Aliso Canyon made well integrity and methane monitoring a gas-storage accountability test

Summary

• The sustained release from Standard Sesnon 25 was ultimately traced by an independent root-cause investigation to rupture of the well's outer seven-inch casing after external microbial corrosion where groundwater contacted the steel. That technical finding does not by itself decide household-specific exposure, medical causation, criminal responsibility, civil damages or which costs belong to shareholders rather than customers.
• The deeper governance failure was not age alone. SS-25 had been converted from oil production to gas storage, earlier casing failures across the field had not produced a systematic failure-analysis programme, integrity surveillance did not adequately address external corrosion, continuous pressure evidence was limited, and the well depended on a casing configuration that permitted loss of one barrier to become a surface release. Seven unsuccessful top-kill attempts extended the emergency until a relief well intercepted SS-25.
• Credible repair therefore requires linked but separate proof: well-level barrier and corrosion records; continuous, independently reviewable leak signals; practiced notification and well-control plans; exposure-specific community monitoring; uncertainty-bounded methane measurement; transparent relocation and health-study governance; regulator-specific enforcement; protected ratepayers; and public evidence that later state and federal rules are implemented, not merely published.

The Aliso Canyon gas-storage leak began as a subsurface mechanical failure and became four accountability crises at once. For engineers, the central question was why an ageing storage well lost containment and why the release could not be controlled promptly. For nearby residents, it was what they had breathed or encountered, why odors and symptoms persisted, and what evidence justified relocation and return. For climate authorities, it was how to quantify an unusually large, changing methane plume.

For utility regulators and courts, it was who should pay, what conduct had been admitted or proved, and what operating restrictions could protect people without creating a different reliability failure. Those questions share a chronology, but they do not share one standard of proof.

The event began on 23 October 2015, when Southern California Gas Company detected a leak at Standard Sesnon 25, known as SS-25, at its Aliso Canyon underground storage field north of Los Angeles. The operator began a surface top-kill operation the following day. The release continued through repeated control attempts, while odor reports and acute symptoms drove a growing community response. A relief well eventually intercepted SS-25 at depth, allowing heavy drilling mud and cement to stop reservoir flow in February 2016. The well was then confirmed sealed and later plugged and abandoned.

That sequence can be described simply, but accountability cannot. A storage field is a system of reservoir pressure, converted and purpose-built wells, casing and tubing barriers, valves, compressors, instruments, maintenance history, people and regulatory authorities. A release may become visible at one wellhead while its enabling conditions accumulated in records dispersed across decades. The institution responsible for the asset must therefore do more than react to a detectable plume. It must continually prove that barrier condition, known failure mechanisms, operating pressure, leak signals and emergency capability fit together.

An old well became critical infrastructure

SS-25 began as an oil well and was later converted for gas-storage service. Conversion matters because a storage well does not experience only the operating history imagined at its original construction. Injection and withdrawal cycles, reservoir pressure, ageing steel, cement condition, groundwater contact and prior interventions create a changing integrity problem. A well that remains available is not necessarily a well whose barriers have been demonstrated fit for every current failure mode. Age is a risk factor and a prompt for evidence; it is not itself a diagnosis.

The independent investigation commissioned by the California Public Utilities Commission and the state's oil-and-gas regulator reconstructed the failure using recovered materials, well records, logging, laboratory examination and modelling. Its controlling technical conclusion was that the direct cause of the leak was rupture of the outer seven-inch casing due to external microbial corrosion where the casing contacted groundwater. The investigation also identified an axial split, corrosion pits, significant metal loss and a broader management context in which earlier casing leaks did not generate detailed follow-up failure investigations.

The independent SS-25 root-cause report is the primary engineering record; it is not a judgment about an individual resident's illness or a verdict on every legal allegation.

The public regulator's synthesis states that more than 60 casing leaks had occurred at Aliso Canyon from the 1970s to the 2015 incident without the detailed failure analyses that could have revealed patterns. It also records the absence of a well-integrity risk assessment focused on this class of hazard, systematic external-corrosion protection and real-time continuous pressure monitoring. CalGEM's incident and root-cause record ties those findings to the regulator's later orders and rules.

The number of prior leaks is important because it changes the governance question from whether one rupture was foreseeable in its exact location to whether repeated loss-of-integrity events were being converted into organisational learning.

