On the evening of September 9, 2010, a 30-inch natural gas transmission line owned by Pacific Gas and Electric ruptured under a residential street in San Bruno, California, and the escaping gas ignited. The National Transportation Safety Board counted eight people dead. It also found that about 95 minutes passed before PG&E stopped the flow of gas, and the San Bruno Fire Department spent that time fighting a fire it had no means of shutting off. This piece uses the NTSB’s report to cover what the utility’s control room saw, how the segment was finally isolated, and what the fire department was and was not told.

Crestmoor, September 9, 2010: what the record establishes and what early reports got wrong

The rupture happened at about 6:11 p.m. Pacific daylight time on PG&E’s Line 132, a transmission line that carried gas up the San Francisco Peninsula and ran beneath the Crestmoor neighborhood of San Bruno. The reference record is the NTSB’s pipeline accident report, which the board adopted at a public meeting on August 30, 2011, along with the public docket that supports it. According to that report, the rupture released an estimated 47.6 million standard cubic feet of natural gas, eight people were killed, many others were injured, 38 homes were destroyed and 70 more were damaged. I was not in San Bruno that night, and nothing in this article comes from personal observation. All of it comes from the published record, and where I am characterizing that record rather than repeating a figure from it, I say so.

Early reporting got several things wrong, and the errors are worth naming because they are the kind that recur. Some of the first callers and some early news coverage described the event as an airplane crash, which it was not, although the guess is understandable for a neighborhood a few miles from San Francisco International Airport and a fireball visible from a long distance. Casualty counts in the first days were also lower than eight and changed as victims were identified. I am not going to repeat those early figures, because they never became the record, and eight is the number the NTSB published. Published injury counts vary from source to source, so anyone who needs an injury figure should take it from the NTSB report itself and attribute it there.

The board’s final report includes a probable cause statement and a list of contributing factors, and I am deliberately not restating either one here. This article is about what happened in the control room after the pipe failed and how that shaped what the fire department faced, and a paraphrase of the cause would add nothing to that subject while risking a summary that drifts from the board’s actual wording. Anyone who needs the probable cause for a class, a plan or a report should read it in the NTSB’s own words in the published report and cite it from there.

The Milpitas Terminal work: an abnormal control room before the rupture

The control room was already dealing with a problem before Line 132 failed. Earlier that afternoon, PG&E personnel were doing electrical work on the uninterruptible power supply at the company’s Milpitas Terminal, a facility at the southern end of the Peninsula system where several lines, Line 132 among them, received gas. As the NTSB describes it, the work disrupted power to parts of the terminal’s control equipment, the pressure controls received erroneous readings, and regulating valves that normally limit pressure into the outgoing lines opened fully. Pressure on the lines leaving Milpitas rose as a result. The report gives the specific pressures and how they compare with the line’s operating limits, and readers who need those numbers should take them from the report rather than from a summary.

PG&E’s Gas Control Center in San Francisco monitored the system through a supervisory control and data acquisition system, the SCADA system that brings remote readings and alarms back to operators’ consoles. Once the Milpitas power problem began, the center started receiving a stream of alarms from the terminal along with readings that could not be trusted, and staff worked the problem by telephone with technicians on site. The NTSB was critical of how the Milpitas work had been planned and controlled, and found that PG&E’s work clearance procedures did not adequately anticipate the loss of control and monitoring functions that the work caused.

For anyone who has worked a console, the significance is the condition the room was in when the rupture alarms arrived. Operators were already in abnormal operations, with a display carrying alarms they believed they understood and data they had reason to doubt. I am careful here, because I do not read the NTSB report as tying the 95-minute isolation time to the Milpitas alarms alone, and I will not put that claim in the board’s mouth. What the record does establish is that the low-pressure indications from the rupture came into a room whose attention was already committed to another abnormal event, which is a situation every dispatch center and every utility control room should plan for, since emergencies do not wait for the console to be quiet.

