. 

2.6.2.3 Regulatory Assumption of Stable Manufacturing- and Construction-Related 

Defects

In accordance with 49 CFR 192.917 (e)(3), an operator may consider manufacturing- and 

construction-related defects to be stable defects not requiring assessment so long as operating 

pressure has not increased over the MOP experienced during the preceding 5 years. When a 

pipeline with a manufacturing- or construction-related defect is operated above the highest 

pressure recorded in the preceding 5 years, it must be prioritized as a high risk segment for 

assessment. According to section 6.3.2 of the integrity management supplement ASME B31.8S,

2004 edition, in that case, “pressure testing must be performed to address the seam issue.”

PG&E raised the pressure at the Milpitas Terminal to 400 psig in 2003 and 2008 to set a 

5-year MOP for Line 132. The PG&E director of integrity management and technical support 

acknowledged at the NTSB investigative hearing that this practice allowed PG&E to regard 

manufacturing threats as stable, thereby continuing to use only ECDA as the assessment method. 

Thus, this practice allowed PG&E to avoid seam integrity inspections it might otherwise have 

been required to conduct. However, the PHMSA deputy associate administrator for field 

operations testified at the investigative hearing that it was not the intent for this rule to be used to 

avoid an assessment. (PG&E has discontinued this practice since the accident.)

Furthermore, studies have discredited the assumption that manufacturing- and 

construction-related defects are stable in pipelines that have not been hydrostatically pressure 

tested to an appropriate level. According to a GRI report dated September 17, 2004—

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 73

of 101
NTSB Pipeline Accident Report

113

the risk of pressure-cycle-induced fatigue can be dismissed if and only if the 

pipeline has been subjected to a reasonably high-pressure hydrostatic test. 

Therefore, ... eliminating the risk of failure from pressure-cycle-induced fatigue 

crack growth of defects that can survive an initial hydrostatic test of a pipeline 

requires that the test pressure level must be at least 1.25 times the [MAOP].149

Similarly, a 2007 PHMSA report concluded—

experience and scientific analysis indicates that manufacturing defects in gas 

pipelines that have been subjected to a hydrostatic test to 1.25 times MAOP 

should be considered stable. No integrity assessment is necessary to address that 

particular threat in such pipelines. The principal challenge for deciding whether or 

not to consider manufacturing defects to be stable is associated with those gas 

pipelines that have never been subjected to a hydrostatic test to a minimum of 

1.25 times MAOP.150

In summary, under 49 CFR 192.917(e)(3), operators are entitled to consider known 

manufacturing- and construction-related defects to be stable, even if a line has not been pressure 

tested to at least 1.25 times its MAOP. However, such defects may not, in actuality, be stable. 

The NTSB concludes that the premise in 49 CFR Part 192 of the Federal pipeline safety 

regulations that manufacturing- and construction-related defects can be considered stable even 

when a gas pipeline has not been subjected to a pressure test of at least 1.25 times the MAOP is 

not supported by scientific studies. Therefore, the NTSB recommends that PHMSA amend 

49 CFR Part 192 of the Federal pipeline safety regulations so that manufacturing- and 

construction-related defects can only be considered stable if a gas pipeline has been subjected to 

a postconstruction hydrostatic pressure test of at least 1.25 times the MAOP.

2.6.3 Self-Assessment of Program Effectiveness

The PG&E integrity management program indicates that PG&E will conduct periodic 

self-assessments and sets forth the measurements to be used in evaluating the long-term 

effectiveness of the program. These measures, which are reported semiannually to PHMSA,

include number of total system miles; number of total miles of pipelines inspected; number of 

HCA miles in the integrity management program; number of HCA miles inspected via integrity 

management assessments; number of immediate repairs completed in HCAs as a result of the 

program; number of scheduled repairs completed in HCAs as a result of the program; and 

number of leaks, failures, and incidents in HCAs classified by cause. On the surface, these 

measures are consistent with the requirements of 49 CFR 192.945 and ASME B31.8S,

2004 edition, appendix A. However, as discussed above, PG&E did not make use of this 

information to revise its threat weights so as to reflect its actual leak, failure, and incident 

 149 Effects of Pressure Cycles on Gas Pipelines, report GRI-04/0178 (Des Plaines, Illinois: Gas Research 

Institute, 2004).

150 Evaluating the Stability of Manufacturing and Construction Defects in Natural Gas Pipelines, No. 05-12R 

(Washington, DC: Pipeline and Hazardous Materials Safety Administration, 2007).

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 74

of 101
NTSB Pipeline Accident Report

114

experience, even though the data reported to PHMSA from 2004–2010 showed the weight of 

those threats to be significantly different.

Further, after the CPUC May 2010 audit of the PG&E integrity management plan, the 

CPUC expressed a concern that “PG&E needs to analyze, review, and formulate appropriate 

actions or responses to the results of its internal audits in a timely manner.” Specifically, the 

letter pointed out that PG&E had conducted an internal audit in December 2007151

2.6.4 Summary of PG&E Integrity Management Practices

but had not 

formulated a response until December 2009; the letter further noted that PG&E had conducted 

another internal audit in October 2009, but as of May 2010 PG&E still had not formulated a 

response.

In summary, the PG&E gas transmission integrity management program (1) was based on 

a GIS that did not contain, and PG&E did not require it to contain, complete and accurate 

pipeline information; (2) significantly understated the threats due to external corrosion and 

design and manufacturing, and overstated the threats due to third-party damage and ground 

movement; (3) did not consider known longitudinal seam cracks in Line 132 dating to the 

1948 construction and at least one longitudinal seam leak in a DSAW weld in its identification 

and assessment procedures; (4) allowed PG&E to chose an inappropriate assessment method for 

Line 132 that was inadequate to detect seam defects, such as the weld defect in the accident 

segment that led to the rupture; (5) considered known manufacturing- and construction-related 

defects on Line 132 to be stable even though the pipeline had not been pressure tested to at least 

1.25 times its MAOP; and (6) included self-assessments that were superficial and resulted in no 

improvements to the integrity management program. Therefore, the NTSB concludes that the 

PG&E gas transmission integrity management program was deficient and ineffective.

PG&E may already be addressing its GIS data deficiencies as part of its response to the 

NTSB’s January 3, 2011, safety recommendations, by beginning to verify the underlying records 

for the more than 1,800 miles of pipeline covered by the recommendations. Nevertheless, the 

NTSB is concerned that many unaddressed deficiencies still remain.

Accordingly, the NTSB recommends that PG&E assess every aspect of its integrity 

management program, paying particular attention to the areas identified in this investigation, and

implement a revised program that includes, at a minimum, (1) a revised risk model to reflect 

PG&E’s actual recent experience data on leaks, failures, and incidents; (2) consideration of all 

defect and leak data for the life of each pipeline, including its construction, in risk analysis for 

similar or related segments to ensure that all applicable threats are adequately addressed; (3) a 

revised risk analysis methodology to ensure that assessment methods are selected for each 

pipeline segment that address all applicable integrity threats, with particular emphasis on 

design/material and construction threats; and (4) an improved self-assessment that adequately 

measures whether the program is effectively assessing and evaluating the integrity of each

 151 PG&E’s integrity management plan also specifies that internal or external audits will be performed every 

other year to ensure compliance with PG&E and regulatory requirements. Such audits were completed in 2007 and 

2009. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 75

of 101
NTSB Pipeline Accident Report

115

covered pipeline segment. The NTSB further recommends that PG&E conduct threat 

assessments using the revised risk analysis methodology incorporated in its integrity 

management program, as recommended in Safety Recommendation P-11-29, and report the 

results of those assessments to the CPUC and PHMSA.

2.7 Adequacy of PG&E’s Public Awareness Program Evaluation

The NTSB also examined how PG&E conducts its public awareness program 

evaluations. The NTSB reviewed PG&E’s annual self-evaluations for the two review periods 

before the accident, June 2008–June 2009 and June 2009–June 2010. The NTSB found that the 

reviews simply documented that all required mailings were issued. Further, the action items in 

both reviews were nearly identical. The reviews did not further evaluate the public awareness 

program, such as reviewing the content, quality, or effectiveness of the information delivered. 

