TESORO REFINING & MARKETING COMPANY, LLC — Notice of Amendment

party submissionOfficial PDF520080006M_operator response_08212008.pdf#

520080006m_notice of amendment_03132008_text.pdf, page 1Official PDFSENT TO COMPLIANCE REGIS Y Hardcopy +ctroTtiC y ii of Copiers +I Date ~ I p ii U. S. Department of Transportation Pipeline and Hazardous Materials Safety Administration 12300 W Dakota Ave, Suite 110 Lakewood, CO 80228 NOTICE OF AMENDMENT CERTIFIED MAIL - RETURN RECEIPT RE UESTED March 13, 2008 Mr. John W. Moore V. P. Pipelines, Terminals, Trucking, and Rail (PTTR) Tesoro Los Angeles Refinery 2101 E Pacific Coast Highway Wilmington, CA, 90748 CPF 5-2008-0006M Dear Mr. Moore: On December 17 through December 20, 2007, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code inspected your Integrity Management Program in Los Angeles, California. On the basis of the inspection, PHMSA has identified the apparent inadequacies found within Tesoro's plans and procedures, as described below: HCA Identification $192. 905 How does an operator identify a high consequence area? (a) General. To determine which segments of an operator's transmission pipeline system are covered by this subpart, an operator must identify the high consequence areas. An operator must use method (1) or (2) from the definition in g 192. 903 to identify a high consequence area. An operator may apply one method to its entire pipeline system, or an operator may apply one method to individual portions of the pipeline system. An operator must describe in its integrity management program which method it is applying to each portion of the operator's pipeline system. The description must include the potential impact radius when utilized to establish a#

520080006m_notice of amendment_03132008_text.pdf, page 2high consequence area. (See appendix E. I. for guidance on identifying high consequence areas. ) (b)(1) Identified sites. An operator must identify an identified site, for purposes of this subpart, from information the operator has obtained from routine operation and maintenance activities and from public officials with safety or emergency response or planning responsibilities who indicate to the operator that they know of locations that meet the identified site criteria. These public officials could include officials on a local emergency planning commission or relevant Native American tribal officials. (2) If a public official with safety or emergency response or planning responsibilities informs an operator that it does not have the information to identify an identified site, the operator must use one of the following sources, as appropriate, to identify these sites. (i) Visible marking (e. g. , a sign); or (ii) The site is licensed or registered by a Federal, State, or local government agency; or (iii) The site is on a list (including a list on an internet web site) or map maintained by or available from a Federal, State, or local government agency and available to the general public. (c) Newly identified areas. When an operator has information that the area around a pipeline segment not previously identified as a high consequence area could satisfy any of the definitions in f 192. 903, the operator must complete the evaluation using method (1) or (2). If the segment is determined to meet the definition as a high consequence area, it must be incorporated into the operator's baseline assessment plan as a high consequence area within one year from the date the area is identified. $192. 905 How does an operator identify a high consequence area? $192. 903 What definitions apply to this subpart? High consequence area (HCA) means an area established by one of the methods described in paragraphs (1) or (2) as follows: (1) An area defined as- (i) A Class 3 location under $192. 5; or (ii) A Class 4 location under f192. 5; or (iii) Any area in a Class 1 or Class 2 location where the potential impact radius is greater than 660 feet (200 meters), and the area within a potential impact circle contains 20 or more buildings intended for human occupancy; or (iv) Any area in a Class 1 or Class 2 location where the potential impact circle contains an identified site.#

