IDAHO PIPELINE CORP — Warning Letter

520186018W_Warning Letter_11062018_text.pdf, page 1Official PDFWARNING LETTER CERTIFIED MAIL - RETURN RECEIPT REQUESTED November 6, 2018 Mr. Robert Rose President Idaho Pipeline Corporation P.O. Box 35236 Sarasota, FL 34242 CPF 5-2018-6018W Dear Mr. Rose: On September 5 through 8 and September 18 through 21, 2017, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code, inspected your Boise Aviation Fuel Pipeline (BAFP) in Boise, Idaho. As a result of the inspection, it is alleged that you have committed probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations (CFR). The items inspected and the probable violations are: 1. §194.105 Worst case discharge. (a) . . . (b) The worst case discharge is the largest volume, in barrel (cubic meters), of the following: (1) . . . (3) If the response zone contained one or more breakout tanks, the capacity of the single largest tank of the battery of tanks within a single secondary containment#

520186018W_Warning Letter_11062018_text.pdf, page 2system, adjusted for the capacity or size of the secondary containment system, expressed in barrels (cubic meters). Despite the fact that the response zone contained one or more breakout tanks, IDPC’s Facility Response Plan (FRP) did not address the discharge volume of the single largest tank of the battery of tanks within a single secondary containment system, adjusted for the capacity or size of the secondary containment system, expressed in barrels. The FRP worst case discharge calculation only takes pipeline volumes into consideration. There are no statements in regard to the capacity of the secondary containment system adjusting worst case discharge of any tank. 2. §194.121 Response plan review and update procedures. (a) Each operator shall update its response plan to address new or different operating conditions or information. In addition, each operator shall review its response plan in full at least every 5 years from the date of the last submission of the last approval as follows: (1) For substantial harm plans, an operator shall resubmit its response plan to OPS every 5 years from the last submission date. (2) For significant and substantial harm plans, an operator shall resubmit every 5 years from the last approval date. During the records review of Idaho Pipeline Corporation’s (IDPC) FRP, the December 11, 2014 FRP had incorrect information including inaccurate pipeline mileage and incorrect asset ownership of the receipt line. Per a discussion with the Terminal Manager, the accurate pipeline mileage is unknown and the value in the FRP is an estimate. Ownership of the receipt line changed in 2014 from Chevron to Andeavor, formerly Tesoro, and has not been documented in the FRP. 3. §195.61 National Pipeline Mapping System. (a) . . . (b) This information must be submitted each year, on or before June 15, representing assets as of December 31 of the previous year. If no changes have occurred since the previous year’s submission, the operator must refer to the information provided in the NPMS Operator Standards manual available at www.npms.phmsa.dot.gov or contact the PHMSA Geographic Information Systems manager at (202) 366-4595. 2#

520186018W_Warning Letter_11062018_text.pdf, page 3IDPC submitted an email to NPMS on April 27, 2017 stating that no changes were required to the existing NPMS data for calendar year 2016. During the records review, however, IDPC’s NPMS data was found to be incorrect. NPMS shows inaccurate pipe diameters, including a 4.5-inch pipeline which the Terminal Manager informed PHMSA does not exist. 4. §195.402 Procedural manual for operations, maintenance, and emergencies. (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies. This manual shall be reviewed at intervals not exceeding 15 months, but at least once each calendar year, and appropriate changes made as necessary to ensure that the manual is effective. This manual shall be prepared before initial operations of a pipeline system commence, and appropriate parts shall be kept at locations where operations and maintenance activities are conducted. During the records review of IDPC’s Emergency Response Plan (ERP), there was no documentation for the annual review of the ERP following the August 2014 revision. Despite the fact that the ERP requires the annual review be signed and dated by all employees, no records were retained. As a result, the ERP includes information known to be incorrect by IDPC’s Terminal Manager, dating as far back as 2009. 5. §195.402 Procedural manual for operations, maintenance, and emergencies. (a) . . . (c) Maintenance and normal operations. The manual required by paragraph (a) of this section must include procedures for the following to provide safety during maintenance and normal operations: (1) . . . (13) Periodically reviewing the work done by operator personnel to determine the effectiveness of the procedures used in normal operation and maintenance and taking corrective action where deficiencies are found. 3#