Low pressure on the screen: what SCADA could and could not tell the operators

After the pipe failed, pressure along Line 132 fell, and the SCADA system reported low pressures at monitoring points on the line. A pressure drop tells an operator that gas is leaving the system faster than it is entering, but it does not by itself say where. PG&E’s SCADA had no leak detection capability that would place a break at a particular location on the line, so operators had to infer location from the pattern of readings at stations miles apart, combined with whatever information arrived by telephone. The NTSB found that limitations in PG&E’s SCADA system caused delays in pinpointing the location of the break, and it recommended that PHMSA require operators to equip their SCADA systems with tools to help recognize and locate leaks.

The public docket includes transcripts of telephone calls made and received by the gas control center and other PG&E offices that evening. I am not going to quote from them, because a quotation pulled out of a confused telephone call misleads more often than it informs, and anyone who wants the wording should read the transcripts in full on the NTSB docket. In my reading, the calls show control room staff assembling the picture from several directions at once, with their own screens, calls from other PG&E personnel and reports of a large fire in San Bruno all arriving over the same period, and only gradually being connected into a conclusion that Line 132 had ruptured there.

The NTSB also addressed how the room was organized. The board found that PG&E lacked a detailed and comprehensive procedure for responding to a large-scale emergency such as a transmission line break, including a defined command structure that clearly assigned responsibility to control center staff, and it found that this shortcoming contributed to the delay in isolating the rupture. That finding should sound familiar to anyone trained in the Incident Command System, because it describes a room where several capable people were working the same problem without a clear statement of who was in charge of which part of it. Federal regulations administered by PHMSA now include control room management requirements for gas pipeline operators that cover subjects such as alarm management and operator roles, and anyone who needs the current text should read the regulations in Title 49 of the Code of Federal Regulations or ask PHMSA.

Ninety-five minutes: how the segment was finally isolated

The mainline valves on the stretch of Line 132 that had to be closed to isolate the rupture were manually operated. None of them could be closed remotely from the control center, and none would close automatically on a pressure drop. Stopping the gas therefore required PG&E to identify which valves bracketed the break, send personnel who could reach those valve sites, and have them close the valves by hand. The NTSB found that it took PG&E 95 minutes from the rupture to stop the flow of gas and isolate the rupture site, which puts the end of the gas flow at roughly 7:46 p.m. The report and docket give the times at which individual valves were closed, and anyone reconstructing the sequence should use those records rather than a retelling.

The board drew a direct line from the valve design to the duration. It found that the use of automatic shutoff valves or remote control valves would have significantly reduced the time it took to stop the gas and isolate the rupture. It also found that the time PG&E took to isolate the rupture contributed to the extent and severity of the property damage and increased the life-threatening risks to residents and emergency responders. Both points are findings in the published report rather than inferences of mine, and the full wording is in the findings section.

Closing valves does not end the fire the moment the last one turns, and responders should understand why. The gas already in the pipe between the closed valves still has to escape and burn, so a fire fed by an isolated segment continues for some time after isolation while that inventory empties, at a rate that depends on the pipe size, the pressure and the length of the isolated section. I am not going to put a number on that for San Bruno, but it means the fire department’s working estimate of when a gas-fed fire will diminish has to start from the isolation time and add the time it takes the isolated segment to empty. Remote or automatic valves shorten the first part of that estimate considerably, and nothing a valve does shortens the second part.

Who told the fire department: the notification findings

The San Bruno Fire Department learned about the rupture the way most fire departments learn about most incidents, through 911 calls and, for crews near enough, through what they could see and hear. PG&E’s gas control center knew within minutes that something was badly wrong with Line 132, but the NTSB found that the utility did not have procedures for its control room to notify the fire department or the 911 center directly, and that the fire department did not receive that information from the operator in the early part of the response. The utility’s knowledge of a pressure loss on a specific transmission line and the fire department’s knowledge of a fire at a specific street address were held in different buildings by people who had no established reason to call each other.

