Podcast: San Bruno Pipeline Explosion Lessons Learned

Trish: Yeah. Look, this was an incredibly tragic incident because it occurred in the middle of a residential neighborhood. And that's why residents were killed. It actually occurred only about two miles or so from San Francisco international airport as well. So when this massive explosion occurred, there was all sorts of concern. No one knew what had happened and wondered whether there was something associated with the airport or an aircraft that had potentially resulted in this incident that occurred. But the details of the incident are quite interesting. There was a maintenance activity going on at one of the control rooms on this major gas pipeline system. And they were changing over some uninterruptable power supplies or UPSs that power, the pressure controllers on the pipelines. And this work did not go to plan.

And there was an incident where they increased the pressure into the pipeline and they actually lost the ability to track and record that pressure at the time. Now, having said that technically under the way the pipeline was being operated, they hadn't actually exceeded their maximum allowable operating pressure (MAOP). The MAOP was stated to be about 400 KPA and they had actually got to about 396 KPA. Um, I might have those units wrong. It might be, PSI, sorry, but the numbers are correct. 400, about 396. So there were close to the MAOP but they were not at it at the time that the rupture occurred. The rupture did occur. The pipeline released a massive amount of gas very, very quickly that resulted in the explosion found emission source.

Traci: How does that happen? When you say that it didn't meet the level, it didn't meet the 400. Is there a little give and take in there where, you know, it can go to 425 and the, and the 396 would, would be okay, even if they went over, do you know where I'm going with that?

Trish: I do. So the challenge that happened here is this was a very old pipeline that had been installed decades earlier. And when it had been installed, it was installed under a certain set of rules. And those rules were that the hydro test wasn't required for particular pipelines. Because the pipeline hadn't been hydro tested, it, hadn't actually established a maximum allowable operating pressure in the documentation. So what they do is they do a hydro test, 1.5 times, your AP, and that will define what your MAOP is. So you're designed to be able to hold one and a half times your pressure that you're likely to see over time, the regulations changed. And what happened is in 70s they introduced in California grandfather law that allowed existing pipelines, MAOP to be the highest actual pressure to which the pipeline had been exposed to prior to July 1970. At that point in time, they said, okay, well, the maximum that pipeline's been exposed to is 400. That's now our AOP. So that's the sign that went behind creating that number for them in the first place. And then further on in 2004, the California government made another change. The change was that for existing pipelines, like the one that had that 400 MAOP it could operate at its maximum allowable operating pressure could be the highest operating pressure it has seen in the previous five years.

So what that led the organization to do is to maintain the 400 MAOP. What they did was they periodically every five years put pressure in the pipeline and spiked it up to hit 400 and said, okay, we've now hit 400 in the last five years that remains our MAOP. Now you need to be aware that they weren't pressure testing the pipeline, that wasn't a hydrostatic test. They weren't pumping up and leaving it there for extended periods of time and monitoring for leakage. They were spiking the pipeline, which meant that down the length of the pipeline, it probably wasn't at 400 pressure. It was a lot less because of frictional losses through the pipeline, as the product moved through the pipe. So they effectively had set themselves an artificial maximum pressure that the pipeline was clearly unable to handle because it's 396, it ruptured.

Traci: Let's talk a little bit about the grandfathering and testing requirements. It seems like that's where, where the fault lies a little bit.

Trish: That's partly where it lies. There's a whole range of different issues that were uncovered in this investigation. There was maintenance activity that wasn't being done as necessary. There was a lack of understanding of what the nature of the pipe actually was. They assumed they had one sort of pipe in the ground. It was a completely different sort of pipe that had different needs from a maintenance and reliability point of view. And then they had the, this grandfathering issue around the maximum pressure that they were operating to grandfathering assumes that when something was built, if it was built to the standard appropriate at the time, it's okay. And it's okay today, even if standards have changed now effectively, what the grandfathering clause allows us to do is to not have to go and reinvest in old equipment, because we would now deem it as unsafe and would never build it that way.

But think about that for a moment. It’s a get out of jail free card to doing some investment and upgrade that you need to do on something that we actually now know is unsafe because we have new standards that tell us it's unsafe, but we're going to stay with it because it was okay when it was built. That's like saying, you know, it would be completely safe to not worry about driving a T Model Ford up and down the highways as fast as you could with all the other cars around today and not worry about seat belts, not worry about ABS, not worry about airbags, because it was safe then, but it's not safe today. Um, you know, we drive them under certain conditions in certain rallies and they can still go on the road in certain conditions, but we don't drive them as our everyday vehicle.