520080006m_notice of amendment_03132008_text.pdf, page 3(2) The area within a potential impact circle containing- (i) 20 or more buildings intended for human occupancy, unless the exception in paragraph (4) applies; or (ii) An identified site. (3) Where a potential impact circle is calculated under either method (1) or (2) to establish a high consequence area, the length of the high consequence area extends axially along the length of the pipeline from the outermost edge of the first potential impact circle that contains either an identified site or 20 or more buildings intended for human occupancy to the outermost edge of the last contiguous potential impact circle that contains either an identified site or 20 or more buildings intended for human occupancy. (See Figure E. I. A. in Appendix E. ) (4) If in identifying a high consequence area under paragraph (1)(iii) of this definition or paragraph (2)(i) of this definition, the radius of the potential impact circle is greater than 660 feet (200 meters), the operator may identify a high consequence area based on a prorated number of buildings intended for human occupancy with a distance of 660 feet (200 meters) from the centerline of the pipeline until December 17, 2006. If an operator chooses this approach, the operator must prorate the number of buildings intended for human occupancy based on the ratio of an area with a radius of 660 feet (200 meters) to the area of the potential impact circle (i. e. , the prorated number of buildings intended for human occupancy is equal to 20 x (660 feet) [or 200 meters]/potential impact radius in feet [or meters]**2). Identified site means each of the following areas: (a) An outside area or open structure that is occupied by twenty (20) or more persons on at least 50 days in any twelve (12)-month period. (The days need not be consecutive. ) Examples include but are not limited to, beaches, playgrounds, recreational facilities, camping grounds, outdoor theaters, stadiums, recreational areas near a body of water, or areas outside a rural building such as a religious facility; or (b) A building that is occupied by twenty (20) or more persons on at least five (5) days a week for ten (10) weeks in any twelve (12)- month period. (The days and weeks need not be consecutive. ) Examples include, but are not limited to, religious facilities, office buildings, community centers, general stores, 4-H facilities, or roller skating rinks; or (c) A facility occupied by persons who are confined, are of impaired mobility, or would be difficult to evacuate. Examples include but are not limited to hospitals, prisons, schools, day-care facilities, retirement facilities or assisted-living facilities. Potential impact circle is a circle of radius equal to the potential impact radius (PIR).#

520080006m_notice of amendment_03132008_text.pdf, page 4Potential impact radius (PIR) means the radius of a circle within which the potential failure of a pipeline could have significant impact on people or property. PIR is determined by the formula r = 0. 69* (square root of (p*d Q)), where 'r' is the radius of a circular area in feet surrounding the point of failure, 'p' is the maximum allowable operating pressure (MAOP) in the pipeline segment in pounds per square inch and 'd' is the nominal diameter of the pipeline in inches. ~ Item 1A: $192. 905(a) Tesoro's High Consequence Area (HCA) identification process does not document the method used to identify HCAs. ~ Item 1B: $192. 903 The calculations performed by Tesoro's consultant, SECOR, to determine the potential impact radius (PIR) appear to use a value for the pipe diameter of 10. 52 inches, while the Tesoro IMP states that the pipe outside diameter is 10. 75 inches. This results in a lower PIR. ~ Item 1C: $192. 905(b)(1) The Tesoro HCA identification results do not indicate whether high consequence areas that were identified include the area extending axially along the length of the pipeline from the outermost edge of the first potential impact circle to the outermost edge of the last contiguous potential impact circle. ~ Item 1D: $192. 905(a) and $192. 905(b)(1)A(2) The Tesoro HCA identification does not include a systematic identification of potential identified sites in the vicinity of the pipeline. The HCA identification did not include consideration of the "Coke Barn" facility as an identified site, even though the site occupancy may meet the criteria for an identified site. Risk Assessment $192. 917 How does an operator identify potential threats to pipeline integrity and use the threat identification in its integrity program? (a) Threat identification. An operator must identify and evaluate all potential threats to each covered pipeline segment. Potential threats that an operator must consider include, but are not limited to, the threats listed in ASME/ANSI B31. 8S (ibr, see $192. 7), section 2, which are as follows: (1) Time dependent threats such as internal corrosion, external corrosion, and stress corrosion cracking; (2) Static or resident threats, such as fabrication or construction defects;#

