Merrimack Valley made gas-pressure control and engineering review a utility accountability test

Summary

• On September 13, 2018, a Columbia Gas of Massachusetts project crew isolated and abandoned a cast-iron main in South Lawrence while two regulator sensing lines remained connected to it. As pressure in the abandoned pipe fell, the worker and monitor regulators interpreted the signal as a demand for more gas and opened. High-pressure supply entered a low-pressure network, causing fires and explosions in Lawrence, Andover and North Andover. One person was killed, 22 people were transported to hospitals, 131 structures were damaged, and gas service was shut off to 10,894 customers.
• The National Transportation Safety Board found weak engineering management to be the probable cause and inadequate overpressure protection to be a contributing factor. The project records did not place sensing lines in the work package, the constructability process did not force review by the department that owned relevant records, and Columbia Gas did not apply a project-level management-of-change and risk-assessment process. Qualified construction workers followed an incomplete plan; that distinction places the central accountability burden on system and project governance rather than unsupported claims about crew incompetence.
• Response controls also failed at interfaces. A remote monitoring center saw high-pressure alarms but could not operate valves. The company incident commander had simultaneous shutdown and liaison duties. Municipal responders did not promptly receive maps, affected-area information or actionable status, while regional radio interoperability was strained. State emergency authority, mutual aid and another utility's management role helped stabilize the event, but recovery created a second control test involving thousands of service reconnections, appliance work, abandonment records and accelerated construction.
• Remedies came through separate channels. Columbia Gas pleaded guilty to one federal Pipeline Safety Act offence and received a $53,030,116 fine and probation. Parent NiSource signed a deferred prosecution agreement rather than a guilty plea. State investigations ended through a $56 million settlement associated with the sale to Eversource. A $143 million class settlement excluded bodily-injury, wrongful-death, insurance-subrogation and certain appliance claims. These amounts cannot be added into a single measure of loss, compensation or individual responsibility.
• Durable proof requires more than a professional engineer's stamp or a closed recommendation. It requires complete system records, site-specific construction sequencing, failure-mode analysis, independent pressure protection, continuous monitoring during change, personnel positioned to isolate the system, tested municipal communications, verified restoration records and recurring regulator evidence. Massachusetts converted several lessons into law and detailed engineering rules. Federal overpressure and distribution-safety reform, however, must be described by its actual stage: a 2020 advisory and a rulemaking that remained proposed and under advisory-committee review in 2026.

The event turned routine replacement work into a regional emergency

The public event began shortly before 4:00 p.m. on September 13, 2018. A contractor crew working under a Columbia Gas construction coordinator completed tie-ins for a replacement polyethylene main near South Union and Salem Streets. The crew then isolated the old cast-iron main by closing valves on a bypass and cut the bypass to abandon the old section. Within minutes, pressure on the new main rose beyond expected readings, a fitting separated, emergency vehicles became audible and smoke appeared in several directions.

The NTSB investigation record for PLD18MR003 establishes the public scale and the agency's final probable-cause statement. Fires and explosions damaged 131 structures, including at least five destroyed homes. One person died, and 22 people, including three firefighters, were transported to hospitals; seven additional firefighters sustained minor injuries. Columbia Gas shut down the affected low-pressure system, interrupting 10,894 customers, including some disconnected as a precaution. Those are NTSB figures and categories, not a civil-court allocation of compensable injury.

That speed is central to the accountability test. A low-pressure network can serve many customers without an individual service regulator at every meter. A pressure-control failure at the district level can therefore propagate before a field team can visit each regulator station. Emergency plans designed around one leak, one fire or one excavation strike do not automatically scale to simultaneous alarms, dozens of fires, traffic congestion, a regional power shutdown and uncertain system boundaries.

The incident should not be reduced to old cast iron alone. Replacement of leak-prone pipe was a legitimate safety objective, and the crew was installing new polyethylene main. The failure occurred because the project changed the feedback path that governed pressure while the construction package did not treat that path as part of the system being changed. Infrastructure renewal can reduce one hazard and expose another when configuration control does not follow the physical network.

