# NORTHERN NATURAL GAS CO — Notice of Amendment

**Citation:** CPF 32024027NOA  
**Type / status:** enforcement / historical  
**Agency:** Pipeline and Hazardous Materials Safety Administration  
**Effective:** Not stated  
**Published:** 2024-07-12

CLOSED notice of amendment citing 192.631(a)(1), 192.631(a)(2), 192.631(b)(4), 192.631(c)(1), 192.631(c)(2), 192.631(e)(1), 192.631(e)(2), 192.631(e)(3), 192.631(e)(5), 192.631(f), 192.631(g)(1), 192.631(h), 192.631(h)(5), 192.631(j)(2).

## Document text

Notice of Amendment involving NORTHERN NATURAL GAS CO. PHMSA's enforcement data identifies the cited regulations as 192.631(a)(1),  192.631(a)(2),  192.631(b)(4),  192.631(c)(1),  192.631(c)(2),  192.631(e)(1),  192.631(e)(2),  192.631(e)(3),  192.631(e)(5),  192.631(f),  192.631(g)(1),  192.631(h),  192.631(h)(5),  192.631(j)(2). The case was opened on 2024-07-12 and is reported as closed as of 2025-11-10. Open the official case record for notices, responses, orders, and the latest status.

Official case documents:

32024027NOA_Closure Letter_11102025_(20-188476).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Closure%20Letter_11102025_(20-188476).pdf

32024027NOA_Closure Letter_11102025_(20-188476)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Closure%20Letter_11102025_(20-188476)_text.pdf

32024027NOA_Notice of Amendment_07122024_(20-188476).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Notice%20of%20Amendment_07122024_(20-188476).pdf

32024027NOA_Notice of Amendment_07122024_(20-188476)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Notice%20of%20Amendment_07122024_(20-188476)_text.pdf

32024027NOA_Operator Response to Notice_09092024_(20-188476).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Operator%20Response%20to%20Notice_09092024_(20-188476).pdf

32024027NOA_Closure Letter_11102025_(20-188476)_text.pdf

U.S. Department
of Transportation
Pipeline and Hazardous
Materials Safety
901 Locust Street, Suite 480
Kansas City, MO 64106
VIA ELECTRONIC MAIL TO: laura.demman@nngco.com, thomas.correll@nngco.com;
November 10, 2025
Ms. Laura Demman
President & CEO
Northern Natural Gas Company
1111 South 103rd Street
Omaha, NE 68124
RE: CPF 3-2024-027-NOA
Dear Ms. Demman:
From September 8 through September 11, and September 23 through September 25, 2020, a
representative from the Pipeline and Hazardous Materials Safety Administration (PHMSA),
pursuant to chapter 601 of 49 United States Code, conducted an inspection of the procedures for
the Northern Natural Gas Company (NNG) Control Room located in Omaha, Nebraska. On July
12, 2024, pursuant to 49 CFR § 190.206, PHMSA issued a Notice of Amendment which proposed
amendment of NNG’s procedures.
NNG submitted its amended procedures, with the final submission occurring on November 10,
2025. PHMSA has reviewed the amended procedures, and it appears that the inadequacies
outlined in the Notice of Amendment have been corrected.
This letter is to inform you that no further action is necessary, and this case is now closed. Thank
you for your cooperation.
Sincerely,
David Barrett
Acting Director, Central Region, Office of Pipeline Safety
Pipeline and Hazardous Materials Safety Administration
cc: Thomas Correll, VP, Pipeline Safety and Risk, NNG, thomas.correll@nngco.com

32024027NOA_Notice of Amendment_07122024_(20-188476)_text.pdf

NOTICE OF AMENDMENT
VIA ELECTRONIC MAIL TO: mark.hewett@nngco.com, thomas.correll@nngco.com;
john.gormley@nngco.com
July 12, 2024
Mr. Mark Hewett
President and CEO
Northern Natural Gas Company
1111 S. 103rd Street
Omaha, NE 68124
CPF 3-2024-027-NOA
Dear Mr. Hewett:
From September 8 through September 11, and September 23 through September 25, 2020, a
representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA),
pursuant to Chapter 601 of 49 United States Code (U.S.C.), inspected procedures for the
Northern Natural Gas Company (NNG) Control Room located in Omaha, Nebraska. NNG
updated its Control Room Management procedures initially as a result of this inspection in 2020
and continued to work on procedure amendments with PHMSA during meetings held at various
times including those occurring in September 2022 and August 2023.
As a result of the inspection and NNG’s continued work on procedure amendments, PHMSA has
identified apparent inadequacy found within NNG’s plans or procedures. The items inspected
and the inadequacies identified are described below:
1. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) Roles and responsibilities. Each operator must define the roles and
responsibilities of a controller during normal, abnormal, and emergency operating



conditions. To provide for a controller's prompt and appropriate response to
operating conditions, an operator must define each of the following:
(1) . . . .
(4) A method of recording controller shift-changes and any hand-over of
responsibility between controllers;
NNG’s procedures 50.200, entitled “Controller Roles and Responsibilities” (Procedure 50.200),
and 50.201, entitled “Providing Adequate Information – Shift Exchange” (Procedure 50.201),
were not adequate to address any hand-over responsibility between controllers as required by §
192.631(b)(4). Specifically, while the procedures did require that a controller log-on to the
console when handing over responsibility to another controller, nothing required that the
controller leaving the console would log-off, or clarified that the SCADA system would
automatically log-off the outgoing controller after a period of time, leaving the prior controller’s
area of responsibility active.
The control room has multiple consoles (North Horsepower, North Town Border Station (TBS),
and South/Central), all three of which can monitor and control any other console’s information.
The control room procedures and SCADA system allow multiple controllers to be logged onto
the SCADA system at any given time. Some individuals that are not qualified controllers also
have access to the control room, such as the control room Director. Additionally, during certain
times, controllers have completed training on only one or more consoles but have not completed
training relevant to all of the specific consoles with the assigned area of responsibility. Procedure
50.100, entitled “Control Room Management,” required a controller to be qualified, and
Procedure 50.200 required a log-on, but nothing required a controller to perform a log-off
function. Since multiple controllers can be logged-on at the same time, and this log-on feature
sets their area of responsibility based on qualifications and supervisor’s assignment for the
specific day or night, nothing would prevent unqualified individuals from operating a console,
unless a log-off function is required.
NNG’s Procedure 50.200 in section 3.2.2 stated “[a] monthly audit will be completed to verify a
controller did not operate on a console they were not qualified for. Document any violations in a
deviation report.” However, if controllers that are qualified can stay logged on indefinitely, then
anyone in the control room (qualified or not) could access the console and execute commands or
acknowledge alarms without this being detected or discovered in the monthly audit function.
Additionally, if controllers are not required to log-out/log-off or if the SCADA system does not
automatically log-out/log-off qualified individuals within a certain time frame, individuals that
had not completed cross-training on all consoles would also be able to execute commands and
respond to information for systems they were not qualified for. By not requiring a log-off
function, the monthly audit would not be able to determine if a console had a person operating it
that was not qualified for that area of responsibility.
NNG’s procedures 50.200 and 50.201 require amendment to adequately address the hand-over
responsibility between controllers and to adequately establish and implement the monthly review
process regarding qualified controllers as described in Procedure 50.201, section 3.2.2.



2. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section . . . .
(b) . . . .
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) Implement sections 1, 4, 8, 9, 11.1, and 11.3 of API RP 1165 (incorporated by
reference, see §192.7) whenever a SCADA system is added, expanded or replaced,
unless the operator demonstrates that certain provisions of sections 1, 4, 8, 9, 11.1,
and 11.3 of API RP 1165 are not practical for the SCADA system used;
NNG’s procedure 50.202, entitled “Providing Adequate Information-SCADA Upgrade”
(Procedure 50.202), was not adequate for defining adding, expanding or replacing a SCADA
system as required by § 192.631(c)(1). Specifically, API RP 1165, section 3 Definitions, at 3.25
states that a SCADA system is, “[a] system which is a combination of computer hardware and
software used to send commands and acquire data for the purpose of monitoring and
controlling.is comprised of hardware and software.” As a result, hardware individually, software
individually, or both hardware and software can be changed in an addition, expansion, or
replacement of the SCADA system. The entire SCADA system is not required to be changed for
a SCADA system expansion or addition, or replacement to occur. Procedure 50.202 did not
clearly identify the types of hardware that when added, expanded or replaced (such as servers,
communications components, or consoles) will result in API RP 1165 implementation.
Additionally, the requirements of API RP 1165 are not just applicable to a SCADA system that
is upgraded. Other statements within NNG’s procedure were not clear regarding meaning as
well, such as the following:
3.6 Northern considers an expansion of the SCADA system as the addition of a
real-time/historical environment integrated into the current SCADA systems.
Current SCADA systems include the primary, backup and model office/test
systems.
This statement should be clarified as to whether or not it means a software or a hardware change
as well. Further, neither the procedure nor the engineering standard for the HMI referenced in the
procedure (NNG’s procedure, entitled “ES 5675 General Specifications for HMI”) provided
clarity on what record would be used to demonstrate compliance with the implementation of API
RP 1165 sections 1, 4, 8, 9, 11.1, and 11.3, per § 192.631(j)(1).
Procedure 50.202 requires amendment to adequately address the types of individual hardware or
individual software changes that will result in implementation of the appropriate sections of API



RP 1165. Additionally, the record that will be used to demonstrate API RP 1165 has been
implemented needs to be added to the procedures.
3. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section . . . .
(b) . . . .
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) . . . .
(2) Conduct point-to-point verification between SCADA displays and related field
equipment when field equipment is added or moved and when other changes that
affect pipeline safety are made to field equipment or SCADA displays;
NNG’s procedure 50.203, entitled “Providing Adequate Information – SCADA Point to Point
Verification” (Procedure 50.203), and ES-0165 entitled “Turnover/Start-Up Procedure for New
Construction ” (ES-0165), along with various engineering commissioning checklists, were not
adequate to define point-to-point verifications between SCADA displays and related field
equipment when field equipment is added or removed and when other changes that affect
pipeline safety are made to field equipment or SCADA displays as required by § 192.631(c)(2).
Specifically, Procedure 50.203 stated in section 3.1:
For the purposes of this procedure, Northern considers adding or moving field
equipment (including but not limited to compression station equipment, meters,
transmitters and valves) to be defined as a change that affects the data
communication to the SCADA system from monitoring devices such as a remote
terminal unit (RTU) or programmable logic controller (PLC). This is further
defined as a field equipment change that results in an addition or change in RTU
or PLC address for a safety related alarm point. This type of change would require
the SCADA support team and field representative to perform a point-to-point
verification between the SCADA system and the field end device in order to
ensure gas controllers are viewing correct data.
NNG’s Procedure 50.203 was not clear that either a change in data communication to SCADA,
or, separately, a change or addition to an address would result in a point to point being
conducted. This requires amendment because while a change in a transmitter range could result
in a loss of communication during the replacement depending on how this was performed in the
field, the addressing may remain the same, but the range of the device would change, and it is
not clear if data communication such as loss of communication is considered. Data



communication may only mean a change in address or method of communication, and this would
not adequately ensure gas controllers are viewing correct data. Clarification to procedures should
include requiring flow computer changes to result in point-to-point verifications as well.
Further, NGG’s inadequate point-to-point verification procedures impacted alarm management
procedures, required under § 192.631(e)(1). Procedure 50.203, section 5.1.2, stated, “[c]alculated
points set up for processing alarms will be validated when points are added or deleted.
Communication from the new point will be cycled from on to off and verify the loss of
communication changes the calculated points color.” However, it would be possible for a point
involved in a calculation to have the same point with the same address used but the range
changed, and that range change could impact the calculation. This would only work correctly if
the calculated point did not have any separate alarm setpoints. For example, this would not be
accurate for a calculated point such as that for a pack alarm as defined in the Alarm Management
plan referenced as 50-400.
Additionally, Procedure 50.203 section 5.1.15 stated:
For project related SCADA display changes, a field technician or engineering
representative will submit a SCADA screen change EATS ticket and installation
report documenting SCADA point requirements for the screen prior to the work
being performed. The EATS ticket will be approved by a designated
representative from gas control. For non-project related SCADA display changes,
a designated representative from gas control will submit a SCADA screen change
EATS ticket to the SCADA support team. The display and point-to-point
validation will be conducted per 5.1.14.
However, nothing required that these changes be made before the project related assets are
pushed to the controllers or become operational and this would clearly be required for the
controllers to have the necessary information and tools to complete their roles and
responsibilities.
Also, it was not clear how other aspects of point-to-point will be conducted and when. From
Procedure 50.203, nothing was specially described regarding logic testing. Logic testing would
be required for ESD applications, or elements such as valve status alarming on emergency
valves. An alarm condition would be detected and alarmed on when the valve did not complete
the command sequence within a certain amount of time. While Procedure 50.203 did reference
the following ES 0165 procedures and the associated commissioning checklists,
ES 0165 - Turnover/Start-Up Procedure for New Construction;
ES 0165e - Appendix E: Fire and Gas System Commissioning Checklist;
ES 0165k - Appendix K: SCADA Commissioning Checklist; and
ES 0165v - Appendix V: ESD Commissioning Checklist;
it was not clear whether this is only achieved by testing with air. Air testing would not be
sufficient in some cases to confirm adequate information is available for controllers, as timing
and operation can be impacted when the commodity is added to the pipe, thus impacting the