The report also looked at what local responders knew about the pipeline before the night it failed. The NTSB recommended that PHMSA issue guidance to pipeline operators to provide system-specific information to the emergency response agencies in the communities their pipelines pass through, covering details such as pipe diameter, operating pressure, the product carried and the potential impact radius. The fact that the board saw a need for that recommendation tells you something about how much the fire service in pipeline communities generally knew, although the precise finding about San Bruno’s prior knowledge should be read in the report itself rather than taken from my summary.

No radio failed in this part of the story, and that is why it belongs in a communications section. The gap lay between two organizations that each held half of the picture, and neither side had a written procedure or an established contact that would have prompted a call to the other. A 911 call-taker hearing reports of an explosion, a fire and possibly an airplane had no line into the utility’s control room, while the control room operator watching pressure drop on a screen had no procedure to call the public safety answering point serving San Bruno. Closing that gap takes a verified telephone number and a written step in each side’s procedures that someone has actually tested with a call, and the cost of doing that is small compared with what the gap cost that night.

A fire that cannot be shut off: what the delay meant on scene

Fire service doctrine for a pressure-fed gas fire is well established and appears in standard hazmat and fire officer training. You do not extinguish the flame at the point of release while gas is still flowing, because unburned gas accumulating in the area can find an ignition source and produce an explosion worse than the fire. Until the supply is controlled, the work consists of rescue, evacuation, protecting exposures from radiant heat and controlling the fires the gas fire has started in surrounding structures. Every minute before isolation is a minute spent in that defensive posture, and the length of that phase belongs entirely to the operator and its valves.

In San Bruno that phase lasted about 95 minutes by the NTSB’s count. During that time, homes in the surrounding blocks ignited and burned, residents had to be found and moved, and the fire department and the mutual aid companies that came in from around the region had to work the edges of a gas-fed column while the utility tried to locate and close the valves. I am not going to give apparatus counts or a timeline of the fire department’s operations, because those details should come from the NTSB report, the docket and the agencies’ own records rather than from me, and the published accounts do not all agree on the details.

The lesson I take from the fire side of San Bruno comes from my own hazmat training and not from a finding in the report. Every decision the incident commander makes in that defensive phase, from how far to extend the evacuation to how long crews can hold exposure lines to when to request more mutual aid, depends on an estimate of when the gas will stop, and the only organization that can produce that estimate is the operator. If the incident commander has no utility representative at the command post and no working telephone line into the operator’s control room, command is planning without the most important number on the incident. In San Bruno, the record shows that even the operator took more than an hour and a half to produce the answer by actually closing the valves.

Recommendations on valves, control rooms and calling 911

The NTSB issued recommendations to PG&E, to the California Public Utilities Commission, to PHMSA and to industry groups, and the complete list with recommendation numbers is in the report. Several bear directly on control rooms and the interface with emergency responders. The board recommended that PHMSA require automatic shutoff valves or remote control valves in high consequence areas and in more densely populated class locations, with spacing considered as well. It recommended that PHMSA require operators to equip SCADA systems with tools to assist in recognizing and pinpointing leaks. It also recommended that PHMSA require control room operators to notify the 911 call center for the affected communities immediately and directly when a possible pipeline rupture is indicated.

The recommendations to PG&E itself addressed, among other things, the work clearance process that failed at Milpitas and the need for a comprehensive emergency response procedure, including a defined command structure in the control center. An NTSB recommendation is not a regulation, and the board has no power to compel anyone to act on it. What happened next depended on Congress, PHMSA and the California Public Utilities Commission, and the NTSB tracks whether each recommendation was adopted, so the current status of any of them can be checked on the board’s website.

Congress responded with the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, which among other provisions directed requirements for automatic or remote-controlled shutoff valves, where technically, operationally and economically feasible, on newly constructed or replaced transmission pipeline segments. PHMSA later issued a rule in 2022 addressing valve installation and rupture detection and response for gas transmission and hazardous liquid lines. The scope of these requirements, meaning which pipe segments they cover, what counts as a qualifying valve and what compliance dates apply, is exactly the sort of detail I will not paraphrase from memory, so verify current requirements directly with PHMSA before you put anything about them in a plan.