520080006m_notice of amendment_03132008_text.pdf, page 5(3) Time independent threats such as third party damage and outside force damage; and (4) Human error. (b) Data gathering and integration. To identify and evaluate the potential threats to a covered pipeline segment, an operator must gather and integrate existing data and information on the entire pipeline that could be relevant to the covered segment. In performing this data gathering and integration, an operator must follow the requirements in ASME/ANSI B31. SS, section 4. At a minimum, an operator must gather and evaluate the set of data specified in Appendix A to ASME/ANSI B31. SS, and consider both on the covered segment and similar non- covered segments, past incident history, corrosion control records, continuing surveillance records, patrolling records, maintenance history, internal inspection records and all other conditions specific to each pipeline. (c) Risk assessment. An operator must conduct a risk assessment that follows ASME/ANSI B31. SS, section 5, and considers the identified threats for each covered segment. An operator must use the risk assessment to prioritize the covered segments for the baseline and continual reassessments ($/192. 919, 192. 921, 192. 937), and to determine what additional preventive and mitigative measures are needed ($192. 935) for the covered segment. The Tesoro IMP does not document the risk assessment process that will be used in future risk assessments. A risk assessment is needed to set priorities for integrity assessments and it is required to support evaluation of preventive and mitigative measures. Current documentation is from a Shell risk assessment process was last implemented in 2004. Potential errors were found in the risk scorecard evaluation that was part of the risk assessment at that time. IMP Section 3 does not indicate what risk assessment process will be conducted in the future. 3. Reassessment Intervals $192. 937 What is a continual process of evaluation and assessment to maintain a pipeline's integrity? (a) General. After completing the baseline integrity assessment of a covered segment, an operator must continue to assess the line pipe of that segment at the intervals specified in g 192. 939 and periodically evaluate the integrity of each covered pipeline segment as provided in paragraph (b) of this section. An operator must reassess a covered segment on which a prior assessment is credited as a baseline under g 192. 921(e) by no later than December 17, 2009. An operator must reassess a covered segment on which a baseline assessment is conducted during the baseline period specified in g 192, 921(d) by no later than seven years after the baseline assessment of that covered segment unless the evaluation under paragraph (b) of this section indicates earlier reassessment.#

520080006m_notice of amendment_03132008_text.pdf, page 6(b) Evaluation. An operator must conduct a periodic evaluation as frequently as needed to assure the integrity of each covered segment. The periodic evaluation must be based on a data integration and risk assessment of the entire pipeline as specified in g 192. 917. For plastic transmission pipelines, the periodic evaluation is based on the threat analysis specified in g 192. 917(d) For all other transmission pipelines, the evaluation must consider the past and present integrity assessment results, data integration and risk assessment information (g 192. 917), and decisions about remediation (g 192. 933) and additional preventive and mitigative actions (g 192. 935). An operator must use the results from this evaluation to identify the threats specific to each covered segment and the risk represented by these threats. The assumed corrosion growth rate used to obtain the seven year reassessment interval is not conservative. The corrosion growth analysis assumes a corrosion half life of 39 years. This is not consistent with NACE defaults and predicts slower corrosion growth than would be obtained using these default figures. Tesoro does not offer a basis for making these more optimistic assumptions. Preventive and Mitigative Measures $192, 911 What are the elements of an integrity management program? (h) Provisions meeting the requirements of $192. 935 for adding preventive and mitigative measures to protect the high consequence area. $192. 935 (a) General requirements. An operator must take additional measures beyond those already required by Part 192 to prevent a pipeline failure and to mitigate the consequences of a pipeline failure in a high consequence area. An operator must base the additional measures on the threats the operator has identified to each pipeline segment. (See $192. 917) An operator must conduct, in accordance with one of the risk assessment approaches in ASME/ANSI B31. 8S (ibr, see $192. 7), section 5, a risk analysis of its pipeline to identify additional measures to protect the high consequence area and enhance public safety. Such additional measures include, but are not limited to, installing Automatic Shut-off Valves or Remote Control Valves, installing computerized monitoring and leak detection systems, replacing pipe segments with pipe of heavier wall thickness, providing additional training to personnel on response procedures, conducting drills with local emergency responders and implementing additional inspection and maintenance programs.#