The sensing lines made the abandoned main part of the control loop

Before the accident, 14 regulator stations supplied the Merrimack Valley low-pressure network. At a typical station, high-pressure gas at roughly 75 pounds per square inch gauge was reduced to about 12 inches of water column, approximately 0.5 psi, for distribution to customers. Each station used a worker regulator and a monitor regulator in series. Each had a sensing, control or static line connected downstream so that the regulator could respond to actual network pressure.

The worker and monitor arrangement looked redundant, but both devices depended on pressure information from the same system condition. At the Winthrop Avenue station, their sensing lines remained connected to the cast-iron main that the project abandoned. When the main was isolated, pressure in that abandoned section dropped. Both regulators responded as designed to the false low-pressure signal: they opened further. Once the signal disappeared, the regulators could open fully and admit high-pressure gas into the low-pressure network.

The NTSB Pipeline Accident Report PAR-19/02 found that the regulators themselves were operable and that crew qualification, drugs and alcohol were not factors. It determined that Columbia Gas's weak engineering management did not adequately plan, review, sequence and oversee the project, leading to abandonment before sensing-line relocation. It also identified a low-pressure system designed and operated without adequate overpressure protection as a contributing cause. NTSB investigations are safety fact-finding proceedings; their probable-cause findings do not assign civil fault or legal liability.

This distinction explains why two regulators were not two independent barriers. Redundancy protects against some single-component failures only when the redundant elements do not share the same vulnerable input. Here, one project action removed the pressure signal used by both. In engineering terms, the sensing-line arrangement had a common-mode failure. In governance terms, no mandatory review forced the project team to ask which protective devices would be defeated by abandoning that main.

Adequate low-pressure overprotection can take different forms depending on system design: relief capacity, slam-shut devices, monitor arrangements with independent sensing, pressure limiting, automatic isolation or other engineered layers. The relevant test is not whether equipment is duplicated but whether a single operator error or equipment failure can defeat protection. A design review must model maximum inlet flow, downstream capacity, appliance limits, detection time, isolation time and the effect of losing each instrument path.

The system also lacked rapid remote control. Supervisory monitoring could detect abnormal pressure, but the control center could not close the local valves that would isolate the low-pressure district. That meant the effective protective path ran from alarm to a telephone call, from the call to field dispatch, and from field personnel to physical valves. Every minute in that chain mattered after excess pressure had already entered customer premises.

The work package failed to represent the system being changed

The South Union project passed through Columbia Gas's project workflow, but its construction documents omitted the sensing lines. The field engineer used records available in the engineering process and identified a nearby regulator station, yet did not review the separate drawings held by the Measurement and Regulation function that showed control-line information. The field engineer had limited knowledge of those lines' importance. Because the engineer did not determine that Measurement and Regulation was affected, that department was not required to review the package.

This is a data-governance failure expressed through physical infrastructure. An asset can exist in a utility's files while being absent from the document that authorizes work around it. “Recorded somewhere” is weaker than traceable, reliable, complete and available at the point of decision. The NTSB's public investigation docket preserves interviews, pipeline-operations factual material, emergency-response records and the NiSource party submission. The docket supports scrutiny of how different functions understood the system; it should not be treated as if every party submission were an adopted NTSB conclusion.

A controlled work package should begin with an authoritative system model, not a collection of department-specific maps. For every main segment to be installed, tied in, isolated or abandoned, the package should identify services, valves, bypasses, regulator stations, sensing lines, relief devices, telemetry, cathodic-protection bonds and adjacent utilities. Each record needs provenance, revision status and field-verification status. Conflicts between GIS, as-built drawings and field observations should stop approval until resolved or be carried as explicit hazards with controls.

The records also must reach operations. A control-room operator responding to an alarm needs the current project boundary, valve and regulator map, planned configuration, responsible field leader and immediate isolation options. A work package used only by construction cannot support abnormal-operations response. Planned changes should be visible in a shared operational window before field execution, with a clear start, hold points, completion state and rollback or safe-stop condition.