In the program evaluation and effectiveness section of its program plan, PG&E states that 

the annual review will be conducted using the guidelines of the plan. However, no specific 

guidelines for annual evaluations are defined. Examples of measurement components might 

include documenting website traffic on the company’s awareness pages and documenting the 

numbers of actual attendees in classes and meetings for emergency officials. If the data from 

these two example measures were gathered and documented, the effectiveness of the program 

could be tracked through the years. However, the NTSB notes that capturing such numbers is 

only the first step toward gauging whether attending the classes or ordering the materials PG&E 

offers translates into understanding, retention, and changed behavior. 

In addition to its annual self-assessments, PG&E had its contractor Paradigm Alliance, Inc.,

conduct a separate program documentation review (dated 2010) of its public awareness program 

for noncustomers along the pipeline right-of-way. As a program effectiveness measure, 

Paradigm sent out brochures with detachable business reply mail survey postcards to 

15,302 addresses. Paradigm received only 20 survey postcards in response. The answers received 

indicated that the majority of respondents did not recall seeing any recent pipeline safety 

information, and nearly half had low awareness about pipeline proximity. The lack of responses, 

the poor comprehension reflected in the responses received, and PG&E’s failure to make 

changes based on such dismal effectiveness data raise concerns about PG&E’s commitment to 

the quality of its public awareness program and to continuously improving it.

API Recommended Practice 1162 specifies that operators continuously improve their 

public awareness programs. In 2007, PG&E participated in the API’s PAPERS program. This 

particular PAPERS surveyed only the affected public that lived along the right-of-way; PG&E’s 

customers were left out. The survey results showed that the affected public respondent pool had 

the lowest awareness about pipeline safety, whereas the emergency responder respondents had 

the highest awareness but also had indicated they needed more information and appropriate 

training. These 2007 results were still keenly reflective of PG&E’s public awareness program 

effectiveness on the day of the accident in 2010, showing that residents were unaware and 

emergency responders were in need of more information. Had PG&E interpreted the 

2007 PAPERS effectiveness results and acted upon them 3 years prior, PG&E could have made 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 76

of 101
NTSB Pipeline Accident Report

116

meaningful changes to its program and increased awareness in the San Bruno community. As of 

the date of this report, no program revisions have been noted as a result of the PAPERS. 

The NTSB concludes that PG&E’s public awareness program self-evaluation was

ineffective at identifying and correcting deficiencies. Therefore, the NTSB recommends that 

PG&E develop, and incorporate into its public awareness program, written performance 

measurements and guidelines for evaluating the plan and for continuous program improvement. 

2.8 Summary of PG&E Practices

As discussed throughout this report, the NTSB accident investigation revealed multiple 

deficiencies with PG&E’s practices. To summarize, PG&E’s practices were revealed to be 

inadequate because—

• The accident pipe segment did not meet any known pipeline specifications.

• Construction and quality control measures for the 1956 relocation project were 

inadequate in that they did not identify visible defects.

• The integrity management program, including self-assessment of that program, was 

ineffective.

• Emergency response to the pipeline rupture was slow, and isolation and shutdown of 

gas flow were unacceptably delayed.

• The postaccident drug and alcohol testing program had multiple deficiencies.

• SCADA staff roles and duties were poorly defined.

• SCADA work clearance procedures were inadequate.

• Critical components at the Milpitas Terminal were susceptible to single-point failures.

• The public awareness program, including self-assessment, was deficient and 

ineffective.

Although PG&E has taken some corrective actions since the accident, many of these 

deficiencies should have been recognized and corrected before the accident.

Further, the NTSB notes that several of the deficiencies revealed by this investigation, 

such as poor quality control during pipeline installation and inadequate emergency response, 

were also factors in the 2008 explosion of a PG&E gas distribution line in Rancho Cordova, 

California. That accident involved the inappropriate installation of a pipe piece that was not 

intended for operational use and did not meet applicable pipe specifications. The response to that 

event was inadequate in that an unqualified person was initially dispatched to respond to the 

emergency, and there was an unnecessary delay in dispatching a properly trained and equipped 

technician. Some of these deficiencies were also factors in the 1981 PG&E gas pipeline leak in 

San Francisco,152

 152 NTSB/PAR-82/01.

which involved inaccurate record-keeping, the dispatch of first responders who 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 77

of 101
NTSB Pipeline Accident Report

117

were not trained or equipped to close valves, and unacceptable delays in shutting down the 

pipeline.

Accident investigations often uncover a broad range of causal relationships or 

deficiencies that extend beyond the immediacy of components damaged or broken in a system 

failure. As indicated by the list above, a multitude of deficient operational procedures and 

management controls led to hazardous circumstances persisting and growing over time until the 

pipeline rupture occurred. These higher-order or organizational accident factors must be 

addressed to improve PG&E’s safety management practices.

Organizational accidents have multiple contributing causes, involve people at numerous 

levels within a company, and are characterized by a pervasive lack of proactive measures to 

ensure adoption and compliance with a safety culture. Moreover, organizational accidents are

catastrophic events with substantial loss of life, property, and environment; they also require 

complex organizational changes in order to avoid them in the future. In its report on the 

2009 collision of two Washington Metropolitan Area Transit Authority trains near Fort Totten 

Station in Washington, DC,153 the NTSB stated that “the accident did not result from the actions 

of an individual but from the ‘accumulation of latent conditions within the maintenance, 

managerial and organizational spheres’ making it an example of a ‘quintessential organizational 

accident.’”154 The Chicago Transit Authority train derailment in 2006,

155 which caused injuries 

to 152 people and over $1 million in damages, is another case study in organizational accidents.

Similarly, the BP Texas City Refinery organizational accident in 2005156

The character and quality of PG&E’s operation, as revealed by this investigation, indicate 

that the San Bruno pipeline rupture was an organizational accident. PG&E did not effectively 

utilize its resources to define, implement, train, and test proactive management controls to ensure 

the operational and sustainable safety of its pipelines. Moreover, many of the organizational 

deficiencies were known to PG&E, as a result of the previous pipeline accidents in San Francisco 

in 1981,

killed 15 people, 

injured 180 others, and caused financial losses exceeding $1.5 billion. 

157 and in Rancho Cordova, California, in 2008.158

 153 Collision of Two Washington Metropolitan Area Transit Authority Metrorail Trains Near Fort Totten 

Station, Washington D.C., June 22, 2009, Railroad Accident Report NTSB/RAR-10/02 (Washington, DC: National 

Transportation Safety Board, 2010).

As a lesson from those accidents, 

PG&E should have critically examined all components of its pipeline installation to identify and 

manage the hazardous risks, as well as to prepare its emergency response procedures. If this 

recommended approach had been applied within the PG&E organization after the San Francisco 

154 (a) J. Reason, Managing the Risks of Organizational Accidents (Burlington, Vermont: Ashgate Publishing 

Company, 1997). (b) J. Reason, “Achieving a Safe Culture: Theory and Practice,” Work and Stress, vol. 12 (1998), 

p. 227.

155 Derailment of Chicago Transit Authority Train Number 220 Between Clark/Lake and Grand/Milwaukee 

Stations, Chicago, Illinois, July 11, 2006, Railroad Accident Report NTSB/RAR-07/02 (Washington, DC: National 

Transportation Safety Board, 2007).

156 Refinery Explosion and Fire, Investigation Report, report No. 205-04-1-TX (Washington, DC: 

U.S. Chemical Safety and Hazard Investigation Board, 2007).

157 NTSB/PAR-82/01.

158 NTSB/PAB-10/01.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 78

of 101
NTSB Pipeline Accident Report

118

and Rancho Cordova accidents, the San Bruno accident might have been prevented. Therefore, 

based on the circumstances of this accident, the NTSB concludes that the deficiencies identified 

during this investigation are indicative of an organizational accident. 

