TESORO HIGH PLAINS PIPELINE COMPANY LLC — Warning Letter

520075017w_warning letter_04172007_text.pdf, page 1Official PDFU. S. Department of Transportation Pipeline and Hazardous Materials Safety Administration 12300 W Dakota Ave, Suite 110 Lakewood, CO 80228 WARNING LETTER CERTIFIED MAIL - RETURN RECEIPT RE UESTED April 17, 2007 Mr. John Moore Tesoro Refining & Marketing Company 300 Concord Drive Plaza San Antonio, TX 78216 SENT TO COMPLIANCE REGISTRY Hardcopy Electronically ~ tf of Copiea&/Date ~07 CPF 5-2007-5017W Dear Mr. Moore: On February 26 through March 2, 2007, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code, inspected your procedures and records for Tesoro Refining & Marketing Company's (Tesoro) Integrity Management Program in Denver, Colorado. As a result of the inspection, it appears that you have committed probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations. The items inspected and the probable violations are: $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (8) A process for review of integrity assessment results and information analysis by a person qualified to evaluate the results and information (see paragraph (h)(2) of this section). (g) What is an information analysis? In periodically evaluating the integrity of each pipeline segment (paragraph (j) of this section), an operator must analyze all available information about the integrity of the entire pipeline and the consequences of a failure. This information includes:#

520075017w_warning letter_04172007_text.pdf, page 2(1) Information critical to determining the potential for, and preventing, damage due to excavation, including current and planned damage prevention activities, and development or planned development along the pipeline segment; (2) Data gathered through the integrity assessment required under this section; (3) Data gathered in conjunction with other inspections, tests, surveillance and patrols required by this Part, including, corrosion control monitoring and cathodic protection surveys; and (4) Information about how a failure would affect the high consequence area, such as location of the water intake. Tesoro compiled numerous sources of integrity information for the Ramberg to Dunn Center segment. However, it appears there is a discrepancy in the number of miles of pipe listed in the Baseline Assessment Plan (BAP) (81. 2 miles) and the 2006 in-line inspection (ILI) run (approximately 66 miles) for the Ramberg to Dunn Center segment. 2. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (4) Criteria for remedial actions to address integrity issues raised by the assessment methods and information analysis (see paragraph (h) of this section); (h) What actions must an operator take to address integrity issues? (2) Discovery of condition. Discovery of a condition occurs when an operator has adequate information about the condition to determine that the condition presents a potential threat to the integrity of the pipeline. An operator must promptly, but no later than 180 days after an integrity assessment, obtain sufficient information about a condition to make that determination, unless the operator can demonstrate that the 1SO-day period is impracticable. (4) Special requirements for scheduling remediation. . . Tesoro categorized the dents with echo loss on the Tesoro Alaska Pipeline as 60-day repair conditions. When the anomalies were excavated, the dents were found to include metal loss. Topside dents with metal loss are considered Immediate Repair conditions. Tesoro did not excavate other anomalies with the same signature characteristic on an expedited schedule. 3. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and -2-#

520075017w_warning letter_04172007_text.pdf, page 3surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (4) Criteria for remedial actions to address integrity issues raised by the assessment methods and information analysis (see paragraph (h) of this section); (h) What actions must an operator take to address integrity issues? (1) General requirements. An operator must take prompt action to address all anomalous conditions that the operator discovers through the integrity assessment or information analysis. In addressing all conditions, an operator must evaluate all anomalous conditions and remediate those that could reduce a pipeline's integrity. An operator must be able to demonstrate that the remediation of the condition will ensure that the condition is unlikely to pose a threat to the long- term integrity of the pipeline. A reduction in operating pressure cannot exceed 365 days without an operator taking further remedial action to ensure the safety of the pipeline. An operator must comply with Sec. 195. 422 when making a repair. The repair records for item numbers 179, 180 and 181 of your in-line inspection (ILI) assessment results were not properly documented. 4. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (6) Identification of preventive and mitigative measures to protect the high consequence area (see paragraph (i) of this section); (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (1) General requirements. An operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection. Such actions may include, but are not limited to, implementing damage prevention best practices, better monitoring of cathodic protection where corrosion is a concern, establishing shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the systems that monitor pressure and detect leaks, providing additional training to personnel on response procedures, conducting drills with local emergency responders and adopting other management controls. Tesoro identified numerous Preventive and Mitigative (PERM) measures that are already required by 49 C. F. R Part 195 e. g. monitoring for atmospheric corrosion. The Integrity#