Management of change should have converted omission into a stop point

NiSource had a pipeline safety management system initiative, but Columbia Gas did not apply a formal management-of-change process to maintenance and construction changes of this kind. Project checklists existed, yet the project did not receive a separate risk assessment that traced how abandonment would affect pressure control. A checklist confirms expected tasks; management of change asks what the changed configuration can newly cause.

The NTSB's earlier urgent Safety Recommendation Report PSR-18/02 made four company recommendations: improve engineering and constructability review with appropriate professional-engineer sealing; make system records traceable, reliable and complete; apply management of change to all changes that could create common-mode failure; and establish controls during main modifications, including continuous pressure monitoring and personnel at critical locations able to shut down the system. It separately recommended that Massachusetts eliminate its utility exemption from professional-engineer requirements.

A useful management-of-change record for this project would have described the before and after configuration, each temporary state, the pressure-control logic, affected departments, hazards, safeguards, required approvals and emergency response. It would have asked what happens if the old main loses pressure before sensing lines move, whether worker and monitor regulators share a dependency, where pressure will be observed, and which person can isolate flow at each stage. The answers would turn construction sequence into a set of safety hold points.

Sequence is a control. “Relocate sensing lines” and “abandon old main” can both appear on a project list while remaining dangerously unordered. The permit to abandon should be impossible to release until field evidence shows the sensing lines connected to the active main, pressure stable, telemetry verified and responsible departments signed off. A valve closure or pipe cut should require positive confirmation, not an assumption that another work order already completed the prerequisite.

Pressure monitoring likewise needs an action design. A gauge or SCADA point is not protection if no one owns the alarm or can reach isolation equipment quickly. Limits should be set before work; alarms should go to named personnel; local and control-room readings should be reconciled; and pre-positioned technicians should have authority to stop work and close specified valves. The shutdown route should be rehearsed under realistic traffic and access conditions.

Professional review can strengthen this process but cannot substitute for it. A seal on an incomplete drawing may create false confidence if the engineer lacks the regulator records, cannot verify field conditions or reviews only the final arrangement rather than temporary construction states. The engineer's scope, assumptions, data sources and unresolved discrepancies must be visible. Independent review is valuable because it creates accountable challenge, not because a stamp makes missing information appear.

Contractor qualification did not cure an owner-controlled design omission

Feeney Brothers performed the field work with a Columbia Gas construction coordinator present. The NTSB found the crew trained and qualified under operator-qualification requirements and found no drug or alcohol factor. Crew members followed the work plan, noticed abnormal pressure and responded to a separated fitting. Those findings do not remove all field responsibilities, but they prevent the incident from being inaccurately narrated as an unqualified contractor simply ignoring a correct design.

The operator retained control over system knowledge, engineering approval, regulator records, project sequencing and operating authority. A contractor cannot safely execute information it was never given. Owner accountability therefore includes specifying the work, providing accurate records, ensuring constructability review, assigning qualified inspection and defining abnormal-condition actions. Contract language that says the contractor must work safely does not transfer the operator's duty to represent its own network accurately.

Contractor interfaces still need reciprocal challenge. A field briefing should identify pressure-control assets and explain why sequence matters. Workers should compare the package with exposed conditions and stop when pipes, control lines, valves or gauges differ from the drawing. The owner should make it easy to reach Measurement and Regulation experts and protect schedule decisions that pause work. Near misses, fitting releases and unexpected readings must feed the same incident channel as control-room alarms.

Municipal interfaces belong earlier than emergency response. Main replacement affects streets, traffic, other underground utilities, fire access and sometimes public works records. Municipal permits and police details cannot validate the operator's pressure-control design, but coordinated construction calendars and maps can reveal conflicting work, blocked valve access and vulnerable public facilities. Utilities should provide municipalities with project contacts and emergency boundaries without disclosing sensitive infrastructure beyond legitimate operational need.