timing of adequate alarming. It was also not clear from procedures how the deficiencies
identified during the commissioning (known as COMM list) are addressed before the controller
is required to operate the system. This is noted as in ES 0165k, as it stated in the Instructions
section, “[i]f a station was partially validated, provide a list of points that were left in the
“COMM” group to DL-Gas Control.” The COMM list or group should not have any elements
that could impact safety implemented for the controller before completely tested and this is not
clear in procedures.
Section 192.631(e)(1) requires accurate alarms and is not time dependent so this would apply
any time commodity is in the pipeline (regardless of flowing or not) and would impact point-to-
point activities.
Finally, neither Procedure 50.203 nor the procedures referenced in ES-0165 defined how loss of
communication is checked on point types beyond that of Calculated Points. Loss of
communication is an alarm that must be checked to operate correctly through a point-to-point
prior to operation. The procedures did not define how valve status alarms, various aspects of
power including UPS systems, or man down alarms would receive a point-to-point as required.
Procedures were not clear on how simulation would be noted in the point-to-point documentation
and that the location of the simulation would be identified, as this can impact whether or not the
controller has sufficient information to complete their roles and responsibilities upon point-to-
point completion.
Procedures 50.203 and ES-0165 with associated commissioning checklists require amendment to
sufficiently clarify these elements identified and to sufficiently address the requirements of
§ 192.631(c)(2) and § 192.631(e)(1). Further these procedures need to clarify points that can
impact safety as required by § 192.631(c)(2).
4. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator’s plan must include provisions to:
(1) Review SCADA safety-related alarm operations using a process that ensures
alarms are accurate and support safe pipeline operations;
NNG’s Procedure 50.400, entitled “Alarm Management,” was not adequate as it did not clearly
define how a review is conducted on alarms to ensure accuracy and the support of safe pipeline
operations as required by §§ 192.631(e) and 192.631(e)(1). Specially, Section 192.631(e)
requires the Alarm Management plan to provide for effective controller response to alarms, and



must include provisions to review SCADA safety-related alarm operations using a process that
ensures alarms are accurate and support safe pipeline operations. Yet the Procedure 50.400 was
not clear as to which points will be reviewed to ensure accuracy and that the alarms are set to
support safe pipeline operations.
LoLo pressure alarms were identified as a Critical Alarm A priority 2 in Appendix A and not as a
Safety Related Alarm Priority 1. It was not clear in procedures if this priority of alarm would be
reviewed to ensure accuracy and the support of safe pipeline operations.
Similarly, Appendix A identified an alarm priority called Safety-Related Priority 1. However,
not all alarms that support safe-pipeline operations were found in this priority. For example,
Priority 8 was communication failure. Communication failure is an alarm state that is necessary
to support safe operations. Additionally, valve alarms associated with incorrect commanded
status or a valve that has not achieved a commanded state within a certain amount of time were
not identified in Appendix A. Only ESD valves are identified as Safety-Related Priority 1. The
priority and alarm function associated with other valves was unknown. Yet valves were defined
as a point that is Safety-Related in section 3.1.8 of Procedure 50.400. The procedure needs to
clarify if all points that are safety related, regardless of Alarm Priority, will be reviewed to
ensure the setpoints or values are accurate and support safe operation.
Also, Appendix A indicated H2S Delivery pressure would have a priority of 1 called Safety-
Related Alarm, but other information indicated that H2S high limit in composition would be a
Safety Related Alarm Priority 1 with delivery pressure treated difference as a Critical Alarm A
Priority 2. Because the Safety-Related alarm priority was not the only priority group that must be
accurate and established to support safe operations, it was not clear from Procedure 50.400 how
these types of alarms in Priority 2 would be reviewed.
The operator identified verbally during the inspection and confirmed this information during
follow-up meetings as late as August 2023 that rate-of-change (ROC) alarms exist on certain
points. However, ROC alarms were not described in the Procedure 50.400 nor listed on the
Appendix A: Alarm and Alert priorities table. As a result, it was not clear if these alarms would
be reviewed to support safe pipeline operations or what priority would be relevant.
Finally, Procedure 50.400 defined “Safety-Related Point” in section 3.1.8 as an “input or output
point on the system that when it exceeds allowable levels results in a safety-related alarm or has
the potential to develop into abnormal operations or a safety-related condition. Input points
include pipeline and station inlet and outlet pressures, pressure regulating inlet and outlet
pressures, delivery pressures, calculated line pack values, flow rates, valve operation, fire
detection, gas detection, H2S detection, smoke detection, temperatures associated with the gas
cooling and high filter separator levels. Output points include set points for pressure and turbine
speed control, command for valve control, station isolation and unit shutdowns.” However, not
all of these types of points were clarified as having a priority on Appendix A, such as flow rate
or pack. If this is because alarms are not set on these two types of inputs or as an output, this
should be clarified in the Alarm Management procedure 50.400 as it was not clear why these
were not listed in Appendix A.



Procedure 50.400 and Appendix A require amendment to clearly define how and on what
specific points (including the various priorities) a review is conducted on alarms to ensure
accuracy and the support of safe pipeline operations as required by §§ 192.631(e) and
192.631(e)(1).
5. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator’s plan must include provisions to:
(1) . . . .
(2) Identify at least once each calendar month points affecting safety that have been
taken off scan in the SCADA host, have had alarms inhibited, generated false
alarms, or that have had forced or manual values for periods of time exceeding that
required for associated maintenance or operating activities;
NNG’s Procedure 50.400 entitled “Alarm Management,” was not adequate as it did not clearly
describe how the identification at least once each calendar month will be accomplished for points
that affect safety that have been taken off scan in the SCADA host, had alarms inhibited,
generated false alarms or that have forced or manual values for period of time exceeding that
required for associated maintenance or operator activities as required by §§ 192.631(e) and
192.631(e)(2). Specifically, section 5.4 of Procedure 50.400 stated:
5.4 Reports and analysis will be conducted on a monthly or annual basis as defined below to
demonstrate compliance and measure effectiveness.
• 5.4.1 An alarm/alert review process will be completed at least once each calendar month.
This review will consist of the following:
o 5.4.1.1 Review the number of Safety-Related Alarms that have occurred, been
suppressed, manually overridden, points taken off-scan, shown to be false or had
alarm limits changed and include in the monthly report.
o 5.4.1.1.1 Gas controllers shall include actions taken on all Safety-Related
alarms received in the daily log.
o 5.4.1.1.2 Sequential alarms received during the day due to maintenance
activities can be consolidated in one daily log entry.
o 5.4.1.2 Review the number of Alarms/Alerts that have occurred, been suppressed,
manually overridden, points taken and off-scan to identify excessive
reoccurrences and include in the monthly report.
o 5.4.1.2.1 The top 10 alarms and alerts from each console will be reviewed
monthly to determine the source of the alarm and if limits require



