Case file
- What happened: On 8 November 2018 a worn steel suspension hook – a C-hook – fractured on a PG&E transmission tower in the Sierra foothills above Paradise, California. The energised conductor it carried separated, contacted the tower, and ignition material fell into dry vegetation, starting the Camp Fire.
- Scale: 85 people died in California's deadliest wildfire. Roughly 19,000 structures burned across about 153,000 acres, and the town of Paradise was largely destroyed.
- Root cause: CAL FIRE determined the hook, on hardware dating to 1921, caused the ignition. The component had no defined service life, no replacement interval, no inspection requirement. It was 97 years old.
- The bill: a 2020 guilty plea to 84 counts of involuntary manslaughter, a $13.5 billion settlement with fire victims, and Chapter 11 bankruptcy under roughly $30 billion of wildfire liabilities.
A C-hook is a commodity component: a curved length of steel whose whole job is to hang something heavy and stay quiet about it. I have argued over parts like this for twenty years, and never about strength on day one – the argument is always about who owns the part's fatigue life, and by what number. On that tower the answer was nobody. Had been nobody for 97 years. The fracture was not a surprise; it was a scheduling decision nobody made.
The situation
PG&E ran one of the largest overhead networks in the United States, and a meaningful share of its transmission hardware predated the Second World War. The 115 kV line through Butte County was one of these: steel towers, original fittings, a design frozen in 1921 and still carrying current nine decades later. Below it, everything had changed – drought-stressed vegetation, housing pushed to the wildland edge, and a liability doctrine under which California utilities answer for fires their equipment causes even without negligence. The asset was static. Its consequence environment was not.
How it unfolded
The hook failed shortly after 06:00 on a dry, windy autumn morning. Worn fitting fractures, conductor separates, contacts the tower, arcing drops hot material into the brush beneath. The fire reached Paradise faster than the town could evacuate; 85 people died, many of them elderly, many caught in cars on jammed escape roads. The physical failure took under a second. The damage accumulation behind it took 97 years. PG&E filed for Chapter 11 within three months and pleaded guilty in 2020 to 84 counts of involuntary manslaughter and one count of unlawfully causing a fire.
Root-cause anatomy
Technically, a textbook wear-out failure – the right-hand tail of the bathtub curve. The hook hung the insulator string off the tower body, and for 97 years it soaked up cyclic wind load, conductor galloping, vibration and corrosion at its bearing surfaces. Nobody can say when the crack began, because no inspection method existed that could have noticed, and nobody was tasked to look. On an uninspectable component, a crack is invisible by design. Not by luck.
Organisationally, the disease is familiar. The tower was the asset; the hook was furniture. Registers counted structures, not the load-bearing fittings inside them, so no component ever acquired an owner, a life limit or a budget line. Capital money follows visible replacements – lines, substations, towers – not commodity hardware hiding within them. Multiply one unowned fitting across a fleet of thousands of towers and you get a silent population of fatigue accumulators with a shared birthday. San Bruno in 2010 had already exposed how little PG&E could trust its own asset records. Same rot, electrical side.
Where the quality system failed
Strip away the utility context and this is a PFMEA line that was never written. A wear-out failure mode with no entry has no occurrence rating and no detection control. It does not score ten on detection – it scores nothing, and nothing is what gets budgeted. Detection is the column everyone underplays: an unscored failure mode is not an accepted risk. It is an invisible one.
Risk that nobody owns is never free. It is a deferred payment at compound interest.
Audit adequacy fails next, in the VDA 6.3 sense. Audits verify the inspection plan was executed as written; they almost never interrogate what the plan is structurally blind to, because findings are generated against the schedule – and what is not on the schedule does not exist. The CAPA gate failed too: PG&E equipment had been implicated in earlier deadly fires, yet the response produced vegetation programmes and settlements, not a fleet-wide component-life review. Change control was only half built – alert to engineering changes on the asset, blind to drift in its surroundings, where the entire consequence side of this risk lived.
What would have caught it
Nothing below is exotic. Ordinary component-life management, applied late.
- A component-level asset registry. Every load-bearing fitting – hooks, pins, clevises, insulator hardware – carries a defined service life or condition criterion, an owner, and a budget line attached to both.
- Destructive sampling of the aged population. Pull the worst hooks from the worst-corrosion, highest-load towers and break them in a lab – hardness, metallography, remaining life. Sacrifice samples of the worst units to certify the fleet. Against a $13.5 billion settlement, the test programme is a rounding error.
- Detection matched to the failure mode. Aerial patrol sees vegetation and broken strands; it will never see a fatigue crack inside a worn hook. A control that cannot physically find the failure mode is inspection theatre.
- An annual blind-spot audit question: name three failure modes your current methods cannot detect, and the cost of closing each gap. A short list means a wrong list.
In 8D terms, CAL FIRE delivered the D4 that PG&E's own system should have produced decades earlier – a clean, evidential root-cause finding that arrived only after the failure had run at full scale in the field. Nobody is ever promoted for replacing a hook that has not failed yet. Which is exactly why replacement must be scheduled, not chosen.
My take
This is a public case record, and I read it as an outsider – I have never worked for a utility. But I have spent two decades in automotive and aerospace inheriting this exact problem in metal form: presses whose counterbalance components had no load history, ground-support and test hardware older than the engineers using it, transfer tooling whose certificates vanished in a merger two owners back. Every plant I have taken over ran on at least one immortal component – immortal not by engineering, but because nobody had been forced to price its death.
The fights were financial, not technical. Forcing a replacement interval onto a fitting that had never failed meant budgeting for a failure that had not happened yet, and I lost that argument more often than I won it. Building a QA organisation from nothing for a 900-person greenfield plant taught me the contrast: there, every asset entered service with life data from day one. Starting clean is easy mode. The real test of a quality system is what it does with the hardware it did not choose.
What this means on your floor
- Every load-bearing component gets an owner, a life limit or inspection criterion, and a budget line. Permanent is not an engineering classification – it is an unpriced liability.
- Audit the blindness, not just the compliance. Ask what your inspection plan cannot detect by the physics of its method.
- Treat aged populations statistically: destroy samples of the worst units in a lab before the field destroys all of them for you.
- Context drift is a change. When load, environment or consequence moves around a frozen design, the risk analysis gets re-run – the asset does not get another 97 years of benefit of the doubt.
The C-hook did not outlive its inspection system. It was never inside one. A wear-out failure mode that no PFMEA recorded, no audit questioned and no budget owned – a scheduling decision deferred for 97 years until 85 people, a town and a corporation paid the invoice. Cost of poor quality at this scale is not scrap and rework; it is manslaughter counts. Somewhere on your floor is a component just like that hook. The only question worth asking today is which one.
