PG&E San Bruno: how a 1956 record error killed eight people in 2010

Here is an uncomfortable observation from two decades in automotive and aerospace quality: the failure that killed eight people in San Bruno was not made in 2010. It was made twice. Once in 1956, when construction left an incompletely fused seam weld in the ground. Once in an office, when someone recorded the pipe as seamless. For fifty-four years, every quality decision built on that record aimed at a pipe that did not exist.

The situation

Post-war California could not lay gas main fast enough. Line 132 went into the ground in 1956 through open hill country, and the neighbourhood arrived afterwards: family homes built up to the easement, metres from thirty inches of pressurised transmission line. Pipe already in service when federal rules arrived in 1970 escaped mandatory hydrostatic testing; its maximum allowable operating pressure could stand on history and paperwork. PG&E's records, migrated from construction files to cards to databases, described this segment as seamless. Seamless pipe has no longitudinal seam welds to assess. One data field quietly exempted the line from an entire branch of failure analysis.

How it unfolded

At 6:11 pm on 9 September 2010 the seam let go. Escaping gas ignited into a firestorm that took the neighbourhood block by block. Eight residents died, 58 were injured, 38 homes destroyed — and isolating the line took nearly ninety-five minutes, because the valves were manual and someone had to walk to them.

NTSB metallurgy traced the rupture to a longitudinal seam weld made in 1956 with incomplete fusion: a defect present from the first day of service, loaded and unloaded for five decades. Because the record said seamless, the segment had never been pressure-validated as welded pipe, and no inspection strategy had ever targeted seam-weld cracking. Then the record system failed in public. PG&E could not reliably document what was in its own ground, and the 2016 trial showed a jury internal emails about managing that problem with regulators. Six felony counts followed — five for pipeline-safety violations, one for obstructing the NTSB itself.

Root-cause anatomy

The technical case is clean: a construction-era weld defect that nobody was looking for finally unzipped the pipe. Nothing went wrong in 2010. The failure was fully formed in 1956 and simply waited.

The organisational anatomy is the real case file. A record was accepted as reality for fifty-four years without one physical verification. Regulatory grandfathering let paperwork substitute for testing. Integrity management — risk ranking, inspection planning, pressure validation — ran on unverified inputs: sophisticated arithmetic on a fiction. When the fiction was challenged, the institutional reflex was to defend the record rather than dig up the pipe. That reflex is how an engineering failure acquires a felony count.

In automotive terms: an as-built nonconformity, undetected at incoming inspection for half a century, with the corrective-action loop never closed because nobody knew the nonconformity existed.

Where the quality system failed

Walk the case through the standard disciplines and it fails at every gate, in order.

The PFMEA line goes first, because everything downstream inherits it. Misidentify the failure mode and every control aims at nothing. PG&E's risk work carried no seam-weld threat, because the records promised there was no seam; occurrence and detection scores were computed for a pipe that did not exist. Then traceability, in the PPAP sense: the record must match the part. A retained record is not a verified one. Retention is not traceability. Audits checked records for completeness and internal consistency — documents reviewed against documents. Nobody asked the VDA 6.3 question: does the file match the item? Change control never registered that the easement had filled up with family homes; the line was still assessed as if it ran through open country. The CAPA gate never fired either: decades of records on other segments carried discrepancies, and not one triggered an extent-of-condition review.

A record nobody has verified against the part is not traceability. It is a rumour with a file number.

What would have caught it

None of this needed 2010 technology. It needed records treated as claims to be tested. Sample digs — excavate a statistical sample of legacy segments and verify seam type, wall thickness and weld condition against the file. A layout inspection, performed on the asset. Hydrostatic testing of pre-regulation pipe, validating maximum operating pressure with the pipe rather than the paperwork. In-line inspection with crack-sensitive tools chosen for seam welds, because tool selection follows failure mode and failure mode follows verified construction. And a standing rule that any record/part mismatch becomes a nonconformity with mandatory extent-of-condition, not a note in a file. None of it exotic. All of it cheaper than the alternative.

My take

San Bruno is not my case — I have never worked in gas transmission — but I have lived its smaller relatives. At SNOP I built the QA/QC function for a 900-plus-employee greenfield plant from bare halls, and was ruthless about one thing: as-built truth. Heat numbers tied to the part, welder identity tied to the weld. I did it because the plant would outlive everyone in it, including the people who remembered what the paperwork meant. At Witte Automotive I kept opening supplier files where the certificate and the parts in the bin disagreed. Same species of failure, a thousand times smaller. QRQC taught me the discipline the NTSB applied here: go to the part. The record is not the gemba.

The obstruction count is the one I feel in my bones, because de-escalating customer crises is work I have done. The rule is absolute — you never fight the investigation. Every withheld fact converts an engineering failure into a credibility failure, and credibility failures do not close with a corrective action.

The records said seamless; the pipe in the ground had seams. For fifty-four years PG&E validated the wrong pressure and inspected for the wrong failure mode. In 2010 eight people paid for it, and $1.6 billion plus six felony counts followed. Traceability is not administrative overhead. It is the control every other control stands on. Verify the record against the part, or one day the part will verify itself.