# EXXONMOBIL PIPELINE CO — Notice of Probable Violation

**Citation:** CPF 520135007  
**Type / status:** enforcement / historical  
**Agency:** Pipeline and Hazardous Materials Safety Administration  
**Effective:** Not stated  
**Published:** 2013-03-25

CLOSED notice of probable violation citing 195.402(e)(2), 195.402(e)(4), 195.403(a)(3), 195.452(i)(1), 195.452(i)(2).

## Document text

Notice of Probable Violation involving EXXONMOBIL PIPELINE CO. PHMSA's enforcement data identifies the cited regulations as 195.402(e)(2),  195.402(e)(4),  195.403(a)(3),  195.452(i)(1),  195.452(i)(2). The case was opened on 2013-03-25 and is reported as closed as of 2015-07-09. Proposed civil penalty: $1,700,000. Assessed civil penalty: $1,045,000. Open the official case record for notices, responses, orders, and the latest status.

Official case documents:

520135007_closure letter_07092015.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_closure%20letter_07092015.pdf

520135007_closure letter_07092015_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_closure%20letter_07092015_text.pdf

520135007_Decision on Petition for Reconsideration_06122015.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Decision%20on%20Petition%20for%20Reconsideration_06122015.pdf

520135007_Decision on Petition for Reconsideration_06122015_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Decision%20on%20Petition%20for%20Reconsideration_06122015_text.pdf

520135007_Final Order_01232015.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Final%20Order_01232015.pdf

520135007_Final Order_01232015_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Final%20Order_01232015_text.pdf

520135007_NOPV PCP PCO_03252013.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_NOPV%20PCP%20PCO_03252013.pdf

520135007_NOPV PCP PCO_03252013_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_NOPV%20PCP%20PCO_03252013_text.pdf

520135007_Operator Petition for Reconsideration_02122015.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Operator%20Petition%20for%20Reconsideration_02122015.pdf

520135007_Operator Request for Hearing and Response to Notice_04242013.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Operator%20Request%20for%20Hearing%20and%20Response%20to%20Notice_04242013.pdf

520135007_Final Order_01232015_text.pdf

JANUARY 23, 2015
Mr. Gerald S. Frey
Global Pipeline Manager & President
ExxonMobil Pipeline Company
800 Bell St., Room 741-D
Houston, TX 77002
Re: CPF No. 5-2013-5007
Dear Mr. Frey:
Enclosed please find the Final Order issued in the above-referenced case. It makes findings of
violation, withdraws one allegation, and assesses a reduced civil penalty of $1,045,000. It
further finds that ExxonMobil Pipeline Company has completed the actions specified in the
proposed compliance order to comply with the pipeline safety regulations. The penalty payment
terms are set forth in the Final Order. This enforcement action closes automatically upon receipt
of payment. Service of this Final Order is made pursuant to 49 C.F.R. § 190.5.
Thank you for your cooperation in this matter.
Sincerely,
Jeffrey D. Wiese
Associate Administrator
for Pipeline Safety
Enclosure
cc: Mr. Chris Hoidal, Director, Western Region, PHMSA
Mr. Bob Hogfoss and Ms. Catherine Little, Hunton & Williams LLP,
Bank of America Plaza, Suite 4100, 600 Peachtree Street, N.E., Atlanta, GA 30308
CERTIFIED MAIL – RETURN RECEIPT REQUESTED



U.S. DEPARTMENT OF TRANSPORTATION
PIPELINE AND HAZARDOUS MATERIALS SAFETY ADMINISTRATION
OFFICE OF PIPELINE SAFETY
WASHINGTON, D.C. 20590
___________________________________
In the Matter of )
ExxonMobil Pipeline Company, ) CPF No. 5-2013-5007
)
)
)
Respondent. )
___________________________________ )
FINAL ORDER
On July 2, 2011, pursuant to 49 U.S.C. § 60117, a representative of the Pipeline and Hazardous
Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), initiated an
investigation of the records and procedures of ExxonMobil Pipeline Company (EMPCo or
Respondent) following a failure of its Silvertip Pipeline in Laurel, Montana, that occurred on
July 1, 2011. EMPCo is a subsidiary of Exxon Mobil Corporation and operates approximately
3,800 miles of pipeline transporting crude oil, refined petroleum products, and highly volatile
liquids in Texas, Louisiana, and Montana.1
As a result of the inspection, the Director, Western Region, OPS (Director) issued a Notice of
Probable Violation, Proposed Civil Penalty, and Proposed Compliance Order (Notice) to
Respondent on March 25, 2013. In accordance with 49 C.F.R. § 190.207, the Notice alleged five
violations of the pipeline safety regulations, proposed a civil penalty of $1,700,000, and
proposed certain corrective action.
EMPCo responded to the Notice by letter dated April 24, 2013 (Response). In its Response,
Respondent contested four of the five alleged violations and requested a hearing. In advance of
the hearing, Respondent submitted additional written materials on July 8, 2013 (Pre-hearing
Submittal). OPS also submitted additional materials. In accordance with 49 C.F.R. § 190.211, a
hearing was held on July 17, 2013, in Lakewood, Colorado, before a Presiding Official from the
Office of Chief Counsel, PHMSA. After the hearing, Respondent submitted additional materials
on August 23, 2013 (Post-hearing Brief). Pursuant to § 190.209(b)(7), the Director submitted a
written evaluation of Respondent’s response material and recommendation on September 20,
2013.
1 This information was reported by EMPCo for calendar year 2013 pursuant to 49 C.F.R. § 195.49.



