NTSB Safety Recommendation Letter P-04-009 through P-04-011

Page 1Official PDFNational Transportation Safety Board Washington, D.C. 20594 Safety Recommendation Date: November 4, 2004 In reply refer to: P-04-09 through -11 Mr. James J. Mulva President, Chairman, and Chief Executive Officer ConocoPhillips Company 600 North Dairy Ashford Houston, Texas 77079-1175 The National Transportation Safety Board is an independent Federal agency charged by Congress with investigating transportation accidents, determining their probable cause, and making recommendations to prevent similar accidents from occurring. We are providing the following information to urge your organization to take action on the safety recommendations in this letter. The Safety Board is vitally interested in these recommendations because they are designed to prevent accidents and save lives. These recommendations address tank operations, including switch loading, at the ConocoPhillips Company (ConocoPhillips) tank farm, and the adequacy of emergency planning and emergency response by ConocoPhillips. The recommendations are derived from the Safety Board’s investigation of the April 7, 2003, storage tank explosion and fire in Glenpool, Oklahoma, and are consistent with the evidence we found and the analysis we performed.1 As a result of its investigation of this accident, the Safety Board has issued eight safety recommendations, three of which are addressed to ConocoPhillips. Information supporting these recommendations is discussed below. The Safety Board would appreciate a response from you within 90 days addressing the actions you have taken or intend to take to implement our recommendations. On April 7, 2003, about 8:55 p.m., central daylight time, an 80,000-barrel storage tank at the ConocoPhillips Glenpool South tank farm in Glenpool, Oklahoma, exploded and burned as it was being filled with diesel. The tank, designated tank 11, had previously contained gasoline, which had been removed from the tank earlier in the day. The tank contained between 7,397 and 7,600 barrels of diesel at the time of the explosion. The resulting fire burned for about 21 hours and damaged two other storage tanks in the area. The cost of the accident, including emergency response, environmental remediation, evacuation, lost product, property damage, and claims, was $2,357,483. There were no injuries or fatalities. Nearby residents were evacuated, and schools were closed for 2 days. The Safety Board determined that the probable cause of the storage tank explosion and fire was ignition of a flammable fuel-air mixture within the tank by a static electricity discharge 1 For additional information, see National Transportation Safety Board, Storage Tank Explosion and Fire in Glenpool, Oklahoma, April 7, 2003, Pipeline Accident Report NTSB/PAR-04/02 (Washington, D,C.: NTSB, 2004). 7666#

Page 22 due to the improper manner in which ConocoPhillips Company conducted tank operations. Contributing to the extent of the property damage and the magnitude of the impact on the local community was the failure of American Electric Power (AEP) employees to recognize the risk the tank fire posed to the nearby power lines and take effective emergency action. The accident occurred while diesel fuel was being transferred from Explorer Pipeline Company (Explorer) to ConocoPhillips’ tank 11, which had previously contained gasoline. In determining the cause of the accident, investigators considered static electricity within tank 11 as a possible ignition source that led to the explosion. For static electricity to cause ignition, the following must be present: generation and accumulation of a static charge, a spark gap, and, in the spark gap, a flammable mixture and a static discharge of sufficient energy to cause ignition. Operating records show that about 10:00 a.m. on April 4, as tank 11 was being drained, the level of gasoline in the tank dropped below that necessary to float the roof. When the draining operation ended, 4,994 barrels remained in the tank. The next day, April 5, between about 8:00 and 10:00 a.m., an additional 1,897 barrels of gasoline were added to the tank, but the total volume was still insufficient to float the roof. On April 6, about 3:00 a.m., a delivery of an another 1,819 barrels of gasoline was begun that would bring the amount of gasoline in the tank to 8,710 barrels. During this delivery, at about 3:30 a.m., the gasoline in the tank reached a level sufficient to again float the roof. Thus, for more than 40 hoursfrom 10:00 a.m. on April 4 until 3:30 a.m. on April 6gasoline vapor accumulated in the space between the surface of the gasoline and the floating roof. The gasoline introduced during the deliveries on April 5 and 6 displaced much of this vapor, which moved up through the two vents in the floating roof and, according to calculations, made the space between the fixed roof and the floating roof flammable. While the gasoline in the tank was being drained on April 7 in preparation for the diesel delivery, the floating roof again landed, and some of the flammable fuel-air mixture that had collected between the fixed roof and the floating roof moved down through the two vents in the floating roof to the space underneath. Calculations indicate that at this time in the operation, flammable environments existed both above and below the floating roof. The Safety Board concluded that the tank 11 operations from April 4 to 7, which included a partial draining that landed the floating roof and partial fillings before draining dry, allowed a large amount of gasoline vapor to be generated and distributed within the tank to create a flammable fuel-air mixture both above and below the floating roof. The Safety Board also concluded that all the conditions necessary for fuel vapor ignition were present in the storage tank at the time of the accident, and the explosion most likely occurred when a static discharge ignited a flammable fuel-air mixture in the space between the surface of the diesel and the floating roof. The extensive damage to the tank is consistent with the flammable fuel-air mixture above the floating roof having contributed to the force of the explosion. ConocoPhillips revised its operating procedures for the Glenpool South tank farm after the accident, but the revised procedures do not address the effect of floating roof operations on both creation and prevention of a flammable atmosphere inside a tank. Because it is possible that a floating roof can be landed inadvertently, it is important to include procedures for eliminating or minimizing any flammable vapors that tank operations may have created.#