adjustment.
o 5.4.1.3 Review points with frozen data from RTUs, PLCs or SCADA that are not
caused by loss of communications.
o 5.4.1.4 Review RTU communication outages and document the duration and
actions to resolve the outage.
o 5.4.1.5 Parked alarms and alerts will be reviewed on a continuous basis and
addressed as appropriate.
o 5.4.1.6 The manager of gas control or designee shall document and track
deficiencies in EATS and follow up with proper departments to ensure excessive,
nuisance, false, parked, suppressed and manually overridden indications are
addressed in a prompt manner.
Section 195.446(e) requires the operator to have an alarm management plan that will provide for
effective controller response to alarms. As such, controllers are only a part of the Alarm
Management process that will identify what must be reviewed for points that can impact safety
each month as required by 195.446(e)(2) and have deficiencies addressed as required by
195.446(e)(6). The following is not clear from procedures:
1. 2. 3. 4. 5. 6. How the review of calculated points and associated alarming if the point can impact
safety will be included on a monthly basis (such as total flow through a station).
How frozen data (or forced data) at the Remote Terminal Unit (RTU), Programmable
Logic Controller (PLC) or in SCADA will be detected and reported on is not clear.
Controllers are not the only individuals that this could be reported by. For example,
field technicians or SCADA personnel could identify forced data on points that can
impact safety, or automatic programming can identify this information, but it is not
clear in procedures what is being done.
How standing alarms and alerts will be reported on and identified each month when
associated with points that can impact safety was not clear in procedures. While this
is described as a continuous review process, if it is associated with a point that can
impact safety, it would be a point when in alarm is required to be part of the monthly
review and would require addressing.
How points taken off-scan will be identified or reported on. Again, this should not fall
only to the controllers to identify, as SCADA personnel can impact this change and
this may not be evident to the controller.
How the alarm inhibit function will be detected and reported on each month. While
controllers can report on certain aspects of this function, others may also perform this
task, such as SCADA, and this must be identified as well. Suppression may be in
place at the time of the monthly report, and this would not be clearly identified
without a reporting function being established.
How false alarms will be determined was not clear in procedures. While false alarms
may include chattering or nuisance alarms as described in Procedure 50.500, section
5.4.1.2, it is not the only potential source for false alarms. Section 3.1.5 defined a
false alarm. However, it was not clear if controllers receive an alarm from the field
due to maintenance activities, but they were not notified in advance of this activity, if



7. 8. 9. this would result in a false alarm and if so, how this would be included in the monthly
review and addressed as required by section 5.4.1.6.
The process as described in Procedure 50.400 did not include points that can impact
safety that have been in manual for periods of time exceeding that required for
associated maintenance or operating activities. This would include if remote/manual,
hand/off/auto, or remote/local switching can occur in the field on a valve or
compressor such that, if the remote function is removed from the controller (placed in
manual, local, hand, etc.) for periods exceeding associated maintenance or operating
activity requirements as part of the monthly report, and address the identified
deficiencies.
How loss of communication will be determined and reported on.
The process as described in Procedure 50.400 and did not include what specific
reports or data sources will be reviewed as part of the monthly review process, such
as emails being provided when alarm setpoints or limits are moved, alarm/event logs,
RTU communication reports, or daily logs. It also did not clarify what information
will be used as the record to demonstrate this has been sufficiently accomplished each
month.
Procedure 50.400 requires amendments to clarify how the reviews identified in 5.4.1 will be
accomplished, what data sources will be used as inputs for the monthly review process (emails,
specific reports, controller shift logs, alarm/events logs, etc.), and how the output will be
recorded (EATS and Summary files, etc.) to complete the monthly review required by §
192.631(e)(2). Additionally, the amendments need to address how aspects of points taken off-
scan, forced data, alarms inhibited, false alarms, and manual conditions on points affecting safety
will be identified monthly.
6. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator's plan must include provisions to:
(1) . . . .
(3) Verify the correct safety-related alarm set-point values and alarm descriptions at
least once each calendar year, but at intervals not to exceed 15 months;
NNG’s Procedure 50.400 did not adequately define the process used to verify the correct safety-
related alarm set-point values and alarm descriptors at least once each calendar year, but at
intervals not to exceed 15 months as required by § 192.631(e)(3).



Specifically, Procedure 50.400 section 5.4.2 stated:
• 5.4.2 An alarm/alert review process will be completed annually, but at intervals
not to exceed 15 months.
o 5.4.2.1 The review process will consist of verifying the correct Safety-Related Alarm
set point values and descriptions. Additionally, the alarm management procedure will
be reviewed as part of this process to determine effectiveness.
o 5.4.2.2 The annual review process will include an analysis of safety-related points to
ensure continued applicability.
o 5.4.2.3 The annual review process will utilize the Annual Safety-Related Alarm
report and Annual Alarm Management Plan Review Report.
o 5.4.2.4 Remedies to improve alarm or alerts include:
o Optimizing set points
o Addressing chattering or flooding alarm/alerts
o Evaluating priority levels for alarms/alerts
o Determining if an alert should be moved to an alarm
o Determining if an alarm should be moved to an alert
o 5.4.2.5 The manager of gas control or designee shall follow up with proper
departments to ensure deficiencies are addressed in a prompt manner.
During the inspection, NNG verbally explained that the process involved creating a list of the
alarm setpoint values and alarm descriptors per location by the control room with SCADA
assistance. This information was then sent to the various field locations for field personnel to
sign off on the correct alarm setpoint values per point and the alarm descriptors. However, none
of this was described as part of the process in Procedure 50.400, nor were the reports noted in
section 5.4.2.3 included as part of NNG’s Alarm Management procedure. It was not clear that
either one or both reports identified in section 5.4.2.3 were developed using the existing SCADA
system data or a Master Alarm Database separate from the SCADA system. It was also not clear
how changes that have been processed through EATS or as part of other MOC processes would
be confirmed to still be in place for relevant temporary or permanent changes. How verification
of alarm setpoint values and alarm descriptors is performed was not adequately defined in
Procedure 50.400.
Procedure 50.400 requires amendment to describe how the requirements of § 192.631(e)(3) will
be implemented.
7. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .



(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator's plan must include provisions to:
(1) . . . .
(5) Monitor the content and volume of general activity being directed to and
required of each controller at least once each calendar year, but at intervals not to
exceed 15 months that will assure controllers have sufficient time to analyze and
react to incoming alarms;
NNG’s Procedure 50.400 was not adequate to assure that controllers have sufficient time to
analyze and react to incoming alarms as required by § 192.631(e)(5). Specifically, Procedure
50.400 section 5.5.2 stated that during the review process the data collected will be analyzed to
determine if the volume of activity processed by the gas controller is at a level that does not
jeopardize the safe operation of NNG facilities. Section 5.5.2.2 stated that NNG will measure the
controller's workload against internally defined Key Performance Indicators (KPIs) to ensure the
controller performance is adequate. However, which specific KPIs will be used has not been
defined. KPIs need to be defined before the analysis is able to be completed and documented.
This is significant to Procedure 50.400 being developed correctly as designed and then
implemented. Also, Procedure 50.400 did not clearly state where KPIs would be recorded and
how these selected KPIs would be used to determine the volume of activity was at a level not to
jeopardize the safe operation of NNG facilities.
Additionally, review of controller workload is required to determine that the controller has
sufficient time to analyze and react to incoming alarms. While KPIs are certainly part of that
answer when selected correctly, without reviewing the time required for controllers to
acknowledge alarms and respond based on priority, the process to confirm controllers have
sufficient time to analyze and react to incoming alarms is incomplete. NNG’s alarm
rationalization process may need to be adjusted and redone if the designed and expected time of
response by priority cannot be achieved by controllers. Adjusting and redoing the alarm
rationalization process was not clearly required in NNG’s procedures.
Finally, how deficiencies associated with this workload analysis will be addressed and recorded
is not adequate as defined in Procedure 50.400 section 5.5.2.1. Section 5.5.2.1 explained:
If the analysis reveals deficiencies, the gas control manager will take steps
necessary to ensure safe operation of facilities by:
• Reducing the volume of phone calls
• Reviewing changes that have been made to the overall operations
• Exploring and implementing automated recordkeeping processes
• Reviewing the need and applicability of alerts
• Requesting staffing additions
• Requesting controller input
• Other actions as identified.
However, it is not clear that “other actions as identified” would include actions such as console
additions, console asset reassignment, or a change to the alarm rationalization process. These



three actions are also types of changes that impact the time for controllers to respond to alarms.
NNG’s procedures need amendment to clarify that these three actions are also possible outcomes
of a workload study.
Procedure 50.400 requires amendment to clarify how NNG will determine that that the volume
of alarms does not jeopardize the safe operation of NNG facilities, to identify the specific KPIs
that will be used, and to clarify that other actions as identified would include at least console
additions, console asset reassignment, and changes to the alarm rationalization process.
8. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section….
(2) The procedures required by this section must be integrated, as appropriate,
with operating and emergency procedures required by §§192.605 and 192.615. An
operator must develop the procedures no later than August 1, 2011, and must
implement the procedures according to the following schedule. The procedures
required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must
be implemented no later than October 1, 2011. The procedures required by
paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later
than August 1, 2012. The training procedures required by paragraph (h) must be
implemented no later than August 1, 2012, except that any training required by
another paragraph of this section must be implemented no later than the deadline
for that paragraph.
(b) . . . .
(f) Change management. Each operator must assure that changes that could affect
control room operations are coordinated with the control room personnel by
performing each of the following:
(1) Establish communications between control room representatives, operator's
management, and associated field personnel when planning and implementing
physical changes to pipeline equipment or configuration;
(2) Require its field personnel to contact the control room when emergency
conditions exist and when making field changes that affect control room
operations; and
(3) Seek control room or control room management participation in planning prior
to implementation of significant pipeline hydraulic or configuration changes.
NNG’s operating procedures 50.500, entitled “Control Room Change Management” (Procedure
50.500), and 10.310, entitled “Management of Change” (Procedure 10.310), were not adequate
to establish communications between the control room representatives, operator’s management
and associated field personnel when planning and implementing physical changes to pipeline
equipment or configuration as required by § 192.631(f), including §§ 192.631(f)(1),



192.631(f)(2), and 192.631 (f)(3). Additionally, procedures relevant to § 192.631(f) were not
properly integrated, as required by § 192.631(a)(2), and did not identify the records to
demonstrate compliance as required by § 192.631(j)(1). Specifically, Procedure 50.500 did not
reference Procedure 10.310, when cross reference is clearly necessary. Procedure 50.500 is used
for certain types of changes, permanent and temporary, that affect the control room. Procedure
10.310 was used when projects are being planned and physical changes implemented including
changes to equipment or configurations or significant pipeline hydraulic or configuration
changes that would also impact the control room. Both of these procedures impact change that
could affect control room operations and require coordination with control room personnel.
Further Procedure 50.500 did not clarify how changes from the implementation of Procedure
10.310 would only result in one or more of the three following plans: a Gas Management Plan
(GMP), a Facility Operating Plan (FOP), or a Configuration Plan. Similarly, while the Enterprise
Action Tracking System (EATS) was referenced in both Procedure10.310 and Procedure 50.500,
it was not clear what types of changes created by Procedure 10.310 would be sent in EATS for
control room required notification. Procedure 10.310 also did not include specifics around
notification to the control room or to control room management or reference Procedure 50.500.
Procedure 10.310 in section 1, entitled “Purpose,” explained that the procedure includes the
identification and consideration of permanent or temporary, technical, physical procedural and/or
organizational changes that impact pipeline integrity, liquid natural gas (LNG) facilities, and
underground storage facilities including high consequence areas (HCAs) and the effect these
changes might have. The procedure also included the basic criteria outlined in ASME/ANSI
B31.8S Section 11 and fulfills the requirements § 192.911(k) and API RP 1173, Pipeline Safety
Management Systems, Section 8.3. However, the Procedure 10.310 did not reference the Control
Room requirements set forth in §§ 192.631(f)(1), (2), or (3) and was not appropriately integrated
with the control room requirements as required by § 192.631(a)(2). This is significant because
many of the requirements in this procedure regarding permanent or temporary changes could
impact the control room and have not appropriately been considered for integration,
communication and coordination, or for required control room notification when making changes
that affect the control room as required.
Additionally, Procedure 50.500 section 5.9 requires modification as it did not clearly state how
the representative from facility planning will be communicating and coordinating with the
control room as required. NNG’s Procedure 50.500 section 5.9 stated:
Gas control or facility planning personnel shall participate in planning meetings
for construction projects that have the potential to cause significant system
hydraulic changes or require a configuration change. The meetings shall take
place well in advance of the proposed hydraulic or configuration change to ensure
control room or facility planning personnel provide input, understand and are
prepared to act on the proposed changes. Participation in the meetings shall be
documented in any of the following documents:
• Level A or Level B estimate review process
• Stakeholder meeting notes detailed in Asite
• Communications through the Outage Tracker