CPF No: 5-2013-5007
Page 2
BACKGROUND
On July 1, 2011, the Silvertip Pipeline operated by EMPCo experienced a failure where the
pipeline crosses the Yellowstone River in Laurel, Montana.2 The failure resulted in the release
of approximately 1500 barrels (63,000 gallons) of crude oil into the river.
The Silvertip Pipeline is 69.6 miles in length and runs from the Silvertip Station near production
fields in Elk Basin, Wyoming, to the ExxonMobil refinery in Billings, Montana.3 The pipeline
also takes crude oil from an intermediate pump station in Edgar, Montana. The pipeline runs
south to north on a 5% to 7% downward slope. The pipeline can drain by gravity into the
refinery in Billings. Pumps at the Edgar station are used to boost flow rate and to pull crude oil
out of tankage.
The pipeline crosses four rivers. At each of the river crossings, the pipeline has a remote
controlled valve (RCV) on the upstream side of the crossing and a hand operated valve on the
downstream side.4 The RCVs are equipped with a relief valve and bypass line to protect the
pipeline from pressure surges caused by the rapid closure of valves and other abnormal hydraulic
events.
The Silvertip Pipeline crosses beneath the Yellowstone River immediately before the pipeline
reaches a terminal facility in Laurel, Montana, about 20 miles upstream from the end of the
pipeline. The pipeline crosses the Yellowstone approximately 800 feet east of the Highway 212
bridge.5 Before 1991, the pipeline crossed the river at the bridge span, but EMPCo was required
to move a portion of the pipeline so that it crossed under the river to accommodate rebuilding of
the bridge.6
At the location of the Yellowstone crossing, the Silvertip pipeline is 12.75-inch outside diameter,
0.500-inch wall thickness, Grade B seamless pipe manufactured by U.S. Steel.7 When the
pipeline was re-routed beneath the river in 1991, it was installed using an open cut crossing
technique, placing the pipeline in a rock cobble trench at least 6 feet below the river bed. The
pipe also had a 1-inch concrete weight coating.
2 EMPCo and OPS were in general agreement on most of the background facts. The primary
disagreement regarded the significance of historical flooding on the Yellowstone River, as detailed below.
3 OPS Pipeline Safety Violation Report (Violation Report) (Apr. 19, 2013), Exhibit A-1 – Accident
Investigation Report (Investigation Report) at 2 (Oct. 30, 2012).
4 Terms “upstream” and “downstream” refer to relative directions on the pipeline. Upstream is in the
direction of the beginning of the pipeline and downstream is in the direction of the end.
5 Violation Report at 2.
6 Post-Hearing Brief at 2.
7 Pre-hearing Submittal Exhibit 8 (Kiefner Report) at 2.