The control room detected pressure but could not control the outcome

The monitoring center in Columbus, Ohio, recorded a rapid pressure increase and high-pressure alarms. Controllers called the on-call Measurement and Regulation technician under company protocol. The center, however, had monitoring capability rather than remote valve control. Field technicians were dispatched among regulator locations, and the broader system shutdown required manual action over hours.

Alarm response should be evaluated as an end-to-end barrier. Detection time, interpretation, dispatch, travel, access, valve operation and confirmation all determine whether the barrier is fast enough. A control room can meet its call procedure yet remain structurally unable to prevent escalation. For a high-consequence low-pressure district, the operator should quantify how far pressure can propagate during the credible manual response interval and decide whether independent automatic protection or remote isolation is necessary.

The incident also exposed a split between construction awareness and operations awareness. Controllers need a live register of safety-significant work that could affect the points they monitor. A pressure alarm during a planned tie-in should immediately display project location, configuration, crew contact, expected pressure window, affected regulators and shutdown plan. Without that context, the controller must investigate while the abnormal condition develops.

Postincident metrics should therefore go beyond “alarm acknowledged.” Evidence should show the pressure trace, first alarm, all calls, dispatch decisions, technician arrival, valve actions and system isolation. Drills should test simultaneous calls, unavailable personnel, blocked roads and failure of normal communications. If safe isolation depends on one specialist or one incident commander, the staffing model has a single point of organizational failure.

Control authority also must be unambiguous. Construction personnel need authority to stop and enter a safe state; control-room personnel need authority to escalate; field operations need authority to close predefined valves; and an incident commander needs a deputy or liaison structure so shutdown work does not crowd out government coordination. These roles should be designed together because a fast technical response and a fast public-safety response draw on the same people.

Emergency response was a map, liaison and communications problem

Local public safety answering points handled a surge of calls, and mutual aid brought substantial resources. Yet the company did not promptly provide municipal incident commanders and state officials with the nature and geographic extent of the overpressure, useful system maps or reliable shutdown progress. The Columbia Gas incident commander faced competing responsibilities: directing isolation while also expected to communicate with affected municipalities and emergency managers.

Massachusetts declared an emergency and used statutory authority to place Eversource in a management role for restoration coordination. The DPU's Merrimack Valley state-of-emergency orders archive documents successive orders rather than one timeless mandate. The orders addressed immediate management, restoration, monitoring and later recovery obligations. Each order must be read by date and scope; emergency control of restoration was not a transfer of legal ownership or a final liability judgment.

Fire departments also experienced radio interoperability and capacity problems. A communication plan was not implemented until hours after the fires began, while the heaviest call and mutual-aid demand arose earlier. The Massachusetts Merrimack Valley Gas Explosions After Action Report later recommended earlier communications-unit leadership, correctly programmed interoperability channels, unified command and leadership structures, stronger public information coordination and other response improvements. It is a government lessons-learned report, not a substitute for NTSB probable-cause findings.

Actionable utility information has a specific form. Responders need the affected pressure district, customer footprint, regulator and valve status, credible hazards, isolation progress, safe staging areas and a time-stamped contact who can answer technical questions. A raw engineering map may be too complex; a generic service-territory map may be too vague. The operator should prepare responder products in advance and be able to generate an incident-specific version rapidly.

Public warning has similar requirements. Residents need clear instructions on evacuation, ignition avoidance, gas odor, electrical shutdown, shelter and return. Those messages should be available in the languages used by the community and coordinated across municipal, state and utility channels. The absence of precise system information can force officials to evacuate and de-energize a larger area, increasing traffic, medical and continuity burdens even when that conservative action is justified by uncertainty.

State investigations separated safety compliance from emergency performance

After the NTSB completed its report, the Massachusetts DPU opened D.P.U. 19-140 and 19-141. The formal investigation announcement defined separate but related inquiries: one into cause and compliance with federal and state pipeline rules, and another into emergency preparation, management of restoration, public safety, resource allocation, municipal communication and public information. That separation prevented engineering cause from swallowing the response record.

