Chevron takes safety very seriously, so making the perfect whiteboard style video to explain their procedures was very important.

Running time: 4:33

Script:

To better understand this incident, we need to examine the safeguards and understand why they failed.

But first, let’s look at the tank design and identify some of the protections that help to prevent or mitigate tank overfill. The storage tanks at this facility are equipped with two primary level indicating transmitters that transmit the level of product in the tank back to the control room. The level indicators trigger a high level alarm if the tank reaches a specified level.

Tanks also have an independent High-high level alarm, set to sound when the product reaches an even higher level in the tank. High-high level alarms are powered from the Motor Control Center on a separate electrical circuit, independent of the primary level indicators.

Additional safeguards to reduce the potential consequences of a tank overflow are provided by a berm surrounding the tank farm and by emergency shut-down systems at the refinery.

Two years prior to the overflow, the electrical distribution system was modified as part of a plant upgrade. Power circuits for the primary level indicators were moved from main breaker 15 to breaker 21. The systems were tested and power loads validated. However, the electrical drawings were never updated.

One year prior to the tank overflow, the High-High level alarm on the tank was replaced. The same model was ordered for the replacement.

After receiving the new high-high level alarm Maintenance installed it, believing it was a replacement in kind. However, the device was actually an upgraded model that required different scaling and calibration than the original unit. As a result, the high-high level alarm was not properly transmitting tank level to the control room.

The mistake was not recognized when the device was received and installed and went undetected during periodic testing programs. A week prior to the incident, the area experienced two days of heavy rainfall and water began collecting inside the berm. In accordance with procedures, the water was verified to be free of contaminants and the drain valves were opened to allow the clean rainwater to drain to the ocean.

But, after opening the drain valve, the operator was called away to another task and neglected to note the open valve on the checklist for shift change turnover. As a result, the drain valve was left open.

On the day of the incident, Tank 30 is receiving gasoline by pipeline from the refinery. Simultaneously, Jet A fuel is being off loaded to the Hilo Bay export tanker. Operations are running smoothly. Meanwhile, an electrical crew is preparing to perform maintenance at the facility’s main motor control center.

Work was permitted to isolate main breaker 21 from service, prior to performing the maintenace tasks. The work crew checks the electrical drawings and confirms with operations that the affected systems can safely be shut down. Main breaker 21 is opened, killing power to the primary level indicators on tank 30.

Procedures do not address how to respond to a loss of primary level control. Believing the High-High level alarm is still working properly, the shift supervisor decides to continue the receiving operations.

The board operator knows the fill rate and tank capacity and is about to calculate the correct time to terminate product receipt when he is distracted by a problem with the marine offloading activity.

The tank continues to fill, the High-high level alarm does not sound and the tank begins to overflow. Gasoline flows out of the berm through the open drain valve to the ocean.

Emergency teams respond immediately, but find that the spill response equipment has not been properly maintained.

Consequences of the incident include

• Loss of containment of 1000 barrels of gasoline to the ocean
• Environmental cleanup and fines
• Damage to the company’s reputation

As bad as the consequences are, they could have been much worse. An ignition source near the overflow could have resulted in a fire and possible loss of life or injury to facility personnel.