They're not safe to drive as an everyday vehicle. So we need to be very careful about just falling into this trap of, I don't need to invest. It was okay. It's grandfathered. We're fine. We're actually not fine. You have a hazard that is just waiting there to come and, and bite you one day because you haven't implemented the safety requirements. It's actually one of the reasons why I personally do really like the, the regulatory regimes that make you work to as far as is reasonably practicable or so far as is reasonably practicable. So you might hear the term alarm at times, and that's because a lab recognizes that standards change.

And if it's unsafe today, then you need to do something about it. You can't just say, but it was safe 30, 40, 50 years ago when we built it, but we're not 30, 40, 50 years ago where today, and we would not accept that today. So why do we continue to accept it? It's just on the basis of the financial aspect, but again, remember good process safety, good implementation of reliability systems means we don't damage rupture, blow things up as much either. So investing in process safety can not only make you money in more reliability. It will also save you money when an incident, as tragic as this one occurs, not only the loss of life, and there were substantial damages paid as a result of that, but just the, the complete distraction of an entire neighborhood for the damage perspective, the pipeline repair, the reputational damage associated with it. There’s so much cost that goes into that. That mistake of grandfathering means we, we can save a little bit of money grandfathering. Sometimes it's going to cost you a lot of money too.

Traci: Indeed. Indeed. It, it begs the question though. How do you manage maintenance on older equipment like this?

Trish: So one of the keys is you actually need to be doing valid inspections and you need to, first of all, know what equipment your pipeline is. I actually said they didn't know what the material of the pipeline was. They, their drawings and all their documentation told them that they had seamless pipe underground, but it wasn't seamless pipe. It was welded pipe. Now the maintenance regime on welded pipe is very different to seamless pipe. Uh, why the documentation was so wrong? I don't know, but you need to do physical inspections at times. And sometimes that will mean that you actually need to go and dig up a small little section of the pipe and physically lay eyes on it. And look at it. Now, a physical inspection would've told you what was not seamless pipe, because it's pretty obvious to see the weld in a welded pipe.

You know, if you see seamless, you see welded, you can really pick the difference between the two of them just by looking at them. You don't need a sophisticated test for it, very obvious. There will be some instances where you have to do periodic excavation and inspection of sections of the pipe, and that should be done on a risk basis of where are you likely to have potential issues -- cause you are looking for corrosion on the outside there as well, particular issues of corrosion, but it will also verify your material. You should also be doing non-destructive testing and inspection. So running intelligent pigs through your pipe to actually do the scanning and understand, do you have weak points? And then you can actually go and investigate the particular area where you find the weak points, dig up that area.

That's often how you decide where you're going to physically look intelligent. Pigging will also tell you if you have welded pipes because the weld is very, very obvious in the intelligent pigging records. It's around making sure you do the right levels of inspection and understand the approach you take. When you look at your maintenance regime. So understand what causes the most of the incidents that you see with your, your equipment. If you are worried about if you're focusing on dealing with vehicle strikes, but you are seriously, there's no possibility of a vehicle strike in your equipment, then why are you focused on vehicle strikes? It was a little bit like this. Within this organization, they were focused on certain types of failures that their data actually didn't say they were having, but they made this overall assumption of an algorithm to look at what parts of the pipe they'd look at and, and look at managing their overall risk on faulty assumptions. So especially when you've got a long history of equipment, what is the history of your faults? What are you seeing? What's causing your incidents and that's at least somewhere to start looking.

Traci: So is it safe to say that the trust, but verify at any time you, you look at information that you have in this case, the blueprints do you need to assume that it's incomplete or incorrect and go and verify or it? Can you trust anything?

Trish: Look, I think that's one of the challenges. The number of times I've seen projects or worked in plants where we go to enormous efforts to get the design, right? We never go back and make the drawings, right? Because inevitably the facility changes from the design on paper to what is physically built. You have to do that verification of as building your facility and we need to normalize paying for the, as building of our drawings at the end of our projects, that's always the we've run out of money. Oh, it doesn't matter. Look, we'll update it for the next HAZOP when it comes time of the next PHA and we never do. We get to the PHA and we PHA and incorrect set of drawings and then wonder why an incident happens. So we actually have to normalize, paying to as-built our plan.