A mature failure-management system treats each casing leak, parted casing, unexplained pressure change and anomalous log as part of a population. It records the component, depth, environment, damage mechanism, consequence and corrective action; tests whether similar wells share the exposure; and updates inspection intervals and control plans. The purpose is not to claim that every earlier leak predicted SS-25 precisely. It is to prevent a company from resetting institutional memory after each repair. Without structured failure analysis, a field can accumulate events but not knowledge.

The barrier configuration was equally important. Gas travelled through the failed casing and reached the surface. The root-cause record has often been summarized as a missing subsurface safety valve or a single-point-of-failure problem. The more exact lesson is that barrier independence must be demonstrated for the relevant leak path and operating mode. A valve protects only within its design envelope and placement; tubing, packer, casing and cement each require proof of condition and isolation.

Governance should identify every credible path from reservoir to atmosphere, the controls on that path, how each control is tested and what happens when one control is unavailable.

The CPUC's operational history describes diagnostic work that found metal-loss and temperature or noise anomalies and records how the independent investigation was conducted outside the operator's control. The commission's technical chronology is useful for separating observation, regulator direction and final root-cause findings. Diagnostic results obtained after the release reveal the failed condition; they do not prove that the same tools, intervals or interpretive thresholds were required or used before it.

Detection and notification are different controls

Loss of containment becomes a public emergency through stages. Instruments or people first detect an anomaly. Someone classifies it. The operator mobilizes well control and notifies agencies. Air and meteorological evidence is gathered. Residents receive instructions and assistance. These are separate control gates. A strong detector cannot compensate for delayed classification, and prompt agency notification cannot compensate for a monitoring system that did not identify the release early.

At Aliso Canyon, the prolonged event exposed the weakness of relying on episodic checks or odor complaints as a principal signal. Storage-well assurance needs continuous pressure, flow and annular evidence with thresholds derived from well configuration. It also needs field-level methane detection capable of recognizing a plume, locating its likely source and preserving data. Alerts must travel to people who have authority to isolate equipment, mobilize specialists, notify regulators and warn the community.

Data should be timestamped and retained so that investigators can distinguish when the physical release began, when the operator detected it, when it was classified and when each authority was told.

The difference became legally concrete. Southern California Gas Company later pleaded no contest to one misdemeanor count of failing to immediately report the leak to the California Office of Emergency Services and the local Certified Unified Program Agency. The disposition included financial terms and requirements for infrared methane monitoring, well pressure monitoring, independent certification and staffing. The Los Angeles County District Attorney's plea announcement establishes the corporate plea and its terms.

It should not be enlarged into a criminal admission of the engineering root cause, every alleged reporting failure, public-health causation or civil damages.

Notification architecture should now be testable. A well-control plan should state who receives which signal, the clock for internal and statutory notices, what information may remain provisional, and who updates residents. Exercises should include incomplete or conflicting data, because real emergencies rarely begin with a confirmed cause and stable estimate. The audit evidence is not a training attendance sheet. It is the timed record of drills, missed handoffs, corrective actions and proof that after-hours staffing can perform the same functions as daytime teams.

Seven failed top kills and the relief-well decision

SoCalGas and its contractors attempted seven top kills between 24 October and 22 December 2015. In a top kill, dense fluids are pumped from the wellhead in an effort to overcome upward gas flow and regain control. Each failure created new information about flow, well condition and the limits of surface access. Yet repeated attempts also consumed time and carried operational risk. Accountability therefore requires a decision rule for when to continue, modify or abandon a surface strategy and when to commit to a relief well.

On 4 December, with regulator approval, work began on relief well Porter 39A. The relief well had to be steered to intersect SS-25 thousands of feet below ground. Once it reached the target interval, heavy mud followed by cement was pumped into SS-25. The intervention stopped reservoir flow; subsequent testing was used to determine whether the seal held. The Department of Conservation's sealing notice records that regulators supervised a battery of post-cementing tests and confirmed sealing on 18 February 2016.

That confirmation date must be distinguished from the earlier temporary control of flow, the cementing sequence and the later plugging and abandonment of the well.

The response raises a readiness question larger than SS-25. A storage operator should maintain current subsurface surveys, well trajectories, casing and cement records, reservoir models, access routes, contractor arrangements, equipment inventories and decision authorities before a blowout. Relief-well planning should not start from an uncertain archive. Credible readiness can be tested through engineering exercises that use a representative legacy well and require teams to produce an intercept plan, risk register, environmental controls and public timeline under deadline.