CPF No: 5-2013-5007
Page 3
A. Historical Flooding of the Yellowstone River
According to OPS, the Yellowstone has historically been prone to seasonal flooding, including
increased erosion and scouring since 1991.8 OPS asserted that at the time of the failure, these
problems were common knowledge in Laurel and had worsened in 1991 when the Highway 212
bridge was rebuilt in a way that constricted water flow of the Yellowstone, increasing the
velocity and scouring of floodwaters. OPS pointed to information maintained by the United
States Geologic Survey (USGS), including data from a water gauge approximately 20 miles
downriver from the Silvertip crossing.9 The USGS had determined the “flood stage” at this point
of the Yellowstone River is a water level of 13.5 feet at the gauge.
Between 2008 and 2010, the river typically rose during the spring runoff and summer snow melt
and then fell a short period of time later. There were instances when the river would rise
multiple times during the same high water season, but water levels would usually drop within a
week or two. In 2011, the Yellowstone rose and stayed high for more than a month. The
Yellowstone reached the flood stage as measured by the water gauge three times in 2011: on
May 25, June 25, and July 1, the date of the Silvertip failure.10
Seasonal flooding of the Yellowstone had previously affected other pipeline operators in the
area. In June 2009, flooding and river scouring caused the failure of an 8-inch natural gas
pipeline operated by Willison Basin Interstate Pipeline (WBI).11 WBI replaced the 8-inch pipe
with a 16-inch line horizontally drilled at a depth of 40-50 feet below the river. Another 8-inch
pipeline that had been abandoned by ConocoPhillips became exposed and suffered a rupture
sometime between 2009 and 2011.12 After the 2009 WBI failure, EMPCo conducted an inline
inspection (ILI) of the Silvertip Pipeline at the Yellowstone crossing and found no anomalies.13
This was in addition to a prior ILI performed in 2004.
EMPCo acknowledged the Yellowstone is prone to seasonal flooding, but believed the facts
presented by OPS concerning flooding were overstated. EMPCo asserted that federal databases,
including the USGS, indicated that high water events on the river since the pipeline was installed
were less extreme than past levels. EMPCo also pointed to a report by the Yellowstone River
Conservation Council that indicated the period from 1979 to 2007 “was characterized by
minimal floods on the tributaries and no floods on the Yellowstone River.”14
8 Violation Report at 4.
9 Investigation Report at 5-6.
10 Investigation Report at 5-6.
11 Violation Report, Exhibit B-16 at 3.
12 Violation Report 4.
13 Response at 2.
14 Response at 2, referencing Pre-hearing Submittal, Exhibit 4 “Yellowstone River Historic Events
Timeline” at 5.



CPF No: 5-2013-5007
Page 4
Additionally, EMPCo noted that in the past 20 years, three floods had higher levels than the
flood level at the time of the July 1, 2011, failure. The first occurred before 1991 when the
pipeline was installed; the second occurred in 1997; and the third occurred on May 26, 2011.
The 1997 flood, EMPCo asserted, was the highest crest ever recorded for the Yellowstone.
EMPCo stated that the Silvertip Pipeline “survived [these previous] high water events, and the
Company increased monitoring of the river crossing.”15 Additionally, EMPCo indicated that the
OPS Investigation Report acknowledged there was an absence of historical flooding impacts to
this pipeline.16
B. Events Leading up to the 2011 Flooding
Prior to the flooding in 2011, there were numerous contacts between interested stakeholders and
EMPCo concerning the Yellowstone crossing. In August 2010, there was a meeting of Laurel
officials, the U.S. Army Corps of Engineers, EMPCo, Cenex Pipeline Company, WBI, and
Conoco Phillips that took place at Riverside Park, located slightly east of the Highway 212
bridge on the south side of the Yellowstone River. The meeting concerned erosion of the river
bank in that location and the pipelines that ran beneath, including the Silvertip. Laurel officials
hoped to obtain assistance in fortifying the south bank to help protect the park.17
Several months later in October 2010, Laurel officials contacted OPS and expressed concern
about the pipeline crossings downstream of the Highway 212 bridge due to the seasonal
flooding. OPS relayed this information to EMPCo. In December 2010, EMPCo conducted a
depth of cover survey at the Yellowstone crossing at the request of OPS, and reconfirmed the
findings from a prior survey that the pipeline was “buried in rock and cobble at least five to eight
feet below the riverbed.”18 EMPCo submitted the survey report to OPS on January 29, 2011.
The survey indicated that the Silvertip “met the required minimum depth of cover for new
pipelines, and that the bottom of the river had not changed significantly since the last crossing
survey performed in 2002.”19 OPS staff advised EMPCo at the time to “maintain vigilance with
respect to the annual flooding of the Yellowstone River especially in the vicinity of their pipeline
crossing in Laurel, MT.”20
On May 25, 2011, the Yellowstone reached flood stage level. Laurel officials again contacted
OPS with concerns over the erosion of the south bank of the Yellowstone. In turn, OPS
contacted EMPCo, which sent employees to Riverside Park in response. On this date, EMPCo
shut down the Silvertip for five hours, assessed site conditions, and evaluated data. When no
15 Response at 2.
16 Pre-hearing Submittal at 2, citing Investigation Report at 12.
17 Investigation Report at 3.
18 Investigation Report at 3.
19 Investigation Report at 3-4. The minimum depth of cover for a new pipeline under a river is four feet.
Respondent indicated the depth of cover survey was actually performed in 2001. Response at 2.
20 Investigation Report at 4.