We need to physically know what's there. This is not the first example of an incident occurring because an assumption was made on a piece of equipment that was hidden in some way. It couldn't, it wasn't, it's not visible in this instance, it was underground. In other instances, behind cladding where assumptions were made because of what the drawing said, but the drawings were never as built. And then an incident happened, Grangemouth refinery in the UK is an example. There was an unknown dead leg that they didn't, they didn't understand how it was constructed under its lagging. And eventually it failed resulting in a leaking explosion, a lack of ASBI of drawings. And it wasn't physically insight because the way it was clouded. So these incidents happen. We need to really make sure that we do verify our drawings. When you do come up to do a PHA, you should do a quick verification check to make sure your drawings are actually correct.

Go do a line walk of your P & IDs and make sure they're actually correct. Are the instruments on your P & IDs actually in the field and are they set at those set points? Some of those key things are really quite important. You know, what is the material of, of construction that we are looking at? Is it the right sort? Is, does the drawing tell us the right thing? Am I looking for a 300 pound pipe that I'm actually finding a 150 pound?

Because my drawing says it's 300, but the one I'm looking at sure has 150 pound FLAS on it, not 300 pound. And these are the things that experienced engineers can walk around and just recognize that's a 150 that the 300, we know what they look like. So go walk around with an experienced person, learn what these things should look like and make sure you do your verification checks. Make sure the information going into your assumptions is correct. Otherwise rubbish in rubbish out. It's really that simple. If you put false information into your assumptions, do not expect to get a decent answer out. That's going to help you with anything.

Traci: Good advice there. You alluded to this, but I want to ask the question anyhow, should current standards always trump past guidance?

Trish: I think you need to review it and you need to make a conscious decision. So I'm not going to say always, but you need to review it and you need to understand the significance of what you're doing. So in this instance, the deliberate spiking of a pipeline every five years was almost, I would suggest a way to game the system rather than say, we actually really only operate to 250. So let's have a MAOP of 250 that's they didn't do that. They said, no, no, we're going to take it to 400 every five years. So we maintain 400. That's actually working the system in my mind. I don't think that is in the spirit of grandfathering. Technically it was in the letter of grandfathering, but not in the spirit of grandfathering. We need to understand what the ramifications are that we're looking at. And as I said, you can still take your T Model Ford out for a drive on a Sunday as part of a car rally, but you don't drive it every day of the week down the freeway. So it's allowed on the road under certain circumstances. So grandfathering is not always bad, but we need to be assessing, understanding and making conscious decisions with it.

Traci: Well, the Model T analogy is perfect. Perfect for this. Do you have anything you want to add that this topic deserves to hear?

Trish: Go and look at what your equipment is and make sure your drawings are up to date. Understand whether the information you've got is accurate because also in an emergency, you're probably going to look at those drawings. You're going to want them to be accurate, because you need to make decisions off them. So my one piece of advice for people is take a step outside, take the drawing with you, go for a line, walk, see what's there. And if that means you have to do periodic inspection underground or under insulation, get that done to take a look at what you've physically got in your facilities. Because if you don’t know what you've got, you can't maintain it correctly. If you're not maintaining it correctly, you are going to have an incident.

A really useful reference to understand a little bit more about this particular incident and other incidents like this is a book called “Nightmare Pipeline Failures: Fantasy planning, black swans, and integrity management,” by Jan Hayes and Andrew Hopkins.

Traci: Well, Trish, as always, you give us sage advice on how to make our lives and our work lives safer. And I appreciate that unfortunate events happen all over the world and we will be here to discuss and learn from them, subscribe to this free podcast. So you can stay on top of best practices on behalf of Trish, I'm Traci. And this is Process Safety with Trish & Traci

Trish: Stay safe.

Want to be the first to know? Subscribe and listen to Process Safety With Trish & Traci on these platforms

Trish Kerin, director, IChemE Safety Centre, Institution of Chemical Engineers, spent several years working in design, project management, operational, safety and executive roles for the oil, gas and chemical industries. She currently sits on the board of the Australian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) and is a member of the Mary Kay O'Connor Process Safety Center steering committee. You can email her at [email protected].