Top-kill failure also illustrates why incident management should preserve negative results. A failed attempt is not merely an operational disappointment. Pump rates, pressures, fluid returns, wellhead conditions and observed plume changes constrain the possible leak path and help the next decision. If those data remain in contractor systems or unstructured daily reports, they cannot support real-time learning or later independent review. The operator owns the obligation to create a coherent incident record even when several specialist firms execute the work.

Community protection under uncertain exposure

Residents in Porter Ranch and nearby communities reported odors and acute symptoms including headaches, nausea, nosebleeds and irritation. Natural gas was odorized, and the release and control operations could involve compounds other than methane. The appropriate public-health question was not simply whether methane itself was acutely toxic at measured community concentrations. Authorities needed to identify potential constituents, characterize changing exposures across location and time, evaluate reported symptoms, decide whether relocation was protective, and define conditions for return.

The Los Angeles County Department of Public Health directed SoCalGas in November 2015 to offer free temporary relocation to affected residents and later directed assistance for moving students from two schools. It expanded air monitoring and reviewed indoor and outdoor evidence. The county's incident background records these directives, the post-control monitoring context and cleaning and return-home issues. A relocation directive is a protective action under uncertainty; it is not proof that every household experienced the same dose or that each reported condition had the same cause.

The population evidence remained complex. Indoor sampling, environmental measurements and a community assessment were used to evaluate chemicals and symptoms. The county's assessment reported that many households experienced symptoms after the well was sealed and considered the leak or response-related conditions as possible contributors, while indoor testing did not find chemicals at levels interpreted as an elevated health hazard in the sampled settings. The public-health assessment must be read with its sampling design, timing, detection limits and population scope.

It cannot establish a universal absence of exposure, nor can symptom prevalence alone establish individual medical causation.

Good accountability preserves that tension. Monitoring may show concentrations below a comparison level at a particular place and time while residents still report symptoms, odors or stress. The response should investigate the mismatch rather than force one evidence type to cancel the other. Sampling locations, wind conditions, duration, laboratory methods and detection limits should be published. Health reports should be coded without erasing narrative context. Clinicians need exposure information, while epidemiologists need comparison groups and control of confounding.

Residents need an explanation of what the evidence can and cannot answer.

More than 8,000 households and two schools were directed to temporary relocation according to the county's later programme account. Settlement funding supported a long-term health study overseen through an independent scientific structure. The county health-study FAQ explains both the relocation scale and the study's purpose. The study is evidence that unanswered questions were recognized and funded; it should not be described in advance as proving a particular long-term outcome.

Return is another control gate. Ending a leak does not automatically resolve deposited material, indoor concerns, stress, disrupted schooling or uncertainty about continuing facility operations. A return framework needs stated air criteria, cleaning options, special provisions for medically vulnerable people, a complaint path and post-return surveillance. It should record what evidence changed the public-health recommendation. Otherwise, “safe to return” can be heard as a claim of zero risk when the actual decision is a bounded judgment that protective relocation is no longer warranted under available evidence.

Measuring a moving methane plume

The climate-accountability problem differed from the health inquiry. Methane is a powerful greenhouse gas, and the release rate changed as reservoir pressure and control work changed. No single ground monitor could directly weigh the entire plume over months. Scientists combined aircraft measurements, ground and tower observations, remote sensing, reservoir data and temporal modelling. The calculation had to bridge periods without direct overflight measurements and express uncertainty.

California Air Resources Board staff ultimately estimated 109,000 metric tons of methane emitted from late October 2015 to mid-February 2016. The estimate used aircraft plume measurements and reservoir-pressure information, among other data. CARB's final emissions announcement explains the selected total and its role in mitigation. The figure is not a direct meter reading at the well, and it should not be converted into a claim about a specific person's exposure.

The distinction between scientific estimate and mitigation obligation is important. Earlier analyses reported ranges as methods and data evolved. For full climate mitigation, the state selected the upper-bound total of 109,000 metric tons rather than treating a lower central estimate as the obligation. CARB's Aliso Canyon programme record documents the measurement approach and mitigation framework. Choosing a conservative mitigation amount is a policy and remedy decision informed by science; it does not eliminate the underlying measurement uncertainty.