520075017w_warning letter_04172007_text.pdf, page 4Management (IM) rule only requires the operator to identify additional P&M measures to enhance pipeline integrity. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (5) A continual process of assessment and evaluation to maintain a pipeline's integrity (see paragraph (j) of this section); (j) What is a continual process of evaluation and assessment to maintain a pipeline's integrity'? (1) General. After completing the baseline integrity assessment, an operator must continue to assess the line pipe at specified intervals and periodically evaluate the integrity of each pipeline segment that could affect a high consequence area. (2) Evaluation. An operator must conduct a periodic evaluation as frequently as needed to assure pipeline integrity. An operator must base the frequency of evaluation on risk factors specific to its pipeline, including the factors specified in paragraph (e) of this section. The evaluation must consider the results of the baseline and periodic integrity assessments, information analysis (paragraph (g) of this section), and decisions about remediation, and preventive and mitigative actions (paragraphs (h) and (i) of this section). Tesoro has not yet implemented their process for periodic evaluation. 6. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (5) A continual process of assessment and evaluation to maintain a pipeline's integrity (see paragraph (j) of this section); (j) What is a continual process of evaluation and assessment to maintain a pipeline's integrity'? (1) General. After completing the baseline integrity assessment, an operator must continue to assess the line pipe at specified intervals and periodically evaluate the integrity of each pipeline segment that could affect a high consequence area.#

520075017w_warning letter_04172007_text.pdf, page 5(2) Evaluation. An operator must conduct a periodic evaluation as frequently as needed to assure pipeline integrity. An operator must base the frequency of evaluation on risk factors specific to its pipeline, including the factors specified in paragraph (e) of this section. The evaluation must consider the results of the baseline and periodic integrity assessments, information analysis (paragraph (g) of this section), and decisions about remediation, and preventive and mitigative actions (paragraphs (h) and (i) of this section). (3) Assessment intervals. An operator must establish intervals not to exceed five (5) years for continually assessing the line pipe's integrity. An operator must base the assessment intervals on the risk the line pipe poses to the high consequence area to determine the priority for assessing the pipeline segments. An operator must establish the assessment intervals based on the factors specified in paragraph (e) of this section, the analysis of the results from the last integrity assessment, and the information analysis required by paragraph (g) of this section. Tesoro did not consider all of the risk factors listed in $195. 452(e) and (g) when establishing re-assessment intervals. 7. $195. 452 Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (7) Methods to measure the program's effectiveness (see paragraph (k) of this section); (k) What methods to measure program effectiveness must be used? An operator's program must include methods to measure whether the program is effective in assessing and evaluating the integrity of each pipeline segment and in protecting the high consequence areas. See Appendix C of this part for guidance on methods that can be used to evaluate a program's effectiveness. 7a. Tesoro must develop an independent corporate quality control (QC) functions to evaluate the effectiveness of your Integrity Management Program. 7b. Tesoro must evaluate the Performance Metrics identified in API 1160 for potential incorporation into your Integrity Management Program. Under 49 United States Code, f 60122, you are subject to a civil penalty not to exceed $100, 000 for each violation for each day the violations persists up to a maximum of $1, 000, 000 for any related series of violations. We have reviewed the circumstances and -5-#

520075017w_warning letter_04172007_text.pdf, page 6supporting documents involved in this case, and have decided not to conduct additional enforcement action or penalty assessment proceedings at this time. We advise you to correct the item{s) identified in this letter. Be advised that failure to do so will result in Tesoro being subject to additional enforcement action. No reply to this letter is required. If you choose to reply, in your correspondence please refer to CPF 5-2007-5017W. Sincerely Chris Hoidal Director, Western Region Pipeline and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 H. Nguyen {P. 118232) -6-#