520186018W_Warning Letter_11062018_text.pdf, page 4During the records review of IDPC’s Operations and Maintenance (O&M) Manual, there was no detailed documentation for periodically reviewing the work done by the operator to determine the effectiveness of the procedures used in normal operation and maintenance, and taking corrective action where deficiencies are found. Although the O&M Manual had a signed form indicating an annual calendar year review was completed from 2009 through 2017, no information as to program effectiveness was included, nor had any corrective actions (e.g., appropriate changes made in the O&M Manual) been documented prior to Revision 3, dated 19 October 2016. As a result, there was no evidence that the O&M Manual had been updated prior to October 2016, with incorrect information dating back to 2009. 6. §195.410 Line markers. (a) Except as provided in paragraph (b) of this section, each operator shall place and maintain line markers over each buried pipeline in accordance with the following: (1) Markers must be located at each public road crossing, at each railroad crossing, and in sufficient number along the remainder of each buried line so that its location is accurately known. IDPC failed to place and maintain line markers from the Andeavor tie-in facility, across the Boise Airport grounds, and entrance into the IDPC tank facility. The lack of pipeline markers does not allow the location of the buried pipeline to be accurately known at and between these two (2) locations. 7. §195.420 Valve Maintenance. (a) . . . (b) Each operator shall, at intervals not exceeding 7 1/2 months, but at least twice each calendar year, inspect each mainline valve to determine that it is functioning properly. During the field inspection, IDPC’s Terminal Manager stated there were two (2) mainline pressure control valves in the meter run of the Andeavor tie-in that were unable to be operated due to lack of knowledge of function. These valves are downstream of the custody transfer point and belongs to IDPC. Since IDPC does not know how to operate the valves, it could not inspect these two (2) pressure control valves to determine that they are functioning properly. In addition, the valve inspection form used by IDPC does not provide clarity as to which valves are operated during inspection. 8. §195.420 Valve maintenance. (a) . . . (c) Each operator shall provide protection for each valve from unauthorized operation and from vandalism. 4#

520186018W_Warning Letter_11062018_text.pdf, page 5During the field inspection, IDPC’s valve within the Idaho Air National Guard (IANG) base was found to not be secured against unauthorized operation and vandalism. While the IANG is a gate-controlled facility, the valve is not protected against unauthorized use by those allowed in the IANG facility. The valve did not have a lock in place or security fencing to prevent unauthorized operation or vandalism of the valve. 9. §195.404 Maps and records. (a) . . . (c) Each operator shall maintain the following records for the periods specified: (1) . . . (3) A record of each inspection and test required by this subpart shall be maintained for at least 2 years or until the next inspection or test is performed, whichever is longer. IDPC failed to provide any documentation of inspection, testing, or maintenance of the firefighting equipment at the IDPC Breakout Tank Facility as required by §195.430. As a result, IDPC could not produce documentation to prove the firefighting system was in proper operating condition at all times. 10. §195.434 Signs. Each operator must maintain signs visible to the public around each pumping station and breakout area. Each sign must contain the name of the operator and a telephone number (including area code) where the operator can be reached at all times. During the field inspection, it was noted that IDPC had missing signage in required areas. Specifically, there was no signage for IDPC around the tie-in facility with Andeavor. Although signs were in place on three of the four sides of the facility, there was no signage on the eastern fence, which is exposed to the public. Further, the largest sign on the southern fence of the IDPC Breakout Tank facility, facing West Gowen Road, did not include the area code for the facility’s telephone number where the operator can be reached at all times. 11. §195.438 Smoking or open flames. Each operator shall prohibit smoking and open flames in each pump station area and each breakout tank area where there is a possibility of the leakage of a flammable hazardous liquid or of the presence of flammable vapors. 5#

520186018W_Warning Letter_11062018_text.pdf, page 6During the field inspection, it was noted that IDPC had missing signage in required areas. Specifically, there were no signs prohibiting smoking or open flames around the northern, eastern, or western fencing of the IDPC Breakout Tank facility, where there is a possibility of leakage of a flammable hazardous liquid. (The eastern and western sides of the facility are exposed to the public, while the northern fence is shared with the Boise Airport.) 12. §195.452 Pipeline integrity management in high consequence areas. (a) . . . (b) What program and practices must operators use to manage pipeline integrity? Each operator of a pipeline covered by this section must: (1) . . . (4) Include in the program a framework that - (i) . . . (ii) Initially indicates how decisions will be made to implement each element. During the record review of IDPC’s risk analysis documentation, IDPC provided no explanation as to how the risk factors are defined or how the scaling process is achieved. The risk matrix addresses the typical risk factors, and ranked from one to five. No documentation was provided describing how the scaling was determined. The risk matrix is divided into three (3) segments, in line with the FRP. Also, the breakout tanks were not included in discharge volume calculations of the FRP, therefore the inclusion of the breakout tanks in the risk analysis cannot be determined. 13. §195.452 Pipeline integrity management in high consequence areas. (a) . . . (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (1) . . . (3) Leak detection. An operator must have a means to detect leaks on its pipeline system. An operator must evaluate the capability of its leak detection means and modify, as necessary, to protect the high consequence area. An operator's evaluation must, at least, consider, the following factors-length and size of the pipeline, type of product carried, the pipeline's proximity to the high consequence area, the swiftness of leak detection, location of nearest response personnel, leak history, and risk assessment results. 6#