Mitigation then created a second evidence chain. Funding a project is not the same as achieving a verified methane reduction. The agreement required California projects intended to cause reductions equivalent to the release, with reporting and programme conditions. CARB's mitigation reporting summaries provide the public implementation trail. Credible closure requires project baselines, additionality, commissioning dates, monitored performance, durability and treatment of underperformance. Climate accounting should not be closed by the amount of money spent.

For future storage incidents, emissions measurement should be part of emergency readiness. Operators and regulators need prearranged aircraft or mobile capacity, calibrated site instruments, meteorological data, data-sharing formats and a method for publishing revised estimates. Early numbers should be labeled provisional, with version history showing why they changed. This prevents uncertainty from becoming either false precision or an excuse for silence.

Fragmented authority needs an explicit control map

Aliso Canyon was governed by overlapping mandates. The state oil-and-gas regulator controlled downhole well safety and storage-well orders. The CPUC addressed utility safety, operational reliability, investigation and cost recovery. CARB quantified greenhouse-gas emissions and oversaw mitigation. Los Angeles County public-health authorities addressed community monitoring, symptoms and relocation. Emergency agencies received incident notifications. Federal agencies later developed national storage-safety standards. Courts and prosecutors addressed defined claims and offences.

Overlap can provide multiple lines of defence, but it can also create gaps. The wellhead is not a natural boundary for residents, methane or information. A regulator may possess casing data while another sees customer cost data and a third sees air measurements. Accountability therefore requires a shared incident-control map identifying the decision right, lead authority, required evidence and escalation route for each function. It must also state where authority changes: subsurface integrity, surface equipment, ambient air, public health, emergency command, reliability dispatch, rate recovery and legal enforcement.

The governor's January 2016 emergency proclamation made that coordination problem explicit. It mobilized state agencies, prohibited further injection absent authorization, directed maximum withdrawal consistent with safety, required methane mitigation funded by SoCalGas, and called for stronger storage regulation and a long-term viability assessment. The emergency proclamation is a contemporaneous allocation of executive actions. It does not establish the later engineering cause, quantify every loss or determine civil liability.

The federal interagency task force widened the control map. It examined well integrity, public-health and environmental effects, and energy reliability, and recommended risk-management, data, emergency-response and regulatory improvements. The Department of Energy's task-force record is evidence of the national reform programme prompted by Aliso Canyon. Its recommendations are policy guidance and technical synthesis, not incident-specific adjudication.

Legal remedies answer different questions

Several legal and regulatory outcomes followed, and they must remain separate. The misdemeanor plea addressed immediate reporting. A state and local civil consent decree addressed environmental claims, monitoring, health research, mitigation, penalties and costs. Private civil litigation addressed claims by residents and others. CPUC proceedings addressed utility violations, penalties and whether incident costs could be recovered from customers. None of these proceedings substitutes for the independent root-cause analysis.

The 2019 consent decree required SoCalGas to pay $119.5 million across methane mitigation, a long-term health study, local air monitoring, civil penalties and government costs, along with injunctive provisions. The California Attorney General's consent-decree implementation page contains the controlling documents and tracks specified obligations. A settlement resolves defined claims under agreed terms; it is not a trial finding on every disputed fact, every resident's injury or all future facility operations.

The remedy design is nevertheless instructive. It linked money to evidence-producing institutions: a health study, community air monitoring, near-real-time fence-line methane data, an internal safety committee and an independent safety ombudsman. These measures recognize that accountability after a complex industrial event is not exhausted by compensation. The public needs durable visibility into the risk system. The quality test is whether the resulting data are complete, intelligible, independently governed and acted upon when thresholds are crossed.

The CPUC later adopted a settlement including a $71 million penalty and restrictions preventing SoCalGas from seeking customer recovery of specified incident-related categories, including civil settlements, relocation and lodging, root-cause analysis and legal or community work. It also required executive attestations in later cost-recovery applications. The CPUC's 2023 decision announcement records these shareholder and ratepayer protections. The listed amounts are distinct categories, not a single physical-damage estimate, and the regulatory settlement should not be conflated with private civil resolution.

Executive attestation is useful only if supported by traceable accounting. Each invoice, internal labour charge, settlement payment, mitigation expenditure and capital project should be coded to a governed cost taxonomy. Controls should prevent disallowed costs from migrating into another application, account or depreciation schedule. Internal audit should sample from source documents to rate filings, while the regulator should be able to reconcile totals across proceedings. Otherwise, a promise that shareholders will pay is not demonstrable.