Regulatory investigations have a different purpose and standard from NTSB work or criminal prosecution. The DPU could examine compliance and impose state remedies within its jurisdiction. The NTSB determined probable cause for safety improvement without assigning liability. Prosecutors had to prove or obtain an admission to a statutory offence. A later settlement could resolve regulatory claims without producing fully adjudicated findings on every contested issue.

The DPU and other state agencies also used emergency and oversight mechanisms before those formal cases ended. Work moratoria, third-party engineering oversight, restoration conditions and statewide review addressed immediate risk. Rapid protective orders and slower adjudicatory investigations serve different functions. The public record should retain both so an emergency restriction is not mistaken for a final violation finding and a later settlement does not erase the controls imposed during recovery.

The enforcement question is not only how large a penalty could have been. Regulators need to convert the identified mechanism into inspection tests across every operator: control-line mapping, regulator common-mode analysis, project review routing, management of change, pressure monitoring, abandonment records, emergency maps and responder exercises. A case closes; those inspection assertions must remain.

Restoration created a second management-of-change test

Restoring heat and hot water before winter required a scale of work far beyond ordinary annual activity. The affected low-pressure cast-iron network was replaced with a high-pressure system using service regulators and additional protection at customer connections. Thousands of meters and appliances required attention, while street work, customer access, temporary housing and community claims continued. Speed was necessary, but urgency changed normal workflows and created new record and quality risks.

The DPU-commissioned independent assessment of the Merrimack Valley restoration program concluded that the renewed infrastructure improved safety compared with the system it replaced. It also found that changes made to accelerate work created gaps involving pressure-test records, service-line records and abandonment of infrastructure, and that reliance on people more than process created documentation, inspection and quality-control gaps. Those balanced findings matter: new assets can be safer while the restoration process still requires remediation.

Restoration quality should be proved asset by asset. Each new main and service needs material identity, fusion or joint records, pressure-test evidence, tie-in and abandonment status, regulator installation, inspection, as-built location and customer reconnection. Exceptions should not disappear into a project closeout percentage. They need an owner, risk classification, interim protection, due date and independent verification.

Abandonment deserves special control because disconnected assets can be visually confused with live ones and incomplete sealing can create leaks. A field completion should reconcile to GIS and customer records, with verification independent of the crew that performed the work. Pressure-test packages should link the instrument, calibration, test limits, duration, segment and witness. A scanned sheet without a stable asset identifier cannot support later operations or incident review.

The restoration assessment also illustrates why a utility sale cannot transfer uncertainty invisibly. The successor needs a complete exception register and the right to validate records, inspect assets and require correction. Purchase accounting may assign liabilities, but operational accountability depends on a handoff detailed enough for crews and regulators to know which assets remain under review.

Statewide review asked whether the lesson generalized

Massachusetts did not limit its response to Columbia Gas. An independent statewide assessment examined gas companies, field work, operating centers, regulator sites, control centers, DPU capacity and the use of safety-management practices. The Dynamic Risk Phase 2 final report was an assessment of conditions observed across the Commonwealth, not an adjudication that every operator shared Columbia Gas's specific failures.

The review treated process maturity as a safety issue. Procedures must be usable in the field; supervisors need enough time and authority to observe work; risk information must move among functions; and regulators need timely inspection and enforcement capacity. It also observed that implementation of the new professional-engineer requirement was evolving. That is useful implementation evidence because it resists the fiction that passing a law instantly produces uniform practice.

Statewide assurance should use repeated sampling. Inspectors can select projects involving regulator work, abandonment, multiple tie-ins or pressure changes and trace them from design through field completion. They should compare the stamped plan with actual construction, confirm that departures received engineering approval, test whether control-room personnel knew the work state, and inspect closeout records. Metrics should show exceptions and correction time, not only the number of stamped drawings.