The NTSB also concludes that the multiple and recurring deficiencies in PG&E 

operational practices indicate a systemic problem. The NTSB recommends that the CPUC, with 

assistance from PHMSA, conduct a comprehensive audit of all aspects of PG&E operations, 

including control room operations, emergency planning, record-keeping, performance-based risk 

and integrity management programs, and public awareness programs. Further, the NTSB 

recommends that the CPUC require PG&E to correct all deficiencies identified as a result of the 

San Bruno, California, accident investigation, as well as any additional deficiencies identified 

through the comprehensive audit recommended in Safety Recommendation P-11-22, and verify 

that all corrective actions are completed. The NTSB also recommends that PHMSA assist 

the CPUC in conducting the comprehensive audit recommended in Safety Recommendation 

P-11-22. The NTSB urges the CPUC and PHMSA to complete this comprehensive audit and 

require PG&E to take corrective actions as soon as possible, to reap the maximum safety benefit. 

The NTSB believes that 6 months would be a reasonable time frame for conducting the audit and 

that an additional 6 months after the completion of the audit would be a reasonable deadline for 

PG&E to take action in response to audit findings.

2.9 Inspection Technology

The detection, identification, and elimination of pipeline defects before they result in 

catastrophic failures is critical to a successful integrity management program for gas 

transmission pipelines. In the NTSB’s judgment, the use of specialized in-line inspection tools 

that identify and evaluate damage caused by corrosion, dents, gouges, and circumferential and 

longitudinal cracks is a uniquely promising option for identifying defects. Unlike other 

assessment techniques, in-line inspection is continuous throughout the entire pipeline segment

and, when performed periodically, can provide useful information about defect growth. Although

in-line inspection technology has detection limitations (generally at best a 90 percent probability 

that a certain type of known defect will be detected, although the probability of detecting a crack 

can be improved with multiple runs), it is nonetheless the most effective method for detecting

internal pipeline defects. 

At the time Line 132 was constructed, in-line inspection tools had not been developed. 

Due to construction limitations such as sharp bends and the presence of plug valves, many older 

natural gas transmission pipelines, like Line 132, cannot accommodate modern in-line inspection 

tools without modifications. According to testimony provided during the NTSB investigative 

hearing, the technical challenges of conducting in-line inspections of older gas transmission 

pipelines relate not to the sensors, but to the platforms (the tool or pig) that need to move through 

the pipeline. Gas transmission pipeline operators have also asserted that, because of differences 

in the flow regimes between natural gas (a compressible fluid) and hazardous liquids (an 

incompressible fluid), the use of in-line inspection tools in gas transmission pipelines presents 

additional technical challenges, especially when the operating pressure many not be sufficiently 

high to push the tool through the pipeline.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 79

of 101
NTSB Pipeline Accident Report

119

According to testimony from the NTSB investigative hearing, current in-line inspection 

technology is advanced enough to have detected the defect that caused the rupture of Line 132, 

but it could not be used without significant modifications to the pipeline. The NTSB concludes 

that because in-line inspection technology is not available for use in all currently operating gas 

transmission pipeline systems, operators do not have the benefit of a uniquely effective 

assessment tool to identify and assess the threat from critical defects in their pipelines.

Only in-line inspection can provide visualization of the internal pipe structure. The geometry of 

Segment 180, like many older pipelines, would not accommodate in-line inspection tools. The 

NTSB is concerned that in-line inspection is not possible in many of the nation’s pipelines, 

which—because of the date of their installation—have been subjected to less scrutiny than more 

recently installed lines. Therefore, the NTSB recommends that PHMSA require that all natural 

gas transmission pipelines be configured so as to accommodate in-line inspection tools, with 

priority given to older pipelines.

The NTSB also recommends that the AGA and INGAA report to the NTSB on their

progress to develop and introduce advanced in-line inspection platforms for use in gas 

transmission pipelines not currently accessible to existing in-line inspection platforms, including 

a timeline for implementation of these advanced platforms.

2.10 Oversight

2.10.1 Performance-Based Safety Programs

Over the past few years, PHMSA, with the support and assistance of the pipeline 

industry, has added to its prescriptive regulatory scheme a performance-based regulatory scheme 

with broad performance goals as the basis for its pipeline safety program, most notably with 

respect to integrity management programs, and to a lesser extent, to public awareness programs. 

This new regulatory scheme applies to gas transmission and distribution systems and to 

hazardous liquid pipeline systems. Under performance-based regulations, the fundamental 

premise is that an individual pipeline operator knows its system best, and thereby is best able to 

develop, implement, execute, evaluate, and adjust its integrity management programs to ensure 

the safe maintenance and operation of its pipelines.

Performance-based management systems include activities to ensure that goals are 

consistently being met in an effective and efficient manner. Performance management can focus 

on an organization, a department, an employee, or even the processes to build a product or 

service, among many other areas. Performance measurement involves determining what to 

measure, identifying data collection methods, and collecting the data. Evaluation involves 

assessing progress toward the performance goals, usually to explain the causal relationships

between program activities and outcomes. Performance measurement and evaluation are 

components of performance-based management, the systematic application of information 

generated by performance plans, measurement, and evaluation to strategic planning and budget 

formulation.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 80

of 101
NTSB Pipeline Accident Report

120

The PG&E integrity management plan was audited by the CPUC in 2005, with PHMSA’s

assistance, and again by the CPUC in 2010 using PHMSA’s inspection protocol. Almost none of 

the issues identified in this investigation were identified in either of these audits despite the fact 

that many of them should have been easy to detect. 

The deficiencies in the PG&E GIS data (described in sections 1.9.4.1 and 2.6.1) should 

have been readily apparent to CPUC and PHMSA inspectors during integrity management 

audits. However, the PHMSA integrity management audit protocol does not formally call for a 

check of the completeness and accuracy of information contained in the operator’s pipeline 

attribute database. The PHMSA inspection protocol includes only one inspection item (C.02.d), 

related to the completeness and accuracy of information used in developing integrity 

management programs. That item requires inspectors to verify that the operator has checked the 

data for accuracy, and if the operator lacks sufficient data or the data quality is suspect, instructs 

the inspector to verify that the operator has followed ASME B31.8S. At the NTSB investigative 

hearing, a CPUC supervisory engineer testified that CPUC auditors did not examine GIS data in 

detail; however, they did randomly spot check GIS data and verified that when data were

unknown, PG&E was using appropriately conservative values.

Furthermore, PHMSA regulations do not require an operator to supply missing data or 

assumed values within any time frame. This allows incomplete or erroneous information to 

continue in an operator’s records indefinitely, as was the case with the PG&E GIS, which 

continued to show Segment 180 as seamless X42 pipe until the time of the accident. PHMSA 

should require operators to correct data deficiencies within a specific time frame.

Another deficiency not identified during the audits was the mismatch between PG&E’s 

threat weighting and its actual leak, failure, and incident experience. The PHMSA integrity 

management inspection protocol includes inspection item C.03.c for inspectors to verify that the 

operator uses a feedback mechanism to ensure that its risk model is subject to continuous 

validation and improvement. However, the PHMSA inspection protocol placed insufficient 

emphasis on continuous validation and improvement of risk models. 

Another concern is the fact that the CPUC did not follow up on its 2005 audit finding that 

PG&E lacked a process to evaluate the use of ASVs and RCVs, as required by 

49 CFR 192.935(c). Although PG&E prepared a memorandum, dated June 14, 2006, addressing 

this issue, the CPUC apparently did not evaluate the adequacy of this response. If it did, it failed 

to identify the flawed analysis that concluded the use of ASVs would have little effect on 

increasing safety or protecting property.

CPUC and PHMSA officials acknowledged at the NTSB investigative hearing that it is 

difficult to oversee performance-based regulations, such as the integrity management rules,

because there is no “one-size-fits-all” standard against which to measure performance. 