Operating restrictions and reliability do not cancel safety

After the leak, injection stopped and the facility underwent a comprehensive safety review. Wells had to be tested, remediated or taken out of service, with tubing-and-packer requirements and real-time monitoring among the controls. The facility later returned to limited operation under state oversight. That decision was contested because residents sought closure while system operators and regulators evaluated gas and electricity reliability in Southern California.

The CPUC proceeding on long-term viability was framed around whether reliance on Aliso Canyon could be minimized or eliminated while maintaining reliable gas and electricity service and just and reasonable rates. The commission's long-term proceeding record documents the distinct scope of reliability modelling, storage limits and later policy decisions. A reliability assessment does not certify well integrity; an integrity test does not establish that the regional energy system can operate without the facility.

This separation prevents a false choice. Safety and reliability are both public obligations, but each needs explicit evidence. Well safety requires barrier tests, corrosion assessment, pressure monitoring, leak detection and emergency readiness. Reliability requires demand scenarios, pipeline outage assumptions, storage deliverability, electric-generation dependence, conservation capability and alternatives. Decision-makers should disclose sensitivity to extreme weather and concurrent outages rather than invoke “reliability” as a binary label.

Operating limits also need a change-control record. A maximum storage level is not permanent simply because it was once selected. If the level changes, the regulator should publish the trigger, model, safety constraints, duration and review date. Facility use should be governed by withdrawal protocols and transparent exception logs. Temporary increases should not silently become the new baseline, and a closure objective should not be presented as achieved before replacement capability exists.

From emergency orders to durable well-integrity rules

California's post-leak requirements moved storage governance toward risk assessment, mechanical-integrity testing, ongoing monitoring, reporting, emergency planning and well-specific controls. State rules effective in 2018 required operators to identify failure modes, assess consequences, implement prevention or mitigation protocols, test well integrity and monitor pressure, temperature and flow. Later revisions addressed chemical inventories, off-normal occurrence investigation, corrosion and well-control planning. CalGEM's underground gas-storage programme is the official state record for this evolving framework.

Current requirements are evidence of reform, not proof of compliance at every well or a retroactive statement of the exact duty in 2015.

At federal level, Congress and the interagency task force led to minimum safety standards for underground natural gas storage. PHMSA's interim rule incorporated recognised practices for depleted reservoirs, aquifers and salt caverns; a final rule followed in 2020. PHMSA's underground-storage rule page links the regulatory history and standards. Incorporation of a recommended practice creates a more consistent floor, but a rule cannot inspect steel or interpret an anomalous pressure trend by itself.

Durable implementation should be visible at four levels. At the well level, a digital integrity file should contain construction and conversion records, every workover, casing and cement evidence, corrosion environment, barrier diagram, tests, anomalies and remaining-life assumptions. At the field level, the operator should compare failure mechanisms across the population and update risk-ranked inspection schedules. At the enterprise level, executives and the board should see overdue high-risk actions, degraded barriers and emergency capability, not only aggregate compliance percentages.

At the regulator level, inspectors should have structured submissions, independent access and authority to challenge the operator's risk model.

No single software platform guarantees this. “Enterprise automation” is valuable only where it prevents records from fragmenting and makes decision rights enforceable. Required fields should not be satisfied by vague narrative; measurements need units, instrument identifiers, calibration and timestamps. Changes to well status or risk ranking need approval history. Alerts need closure evidence. Legacy documents must be reconciled to the physical well rather than scanned into an archive and declared complete.

What accountable assurance would now prove

The first proof is barrier integrity. For every active storage well, the operator should maintain a current schematic identifying primary and secondary barriers for injection, withdrawal, shut-in and intervention. Tests must address internal and external metal loss, casing, tubing, packer and cement where relevant. Exceptions should carry an expiry date, compensating controls and named executive acceptance. A population dashboard should show wells operating with degraded or unverified barriers, not hide them inside an average test-completion rate.

The second proof is corrosion control. Groundwater contact and microbial corrosion are not managed by a generic corrosion policy. The operator needs evidence of where the environment can contact casing, which mechanisms are credible, how cathodic or other protection is evaluated, what inspection tool can detect external damage at relevant depths, and how uncertainty affects the next inspection date. Every casing leak should trigger formal causal analysis and a search for analogous wells.