CPF No: 5-2013-5007
Page 5
anomalies were detected, the Silvertip was restarted and EMPCo began daily monitoring by
driving by the location to observe the general area. WBI decided to shut down its pipeline
crossing at the Yellowstone because of the floodwaters.21
One week later, on June 1, 2011, Laurel officials sent photographs of the Yellowstone to EMPCo
with a recommendation that EMPCo come and assess the situation.22 EMPCo responded via
email that the depth of cover at the south bank had been determined to be 12 feet. On June 6,
2011, OPS inspected EMPCo’s integrity management program and most recent ILI data from
2009, finding no actionable pipeline anomalies at the Silvertip’s Yellowstone crossing.
The Yellowstone reached the flood stage again on June 25 due to snow melt.23 Laurel personnel
began reinforcing the Yellowstone banks on both the north and south sides. They again
contacted OPS with concerns over the Silvertip crossing. OPS contacted EMPCo, which shut
down the Silvertip for a second time, visited the site, and assessed the situation. EMPCo
performed a depth of cover survey in Riverside Park from the south bank of the Yellowstone to
RCV 4462, which is the closest upstream valve south of the river crossing. The depth of cover at
this point was between 6.7 feet and 8.5 feet. Additionally, on June 25, 2011, EMPCo placed
sandbags around RCV 4462 in case the park flooded.24
C. Silvertip Pipeline Failure
On July 1, 2011, the Yellowstone River reached the flood stage for the third time in six weeks.
At 10:40:43 p.m., Mountain Daylight Time, EMPCo’s Operation Control Center (OCC) in
Houston, Texas, received an alarm indicating a pressure drop at RCV 4462, the remote valve
immediately upstream of the Yellowstone River crossing.
25 Controller A, who was in charge of
the console at the time, did not see the alarm. At 10:41:14, approximately 30 seconds after the
first alarm, the controller noticed a second alarm which indicated a booster pump at Edgar
Station had automatically shut down because of low suction pressure. The Edgar Station is
approximately fourteen miles upstream of Laurel. Believing there might be a leak, Controller A
shut down the pumps and RCV 1066 at the beginning of the Silvertip Pipeline at 10:50:39 p.m.
He then closed RCV 1067, located approximately one-half mile downstream of the Yellowstone
River at the Laurel facility.
Three minutes later, Controller A notified a supervisor, who reviewed the trends and alarm logs.
At 11:07:32 p.m., the supervisor ordered Controller A to re-open RCV 1067 to allow oil to drain
into the Billings refinery. The supervisor then called the First Line Supervisor in the field, who
requested a senior technician be added to the call. A discussion ensued as to what caused the
Edgar Station pumps to have low suction. After the discussion and review of the relevant data,
21 Violation Report at 5.
22 Investigation Report at 4-5.
23 Investigation Report at 5.
24 Investigation Report at 5.
25 Notice at 1-2.



CPF No: 5-2013-5007
Page 6
the supervisor noticed the low suction pressure alarm had been preceded by a pressure drop at
RCV 4462. At 11:36:51 p.m., the Supervisor ordered RCV 4462 closed, which stopped the
gravity flow of oil into the river. Approximately 56 minutes had passed since the first alarm was
received until RCV 4462 was closed, resulting in a total of about 1500 barrels of crude oil
released into the river.
OPS sent investigators to the scene of the failure. On July 5, 2011, a Corrective Action Order
(CAO) was issued by PHMSA.
26 The CAO required EMPCo to take specific actions before
restarting the Silvertip Pipeline. It also required EMPCo to complete additional safety measures
before the next flood season, including replacement of the pipeline crossing at the Yellowstone
River with a horizontally drilled line.
The OPS Investigation Report indicated the pipeline failed as a result of a submerged
“guillotine” break in the pipeline near the south shore of the Yellowstone River caused by debris
caught on the exposed pipe during flooding, which gradually increased external stress on the
pipe until it failed.27 EMPCo’s failure report, prepared by Kiefner & Associates, Inc., similarly
concluded that the Silvertip “failed at a girth weld as a result of the effects of external loading
that occurred due to exposure to flood conditions.”28 The report concluded further that “the
failure mechanism was fatigue crack growth adjacent to a girth weld, followed by ductile
fracture of the remaining section due to tensile overload.”29 Ultimately, the cracks were caused
by “vortex-induced vibration of the exposed pipe in the river current.”30
The Notice issued on March 25, 2013, alleged that Respondent committed five violations of the
pipeline safety regulations in 49 C.F.R. Part 195, as follows:
Item 1: The Notice alleged that Respondent violated 49 C.F.R. § 195.452(i)(2), which states:
§ 195.452 Pipeline integrity management in high consequence areas.
(a) Which pipelines are covered by this section? This section applies to
each hazardous liquid pipeline and carbon dioxide pipeline that could
affect a high consequence area . . . .
(i) What preventive and mitigative measures must an operator take to
protect the high consequence area?—(1) General requirements. An
FINDINGS OF VIOLATION
26 ExxonMobil Pipeline Co., CPF No. 5-2011-5017H , 2011 WL 10796851 (Jul. 5, 2011). Prior
enforcement decisions can also be viewed on PHMSA’s website at http://www.phmsa.dot.gov/
pipeline/enforcement (follow link for enforcement since 2002 and then for Actions issued by year).
27 Violation Report at 3-4.
28 Pre-hearing Submittal Exhibit 8 (Kiefner Report) at 1.
29 Kiefner Report at 1.
30 Kiefner Report at 1.