Overseeing an operator’s compliance with the integrity management rules is very different from 

overseeing compliance with more clear-cut prescriptive regulations because integrity 

management requires the auditor to evaluate the adequacy of an operator’s technical justification 

rather than its compliance with a hard and fast standard.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 81

of 101
NTSB Pipeline Accident Report

121

The effectiveness of performance-based pipeline safety programs is dependent on the 

diligence and accountability of both the operator and the regulator—the operator for 

development and execution of its plan, and the regulator for oversight of the operators. However, 

as evident in this investigation, the PG&E integrity management and public awareness programs 

failed to achieve their stated goals because performance measures were neither well defined nor 

evaluated with respect to meeting performance goals. By overlooking the existence of, and the 

risk from, manufacturing and fabrication defects under its integrity management program, PG&E 

took no actions to assess risk and ultimately was unaware of the internal defects that caused the 

rupture of Line 132. 

Similarly, the CPUC and PHMSA continue to conduct audits that focus on verification of 

paper records and plans rather than on gathering information on how performance-based safety 

systems are implemented, executed, and evaluated, and whether problem areas are being 

detected and corrected.

Critical to this process, for operator and regulator, is the selection of metrics that quantify 

results against a specified value to provide a rate of occurrence for either a desired or undesired 

outcome. For example, useful metrics might include the number of incidents from internal 

defects per mile of operating pipeline or the number of incidents in a specific location per total 

incidents on a specific pipeline. Such metrics can provide a basis for comparison of the 

frequency of various types of defects and identify specific problem locations on pipelines. 

Similar assessments of operator performance can be used by regulators to exercise more 

effective oversight by focusing on those operators with problems, and to identify the causes of 

critical safety problems.

In summary, PHMSA should develop an oversight model that allows auditors to more 

accurately measure the success of a performance-based pipeline integrity management program.

Specifically, PG&E should develop, and auditors should review, data that provide some 

quantification of performance improvements or deterioration, such as the number of incidents 

per pipeline mile or per 1,000 customers; the number of missing, incomplete, or erroneous data 

fields corrected in an operator’s database; the response time in minutes for leaks, ruptures, or 

other incidents; and the number of public responses received per thousands of postcards/surveys 

mailed. Such metrics would allow a comparison of current performance against previous 

performance. 

The NTSB concludes that the PHMSA integrity management inspection protocols are 

inadequate. Therefore, the NTSB recommends that PHMSA revise its integrity management 

inspection protocol to (1) incorporate a review of meaningful metrics; (2) require auditors to 

verify that the operator has a procedure in place for ensuring the completeness and accuracy of 

underlying information; (3) require auditors to review all integrity management performance 

measures reported to PHMSA and compare the leak, failure, and incident measures to the 

operator’s risk model; and (4) require setting performance goals for pipeline operators at each 

audit and follow up on those goals at subsequent audits.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 82

of 101
NTSB Pipeline Accident Report

122

The NTSB also concludes that because PG&E, as the operator of its pipeline system, and 

the CPUC, as the pipeline safety regulator within the state of California, have not incorporated 

the use of effective and meaningful metrics as part of their performance-based pipeline safety 

management programs, neither PG&E nor the CPUC is able to effectively evaluate or assess the 

integrity of PG&E’s pipeline system. The NTSB also concludes that, because PHMSA has not 

incorporated the use of effective and meaningful metrics as part of its guidance for effective 

performance-based pipeline safety management programs, its oversight of state public utility 

commissions regulating gas transmission and hazardous liquid pipelines needs improvement. 

Therefore, the NTSB recommends that PHMSA (1) develop and implement standards for 

integrity management and other performance-based safety programs that require operators of all 

types of pipeline systems to regularly assess the effectiveness of their programs using clear and 

meaningful metrics, and to identify and then correct deficiencies; and (2) make those metrics 

available in a centralized database. The NTSB also recommends that PHMSA work with state 

public utility commissions to (1) implement oversight programs that employ meaningful metrics 

to assess the effectiveness of their oversight programs and make those metrics available in a 

centralized database, and (2) identify and then correct deficiencies in those programs. Finally, the 

NTSB recommends that the U.S. Secretary of Transportation conduct an audit to assess the 

effectiveness of PHMSA’s oversight of performance-based safety programs. This audit should 

address the (1) need to expand the program’s use of meaningful metrics; (2) adequacy of its 

inspection protocols for ensuring the completeness and accuracy of pipeline operators’ integrity 

management program data; (3) adequacy of its inspection protocols for ensuring the 

incorporation of an operator’s leak, failure, and incident data in evaluations of the operator’s risk 

model; and (4) benefits of establishing performance goals for pipeline operators.

2.10.2 Authority and Enforcement

The CPUC, as the regulator for pipeline safety within California, failed to uncover the 

pervasive and long-standing problems within PG&E. Consequently, this failure precluded the 

CPUC from taking any enforcement action against PG&E. The CPUC lost opportunities to 

identify needed corrective action and to follow through and ensure that PG&E completed the 

prescribed corrective actions in a timely manner. For its part, PHMSA rated the CPUC’s pipeline 

safety program in the mid- to high-90s in the years leading up to the San Bruno accident—a 

superior, if not outstanding, score. Furthermore, PHMSA’s participation in the 2005 joint audit 

with the CPUC of PG&E apparently did not make any difference in uncovering PG&E’s 

systemic problems or in accurately assessing the quality of oversight exercised by the CPUC.

The quality of oversight exercised by any regulatory agency depends upon the quality of 

the regulations in force, the authority granted to the regulator, and the enforcement program 

implemented by the regulator. Despite deficiencies with specific regulatory requirements and 

integrity management programs as discussed previously, the CPUC’s failure to recognize 

PG&E’s corporate failures and PHMSA’s failure to recognize the CPUC’s ineffectiveness 

indicate that more fundamental problems exist, particularly with enforcement practices and 

policies.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 83

of 101
NTSB Pipeline Accident Report

123

The NTSB believes that Federal regulations for all types of pipeline systems provide 

sufficient authority to PHMSA to enforce the regulations and to take appropriate actions to 

address noncompliance by a pipeline operator. PHMSA can require an operator to take numerous 

corrective actions, such as reducing operating pressure, conducting inspections and tests, and, if 

necessary, suspending operation of a pipeline. PHMSA also can initiate enforcement actions 

leading to monetary civil penalties against an operator for safety violations.

Most states either adopt or pattern state pipeline safety regulations after the Federal 

regulations. Because state pipeline regulatory agencies receiving Federal grants through PHMSA 

are monitored for alignment with PHMSA standards, most state regulators should be expected to 

have comparable enforcement authority. However, a state regulator’s authority will be affected 

by the organizational placement of the regulatory agency within the state government. In the case 

of the CPUC, pipeline safety is one of several utility programs under the CPUC’s jurisdiction. 

Further, the CPUC sets utility rates, which could potentially conflict with the enforcement of 

safety programs.

Because of the lapses of oversight seen in this accident, the NTSB is concerned and has 

strong doubts about the quality and effectiveness of enforcement at both the Federal and state 

levels. Although the CPUC and PHMSA have authority to enforce pipeline safety regulations, 

the organizational failures of PG&E seen in this accident suggest that some operators are able to 

ignore certain standards without concern for meaningful enforcement action against them.

Therefore, the NTSB concludes that the ineffective enforcement posture of the CPUC 

permitted PG&E’s organizational failures to continue over many years. The NTSB recommends 

that the governor of the state of California expeditiously evaluate the authority and ability of the 

pipeline safety division within the CPUC to effectively enforce state pipeline safety regulations, 

and, based on the results of this evaluation, grant the pipeline safety division within the CPUC 

the direct authority, including the assessment of fines and penalties, to correct 

noncompliance by state-regulated pipeline operators. 

The NTSB also concludes that PHMSA’s enforcement program and its monitoring of 

state oversight programs have been weak and have resulted in the lack of effective 

Federal oversight and state oversight exercised by the CPUC. The NTSB recommends 

that the U.S. Secretary of Transportation include in the audit conducted pursuant to Safety

Recommendation P-11-4 a review of PHMSA’s enforcement policies and procedures, including, 

specifically, the standard of review for compliance with performance-based regulations. The 

NTSB also recommends that the U.S. Secretary of Transportation conduct an audit of PHMSA’s 

state pipeline safety program certification program to assess and ensure state pipeline safety 

programs and Federal pipeline safety grants are used effectively to conduct oversight of 

intrastate pipeline operations, including an evaluation of state inspection and enforcement 

activities. The NTSB further recommends that the U.S. Secretary of Transportation ensure that 

PHMSA amends the certification program, as appropriate, to comply with the findings of the 

audit recommended in Safety Recommendation P-11-6.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 84

of 101
NTSB Pipeline Accident Report

124

3. Conclusions

3.1 Findings

1. The following were not factors in this accident: seismic activity, corrosion, direct 

third-party damage, or drug use by the workers at the Milpitas Terminal. 