The third proof is detection-to-action performance. Field methane instruments, wellhead inspections, continuous pressure and flow monitoring, alarms and community monitoring must share a clock. Assurance should measure detection latency, classification latency, regulator-notification latency and public-warning latency. Drills should demonstrate that the organisation can mobilize independent plume measurement and a relief-well pathway while surface interventions continue.

The fourth proof is health-evidence governance. The response plan should predefine sampling media, laboratories, detection limits, meteorology, quality assurance and publication frequency. A symptom-reporting system should protect privacy while supporting spatial and temporal analysis. Decisions about relocation, cleaning and return should cite explicit evidence and preserve uncertainty. Research funded through a settlement should have independent scientific oversight, preregistered questions where feasible and a publication policy insulated from the operator.

The fifth proof is climate closure. Release estimates need a versioned calculation linking observations, interpolation and uncertainty. Mitigation requires verified reductions, not only funded projects. Public reporting should state what has been built, what reductions were measured, what remains projected and how shortfalls will be corrected.

The sixth proof is financial accountability. Incident costs must be traceable across emergency work, relocation, monitoring, litigation, settlements, capital replacement and mitigation. The operator should show which amounts shareholders bear, which costs were authorized for customers and why, and how duplicate recovery is prevented. Legal labels should remain precise: plea, consent decree, regulatory settlement and private settlement answer different questions.

The seventh proof is independent challenge. Regulators should compare operator data with field inspections and third-party evidence. Boards should commission assurance that samples high-risk wells and tests whether alerts would reach decision-makers. Community representatives should receive intelligible monitoring data and explanations of revisions. Independence is not the absence of contact with the operator; it is authority to choose scope, access source evidence, publish material findings and track remediation.

A practical accountability architecture

Allocating those proofs to named functions prevents the event from dissolving into a claim that “the system” failed. The storage engineering function should own accurate well schematics, failure-mode analysis and technical acceptance criteria. Field operations should own inspections, alarm response and controlled execution of injection, withdrawal and intervention. An integrity function independent of production pressure should own risk ranking, test interpretation and escalation of degraded barriers. Emergency management should own notification, incident command and well-control readiness.

Environmental and health teams should own sampling design and the interfaces with public agencies. Finance should own incident-cost classification, while executives and the board own risk appetite and overdue corrective action.

Regulators also need named deliverables. The downhole regulator should be able to identify every well whose integrity is unverified and explain the operating consequence. The utility regulator should reconcile safety restrictions with reliability and customer-cost decisions. Air authorities should publish methods and revised emissions estimates. Public-health authorities should state what monitoring can answer, what remains uncertain and why protective recommendations change. Emergency agencies should test notice and coordination.

Where two mandates overlap, a memorandum or incident protocol should identify the lead decision-maker and the evidence each agency must supply.

This architecture needs stop authority. A field employee who sees an unexplained pressure trend must be able to initiate a conservative response without first proving the final failure mechanism. Integrity specialists need authority to restrict a well when records or test results are incomplete. Incident command needs authority to escalate notification while estimates are provisional. Regulators need authority to prevent injection or require abandonment when the operator has not resolved material uncertainty.

Stop authority should be logged and reviewed for both appropriate use and chilling effects; a right that employees fear to exercise is only an organisational diagram.

Assurance should test decisions, not merely documents. A useful audit sample would begin with a high-risk active well and reconstruct its barrier status from original logs, work orders and test data. It would then inject a simulated pressure anomaly and follow the alarm through classification, field response, regulator notice, plume-monitoring mobilisation and public communication. Separately, it would select a prohibited incident-cost category and trace it through accounts and rate filings. Finally, it would choose a public monitoring claim and reproduce it from calibrated instruments, laboratory results or model inputs.

These tests expose gaps that a policy checklist cannot.

Records must describe the physical asset

Aliso Canyon also illustrates a general risk in old infrastructure: records can be internally tidy while the physical asset has changed through conversions, workovers and repairs. The well identifier must anchor a lineage from original construction through every intervention. Depth references, casing sizes, cement tops, perforations, plugs, packers and valves need a common datum and controlled units. When records conflict, the discrepancy is a risk condition requiring resolution, not an administrative inconvenience.

Digitisation should therefore preserve provenance. A value transcribed from a paper log should retain the source image, page and reviewer. Interpretations should not overwrite measurements. The system should distinguish “not found,” “not performed,” “not applicable” and “passed,” because blank fields conceal very different risks. Well diagrams should be generated from controlled data where possible, with changes requiring engineering approval. Contractors may operate logging tools and store raw files, but the operator must retain accessible native data and the information needed to reproduce the interpretation.