520080006m_notice of amendment_03132008_text.pdf, page 7(b) Third party damage and outside force damage— (1) Third party damage. An operator must enhance its damage prevention program, as required under $192. 614 of this part, with respect to a covered segment to prevent and minimize the consequences of a release due to third party damage. Enhanced measures to an existing damage prevention program include, at a minimum— (i) Using qualified personnel (see g 192. 915) for work an operator is conducting that could adversely affect the integrity of a covered segment, such as marking, locating, and direct supervision of known excavation work. (ii) Collecting in a central database information that is location specific on excavation damage that occurs in covered and non covered segments in the transmission system and the root cause analysis to support identification of targeted additional preventative and mitigative measures in the high consequence areas. This information must include recognized damage that is not required to be reported as an incident under part 191. (iii) Participating in one-call systems in locations where covered segments are present. (iv) Monitoring of excavations conducted on covered pipeline segments by pipeline personnel. If an operator finds physical evidence of encroachment involving excavation that the operator did not monitor near a covered segment, an operator must either excavate the area near the encroachment or conduct an above ground survey using methods defined in NACE RP-0502-2002 (incorporated by reference, see $192. 7). An operator must excavate, and remediate, in accordance with ANSI/ASME B31. SS and $192. 933 any indication of coating holidays or discontinuity warranting direct examination. (2) Outside force damage. If an operator determines that outside force (e. g. , earth movement, floods, unstable suspension bridge) is a threat to the integrity of a covered segment, the operator must take measures to minimize the consequences to the covered segment from outside force damage. These measures include, but are not limited to, increasing the frequency of aerial, foot or other methods of patrols, adding external protection, reducing external stress, and relocating the line. (c) Automatic shut-off valves (ASV) or Remote control valves (RCV). If an operator determines, based on a risk analysis, that an ASV or RCV would be an efficient means of adding protection to a high consequence area in the event of a gas release, an operator must install the ASV or RCV. In making that determination, an operator must, at least, consider the following factors — swiftness of leak detection and pipe shutdown capabilities, the type of gas being transported, operating pressure, the rate of potential release, pipeline profile, the potential for ignition, and location of nearest response personnel.#

520080006m_notice of amendment_03132008_text.pdf, page 8(d) Pipelines operating below 30'/o SMYS. An operator of a transmission pipeline operating below 30 lo SMYS located in a high consequence area must follow the requirements in paragraphs (d)(l) and (d)(2) of this section. An operator of a transmission pipeline operating below 30'/o SMYS located in a Class 3 or Class 4 area but not in a high consequence area must follow the requirements in paragraphs (d)(1), (d)(2) and (d)(3) of this section (1) Apply the requirements in paragraphs (b)(1)(i) and (b)(1)(iii) of this section to the pipeline; and (2) Either monitor excavations near the pipeline, or conduct patrols as required by g 192. 705 of the pipeline at bi-monthly intervals. If an operator finds any indication of unreported construction activity, the operator must conduct a follow up investigation to determine if mechanical damage has occurred. (3) Perform semi-annual leak surveys (quarterly for unprotected pipelines or cathodically protected pipe where electrical surveys are impractical). (e) Plastic transmission pipeline. An operator of a plastic transmission pipeline must apply the requirements in paragraphs (b)(1)(i), (b)(1)(iii) and (b)(1)(iv) of this section to the covered segments of the pipeline. ~ Item 4A: $192. 935(a) The Tesoro IMP process for evaluation of preventive and mitigative measure is not defined adequately A risk assessment was conducted in 2004, but this was performed using Shell pipeline approach that is not the approach that is intended to be used in the future. ~ Item 4B: $192. 935(b)(1) The Tesoro IMP does not require the preventive and mitigative evaluation to consider the alternatives specified in 192. 935(a). It is not clear what alternatives were considered in the risk assessment completed in 2004. ~ Item 4C: $192. 935(a) The Tesoro IMP does not document a systematic decision-making process to decide which measures are to be implemented, considering both the likelihood and consequences for pipeline failures. Res onse to this Notice This Notice is provided pursuant to 49 U, S. C. $ 60108(a) and 49 C. F. R. g 190. 237. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance ProceeCkngs. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U. S. C. 552(b), along with the complete original document#

520080006m_notice of amendment_03132008_text.pdf, page 9you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U. S. C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue a Final Order. If, after opportunity for a hearing, your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C. F. R. $ 190. 237). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. In correspondence concerning this matter, please refer to CPF 5-2008-0006M and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely~ 's Hoidal Director, Western Region Pipehne and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 J. Gilliam (¹120054) Bernadette Frieh, PTTR Environmental Compliance Manager Enclosure: Response Options for Pipehne Operators in Comphance Proceedings#