Regulator oversight also needs resources independent of operator filings. The DPU's Pipeline Safety Division expanded after the incident, but headcount alone is an input. Evidence of effectiveness includes risk-based inspection coverage, time from finding to order, repeat violations, closure verification, emergency drill observations and the ability to analyze GIS, pressure and work-management data. External federal evaluation can add a check, but it does not replace transparent state case records.

Massachusetts converted professional review into law and rules

Massachusetts acted on the urgent NTSB recommendation before the final accident report. Chapter 339 of the Acts of 2018, approved December 31, removed the relevant utility exemption and required engineering plans or specifications for gas work that could pose a material risk to public safety to bear the stamp of a certified professional engineer. It also required the gas company to house those records for DPU review and audit.

The statute established the duty but left the DPU to define material-risk work. The later D.P.U. 21-04-A professional-engineer guidelines identify complex projects including creation or reconfiguration of district regulator stations, pressure changes, specified main and service tie-ins, interruption of main flow, transmission work, uprating and other higher-risk configurations. They require site-specific instruments of service, an adequate construction sequence and stamping before work, subject to defined emergency treatment.

This progression supplies three levels of evidence: a recommendation, a statute and an implemented regulatory framework. They should not be collapsed. NTSB closed its Massachusetts recommendation based on legislative action, but closure meant the recommended action was acceptably addressed; it did not certify every future plan. The law imposed a requirement; the guidelines made its scope more operational; inspection must still prove compliance and quality.

A PE review should be independent enough to challenge project assumptions while integrated enough to obtain complete system information. The engineer should have access to regulator and sensing-line records, GIS, field verification, hydraulic analysis, temporary configuration and emergency procedures. The record should show design changes after stamping, because a field deviation that bypasses re-review defeats the control.

The strongest implementation test is counterfactual. For each sampled project, could one error or omission still abandon a shared control input, open a regulator, isolate the wrong segment or prevent timely shutdown? If yes, the presence of a stamp has not yet converted the lesson into a barrier. Professional accountability is an architecture of information, competence, review and authority, not a mark at the bottom of a page.

Federal reform moved from advisory to a still-pending rulemaking

PHMSA responded to NTSB Recommendation P-19-15 with a 2020 advisory on low-pressure overpressure risk. The ADB-2020-02 Federal Register notice reminded operators of existing distribution-integrity-management duties and encouraged failure modes and effects analysis or an equivalent structured method. The notice expressly said its contents did not have the force and effect of law and did not bind the public beyond underlying requirements.

That legal status matters. An advisory can clarify risk and expected practice, but it is not the Part 192 revision NTSB separately recommended in P-19-14: overpressure protection for low-pressure systems that cannot be defeated by one operator error or equipment failure. An operator should not wait for a final prescriptive rule to address a known hazard, yet public accountability should not report voluntary guidance as if a new hardware mandate already took effect.

PHMSA's 2023 gas-distribution safety notice of proposed rulemaking proposed changes to distribution integrity management, emergency response, operations and maintenance, overpressure threat identification and other practices. It incorporated mandates from the PIPES Act of 2020, including the Leonel Rondon Pipeline Safety Act provisions. As a proposed rule, it described intended amendments and regulatory analysis, not final enforceable text.

Current status requires a later source. PHMSA's 2026 Gas Pipeline Advisory Committee meeting notice still described the distribution-safety measure as an NPRM under committee review and stated that PHMSA would evaluate recommendations before publishing a final rule. Therefore, as of the evidence date for this article, the accurate statement is that federal reform was continuing, not that the proposed provisions had become final.

Implementation evidence should track both existing obligations and the rulemaking gap. Operators can document failure-mode analyses, independent protection, emergency contact data, public-warning procedures and current operations manuals now. PHMSA can publish recommendation status, inspection protocols and rule milestones. A long rulemaking does not suspend the general duty to operate safely, but it does affect what regulators can enforce as a specific national minimum.