Population analysis is the bridge between one well and the field. The operator should be able to query wells by age, conversion history, casing material, groundwater interval, prior leak, corrosion mechanism, intervention type and barrier configuration. An event at one well should automatically identify a comparison set and create review tasks. The analysis should include inactive wells capable of becoming migration pathways, not only wells currently injecting or withdrawing.

Management reports should show the denominator: ten completed tests mean little without knowing how many wells were due and which high-consequence wells remain unresolved.

Data quality itself needs controls. Pressure sensors require calibration and an explicit treatment of missing data. Alarm thresholds need version control and a record of overrides. Leak-detection cameras and fence-line monitors need availability metrics, maintenance history and blind performance checks. Laboratory and model data require quality flags. The goal is not a perfect real-time digital twin; it is enough trustworthy evidence to detect change, support a conservative decision and permit independent reconstruction after the fact.

Community evidence is an operating control

Community complaints are sometimes treated as reputation data outside the safety system. At a storage facility near populated areas, they are also observations. Odor, noise, visible activity and symptom reports should enter a structured incident channel with location, time and follow-up status. Clustering can prompt instrument review or targeted sampling, while privacy protections prevent disclosure of personal health information. Complaints cannot replace calibrated measurements, but neither should negative instrument readings automatically erase reports from places or intervals the instruments did not cover.

The operator and agencies should publish a joint data dictionary so residents can understand what is being measured. Methane concentration, odorant compounds, other air toxics, plume flux and health complaints are different variables. A fence-line methane spike does not translate directly into an indoor dose; an aircraft flux estimate does not describe a street-level concentration; a comparison with a health guideline depends on averaging time. Clear explanations reduce the risk that technically correct numbers mislead through context loss.

Trust also depends on revision practice. When a laboratory result is corrected or an emissions estimate changes, the old version should remain available with an explanation. Meeting questions should receive tracked answers. Independent experts and community representatives should be able to inspect protocols before an emergency and critique them afterward. This is not a promise that every dispute will disappear. It is a way to make disagreement traceable to evidence, assumptions or values rather than access to information.

Finally, community protection should remain connected to facility governance after the visible emergency ends. Monitoring thresholds, complaint patterns, integrity anomalies and operating changes should feed a recurring public review. The review should state which wells are active, which barriers have been tested, what significant alarms occurred, how storage limits changed and whether mitigation or health-study milestones were met. Public disclosure cannot operate a well, but it can reveal whether promises made during crisis have become routine controls.

The accountability test

Aliso Canyon should not be remembered only as a large methane number or a four-month emergency. Its central lesson is that critical infrastructure can fail through a mechanism that was physically local but institutionally distributed. The rupture occurred in one casing. The missed opportunities lay across prior failures, corrosion knowledge, integrity testing, monitoring, notification, well-control readiness and fragmented authority. The consequences then moved through homes, schools, climate accounts, energy planning, courts and customer bills.

The independent engineering record supports a strong finding about SS-25's failure and the operator's pre-incident integrity practices. It does not prove which resident developed which condition. Community monitoring and health assessments support protective decisions and research; they do not decide private medical causation. Atmospheric measurements support an uncertainty-bounded emissions estimate and mitigation obligation; they do not measure household dose. A criminal plea establishes an admitted reporting offence; civil and regulatory settlements define negotiated remedies and cost treatment.

Keeping those boundaries is not evasive.

It is what makes responsibility defensible.

The most important reform is therefore an evidence chain that begins before an emergency. Each ageing well should have a known barrier state, a failure-mode-specific inspection plan, continuously watched signals and a practiced route from anomaly to shutdown, notification and public protection. Each prior integrity event should update the field's risk model. Each emergency action should preserve data. Each consequence should be measured with methods suited to the question. Each remedy should have an owner, deadline and verification record.

If that chain can be shown, underground storage can be governed as critical infrastructure rather than inherited machinery. If it cannot, later rules, settlements and monitoring programmes may document activity without proving control. Aliso Canyon's enduring accountability test is whether institutions can transform a visible catastrophe into durable knowledge—and whether residents, workers, regulators and customers can independently verify that transformation before another casing becomes the only warning system.