2. The accident pipe comprising the pups did not conform to Pacific Gas and Electric 

Company (PG&E) or other known specifications for pipe and was fabricated at an 

undetermined facility to no known specification.

3. The accident pipe would not have met generally accepted industry quality control and 

welding standards in 1956, indicating that those standards were overlooked or ignored.

4. PG&E’s inadequate quality control during the 1956 relocation project led to the 

installation and commissioning of a defective pipe that remained undetected until the 

accident, 54 years later.

5. The fracture of Line 132 Segment 180 originated in the partially welded longitudinal 

seam of pup 1, which was progressively weakened due to ductile crack growth and 

fatigue crack growth.

6. The combination of the size and shape of the weld defect significantly reduced the 

strength of the pup 1 longitudinal seam, making it susceptible to unstable crack growth

under internal gas pressure.

7. The 2008 sewer line installation did not damage the defective pipe that later ruptured.

8. The internal line pressure preceding the rupture did not exceed the PG&E maximum 

allowable operating pressure for Line 132 and would not have posed a safety hazard for a 

properly constructed pipe.

9. Had a properly prepared contingency plan for the Milpitas Terminal electrical work been 

in place and been executed, the loss of pressure control could have been anticipated and 

planned for, thereby minimizing or avoiding the pressure deviations.

10. PG&E lacked detailed and comprehensive procedures for responding to a large-scale 

emergency such as a transmission line break, including a defined command structure that 

clearly assigns a single point of leadership and allocates specific duties to supervisory 

control and data acquisition staff and other involved employees.

11. PG&E’s supervisory control and data acquisition system limitations contributed to the 

delay in recognizing that there had been a transmission line break and quickly 

pinpointing its location. 

12. The 95 minutes that PG&E took to stop the flow of gas by isolating the rupture site was 

excessive.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 85

of 101
NTSB Pipeline Accident Report

125

13. Use of automatic shutoff valves or remote control valves along the entire length of 

Line 132 would have significantly reduced the amount of time taken to stop the flow of 

gas and to isolate the rupture.

14. Considering the challenges of the prolonged fire fueled by natural gas, the emergency 

response was well coordinated and effectively managed by local responders. 

15. The 6-hour delay before ordering drug and alcohol testing, the commencement of alcohol 

testing at the Milpitas Terminal 1 hour after it was no longer permitted, the failure to 

properly record an explanation for the delay, and the failure to conduct drug or alcohol 

testing on the supervisory control and data acquisition center staff all demonstrate that the 

PG&E postaccident toxicological program was ineffective.

16. If the grandfathering of older pipelines had not been permitted since 1961 by the 

California Public Utilities Commission and since 1970 by the U.S. Department of 

Transportation, Line 132 would have undergone a hydrostatic pressure test that would 

likely have exposed the defective pipe that led to this accident.

17. There is no safety justification for the grandfather clause exempting pre-1970 pipelines 

from the requirement for postconstruction hydrostatic pressure testing.

18. The premise in Title 49 Code of Federal Regulations Part 192 of the Federal pipeline 

safety regulations that manufacturing- and construction-related defects can be 

considered stable even when a gas pipeline has not been subjected to a pressure test of at 

least 1.25 times the maximum allowable operating pressure is not supported by scientific 

studies.

19. The PG&E gas transmission integrity management program was deficient and 

ineffective.

20. PG&E’s public awareness program self-evaluation was ineffective at identifying and 

correcting deficiencies.

21. The deficiencies identified during this investigation are indicative of an organizational 

accident.

22. The multiple and recurring deficiencies in PG&E operational practices indicate a 

systemic problem.

23. Because in-line inspection technology is not available for use in all currently operating 

gas transmission pipeline systems, operators do not have the benefit of a uniquely 

effective assessment tool to identify and assess the threat from critical defects in their 

pipelines.

24. The Pipeline and Hazardous Materials Safety Administration integrity management 

inspection protocols are inadequate.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 86

of 101
NTSB Pipeline Accident Report

126

25. Because PG&E, as the operator of its pipeline system, and the California Public Utilities 

Commission, as the pipeline safety regulator within the state of California, have not 

incorporated the use of effective and meaningful metrics as part of their 

performance-based pipeline safety management programs, neither PG&E nor the 

California Public Utilities Commission is able to effectively evaluate or assess the 

integrity of PG&E’s pipeline system.

26. Because the Pipeline and Hazardous Materials Safety Administration has not 

incorporated the use of effective and meaningful metrics as part of its guidance for 

effective performance-based pipeline safety management programs, its oversight of state 

public utility commissions regulating gas transmission and hazardous liquid pipelines

needs improvement.

27. The ineffective enforcement posture of the California Public Utilities Commission 

permitted PG&E’s organizational failures to continue over many years.

28. The Pipeline and Hazardous Materials Safety Administration’s enforcement program and 

its monitoring of state oversight programs have been weak and have resulted in lack of 

effective Federal oversight and state oversight exercised by the California Public Utilities 

Commission.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 87

of 101
NTSB Pipeline Accident Report

127

3.2 Probable Cause

The National Transportation Safety Board determines that the probable cause of the 

accident was the Pacific Gas and Electric Company’s (PG&E) (1) inadequate quality assurance 

and quality control in 1956 during its Line 132 relocation project, which allowed the installation 

of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time 

grew to a critical size, causing the pipeline to rupture during a pressure increase stemming from 

poorly planned electrical work at the Milpitas Terminal; and (2) inadequate pipeline integrity 

management program, which failed to detect and repair or remove the defective pipe section. 

Contributing to the accident were the California Public Utilities Commission’s (CPUC) 

and the U.S. Department of Transportation’s exemptions of existing pipelines from the 

regulatory requirement for pressure testing, which likely would have detected the installation 

defects. Also contributing to the accident was the CPUC’s failure to detect the inadequacies of 

PG&E’s pipeline integrity management program.

Contributing to the severity of the accident were the lack of either automatic shutoff 

valves or remote control valves on the line and PG&E’s flawed emergency response procedures 

and delay in isolating the rupture to stop the flow of gas. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 88

of 101
NTSB Pipeline Accident Report

128

4. Recommendations

As a result of its investigation of this accident, the National Transportation Safety Board 

makes the following safety recommendations:

4.1 New Recommendations

To the U.S. Secretary of Transportation:

Conduct an audit to assess the effectiveness of the Pipeline and Hazardous 

Materials Safety Administration’s oversight of performance-based safety 

programs. This audit should address the (1) need to expand the program’s use of 

meaningful metrics; (2) adequacy of its inspection protocols for ensuring the 

completeness and accuracy of pipeline operators’ integrity management program 

data; (3) adequacy of its inspection protocols for ensuring the incorporation of an 

operator’s leak, failure, and incident data in evaluations of the operator’s risk 

model; and (4) benefits of establishing performance goals for pipeline operators.

(P-11-4)

Include in the audit conducted pursuant to Safety Recommendation P-11-4 a 

review of the Pipeline and Hazardous Materials Safety Administration’s 

enforcement policies and procedures, including, specifically, the standard of 

review for compliance with performance-based regulations. (P-11-5)

Conduct an audit of the Pipeline and Hazardous Materials Safety Administration’s 

state pipeline safety program certification program to assess and ensure state 

pipeline safety programs and Federal pipeline safety grants are used effectively to 

conduct oversight of intrastate pipeline operations, including an evaluation of 

state inspection and enforcement activities. (P-11-6)

Ensure that the Pipeline and Hazardous Materials Safety Administration amends 

the certification program, as appropriate, to comply with the findings of the audit 

recommended in Safety Recommendation P-11-6. (P-11-7)

To the Pipeline and Hazardous Materials Safety Administration:

Require operators of natural gas transmission and distribution pipelines and 

hazardous liquid pipelines to provide system-specific information about their 

pipeline systems to the emergency response agencies of the communities and 

jurisdictions in which those pipelines are located. This information should include

pipe diameter, operating pressure, product transported, and potential impact 

radius. (P-11-8) This recommendation supersedes Safety Recommendation 

P-11-1.

