After Oroville, Rancho LPG’s Risks Becomes More Visible
By Paul Rosenberg, Senior Editor
The near-collapse of the Oroville Dam’s containment structure on Feb. 13 sent almost 200,000 residents fleeing for their lives — despite more than 15 years of advanced warning from environmental organizations and local governments. These groups have unsuccessfully sought significant flood-control upgrades since 2001, including challenges to the dam’s relicensing process, which began in 2005.
The years of ongoing risk and regulatory neglect make for a chilling parallel to San Pedro’s situation with residents organizing to shut down Rancho LPG — and a frightening glimpse at what can happen if no action is taken. Both fit the “disaster roadmap,” developed from decades of studying more than 600 infrastructure system disasters, UC Berkeley risk management expert Bob Bea (nicknamed “the Master of Disaster”), told Random Lengths.
In both cases, the original designs did not match how the systems were used, operators failed to respond to new risk factor information, and regulators failed to reanalyze risks decades later when petitioned to do so — all human failures that make disasters more likely as systems age.
At 770 feet, the Oroville Dam is the tallest dam in the United States, almost 50 feet taller than the next tallest, Hoover Dam. The main spillway suffered severe erosion on Feb. 7. After several days of coping efforts, water flooded down the emergency spillway, rapidly eroding the hillside almost to the point of undermining the concrete wall atop the dam. Paving the emergency spillway was the key upgrade authorities refused to consider.
“Fortunately, nobody yet has died,” said Ron Stork, a senior policy advocate with Friends of the River, a leader in that upgrade effort. “But we were within minutes of that happening.”
Local residents have repeatedly sought a complete re-evaluation of Rancho’s risks as well, also without success.
Reactive Risk Management
The dependence on catastrophe — or possibly a near miss — before taking action is all too common, Bea said.
“In the United States, we seem to be stuck in a cycle I call reactive risk management,” Bea said. “We, in essence, wait until the system fails. At that point, we react or we fix it and then return back to our own normal lives.”
But even then, the systems are far from truly safe.
The American approach stands in stark contrast to the approach taken by The Netherlands, whose precarious situation — most of the country is below sea level — leaves no room for simply letting systems fail.
“There are three fundamental risk assessment approaches: Proactive (before major activities are performed); reactive (after major activities are performed); and interactive (during performance of major activities),” Bea said.
Following a disastrous national flood in 1956, the Dutch have devoted significant resources to both proactive and interactive measures; other countries in Europe and elsewhere have since followed their lead.
“The relicensing was a perfect opportunity to perform interactive risk assessment — to detect new challenges to the system, to analyze what had been detected, to determine what should be done to properly address the ‘new’ risks that had been detected, and then, implement corrective measures to reduce the risks to be ‘as low as reasonably practicable,’” Bea said.
Thus, flood control upgrades should have been implemented in conjunction with the dam’s relicensing for a 50-year period in 2007, especially given how much had changed since the dam opened in 1968. This included increased flood prospects due to global climate change (which were explicitly ignored) and the failure to build the Marysville Dam, whose presence was assumed in the dam’s original flood control planning. But water contractors, most notably the Metropolitan Water District of Southern California, opposed paving the emergency spillway for financial reasons. Community input was summarily brushed aside. Potential environmental impacts that should have been considered and mitigated were ignored.
In sharp contrast, much more has been spent — almost $1 billion — on an auxiliary spillway at the nearby Folsom Dam, a federal facility proactively upgraded in the wake of Hurricane Katrina. As of 2015, 678 of California’s 1,250 dams were deemed “high hazard” because of the consequences of their failure, according to Association of State Dam Safety officials.
A Better Grasp of Risk
Bea and his colleagues define risk as “the ‘combination’ of likelihoods and consequences,” which he said “helps keep attention on the uncertainties and on the management of the two key variables.”
Mapping likelihood on one axis and consequences (potential fatalities) on another creates a two-dimensional plane with regions of intolerable and tolerable risk. One can clearly compare different sorts and sizes of entities: levee systems, refineries, pipelines, dams, etc., all within a similar framework.
Even after systems have been corrected, Bea found that they generally were “sitting pretty close to the dividing line between the risks that are tolerable and the risks that are not tolerable.”