Criminal accountability attached to the company, not unnamed individuals

Bay State Gas Company, doing business as Columbia Gas of Massachusetts, pleaded guilty to violating the federal Pipeline Safety Act through failure to implement procedures required to prevent overpressurization during the South Union project. The DOJ case and sentencing record states that the court imposed a $53,030,116 fine, calculated as twice the profit earned from the Gas System Enhancement Plan from 2015 through 2018, and three years of probation with monitoring until the company was sold to a qualified buyer.

The admitted offence has a defined scope. It was a corporate Pipeline Safety Act violation concerning required procedures and the low-pressure project. It was not a guilty plea by every engineer, manager, contractor or parent-company officer. DOJ's case page expressly stated that no individuals were charged. That does not answer every question about employment discipline, civil responsibility or internal decision-making; it means the public criminal record used here contains no individual prosecution to assign.

NiSource's resolution was legally different. The parent signed a deferred prosecution agreement covering federal criminal exposure known to the government relating to the event and restoration. It agreed to use reasonable best efforts to sell the Massachusetts business, cease Massachusetts pipeline activity after sale, forfeit sale profit as defined by the agreement, implement NTSB recommendations across specified subsidiaries, cooperate, continue restitution and seek to resolve civil claims. A DPA defers prosecution subject to conditions; it is not a parent-company guilty plea or conviction.

The DPA and plea agreement also should not be used to infer individual intent beyond admitted corporate facts. Prosecutorial language, NTSB findings and civil allegations arise under different processes. A sound accountability record identifies the respondent, charge, admission, sentence, monitoring term and disposition separately. It also records what was not resolved: individual criminal loss allocation and personal liability cannot be manufactured from a corporate fine formula.

The criminal fine was directed largely to the federal Crime Victims Fund rather than allocated dollar for dollar to Merrimack Valley claimants. DOJ noted separate voluntary restitution and civil claims. Calling the $53 million direct local compensation would therefore be inaccurate. Punishment, national victim-service funding, private compensation and infrastructure spending are different remedy categories even when funded by the same corporate group.

Civil, regulatory and compensation figures measure different things

The state regulatory path ended through a negotiated transaction. The DPU settlement approval required a $56 million payment, departure from Massachusetts and transfer of assets to Eversource. About $15 million was directed to low-income arrearage forgiveness, with the remainder supporting a Merrimack Valley renewal fund for clean-energy and efficiency measures. The settlement resolved the DPU safety and emergency-response investigations and related state matters within its terms; it was not a trial judgment quantifying every violation or resident's loss.

NiSource's 2020 Form 10-K provides first-party financial and legal context. It records final court approval on March 12, 2020, of a $143 million class settlement for persons and businesses in the three municipalities, while identifying excluded categories: physical bodily injury and wrongful death, insurance subrogation, and claims concerning appliances subject to DPU orders. It also records the sale and incident-related costs and proceedings from the company's reporting perspective.

The exclusion list prevents a common arithmetic error. The class fund was not the universe of compensation. Bodily-injury and wrongful-death claims could proceed separately; insurers could pursue subrogation; appliance remedies followed another channel; municipalities and businesses also received payments or support under distinct arrangements. Some claims settled outside the class, but the cited primary disclosures do not provide a final person-by-person ledger of every gross loss, insurer recovery, legal cost and net payment.

Nor should the $143 million class fund, $56 million state settlement, $53,030,116 criminal fine, restoration spending, insurance proceeds and sale price be summed as one “cost of the disaster.” They have different recipients, accounting treatment, coverage and legal effect. Sale consideration purchased utility assets; it was not compensation for residents. Capital replacement created operating assets; it was not necessarily a penalty. A criminal fine punished an offence; it did not value each injury.

Public remedy evidence should use a recovery ledger with claimant class, legal basis, gross amount, funding source, exclusions, administrative cost, payment status and subrogation. Where person-level data is protected, aggregate categories can still show whether approved amounts were paid. Without that structure, large public totals can coexist with unanswered questions about a household, small business, municipality or insurer.