Require operators of natural gas transmission and distribution pipelines and 

hazardous liquid pipelines to ensure that their control room operators immediately 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 89

of 101
NTSB Pipeline Accident Report

129

and directly notify the 911 emergency call center(s) for the communities and 

jurisdictions in which those pipelines are located when a possible rupture of any 

pipeline is indicated. (P-11-9) This recommendation supersedes Safety 

Recommendation P-11-2.

Require that all operators of natural gas transmission and distribution pipelines

equip their supervisory control and data acquisition systems with tools to assist in 

recognizing and pinpointing the location of leaks, including line breaks; such 

tools could include a real-time leak detection system and appropriately spaced 

flow and pressure transmitters along covered transmission lines. (P-11-10)

Amend Title 49 Code of Federal Regulations 192.935(c) to directly require that 

automatic shutoff valves or remote control valves in high consequence areas and 

in class 3 and 4 locations be installed and spaced at intervals that consider the 

factors listed in that regulation. (P-11-11)

Amend Title 49 Code of Federal Regulations 199.105 and 49 Code of Federal 

Regulations 199.225 to eliminate operator discretion with regard to testing of 

covered employees. The revised language should require drug and alcohol testing 

of each employee whose performance either contributed to the accident or cannot 

be completely discounted as a contributing factor to the accident. (P-11-12)

Issue immediate guidance clarifying the need to conduct postaccident drug and 

alcohol testing of all potentially involved personnel despite uncertainty about the 

circumstances of the accident. (P-11-13)

Amend Title 49 Code of Federal Regulations 192.619 to delete the grandfather 

clause and require that all gas transmission pipelines constructed before 1970 be

subjected to a hydrostatic pressure test that incorporates a spike test. (P-11-14)

Amend Title 49 Code of Federal Regulations Part 192 of the Federal pipeline 

safety regulations so that manufacturing- and construction-related defects can 

only be considered stable if a gas pipeline has been subjected to a 

postconstruction hydrostatic pressure test of at least 1.25 times the maximum 

allowable operating pressure. (P-11-15)

Assist the California Public Utilities Commission in conducting the 

comprehensive audit recommended in Safety Recommendation P-11-22.

(P-11-16)

Require that all natural gas transmission pipelines be configured so as to 

accommodate in-line inspection tools, with priority given to older pipelines.

(P-11-17)

Revise your integrity management inspection protocol to (1) incorporate a review 

of meaningful metrics; (2) require auditors to verify that the operator has a 

procedure in place for ensuring the completeness and accuracy of underlying 

information; (3) require auditors to review all integrity management performance 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 90

of 101
NTSB Pipeline Accident Report

130

measures reported to the Pipeline and Hazardous Materials Safety Administration

and compare the leak, failure, and incident measures to the operator’s risk model; 

and (4) require setting performance goals for pipeline operators at each audit and 

follow up on those goals at subsequent audits. (P-11-18)

(1) Develop and implement standards for integrity management and other 

performance-based safety programs that require operators of all types of pipeline 

systems to regularly assess the effectiveness of their programs using clear and 

meaningful metrics, and to identify and then correct deficiencies; and (2) make 

those metrics available in a centralized database. (P-11-19)

Work with state public utility commissions to (1) implement oversight programs 

that employ meaningful metrics to assess the effectiveness of their oversight 

programs and make those metrics available in a centralized database, and

(2) identify and then correct deficiencies in those programs. (P-11-20)

To the Governor of the State of California:

Expeditiously evaluate the authority and ability of the pipeline safety division 

within the California Public Utilities Commission to effectively enforce state 

pipeline safety regulations, and, based on the results of this evaluation, grant the 

pipeline safety division within the California Public Utilities Commission the 

direct authority, including the assessment of fines and penalties, to correct 

noncompliance by state regulated pipeline operators. (P-11-21)

To the California Public Utilities Commission:

With assistance from the Pipeline and Hazardous Materials Safety 

Administration, conduct a comprehensive audit of all aspects of Pacific Gas and 

Electric Company operations, including control room operations, emergency 

planning, record-keeping, performance-based risk and integrity management 

programs, and public awareness programs. (P-11-22)

Require the Pacific Gas and Electric Company to correct all deficiencies 

identified as a result of the San Bruno, California, accident investigation, as well 

as any additional deficiencies identified through the comprehensive audit 

recommended in Safety Recommendation P-11-22, and verify that all corrective 

actions are completed. (P-11-23)

To the Pacific Gas and Electric Company:

Revise your work clearance procedures to include requirements for identifying the 

likelihood and consequence of failure associated with the planned work and for 

developing contingency plans. (P-11-24)

Establish a comprehensive emergency response procedure for responding to 

large-scale emergencies on transmission lines; the procedure should (1) identify a 

single person to assume command and designate specific duties for supervisory 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 91

of 101
NTSB Pipeline Accident Report

131

control and data acquisition staff and all other potentially involved company 

employees; (2) include the development and use of trouble-shooting protocols and 

checklists; and (3) include a requirement for periodic tests and/or drills to 

demonstrate the procedure can be effectively implemented. (P-11-25)

Equip your supervisory control and data acquisition system with tools to assist in 

recognizing and pinpointing the location of leaks, including line breaks; such 

tools could include a real-time leak detection system and appropriately spaced 

flow and pressure transmitters along covered transmission lines. (P-11-26)

Expedite the installation of automatic shutoff valves and remote control valves on 

transmission lines in high consequence areas and in class 3 and 4 locations, and 

space them at intervals that consider the factors listed in Title 49 Code of Federal

Regulations 192.935(c). (P-11-27)

Revise your postaccident toxicological testing program to ensure that testing is 

timely and complete. (P-11-28)

Assess every aspect of your integrity management program, paying particular 

attention to the areas identified in this investigation, and implement a revised 

program that includes, at a minimum, (1) a revised risk model to reflect the 

Pacific Gas and Electric Company’s actual recent experience data on leaks, 

failures, and incidents; (2) consideration of all defect and leak data for the life of 

each pipeline, including its construction, in risk analysis for similar or related 

segments to ensure that all applicable threats are adequately addressed; (3) a 

revised risk analysis methodology to ensure that assessment methods are selected 

for each pipeline segment that address all applicable integrity threats, with 

particular emphasis on design/material and construction threats; and (4) an 

improved self-assessment that adequately measures whether the program is 

effectively assessing and evaluating the integrity of each covered pipeline 

segment. (P-11-29)

Conduct threat assessments using the revised risk analysis methodology 

incorporated in your integrity management program, as recommended in 

Safety Recommendation P-11-29, and report the results of those assessments to

the California Public Utilities Commission and the Pipeline and Hazardous 

Materials Safety Administration. (P-11-30)

Develop, and incorporate into your public awareness program, written 

performance measurements and guidelines for evaluating the plan and for 

continuous program improvement. (P-11-31)

To the American Gas Association and the Interstate Natural Gas Association of 

America:

Report to the National Transportation Safety Board on your progress to develop 

and introduce advanced in-line inspection platforms for use in gas transmission 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 92

of 101
NTSB Pipeline Accident Report

132

pipelines not currently accessible to existing in-line inspection platforms, 

including a timeline for implementation of these advanced platforms. (P-11-32)

4.2 Previously Issued Recommendations

As a result of this accident investigation, the National Transportation Safety Board 

previously issued the following safety recommendations:

To the Pipeline and Hazardous Materials Safety Administration:

Through appropriate and expeditious means such as advisory bulletins and 

posting on your website, immediately inform the pipeline industry of the 

circumstances leading up to and the consequences of the September 9, 2010, 

pipeline rupture in San Bruno, California, and the National Transportation Safety 