What still depends on your relationship with the operator

New valve rules largely govern new and replaced pipe, which means a transmission line that has run through your jurisdiction for decades may still be isolated by manual valves today. Whether a particular segment near a particular neighborhood has been retrofitted is a question only the operator can answer, and the answer may differ from one segment to the next on the same line. A fire department that assumes San Bruno led to automatic valves everywhere is making a planning error, and the way to correct it is to ask.

Federal regulations require gas pipeline operators to maintain liaison with fire, police and other public officials, and operators run public awareness programs that include outreach to emergency responders. In practice the quality of that liaison varies, and it often takes the form of an annual meeting with a slide presentation and a handout. That meeting is the right place to ask specific questions about specific segments, including valve type, the operator’s estimate of isolation time, the 24-hour number for the operator’s control room and whether that control room will call your 911 center if it sees a possible rupture. Those questions are much easier to ask at a scheduled meeting than at a command post.

PHMSA runs the National Pipeline Mapping System, which offers a public map viewer showing the approximate locations of transmission pipelines, and a separate access path that gives government officials more detail. Check PHMSA’s website for current access rules, since they have changed over time. The mapping data shows where lines run, not what valves they have, and it does not substitute for the conversation with the operator, but it is a good way to find out which operators you should be talking to. Some fire departments discover through that map a transmission line they did not know crossed their district.

What to do at your agency

• The fire chief or emergency management director writes to the public liaison of each transmission pipeline operator in the jurisdiction asking which mainline valves isolate segments near populated areas, whether each is manual, remote or automatic, and what the operator’s estimated time to isolate each segment is, and files the written reply with the relevant preplans.
• The 911 center manager confirms that the CAD contact table or call directory holds a 24-hour control room number for every pipeline operator in the service area, calls each number outside business hours, and logs the date, the time and who answered.
• The dispatch supervisor adds one step to the existing gas leak and explosion protocol that tells the dispatcher to call the operator’s control room directly with the incident location, ask for isolation status and an estimated time, and record both in the CAD narrative.
• The training officer puts a 30-minute review of the San Bruno timeline, taken from the NTSB report, on the agenda of the next officer or hazmat team meeting, focused on defensive tactics for a gas-fed fire before isolation and on how to get a utility representative to the command post.
• The communications unit leader or radio administrator adds a line to the agency’s ICS-205 template and communications plan for the utility liaison, listing the operator’s control room number and the talkgroup or channel the utility representative will be given at the command post.
• The emergency management director checks the National Pipeline Mapping System for transmission lines in the jurisdiction, compares the results with the preplan maps the fire department actually uses, and gives the fire chief a written list of any lines or operators missing from those maps.

Takeaways

• The NTSB’s 2011 report records eight deaths from the San Bruno rupture, and early reports of a plane crash and early casualty counts were wrong and should not be repeated as the record.
• PG&E’s gas control center was already handling alarms and unreliable data from electrical work at the Milpitas Terminal when the low-pressure indications from the rupture arrived.
• The NTSB found that limitations in PG&E’s SCADA system delayed pinpointing the location of the break, because a pressure drop showed that gas was escaping but not where.
• Isolating Line 132 required personnel to close manual valves by hand, and the NTSB found that it took 95 minutes to stop the flow of gas.
• The board found that automatic or remote control valves would have significantly reduced the isolation time and that the delay increased the damage and the danger to residents and responders.
• The NTSB found that PG&E lacked procedures for its control room to notify the fire department or 911 directly, and it recommended that control room operators be required to call 911 immediately when a rupture is indicated.
• A pressure-fed gas fire stays in a defensive phase until the gas stops, so the operator’s isolation time is a fire department planning number that should be obtained in writing before an incident.
• Valve requirements adopted after San Bruno largely apply to new and replaced pipe, so verify current requirements with PHMSA and ask the operator what is actually installed in your jurisdiction.