Merrimack Valley: When Engineering Review Failed

The Merrimack Valley gas disaster was a control-management failure in which an engineering project connected a high-pressure source to a low-pressure distribution network, while review, sequencing, and responsibility were too weak to prevent the wrong system state.

On September 13, 2018, a series of structure fires and explosions struck Lawrence, Andover, and North Andover, Massachusetts. The National Transportation Safety Board found that high-pressure natural gas entered a low-pressure distribution system operated by Columbia Gas of Massachusetts. One teenager died, many people were injured, and hundreds of buildings were damaged or destroyed.

The case matters to safety leaders because the visible event began after a construction project had already changed the system. The investigation therefore needs to look beyond the final pressure surge. It needs to follow the decisions that made the surge possible, the reviews that should have caught the design condition, and the emergency actions that limited the consequences after the network became unsafe.

Initial scenario: A routine replacement changed the pressure boundary

The incident began during a project to replace cast-iron gas mains with plastic pipe. The work was not inherently unusual, yet the design required the new pipe to be connected to an existing distribution network whose regulators and sensing arrangements were built around a different pressure configuration.

The NTSB report states that the project led to the abandonment of a cast-iron main without adequately accounting for the consequences of losing the pressure-sensing path associated with that main. Once the sensing relationship changed, the regulator system no longer had the information needed to maintain the intended downstream pressure.

This is the first lesson in the case. A modification can preserve the visible function of an asset while changing the conditions that make its safeguards work. The pipe still carried gas, but the control architecture had changed. That difference is why a project review must test interfaces, not just the component being replaced.

The incident also exposes why management of change and field verification should not be treated as paperwork that follows design approval. They are decision gates for proving that the operating system still behaves as intended after the physical change.

Decision: The project was approved without a complete system picture

The NTSB identified weak engineering management as the probable cause. Columbia Gas did not adequately plan, review, sequence, or oversee the project, and the engineering process did not ensure that the design change would preserve pressure control across the affected network.

That finding is more precise than saying that someone made a mistake. The decisive failure was the absence of a reliable review path in which the design owner, construction team, operations group, and qualified engineer could challenge the same system model before the change entered service.

A project can have drawings, approvals, and contractor supervision while still lacking control ownership. The test is whether someone can explain which signal keeps the pressure regulator stable, what happens when that signal is removed, who authorizes the alternative configuration, and what evidence confirms that the new arrangement is safe before gas flows through it.

ISO 45001 specifies a management-system approach to hazards, operational controls, and change, but certification cannot substitute for technical review. The standard becomes useful only when leaders connect its requirements to the physical failure path that a project can create.

Execution: A lost sensing path became an overpressure event

After the cast-iron main was abandoned, pressure sensors that were connected to that main no longer represented the downstream network correctly. The regulator stations responded to misleading conditions, allowing high-pressure gas to enter a system designed for lower pressure.

The consequence was not limited to one regulator. Gas entered homes and businesses through the distribution network, overloaded appliances, and created conditions for fires and explosions. The sequence moved quickly because a pressure-control problem became a community-wide loss of containment pathway.

The barrier analysis approach used in incident investigation helps separate this sequence into prevention layers. Design review should have challenged the altered sensing path. Construction verification should have confirmed the installed configuration. Operations should have had a credible method to identify abnormal pressure. Emergency coordination should have supported rapid isolation and evacuation when the first signs appeared.

Each layer had a different job. Treating the whole network as one control hides the point at which information, authority, and physical protection stopped working together.

Measured result: One unsafe system state produced regional consequences

The NTSB documented one fatality, injuries, widespread fires, and damage across three Massachusetts communities. The Board also recorded the evacuation of thousands of residents and the loss of natural-gas service to a large customer population while the system was made safe.

These figures do not describe only the size of the accident. They show how a low-visibility engineering decision can produce a high-consequence event when a utility network serves homes, businesses, roads, and emergency services at the same time.

The measured result is therefore not just the number of damaged structures. It is the distance between the original project decision and the people exposed to its consequences. A review that stops at the worksite misses the system boundary that the public experiences.

The NTSB’s final report, published in 2019, is the source for the causal finding and the reported consequences. The agency’s account should remain the reference point for any organization using Merrimack Valley as a learning case rather than as a dramatic anecdote.

What failed in the management system

The case did not reveal a single missing rule. It revealed several management conditions that allowed a technically significant change to pass through ordinary project routines without a complete challenge of the new risk state.

First, engineering review was too narrow because it treated the abandoned main as a construction detail instead of a sensing dependency. Second, project sequencing did not preserve a safe configuration while the work changed the network. Third, responsibility was distributed across design, construction, and operations without one accountable owner for the pressure-control function.

The distinction resembles the difference between a document that records compliance and a control that changes exposure. Andreza Araujo makes that distinction central to The Illusion of Compliance, because a signed process can still leave the underlying hazard untouched when leaders do not test what the process is supposed to protect.

HSE describes major-accident control as a matter of preventing major accidents and limiting their consequences. Merrimack Valley demonstrates why prevention and consequence control must be reviewed together. Once the pressure boundary was lost, response speed mattered, but it could not restore the original preventive barrier.

Generalizable lessons from Merrimack Valley

The first lesson is to review dependencies before approving a modification. Ask which measurements, signals, utilities, interlocks, and assumptions make the existing control work, then identify what the project removes or changes.

The second lesson is to assign one accountable owner to the safety function, even when several departments execute the work. Shared participation is valuable, but shared accountability can become a gap when no one has authority to stop the change.

The third lesson is to verify the installed state in the field. A drawing review cannot prove that valves, sensors, regulators, tags, and connections match the design. The field check must test the condition that the safeguard needs, not merely confirm that components are present.

The fourth lesson is to rehearse the abnormal condition before commissioning. If high pressure enters a low-pressure system, the organization should already know which signal identifies it, who can isolate it, how residents or workers receive warnings, and which emergency services own each action.

The fifth lesson is to treat public exposure as part of the risk assessment. The affected population may be far larger than the project team, and the public does not see the permits, drawings, or internal approvals that leaders may use to reassure themselves.

What to apply in your operation

Start with the next project that changes a physical or digital dependency in a safety-critical system. Do not begin by asking whether the paperwork is complete. Begin by mapping the safety function that must remain available while the change is designed, installed, tested, and handed back to operations.

Then require four pieces of evidence before startup. The first is a dependency map showing the sensors, barriers, and operating assumptions that the design relies on. The second is a named decision owner who can reject the configuration. The third is a field verification record that tests the installed state. The fourth is an abnormal-condition drill that demonstrates detection, isolation, communication, and recovery.

Use the four proofs of a dependable critical control to structure the review. A control must have a defined function, a credible failure response, evidence of availability, and an owner who can act when the evidence is weak.

ILO frames occupational safety as a responsibility that requires prevention, cooperation, and effective protection. For leaders, that means asking whether the organization has made the safe state easier to maintain than the unsafe one, especially when a project crosses technical and operational boundaries.

The Merrimack Valley case should not be reduced to a warning about gas regulation. Its broader message is that engineering change becomes a safety decision when it alters the information or physical conditions on which a critical control depends. The investigation is complete only when the organization can show how its review process will prevent the same type of system-state failure from returning.

For more practical guidance on incident investigation, safety leadership, and control ownership, visit Andreza Araujo.