Board’s urgent safety recommendations to Pacific Gas and Electric Company so 

that pipeline operators can proactively implement corrective measures as 

appropriate for their pipeline systems. (P-10-1) (Urgent)

Issue guidance to operators of natural gas transmission and distribution pipelines 

and hazardous liquid pipelines regarding the importance of sharing 

system-specific information, including pipe diameter, operating pressure, product 

transported, and potential impact radius, about their pipeline systems with the 

emergency response agencies of the communities and jurisdictions in which those 

pipelines are located. (P-11-1)

Issue guidance to operators of natural gas transmission and distribution pipelines 

and hazardous liquid pipelines regarding the importance of control room operators 

immediately and directly notifying the 911 emergency call center(s) for the 

communities and jurisdictions in which those pipelines are located when a 

possible rupture of any pipeline is indicated. (P-11-2)

To the California Public Utilities Commission:

Develop an implementation schedule for the requirements of Safety

Recommendation P-10-2 (Urgent) to Pacific Gas and Electric Company (PG&E) 

and ensure, through adequate oversight, that PG&E has aggressively and 

diligently searched documents and records relating to pipeline system 

components, such as pipe segments, valves, fittings, and weld seams, for PG&E 

natural gas transmission lines in class 3 and class 4 locations and class 1 and 

class 2 high consequence areas that have not had a maximum allowable operating 

pressure established through prior hydrostatic testing as outlined in Safety 

Recommendation P-10-2 (Urgent) to PG&E. These records should be traceable, 

verifiable, and complete; should meet your regulatory intent and requirements; 

and should have been considered in determining maximum allowable operating 

pressures for PG&E pipelines. (P-10-5) (Urgent)

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 93

of 101
NTSB Pipeline Accident Report

133

If such a document and records search cannot be satisfactorily completed, provide 

oversight to any spike and hydrostatic tests that Pacific Gas and Electric Company 

is required to perform according to Safety Recommendation P-10-4. (P-10-6) 

(Urgent)

Through appropriate and expeditious means, including posting on your website, 

immediately inform California intrastate natural gas transmission operators of the 

circumstances leading up to and the consequences of the September 9, 2010, 

pipeline rupture in San Bruno, California, and the National Transportation Safety 

Board’s urgent safety recommendations to Pacific Gas and Electric Company so 

that pipeline operators can proactively implement corrective measures as 

appropriate for their pipeline systems. (P-10-7) (Urgent)

To the Pacific Gas and Electric Company:

Aggressively and diligently search for all as-built drawings, alignment sheets, and 

specifications, and all design, construction, inspection, testing, maintenance, and 

other related records, including those records in locations controlled by personnel 

or firms other than Pacific Gas and Electric Company, relating to pipeline system 

components, such as pipe segments, valves, fittings, and weld seams for Pacific 

Gas and Electric Company natural gas transmission lines in class 3 and class 4159

locations and class 1 and class 2160 high consequence areas161

Use the traceable, verifiable, and complete records located by implementation of 

Safety Recommendation P-10-2 (Urgent) to determine the valid maximum 

allowable operating pressure, based on the weakest section of the pipeline or 

component to ensure safe operation, of Pacific Gas and Electric Company natural 

gas transmission lines in class 3 and class 4 locations and class 1 and class 2 high 

consequence areas that have not had a maximum allowable operating pressure 

established through prior hydrostatic testing. (P-10-3) (Urgent)

that have not had a 

maximum allowable operating pressure established through prior hydrostatic 

testing. These records should be traceable, verifiable, and complete. (P-10-2) 

(Urgent) 

If you are unable to comply with Safety Recommendations P-10-2 (Urgent) and 

P-10-3 (Urgent) to accurately determine the maximum allowable operating 

pressure of Pacific Gas and Electric Company natural gas transmission lines in 

class 3 and class 4 locations and class 1 and class 2 high consequence areas that 

have not had a maximum allowable operating pressure established through prior 

 159 Class 3 refers to any location unit that has 46 or more buildings intended for human occupancy. Class 4 

refers to any class location unit where buildings with four or more stories above ground are prevalent.

160 Class 1 refers to an offshore area or any class location unit that has 10 or fewer buildings intended for 

human occupancy. A class 2 location is any class location unit that has more than 10 but fewer than 46 buildings 

intended for human occupancy.

161 A high consequence area is any class 3 or 4 location or any area where a potential impact radius of 660 feet 

would contain more than 20 buildings intended for human occupancy.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 94

of 101
NTSB Pipeline Accident Report

134

hydrostatic testing, determine the maximum allowable operating pressure with a 

spike test followed by a hydrostatic pressure test. (P-10-4)

Require your control room operators to notify, immediately and directly, the 

911 emergency call center(s) for the communities and jurisdictions in which your 

transmission and/or distribution pipelines are located, when a possible rupture of 

any pipeline is indicated. (P-11-3)

4.3 Previously Issued Recommendations Classified in This Report

Safety Recommendations P-11-1 and P-11-2 to the Pipeline and Hazardous Materials 

Safety Administration are classified “Closed—Superseded” by Safety Recommendations P-11-8

and P-11-9, respectively, in this report (section 2.4.2, “Notifying Emergency Responders”).

Chairman Hersman filed the following concurring statement on September 12, 2011, and

was joined by Members Sumwalt and Rosekind.

Vice Chairman Hart filed the following concurring and dissenting statement on 

September 12, 2011, and was joined by Member Weener.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD 

DEBORAH A.P. HERSMAN ROBERT L. SUMWALT 

Chairman Member 

CHRISTOPHER A. HART MARK R. ROSEKIND

Vice Chairman Member 

EARL F. WEENER 

Member 

Adopted: August 30, 2011

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 95

of 101
NTSB Pipeline Accident Report

135

Chairman Hersman, concurring:

On August 30, 2011, by a vote of 5-0, the members of the National Transportation Safety Board 

adopted the final report on the most devastating pipeline accident in a decade, an accident which 

left the community of San Bruno, CA, asking, “Who is responsible for our safety?” 

The NTSB investigation revealed that for years, PG&E exploited weaknesses in a lax system of 

oversight. We also identified regulators that placed a blind trust in the companies that they were 

charged with overseeing – to the detriment of public safety.

In the pipeline industry, there must be effective oversight and strong enforcement. With integrity 

management plans, oversight has shifted away from prescriptive regulations to performance 

standards. Yet, this approach, where companies effectively say, “These are our standards and we 

are meeting them,” is only as good as the companies’ commitment and their integrity. In too 

many instances, the regulators in this case didn’t really know what was going on or require the 

operator to live up to their commitments. For example, our investigators identified poor 

record-keeping, flawed assumptions in PG&E’s integrity management programs, a failure to 

increase safety on an aging pipe in a high-consequence area with remote control valves or in-line 

inspections, and inadequate drug and alcohol testing protocols.

PHMSA testified at our March 2011 hearing that performance based regulations are very 

difficult for operators to implement and for regulators to oversee. Ronald Regan famously said, 

“Trust but verify.” For government to do its job – safeguard the public – it cannot trust alone. It 

must verify through effective oversight. 

That is why we have asked DOT to assess the effectiveness of the PHMSA’s oversight program 

and, in turn, the effectiveness of state programs funded with federal dollars. In essence, verify. 

And, where trust is not merited, they need to ensure that the penalty is high. It is critical for the 

pipeline industry to learn from this accident and take action in response to our recommendations. 

Because, when there’s an accident like San Bruno, it is too late.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 96

of 101
NTSB Pipeline Accident Report

136

Vice Chairman Hart, concurring and dissenting:

This report is thorough and well done, and I concur with the findings, the probable cause, and all 

but one of the recommendations.

Concurrence, In Part:

This mishap involves two issues that will need more attention by the NTSB in the future, 

namely, (a) how industries will respond to the fact that safety regulator resources are not 

generally increasing as fast as the industry, and (b) what role the economic regulator will play in 

safety in industries that have both a safety regulator and an economic regulator.