Page 33 Regarding tank operations and procedures governing product flow rates, ConocoPhillips personnel indicated that the company’s current design procedures are based on American Petroleum Institute (API) recommended practice (RP) 2003. These procedures require that flow velocities be restricted in certain operating situations to control the electric charge in a tank. For flow velocity limitation in the case of a tank with a floating roof, such as the tank in this accident, the ConocoPhillips procedures stated that delivery of low-vapor-pressure products into an empty tank should not exceed 3 feet per second until the roof is buoyant. Discussions with ConocoPhillips personnel indicated that this statement of velocity limitation was applied to the velocity of the liquid as it exited the tee and not to the velocity of the liquid in the fill piping. However, the language of the recommended practice includes limiting the “fill line and discharge velocity of the incoming liquid stream” to control static generation. After the accident, ConocoPhillips retrofitted the fill piping in tanks 7, 8, and 12 so the fill piping system now terminates in two tees that result in four 30-inch-diameter openings inside the sump. This was reportedly done to accommodate higher flow rates from Explorer (up to Explorer’s 28,200-barrels-per-hour ultimate capacity for diesel) and still maintain a 3-feet-per- second maximum exit velocity from the tees. At 28,200 barrels per hour, the velocity in the 30- inch-diameter fill piping is 9.4 feet per second, and the exit velocity is 2.4 feet per second. For tank 11 with a single tee, applying the velocity restriction only to the exit velocity from the tee allowed the velocity in the fill piping to exceed the API recommended maximum by a factor of 2 in the filling operation at the time of the accident. For the modifications to tanks 7, 8, and 12, the installation of two tees could allow the velocity in the fill piping to exceed the API recommended maximum by a factor of 4. The investigation noted that increased flow velocity in the fill piping results in the generation of greater static charges, and when the product is a low- conductivity product (static accumulator), the excess static charge is transferred into the tank with the liquid. Adding one or more tees at the end of the fill piping does not reduce the velocity of liquid in the fill piping. The Safety Board concluded that ConocoPhillips operated in a manner that allowed tank 11 to be switch loaded at flow velocities significantly higher than those in both its own procedures and industry-recommended practices. Regarding emergency response planning, because of the proximity of the AEP power lines to the Glenpool South tank farm, it is obvious that damage, a failure, or an emergency at one facility had the potential to jeopardize the safety of the other. However, neither AEP personnel nor ConocoPhillips personnel had contacted one another to familiarize themselves with the affected facilities at the Glenpool South tank farm or to plan for a coordinated response to pipeline and electrical emergencies there. After the tank exploded, ConocoPhillips initiated contact with AEP and requested that the electric lines be inspected. Although several AEP employees and the AEP transmission system operator were aware of the fire from television news reports, AEP did not respond to the emergency at the tank farm until specifically requested to do so by ConocoPhillips. Had ConocoPhillips and AEP, as part of emergency planning, previously met to discuss and plan emergency response activities for an electric line, tank, or pipeline emergency at the Glenpool South tank farm, it is likely that AEP’s emergency response would have been more effective and that, considering the potential hazard to life and property, actions would have been#

Page 44 taken to more thoroughly assess the threat to the electric lines and the consequences of their failure. The Safety Board concluded that because ConocoPhillips and AEP did not preplan their response to emergencies near the Glenpool South tank farm, the emergency response was unsuccessful in managing the electrical hazard caused by the tank explosion and fire. As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations to ConocoPhillips Company: Revise your storage tank operating procedures to include instructions for minimizing the possibility of creating a flammable atmosphere and the occurrence of a static discharge inside a tank after a floating roof has been either intentionally or unintentionally landed, especially for tanks where switch loading is likely to occur. (P-04-09) Evaluate your storage tank operating procedures and make the revisions necessary to ensure that product flow rates in both the tank fill line and the discharge nozzles are restricted to provide a level of protection against excess static electricity that is at least commensurate with industry standards. (P-04-10) Revise your emergency response plan for the Glenpool South tank farm area and similar locations where ConocoPhillips Company facilities are near electric utilities to include preplanning with nearby electric facilities. (P-4-11) The Safety Board also issued safety recommendations to the Research and Special Programs Administration in the Department of Transportation, American Electric Power, the Institute of Electrical and Electronics Engineers, and the American Society of Mechanical Engineers. In your response to the recommendations in this letter, please refer to Safety Recommendations P-04-09 through -11. If you need additional information, you may call (202) 314-6177. Chairman ENGLEMAN CONNERS, Vice Chairman ROSENKER, and Members CARMODY , HEALING, and HERSMAN concurred in these recommendations. By: Ellen Engleman Conners Chairman#