• Review and approval through the GMP process
• Email communications for the System Operation Weekly Overview meeting.
The requirements of §§ 192.631(f)(1), (2), and (3) are specific to the control room or control
room management and the requirement of facility planning alone, as described in section 5.9, did
not meet the requirements of these subsections. Additional description is needed to establish how
the representative from facility planning will be communicating and coordinating with the
control room.
Additionally, based on the items identified in Procedure 50.500 section 5.9, section 6.0, which
discussed NNG’s record keeping, would be required to also include all of these aspects such as
Asite, and Outage Tracker and email communications. The list of maintained records in section
6.0 did not include any of the documents to be created to record the planning meetings required
in section 5.9, nor did it include all of the elements identified in Section 5.9 but these would be
required records for demonstrating compliance with §§ 192.631(f) and (j)(1).
Procedure 50.500 requires clarification in Section 5.10 and 5.11 regarding how the
communication will occur and what record of that communication would demonstrate
compliance. Procedure 50.500 section 5.10 explained, “IT emergencies are coordinated through
the IT EMRT team. The SCADA manager is a member of the IT EMRT team and will contact
the OCC when emergency conditions exist that have potential to affect the SCADA system and
gas control operations. The OCC representative will contact gas control.” Section 5.11 explained,
“[t]he SCADA manager or SCADA IT personnel will contact the OCC when emergency
conditions exist that have potential to affect the SCADA system and gas control operations. The
OCC representative will contact gas control.” Neither section 5.10 nor 5.11 clearly identified
how this communication and contact with gas control will occur (verbally, email, etc.) and what
record(s) will be used to demonstrate compliance (shift log, email, etc.). These sections require
amendment to know how this communication and contact will occur and what records will be
used to demonstrate compliance.
Finally, Procedure 50.500 requires amendment to correct a reference used in Section 5.12. Section
5.12 stated, “[c]hanges to the SCADA system will be communicated with gas control personnel
through processes established in operating procedure 50.220 Providing Adequate Information -
SCADA Upgrade.” The “operating procedure 50.220” did not exist. However, a Procedure 50.202,
entitled “Providing Adequate Information - SCADA Upgrade,” did exist, so the reference 50.220
needs corrected to 50.202.
NNG’s operating Procedures 50.500 and 10.310 require amendments to sufficiently address the
requirements of §§ 192.631(f)(1), (f)(2) or (f)(3) and to be properly integrated, as required by
§ 192.631(a)(2), in order to correct references and clarify records to demonstrate compliance as
required by § 192.631(j)(1).
9. § 192.631 Control room management.
(a) General.



(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .
(g) Operating experience. Each operator must assure that lessons learned from its
operating experience are incorporated, as appropriate, into its control room
management procedures by performing each of the following:
(1) Review incidents that must be reported pursuant to 49 CFR part 191 to
determine if control room actions contributed to the event and, if so, correct, where
necessary, deficiencies related to:
(i) Controller fatigue;
(ii) Field equipment;
(iii) The operation of any relief device;
(iv) Procedures;
(v) SCADA system configuration; and
(vi) SCADA system performance.
NNG’s Procedure 50.600, entitled “Control Room Management Operating Experience –Review
of Reportable Incidents,” was not adequate to meet the requirements of §§ 192.631(g)(1) and
(j)(1). Specifically, Procedure 50.600 section 5.1 did not describe what NNG will review to
determine whether or not the control room actions contributed to the reportable event, section 5.2
failed to address adequately contributory control room actions, and section 5.3 incorrectly
describes when a review is necessary.
Procedure 50.600 section 5.1 stated:
If a regulatory agency reportable incident occurs, an OCC call will be completed to
ensure appropriate stakeholders are informed. Gas control management will
immediately complete an investigation to determine if controller or control room
actions caused or may have contributed to the event. The vice president of gas
control or designee(s) will utilize Form 50.600a Control Room Management
Reportable Incident Review Form to conduct and document the investigation.
Results of the investigation will be immediately reported to the incident
commander, human resources and the legal department to determine if there is a
requirement for drug and alcohol testing as stated in operating procedure 10.103
Investigation of Accidents & Failures.
However, Form 50.600a only referenced the required information on the 30-day written report
(PHMSA Form 7100.2) which is provided by the operator. This is significant because in both
PHMSA Form 7100.2 and NNG’s Form 50.600a there is an option to select the answer “No, the
operator did not find that an investigation of the controller(s) actions or control room issues was
necessary…” NNG’s procedures indicated that if this option was selected, that a review of
whether or not the control room operations contributed to the event was not required. Regardless
of the content of PHMSA Form 7100.2, the review of a reportable incident is required by §



192.631(g)(1) to determine if the control room actions contributed to the event. How this review
will be conducted and what documentation will be reviewed was not sufficiently identified in
procedures. Additionally, what records would be kept in order to demonstrate this review was
performed is not defined as required by § 192.631(j)(1).
Additionally, Procedure 50.600 section 5.2 stated:
If it is determined that the cause of a reportable incident was attributed to one or
more of the following, deficiencies shall be corrected, and a lesson learned review
will be conducted. Lessons learned from the review will be incorporated, as
appropriate, into control room management procedures and the control room
management training program, to prevent recurrence.
5.2.1. Controller fatigue
5.2.2. Operator error or misdiagnosis
5.2.3. Field equipment failure (impacting control room operations)
5.2.4. Control room management procedures
5.2.5. SCADA system configuration
5.2.6. SCADA system performance.
However, section 5.2 misstated the requirements of § 192.631(g)(1); the control room
contribution must be reviewed even if the control room was not the cause of the reportable
incident.
Further, § 192.631(g)(1) requires that for a reportable incident, a review to determine whether
control room actions contributed to the event must be completed, and if the operator determines
that control room activities did contribute to the event, the operator must correct, where
necessary, deficiencies related to controller fatigue; field equipment; the operation of any relief
device; procedures; SCADA system configuration; and SCADA system performance. However,
NNG’s procedures included “[o]perator error or misdiagnosis” in place of operation of any relief
device, and placed the clarification on field equipment failure around “impacting the control
room operations.” Thus, Procedure 50.600 misstated the requirements of § 192.631(g)(1).
Also, Procedure 50.600 section 5.3 stated, “[i]f an incident occurs that requires a Pipeline and
Hazardous Materials Safety Administration Form 7100.2 (Rev. 01-2010) Incident Report – Gas
Transmission and Gathering Systems to be completed and submitted and any items of Part E,
Additional Operating Information – numbers 6, 7 or 8 are attributed to the incident, then this
operating experience procedure review shall be performed. All lessons learned documentation
shall be maintained as a training record.” However, Procedure 50.600 should be implemented
regardless of NNG’s answers to number 6, 7 or 8 on PHMSA Form 7100.2.
Procedure 50.600 requires amendment to clarify how NNG’s review will be conducted to
determine if control room actions contributed to the event and what records outside of PHMSA
Form 7100.2 will be kept in order to demonstrate that review did occur, regardless of answers to
6, 7 or 8 on the PHMSA Form 7100.2. Also, the procedure requires amendment to clarify and