The sale transferred operations but not the historical meaning of the event

Eversource acquired the Massachusetts gas business in October 2020 and operated it through Eversource Gas Company of Massachusetts. The transaction ended NiSource's operation of gas distribution in the state as required by the federal and state resolutions. It also transferred an operating system, workforce, customer obligations and defined remedial work to a successor subject to DPU oversight.

Sale can be a remedy because it changes control and creates a qualified successor. It is not, by itself, evidence that engineering controls are effective. The buyer must integrate GIS, work management, pressure monitoring, emergency plans, contractor controls and open corrective actions without losing traceability. The DPU settlement required a safety and reliability program and attention to remaining remedial actions. Those are implementation obligations, not a blanket certification on the closing date.

The renewed Merrimack Valley system changed the physical risk profile by replacing the shared low-pressure configuration with high-pressure distribution and individual regulation. That reduced the likelihood that one district pressure event would reach many customer appliances in the same way. Yet high-pressure systems introduce their own design, regulator, service-line and excavation risks. Risk is redesigned, not abolished.

Institutional memory also must survive the brand change. The successor should preserve the original engineering packages, NTSB docket references, restoration exceptions, DPU orders, pressure-test records and corrective-action evidence under stable asset identifiers. A new logo or billing system cannot sever the lineage between an asset and the work that installed or remediated it.

For communities, departure may satisfy an accountability demand while continuity still matters. Customers need reliable heat, claim administration, clear emergency contacts and transparent rate treatment. Municipalities need current maps and liaison protocols. Small businesses need predictable restoration and road-work coordination. The operational handoff should therefore be judged from the public-service perspective as well as the transaction closing.

Durable proof is a connected control system

The most transferable lesson is that pipeline safety controls cannot remain in separate departments. The pressure regulator is connected to a sensing line; the sensing line is connected to a map; the map is connected to a work package; the package is connected to a construction sequence; the sequence is connected to the control room; the control room is connected to field isolation; field isolation is connected to municipal response. Accountability fails when any interface has no owner.

A durable evidence system would maintain seven linked records. First, an authoritative asset and control-line register with field verification and revision history. Second, a project management-of-change file showing temporary states, failure modes, approvals and hold points. Third, a professional review record identifying scope, assumptions and changed drawings. Fourth, a live operations view of safety-significant work, pressures, alarms and shutdown resources. Fifth, a contractor and municipal interface log. Sixth, an emergency chronology with maps, messages and liaison actions.

Seventh, a remedy and corrective-action ledger that distinguishes penalties, settlements, compensation, capital work and closure evidence.

Automation can enforce routing, compare GIS with work packages, alert on abandonment near regulator assets and block a closeout missing pressure-test data. It cannot determine that a field map is complete merely because all required database fields contain values. Field verification, engineering judgment and independent challenge remain necessary. Every automated exception needs a responsible person, and every manual override needs a retained reason and second review.

Boards and regulators should test the system with adverse scenarios. What happens if both regulators lose one sensing source? Can a crew abandon a main while a control line remains attached? Does an alarm show the active construction state? Can field personnel isolate the district within the modeled time? Do municipal responders receive an accurate footprint in minutes? Can the successor trace every restoration service to its pressure test and abandonment record? These questions convert reform claims into falsifiable evidence.

Closed recommendations, completed settlements and transferred assets are milestones. They are not the same as sustained control. The engineering standard is whether a single omission can still defeat pressure protection. The management standard is whether an unexpected condition stops work. The emergency standard is whether technical information reaches people making public-safety decisions. The accountability standard is whether every finding and remedy remains correctly attributed to its institution, legal process, date and evidentiary limit.

Merrimack Valley became a utility accountability test because the original failure was not confined to one pipe cut. It joined design, records, review, operations and response into one chain. Repair is credible only when those same interfaces are joined deliberately, tested repeatedly and documented well enough for workers, regulators, municipalities and the public to challenge.