520186018W_Warning Letter_11062018_text.pdf, page 7IDPC failed to evaluate its leak detection capability to protect the high consequence area. Specifically, IDPC failed to consider discharge volumes of the refined products or the swiftness of its leak detection system. IDPC does not have a SCADA system, and all pumping activities are manned. Thus, all discharge calculations are based on pumping operations and pipeline volumes. As a result, tank volumes are not considered in discharge calculations. Further, the facility is typically unmanned outside of business hours, such as nights and weekends. In the event of a leak after hours, it is possible for the potential leak to not be discovered for hours or days. 14. §195.452 Pipeline integrity management in high consequence areas. (a) . . . (k) What methods to measure program effectiveness must be used? An operator's program must include methods to measure whether the program is effective in assessing and evaluating the integrity of each pipeline segment and in protecting the high consequence areas. See Appendix C of this part for guidance on methods that can be used to evaluate a program's effectiveness. IDPC failed to include methods to measure the effectiveness of its Integrity Management program. During the records inspection, IDPC failed to produce any documentation that identified the methods IDPC used to measure the program’s effectiveness, such as integrity management program performance metrics.1 15. §195.505 Qualification Program. (a) . . . (h) After December 16, 2004, provide training, as appropriate, to ensure that individuals performing covered tasks have the necessary knowledge and skills to perform the tasks in a manner that ensures the safe operation of pipeline facilities. IDPC failed to ensure that individuals performing covered tasks have the necessary knowledge and skills to perform the tasks in a manner that ensures the safe operation of pipeline facilities in accordance with §195.505(h). 1 See 49 C.F.R. § 195.452(l) (requiring operators to maintain IMP records for the useful life of the pipeline). 7#

520186018W_Warning Letter_11062018_text.pdf, page 8While reviewing inspection records associated with atmospheric corrosion, the coating condition of tanks and above ground pipe were listed as satisfactory. Field inspection of the coating of tanks and above ground piping found the coatings in disrepair. The paint coating was peeling off tanks and aboveground piping across the IDPC Breakout Tank Facility, the tie-in to Andeavor, and the Zeppelin Valve inside the IANG facility. At the soil-to-air interface of above ground piping, the pipe wrap was missing or damaged, providing minimal to no atmospheric protection. IDPC uses Energy World Net (EWN) to document their employee and contractor training and qualification. The EWN records document the Terminal Manager is qualified to perform Cathodic Protection (CP) and other corrosion-based covered tasks. The Terminal Manager stated that during the performance of OQ covered task evaluation for the CP contractor, the CP contractor was teaching him about how to perform the covered tasks. While the PHMSA inspectors were observing the Terminal Manager performing a valve operation in the field, the Terminal Manager had difficulty addressing Abnormal Operating Conditions (AOCs) related to valve maintenance and operation. When asked what AOCs might be associated with the covered task, he stated that he didn’t know and would need to review the AOCs listed in Energy World Net. 16. §195.507 Recordkeeping. (a) . . . (b) Records supporting an individual's current qualification shall be maintained while the individual is performing the covered task. Records of prior qualification and records of individuals no longer performing covered tasks shall be retained for a period of five years. Interviews with IDPC’s Terminal Manager revealed that he and the one other terminal employee would monitor each other performing covered tasks, but no records supporting their current qualifications were kept. During the records inspection of IDPC’s Operator Qualification (OQ) program, IDPC failed to provide any records for evaluation of performance of a covered task under §§ 195.505 and 195.507(a). 17. §195.579 What must I do to mitigate internal corrosion? (a) General. If you transport any hazardous liquid or carbon dioxide that would corrode the pipeline, you must investigate the corrosive effect of the hazardous liquid or carbon dioxide on the pipeline and take adequate steps to mitigate internal corrosion. 8#