Regulator Resources. In many industries, safety regulator resources are not growing as rapidly as 

the industry they regulate. With respect to the number of safety inspectors, for example, the 

number of inspectors per regulated entity has been decreasing in many industries; and the 

response has generally been to expand the inspectors’ reach by transitioning them away from 

direct inspection of the end product and transitioning them toward inspection of the processes 

that create the end product. An example of that transition in relation to this mishap is the 

integrity management process.

Given the difficulty of keeping the ratio of safety inspectors to inspected entities from declining 

further in many industries, the shift to process inspection is essential. The transition, however, is 

not a trivial one. For example, the inspector skill sets that are needed for direct inspection are 

somewhat different than the skill sets that are needed for process inspection. Moreover, no 

amount of process inspection will ensure that the process will work every time; the best that can 

generally be said about most processes, even if well designed and implemented, is that they 

usually work. Given that there will be times when a process does not work exactly as expected, 

more often than not when a safety inspector is not present because the frequency of inspector 

visits is declining, then the obligation falls upon the operator to do the right thing when the 

process doesn’t quite work and when no inspector is nearby to know that.

This increased reliance upon the operator to do the right thing when no inspector is there to know 

otherwise is a very important aspect of the shift from direct inspection to process inspection, and 

this mishap, as well as several others the NTSB has investigated, illustrates that regulated 

industries need to come up with a better way to make that transition. In this instance, the 

situation is further complicated by the fact that there are two levels of safety regulation, federal 

and state, and in order for the transition from end result inspection to process inspection to be 

successful, the federal and state regulators will need to work in close coordination. Several of the 

recommendations in this report relate to the need for the federal and state safety regulators to 

work better together.

A more difficult challenge is how to keep safety issues from “falling through the cracks” when 

increasing reliance must be placed upon the operator to do the right thing. Most regulated 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 97

of 101
NTSB Pipeline Accident Report

137

industries are still on the learning curve on this issue, and it is an issue on which the NTSB will 

need to maintain close scrutiny in the future.

Economic Regulator. Most of the industries in which the NTSB investigates mishaps do not have 

an economic regulator. In this instance, however, the intrastate natural gas pipeline operator had 

both a safety regulator and an economic regulator. 

If a safety improvement requires an expenditure by an operator in an industry with no economic 

regulator, the decision is largely up to the operator. If the industry has an economic regulator, 

however, the economic regulator plays an important role in the operator’s expenditure decisions. 

Hence, if an expenditure is necessitated because the industry’s safety regulator requires the 

operator to do something, or because the NTSB recommends a safety improvement, query what 

result if the economic regulator does not agree to some or all of the expenditure. 

This situation was mentioned in our Sunshine Meeting, but it was not addressed in the report. If 

the operator decides to implement any of our recommendations that necessitate expenditures, the 

NTSB will need to pay close attention to how this situation plays out. For example, we will need 

to pay attention to the extent, if any, to which safety improvements are encouraged or 

discouraged by the economic regulator; and we will need to look at this issue in situations in 

which the economic regulator and the safety regulator are in the same agency, as they are in this 

instance, as well as situations in which they are in different agencies. Query what effect, if any, 

that organizational difference may have upon the willingness of the economic regulator to 

approve the resources needed for safety improvements.

While safety is and should be the NTSB’s only concern, both to satisfy our legislative mandate 

and to maximize the potential effectiveness of our recommendations, our analysis and 

recommendations in relation to regulated public utilities, such as intrastate natural gas pipeline 

companies, must be responsive to the reality that the resource allocation process involves more 

than just the operator. 

Dissent, In Part:

Our report recommends that the American Gas Association and the Interstate Natural Gas 

Association of America give us a progress report about their development and introduction of 

advanced inline inspection platforms for use in gas transmission pipelines. Although the need for 

better inline inspection methods for gas transmission lines was abundantly highlighted by this 

mishap, I am opposed to this recommendation because it only asks for a report, which does not 

improve transportation safety; and it could adversely affect the NTSB’s relationships with the 

transportation community.

I have these concerns for several reasons. First, the NTSB was created to determine the probable 

cause of mishaps and to make recommendations to recipients who can take actions that could 

help prevent those mishaps from occurring again. A recommendation to provide us a report is not 

the type of recommendation for which the NTSB was created because a recommendation to give 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 98

of 101
NTSB Pipeline Accident Report

138

us a report does not ask a recipient to take any actions that would help prevent a mishap from 

occurring again or that would otherwise improve safety.

Second, a recommendation to give us a report is satisfied by the report, irrespective of whether 

we like or agree with its content. Thus, a report that says, “We are not doing anything, and we do 

not intend to do anything, about that problem,” satisfies our recommendation to the same extent 

as a report that says, “We are aware of that problem, and we are taking steps to address it.” This 

undercuts the value of our recommendations because if we receive a report, we will have to 

classify the recommendation as “Closed Acceptable,” irrespective of what the report says, and 

despite the fact that a report does nothing to improve safety. Our pride in the fact that more than 

80% of our recommendations have been favorably responded to is meaningful only to the extent 

that our recommendations seek actions that can improve safety.

Third, the recommendation is being sent to two trade associations that have no legal duty or 

obligation to do what we are asking them to report about. To their credit, the trade associations 

are trying to address important issues, but they probably could not be held legally liable if they 

chose not to address them. Thus, rather than sending them a recommendation, we should be 

giving them kudos for going above and beyond by doing what they have no legal duty or 

obligation to do to improve transportation safety.

Fourth, our mission is to improve transportation safety, and one of the very important ways we 

pursue that mission is by encouraging the transportation community to take actions that could 

improve safety even without being required to do so, and even without a recommendation from 

us. Hence, we should be very pleased that these trade associations took the initiative to pursue 

these important measures because it was the right thing to do, rather than because they were 

forced or required to do so – and also that they took the initiative to report it to us – and we 

should actively encourage such behaviors.

Normally we send a recommendation because we are concerned that the recipient may not take 

the recommended actions without it, and the public has come to understand this as the reason we 

send recommendations. Thus, this recommendation sends the very inaccurate and misleading 

message to the public that these trade associations have been unwilling to pursue the very 

important measures about which we are asking them to report. Quite the contrary, the trade 

associations are already pursuing the measures, and they have already reported that to us, all on 

their own initiative. Expressing our appreciation for their proactive efforts by sending them a 

recommendation to report about what they have already started doing and have already been 

reporting to us is not, in my view, a way to encourage the transportation community to take 

proactive actions on their own initiative. Moreover, a telephone call or a meeting would have 

been a much more effective way for us to obtain a report from them, and a telephone call or a 

meeting would have caused less of a diversion of their resources from pursuing the measures we 

are asking them to report about.

We often recommend that recipients take certain actions, and then send us a report to let us know 

what they have done, but a recommendation solely to report to us does nothing to improve 

transportation safety. For these reasons, I am very much opposed to this recommendation, and I 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page 99

of 101
NTSB Pipeline Accident Report

139

hope that henceforth we will avoid sending recommendations that only ask a recipient to provide 

us a report. 

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page

100 of 101
NTSB Pipeline Accident Report

140

5. Appendix

Investigation and Hearing

The NTSB was notified of the San Bruno pipeline rupture accident about 8:00 p.m. on 

September 9, 2010, the day of the accident. A go-team consisting of eight NTSB staff members 

was launched early the next morning. Vice Chairman Christopher Hart was the Board Member 

on scene. Investigative groups were formed for pipeline operations, SCADA operations, integrity 

management, metallurgy, human performance, survival factors, fire, and meteorology. Parties to 

the investigation included the Pipeline and Hazardous Materials Safety Administration, the 

Pacific Gas and Electric Company, the California Public Utilities Commission, the city of 

San Bruno, the Engineers and Scientists of California—Local 20, and the International 

Brotherhood of Electrical Workers—Local 1245.

An en banc investigative hearing for this accident investigation was held at the NTSB 

Conference Center in Washington DC, on March 1–3, 2011. The transcript of the proceeding is 

available in the public docket.

Case: 19-30088 Doc# 2028-5 Filed: 05/15/19 Entered: 05/15/19 16:58:06 Page

101 of 101