Very few American examples are truly safe — as one might expect, given that the latest “Infrastructure Scorecard” from American Society of Civil Engineers, issued in early March, gave American infrastructure an overall grade of D-plus, with a suggested $4.6 trillion investment needed by 2025 — compared to only $2.5 trillion in projected spending.
The shortfall is much larger than the $1 trillion within 10 years initially promised by Donald Trump. Moreover, from a safety standpoint, Trump’s promise to roll back regulations would actually leave Americans more at risk from infrastructure failures, as described in the “disaster roadmap.” It shows that potential infrastructure failures derive from four kinds of uncertainty producing unexpected results, Bea explained.
These uncertainties are: first, natural variability in weather, earthquakes, materials, etc.; second, uncertainty in models; third, uncertainty involving “human task performance and organizational task performance”; fourth, “uncertainty posed by our knowledge, how we acquired it, and how we use it.” His insight into the last two variables came from working with Dr. Ed Wenk Jr., the first science advisor to Congress in the 1960s before going to the White House.
“Engineers want to believe the planet is not inhabited,” Wenk once told Bea.
As a result, they tend to overlook these crucial sources of uncertainty.
Using this analysis, Bea and his colleagues came up with what they called the 80/80 rule: “80 percent of those uncertainties are human or organizational, 80 percent show up in the last cycle of the infrastructure systems,” which Bea termed “infrastructure geriatrics.”
They also learned that 60 percent of geriatric problems were baked into the construction process.
Rancho LPG and the Disaster Roadmap
Bea was first contacted about Rancho by homeowner activist Janet Gunter, after she saw him on 60 Minutes discussing his analysis of the Deepwater Horizon disaster. The group Gunter works with provided him with Rancho LPG’s own analysis.
“I looked at the results from their quantitative analyses and most of them included the first two types of uncertainty I talked about: natural and engineering ones,” Bea said. “They completely omitted the last two categories — those human things that are responsible for 80 percent of the failures.”
This obviously meant they severely underestimated the risks. Even so, when it came to the risks they did identify, “they were in the not acceptable region,” he said.
Connie Rutter, a retired oil industry consultant, added further detail. Rancho’s initial approval process was riddled with flaws and based on faulty assumptions that never panned out.
“First they said they didn’t need an EIR [environmental impact report], and then they went ahead and did one anyway,” Rutter said. “They didn’t put it out for general comment. Instead, they declared it final the same day they introduced it as the proposed EIR, which defeats the purpose of an EIR.”
It also utterly ignored the major kinds of risks that it posed.
“The EIR was all about animals in their burrows, being safe,” Rutter said.
But the rationale and assumptions behind it were equally unreal.
“It happened right at the time the gasoline shortage in the 70s, and also there is natural gas shortage,” Rutter said.
Natural gas and LPG are two different things, but there were also plans for a mixing plant in Wilmington, so that they could dilute it to prove that it can be burned in the same burners as natural gas. But that process would have been extremely dangerous, involving mixing liquified petroleum gas with oxygen, making it highly combustible, Rutter explained.
“By the time they got around to doing that, the public was informed enough and alarmed enough to stop it,” she said. “They were never able to permit that mixing plant, so it didn’t do what they had proposed to do, which was resolve the natural gas shortage.”
Thus, from the very beginning, Rancho LPG has been used for purposes other than what was intended in the original design along with inadequate consideration of the risks involved.
Likewise, the Environmental Protection Agency’s whole method of dealing with liquefied petroleum gas was fundamentally flawed. Rutter discovered that it was not based on science at all. There was an effort, following the 1984 Bhopal disaster, to provide the public with information about potential environmental threats to facilitate emergency response planning. But concerns with flammable substances were a legislative afterthought. Their properties didn’t inform the original legislation, but regulators could still have fixed this significantly. Instead, they failed to make important distinctions both between toxics materials and flammable ones and between vastly different types of flammable substances.
“They treated them all the same,” Rutter said.“For example, to qualify for whether or not you have to do something about it, they set the amount to 10,000 pounds…. So 10,000 pounds of LPG means you have to do something about it, 10,000 pounds of diesel means you have to do something about it, whereas they’re not at all comparable. You can leave diesel in an open ditch for six months and unless somebody really worked hard to get it to burn, it’s not going to be a danger. It will make the soil messy.”
But liquefied petroleum gas wouldn’t sit harmlessly for six months.