meet the requirements of § 192.631(g)(1) for the identified condition specifics and the correction
of deficiencies.
10. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section . . . .
(b) . . . .
(h) Training. Each operator must establish a controller training program and
review the training program content to identify potential improvements at least
once each calendar year, but at intervals not to exceed 15 months. An operator's
program must provide for training each controller to carry out the roles and
responsibilities defined by the operator . . . .
NNG's procedures 50.700, entitled “Control Room Management Training” (Procedure 50.700),
and LMS Training NNGGC00004 Module were not adequate to provide for training each
controller to carry out the roles and responsibilities defined by the operator as required by §§
192.631(h) and 192.631(b). Specifically, Procedure 50.700 and LMS Training Module did not
address the training required for the controller regarding 50.205 SCADA Back up Test
procedure. Procedure 50.200 did reference Procedure 50.301, entitled “Control Room
Evacuation,” Procedure 50.204, entitled “Internal Communication Plan Testing for Manual
Operations,” and Procedure 50.205, entitled “SCADA Back up Test Procedure.” However,
Procedure 50.700 only referenced the Internal Communication Plan Testing for Manual
operations and did not mention or describe training relevant to the Procedure 50.205.
Additionally, the LMS Training Module did address evacuations, but did not clearly include or
identify procedures for moving to the backup control room location and did not detail how to use
Procedure 50.205 or when to implement Procedure 50.204 from the backup location.
Further, while on-the-job training (OJT) was referenced in Procedure 50.700 regarding the lead
controller, nothing was referenced for other controllers. While it was clear from the NNG Gas
Control Training Program Outline that OJT will be held for all controllers, NNG’s records were
not specific for these OJT topics and records would need to be console specific. Procedure
50.700 did not adequately define which records would demonstrate OJT activities covering
normal, abnormal and emergencies. Procedures were not clear on how Rate of Change (ROC)
alarms or pack values would be used to determine a leak for different pipeline systems associated
with each console, and records were not clear as to how or when this was addressed in training.
Procedure 50.202, entitled “Providing Adequate Information - SCADA Upgrade,” section 3.8
stated, “[t]he current SCADA system displays have color indicators without associated
alphanumeric indicators. Gas controller color recognition will be incorporated and considered
during the onboarding process and periodically thereafter.” However, Procedure 50.202 did not
cross-reference Procedure 50.700, which did mention onboarding and would be specific to a



controller’s knowledge, skills and abilities, including confirming how the controller’s ability to
detect colors used in the SCADA system would be demonstrated. How the requirements of
Procedure 50.202 section 3.8 would be specifically addressed during training was not defined in
Procedure 50.700.
Additionally, during the inspection, the NNG Gas Control Training Outline (NNG Outline) was
presented as part of the training program to the PHMSA inspector. This document was not
attached or referenced in Procedure 50.700 but was part of the process used.
Both Procedure 50.700 and LMS Training Module require amendment to sufficiently address the
roles and responsibilities of controllers. Amendment would include elements of training
required for the controller to operate or transfer to and from the backup SCADA location.
Additionally, Procedure 50.700 requires amendment to clarify what records will exist to
demonstrate adequate OJT, to include the NNG Gas Control Training Program Outline, and to
describe how Procedure 50.202 section 3.8 will be implemented.
11. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section . . . .
(b) . . . .
(h) Training. Each operator must establish a controller training program and
review the training program content to identify potential improvements at least
once each calendar year, but at intervals not to exceed 15 months. An operator's
program must provide for training each controller to carry out the roles and
responsibilities defined by the operator. In addition, the training program must
include the following elements:
(1) . . . .
(5) For pipeline operating setups that are periodically, but infrequently used,
providing an opportunity for controllers to review relevant procedures in advance
of their application; and
NNG’s Procedure 50.700 was not adequate as it did not require for pipeline operating setups that
are periodically, but infrequently, used the opportunity for controllers to review relevant
procedures in advance of their application as required by §§ 192.631(h)(5) and 192.631(j)(1).
Specifically, 50.700 section 3, entitled “General,” stated, “[t]his procedure addresses the
requirements of DOT § 192.631(h), sections (1), (2), (3), (4), and (5) which outlines the
requirements to train controllers on responding to abnormal operating conditions,
communicating responsibilities during an emergency, working knowledge of the pipeline system,
especially during abnormal operating conditions, and training for relevant but infrequently or
rarely used system setups in advance of their application.” This is inaccurate as it misstated the



requirements of § 192.631(h)(5); “infrequently or rarely used” is not the same as “periodically,
but infrequently used.”
Additionally, while Facility Operating Guidelines (FOG) training was referenced in Procedure
50.700, section 5.3, and Configuration plans are referenced in section 5.4, Procedure 50.700 did
not take into account procedural movements that the operator knows only occur seasonally or
periodically regardless of a FOG or Configuration plan. Examples of such procedural
movements are storage applications, facility bypass, or using common or split line operations.
During the inspection, NNG confirmed that these types of procedures were not included in the
scope of sections 5.3 or 5.4. These types of procedures would be unique per console and these
types of procedures had not been addressed in 50.700 or other training documentation. Without
the specific identification of these types of procedures, and the training documentation
identifying a record that would track the opportunity for the review in advance of their
application, the requirements of §§ 192.631(h)(5) and 192.631(j)(1) have not been met.
NNG Procedure 50.700 requires amendment to address pipeline operating setups that are
periodically used, and to identify per console the procedures that would be used seasonally, or
other procedures not identified in a FOG or Configuration plan that are unique per console.
12. § 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility with a controller
working in a control room who monitors and controls all or part of a pipeline
facility through a SCADA system. Each operator must have and follow written
control room management procedures that implement the requirements of this
section. . . .
(b) . . . .
(j) Compliance and deviations. An operator must maintain for review during
inspection:
(1) . . . .
(2) Documentation to demonstrate that any deviation from the procedures required
by this section was necessary for the safe operation of a pipeline facility.
NNG’s Procedure 50.100 did not require adequate documentation regarding demonstration of
any deviation from NNG’s procedures, required by § 192.631, was necessary for the safe
operation of a pipeline facility, as required by § 192.631(j)(2). Records to demonstrate
compliance associated with deviations are stored in multiple systems that require and contain
very different information. Documentation on deviations was addressed in Procedure 50.100,
section 6.1, however Procedure 50.100 did not clearly state: (1) how records of deviation will be
identified, (2) if deviation records and the associated procedures will be moved to a common
location or reported on from various locations using a specific process for each data set identified
in section 6.1 and (3) if any common data that will be collected (such as the name of the
procedure relevant to the deviation and when it occurred).