520186018W_Warning Letter_11062018_text.pdf, page 9IDPC failed to determine whether the product transported would have a corrosive effect on the pipeline. During the records review, IDPC failed to provide documentation ensuring the product transported and stored is not corrosive. IDPC did not have safety data sheets, test records, or other forms of documentation from Andeavor that would confirm the corrosive effects of the transported product. As a result, IDPC could not provide any evidence that it had performed any monitoring or analysis of the product to determine if the product transported is corrosive and requires mitigation. 18. §195.579 What must I do to mitigate internal corrosion? (a) . . . (b) Inhibitors. If you use corrosion inhibitors to mitigate internal corrosion, you must— (1) Use inhibitors in sufficient quantity to protect the entire part of the pipeline system that the inhibitors are designed to protect. Although IDPC injects corrosion inhibitor at the Terminal Facility at specified rates and quantities defined by the IANG, it could not demonstrate that it did so in sufficient quantity to protect the entire part of the pipeline system that the inhibitors are designed to protect. No analysis has been performed by IDPC to understand how the corrosion inhibitor is affecting their system.2 19. §195.579 What must I do to mitigate internal corrosion? (a) . . . (b) Inhibitors. If you use corrosion inhibitors to mitigate internal corrosion, you must— (1) . . . (2) Use coupons or other monitoring equipment to determine the effectiveness of the inhibitors in mitigating internal corrosion. IDPC injects corrosion inhibitor at the Terminal Facility at specified rates and quantities defined by the IANG. IDPC has no corrosion coupons in the pipeline system, nor other methods to monitor internal corrosion to determine the effectiveness of the ongoing corrosion inhibitor injection. In addition, IDPC failed to provide documentation of corrosion inhibitor monitoring.3 20. §195.581 Which pipelines must I protect against atmospheric corrosion and what coating material may I use? (a) . . . (b) Coating material must be suitable for the prevention of atmospheric corrosion. 2 See 49 C.F.R. § 195.589(c) (requiring operators to maintain a record of each analysis to demonstrate the adequacy of corrosion control measures). 3 Id. 9#

520186018W_Warning Letter_11062018_text.pdf, page 10During the field inspection, some of the pipe was discovered to have a fresh coat of paint. IDPC’s Terminal Manager stated it was sprayed primer purchased from the local hardware store. There was no documentation to support the coating material used was an acceptable coating to prevent atmospheric corrosion. In addition, IDPC failed to provide documentation on the coating used for protection of above ground pipe or the breakout tanks. IDPC’s Terminal Manager stated he had contacted the Idaho Pipeline Corporation head office to determine what coating is allowable for the assets, but had not received a response. Primer paint is not designed to be an external coating and may degrade when exposed to elements such as water and UV light, failing to protect the system against atmospheric corrosion. 21. §195.505 Qualification program. Each operator shall have and follow a written qualification program. The program shall include provisions to: (a) Identify covered tasks. The operator's Operator Qualification program, Section 6.1, page 14 states: “All tasks IDPC performs have been evaluated with the four-part test and the tasks deemed covered have been reviewed by IDPC Facility Manager and/or designated representative.” However, the operator could not provide any records of the method which was used to develop the covered task list, nor how they evaluated the covered task to determine if it met the four-part test. No documentation could be provided showing the application of the four- part test.4 Although the operator has on OQ program, the covered task list is generic and includes covered tasks that are not perform on their system (actuated valves, pneumatic valves, repair of valve actuator (electric and hydraulic), inspect/test/calibrate pressure transmitters, etc.). Under 49 U.S.C. § 60122 and 49 CFR § 190.223, you are subject to a civil penalty not to exceed $209,002 per violation per day the violation persists, up to a maximum of $2,090,022 for a related series of violations. For violations occurring prior to November 2, 2015, the maximum penalty may not exceed $200,000 per violation per day, with a maximum penalty not to exceed $2,000,000 for a related series of violations. We have reviewed the circumstances and supporting documents involved in this case, and have decided not to conduct additional enforcement action or penalty assessment proceedings at this time. We advise you to correct the items identified in this letter. Failure to do so will result in Idaho Pipeline Corporation being subject to additional enforcement action. No reply to this letter is required. If you choose to reply, in your correspondence please refer to CPF 5-2018-6018W. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), 4 See 49 C.F.R. § 195.507 (requiring operators to maintain records that demonstrate compliance with this subpart). 10#

520186018W_Warning Letter_11062018_text.pdf, page 11along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Sincerely, Kim West Director, Western Region Pipeline and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 D. Fehling (#155754) 11#