“It wouldn’t even hit the ground. It would begin to evaporate right away,” Rutter said. “I don’t know how long it would take for 10,000 pounds to evaporate, I would have to do that calculation, but I’m going to guess within an hour…. It expands [more than 200 times] … think of it as an explosion.”
Amazingly, when Rutter sought the records related to that rulemaking, the EPA official responsible, Craig Matthiessen, called to try to dissuade her. Why was she so concerned, he wanted to know?
“I said the first thing that would happen [was] it would vaporize and increase more than 200 times in volume,” Rutter said. “And, he said, ‘Oh what’s wrong with vapor?’ Or words to that effect, and I said that’s how a pressure cooker blows up, and he laughed at me and made fun of me, and acted as if I didn’t know. But that’s a general science thing in grade school…. It just points out [that] he was so uninformed about the real dangers. He didn’t even take the trouble to hide it.”
A regulator that ignorant of science was easy prey for industry lawyers. What seemed like sensible changes to him — some made in just the last week before the rule went into effect — had enormous real-world consequences. That’s why, for example, Rancho can claim a half-mile blast radius as the “worst case scenario” even though the laws of physics say it would be three miles.
With the Oroville Dam, regulators ignored the effects of climate change. But in Rancho’s case, they ignored basic physics. In both cases, the regulators themselves, by their carelessness, were a source of risk. Even worse, they’ve failed to correct that mistake, despite a review of the regulations under Executive Order 13650 from President Barack Obama, following the deadly explosion in West, Texas. Another chance at an interactive risk assessment was missed.
Locally, the same kind of mistake was made when the Port of Los Angeles failed to require a new EIR when Rancho changed its mode of operation after its pipeline was shut down. The switch to using rail cars created an entirely new mode of operation with an entirely new set of risks to be analyzed and considered. Multiple different state and local oversight agencies with oversight duties have similarly failed to protect the public despite repeated community appeals, following the same reactive risk management approach.
A closer look at the history of Oroville Dam shows strikingly similarities and a warning of where this pattern of continued regulatory neglect can lead.
Oroville Dam and the Disaster Roadmap
“If we take what we’ve learned about the [two failures of the] Oroville spillway, it fits exactly that roadmap,” Bea said. “Eighty percent tied up in this human task performance/organizational element, 80 percent shows up in the old phases of the Oroville Dam put in operation in 1969.”
The frantic stop-gap efforts in February, which narrowly averted disaster, were typical.
“That story has fit the roadmap to disaster precisely,” he said.
Friends of the River’s Ron Stork provided more detailed explanation. Spillway erosion had been cited as a potential hazard but was ignored by state regulators at the Department of Water Resources, or DWR, for several years, after which they actively opposed any flood control considerations during the relicensing of the dam by the Federal Energy Regulatory Commission, Stork explained. Subsequently, FERC refused to consider the issues in its environmental review. The emergency spillway was not even included in the dam’s flood control operations plan, which was based upon the projected construction of the never-built Marysville Dam.
“It seemed common sense to us,” Stork said. “And, it certainly has been demonstrated in reality in the last few weeks here in 2017.… We were within minutes of [people dying. This was] 10 years after the proceeding died down and we were thoroughly defeated, squashed like a bug.”
The efforts Stork was involved with were derailed based on claims that they were in the wrong venue.
“But they never offered a real venue nor have they provided the venue to resolve the issue,” he said.
This response is eerily similar to what residents in San Pedro have been told about Rancho. Another similarity was the legal filings divorced from scientific reality, a pattern repeated in a subsequent lawsuit filed by two local counties, Butte and Plumas. These counties challenged DWR’s environmental review of dam operations, based in part on work by DWR’s own scientists. Its lawyers argued that the scientists should be ignored. DWR prevailed in 2012; the case is still being appealed.
This is the flip side of the problem Wenk identified with engineers. Engineers want to believe the planet is not inhabited; lawyers and politicians want to believe the planet isn’t governed by scientific laws: they can easily be changed by clever arguments — or even not-so-clever ones. Together, these two kinds of myopia explain why the material side of things alone is not the major source of risk in the roadmap. Both were also seen in regulator responses to Rancho LPG.
“I don’t care how safe the fossil fuel industry claims their product is,” said Earthjustice attorney Adrian Martinez, who has worked on multiple similar incidents. “It’s flammable; it’s explosive in many instances; it’s dangerous and polluting; and it’s not safe. There’s going to be an accident …. They say it won’t happen here, until it does.”