Procedure 50.100 section 6.1 stated:
Records required to be maintained by Control Room Management regulations,
including deviation records, will be identified and stored in the company’s record
management system. The individual 50 series operating procedures detail what
records are required to be maintained. A summary of deviation records will be
stored in the company’s record management system under 50.100. The record will
determine if the deviation was necessary for pipeline safety. Storage of historical
records shall be contained in various systems including the Maintenance Control
System (MCS), Learning Management System (LMS), Company Records
Management system (P8), Enterprise Action Tracking System (EATS) or other
company intranet locations.
It is not clear from Procedure 50.100, section 6.1, how deviations beyond that of the 50 Series
Procedures, such as a deviation from the SCADA procedure referenced (OP 20.401 Supervisory
Control and Data Acquisition Systems), would be recorded and become part of the deviation
records associated with Procedure 50.100.
Procedure 50.100 requires amendment to adequately define (1) how NNG will adequately
document that any deviation from the procedures as required by this section was necessary for
the safe operation of a pipeline facility and how records of deviation will be identified, (2) if
deviation records and the associated procedures will be moved to a common location or reported
on from various locations using a specific process for each data set identified in section 6.1, and
(3) if any common data that will be collected (such as the name of the procedure relevant to the
deviation and when it occurred). Additionally, Procedure 50.100 requires amendment to clearly
define how other records associated with deviations outside of the 50 Series Procedures, but
applicable to this section, would be documented.
Response to this Notice
This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as
part of this Notice is a document entitled Response Options for Pipeline Operators in
Enforcement Proceedings.
Please refer to this document and note the response options. Be advised that all material you
submit in response to this enforcement action is subject to being made publicly available. If you
believe that any portion of your responsive material qualifies for confidential treatment under 5
U.S.C. § 552(b), along with the complete original document you must provide a second copy of
the document with the portions you believe qualify for confidential treatment redacted and an
explanation of why you believe the redacted information qualifies for confidential treatment
under 5 U.S.C. § 552(b).
Following the receipt of this Notice, you have 30 days to submit written comments, revised
procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of
receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this



Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in
this Notice without further notice to you and to issue an Order Directing Amendment. If your
plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend
your plans or procedures to correct the inadequacies (49 C.F.R. § 190.206). If you are not
contesting this Notice, we propose that you submit your amended procedures to my office within
60 days of receipt of this Notice. This period may be extended by written request for good cause.
Once the inadequacies identified herein have been addressed in your amended procedures, this
enforcement action will be closed.
It is requested that NNG maintain documentation of the safety improvement costs associated
with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit
the total to Gregory A. Ochs, Director, Central Region, Pipeline and Hazardous Materials Safety
Administration. In correspondence concerning this matter, please refer to CPF 3-2024-027-NOA
and, for each document you submit, please provide a copy in electronic format whenever
possible.
Sincerely,
Gregory A. Ochs/kab
Director, Central Region, Office of Pipeline Safety
Pipeline and Hazardous Materials Safety Administration
Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings
cc: Thomas Correll, Vice President, Safety and Risk, NNG (Thomas.correll@nngco.com)
John Gormley, Sr. Corrosion Specialist, NNG (john.gormley@nngco.com)

## Provenance

- Official: Yes
- Source: <https://primis.phmsa.dot.gov/enforcement-data/case/32024027NOA>
- Source ID: `phmsa-enforcement`
- SHA-256: `2af2b287303135a615ad4be9ce504952d1f35a936a8d3e0dff379460e73a0bef`
- Retrieved: 2026-08-20T04:44:44.458Z
- Exported: 2026-08-22T04:24:30.254Z
- Document slug: `phmsa-enforcement-32024027noa`

### Source metadata

```json
{
  "cpf": "32024027NOA",
  "operator": "NORTHERN NATURAL GAS CO",
  "region": "Central",
  "pipelineType": "DISTRIBUTION PRIVATELY OWNED, INTERSTATE GAS TRANSMISSION, INTERSTATE LNG, INTERSTATE UNDERGROUND NG STORAGE",
  "caseStatus": "CLOSED",
  "citedSections": [
    "192.631(a)(1)",
    "192.631(a)(2)",
    "192.631(b)(4)",
    "192.631(c)(1)",
    "192.631(c)(2)",
    "192.631(e)(1)",
    "192.631(e)(2)",
    "192.631(e)(3)",
    "192.631(e)(5)",
    "192.631(f)",
    "192.631(g)(1)",
    "192.631(h)",
    "192.631(h)(5)",
    "192.631(j)(2)"
  ],
  "dataAsOf": "08/04/2026 12PM",
  "caseDataAsOf": "2026-08-04",
  "attachmentCount": 5,
  "attachments": [
    {
      "name": "32024027NOA_Closure Letter_11102025_(20-188476).pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Closure%20Letter_11102025_(20-188476).pdf",
      "bytes": 139043,
      "category": "agency_document"
    },
    {
      "name": "32024027NOA_Closure Letter_11102025_(20-188476)_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Closure%20Letter_11102025_(20-188476)_text.pdf",
      "bytes": 153959,
      "category": "agency_document"
    },
    {
      "name": "32024027NOA_Notice of Amendment_07122024_(20-188476).pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Notice%20of%20Amendment_07122024_(20-188476).pdf",
      "bytes": 400663,
      "category": "agency_document"
    },
    {
      "name": "32024027NOA_Notice of Amendment_07122024_(20-188476)_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Notice%20of%20Amendment_07122024_(20-188476)_text.pdf",
      "bytes": 341384,
      "category": "agency_document"
    },
    {
      "name": "32024027NOA_Operator Response to Notice_09092024_(20-188476).pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/32024027NOA/32024027NOA_Operator%20Response%20to%20Notice_09092024_(20-188476).pdf",
      "bytes": 298290,
      "category": "party_submission"
    }
  ],
  "extractedAgencyDocumentCount": 2,
  "attachmentPolicy": "Official attachment links are retained. Agency-issued documents may also include a verified local PDF and page-level text representation.",
  "jurisdiction": "US",
  "operatorName": "NORTHERN NATURAL GAS CO"
}
```