CPF No: 5-2013-5007
Page 7
operator must take measures to prevent and mitigate the consequences of a
pipeline failure that could affect a high consequence area. These measures
include conducting a risk analysis of the pipeline segment to identify
additional actions to enhance public safety or environmental protection . . .
(2) Risk analysis criteria. In identifying the need for additional
preventive and mitigative measures, an operator must evaluate the
likelihood of a pipeline release occurring and how a release could affect
the high consequence area. This determination must consider all relevant
risk factors, including, but not limited to:
(i) Terrain surrounding the pipeline segment, including drainage
systems such as small streams and other smaller waterways that could
act as a conduit to the high consequence area;
(ii) Elevation profile; . . .
(iv) Amount of product that could be released; [and] . . .
(vii) Physical support of the pipeline segment such as by a cable
suspension bridge; . . . .
The Notice alleged that Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis
of its pipeline considering all the relevant risk factors. Specifically, the Notice alleged that
Respondent prepared a risk analysis of the Silvertip Pipeline in July 2010 to evaluate the
likelihood of a pipeline release and possible consequences, but failed to consider the risk of
flooding and river bottom scour, as well as certain risk factors relevant to the Yellowstone River
crossing. The risk factors that Respondent allegedly failed to consider included the terrain
surrounding the pipeline segment; the elevation profile of the pipeline; the amount of product
that could be released in a spill; and the physical support of the pipeline segment in the river.
The Notice also alleged that Respondent should have considered additional factors listed in
Appendix C to 49 C.F.R. Part 195, such as potential natural forces inherent in flood zones and
subsidence areas. The Notice alleged the risk of flooding, channel migration, and river bottom
scour on the Yellowstone River was a known threat given its history, including at least one prior
pipeline failure in the area caused by flooding and impact to other pipelines.
EMPCo responded that it had complied with all requirements in the regulation concerning
preventative and mitigative risk analysis.31 Specifically, it asserted that its 2010 written integrity
management program addressed natural forces such as flooding. Respondent also asserted that
an integrity threat assessment conducted in 2009 considered the threat of weather-related and
outside forces such as flooding. Based on the threats identified by that integrity assessment,
Respondent maintained that its risk analysis considered all of the relevant risk factors, including
those specified under § 195.452(i)(2).32
In addition, Respondent argued that the effects of the July 1, 2011, flood were unforeseeable.
EMPCo noted that seasonal flooding on the Yellowstone River had never before impacted the
31 Pre-hearing Submittal at 7.
32 Pre-hearing Submittal at 6-7, referencing Exhibits 9 and 10 and Violation Report Exhibit B-7.



CPF No: 5-2013-5007
Page 8
Silvertip Pipeline despite several floods with higher levels than the one that caused the failure.
Respondent noted that it had assessed the pipeline before the failure and found it had adequate
depth of cover with no known anomalies. EMPCo also referenced the OPS Investigation Report
which acknowledged “Based on the lack of historical flooding impacts to this pipeline since [it
was installed in] 1991, EMPCo may not have known that the river bottom could change
sufficiently to undermine their pipeline.”33
A. Applicable Standards for Identifying P&M Measures
Under the pipeline safety regulations in 49 C.F.R. Part 195, pipeline operators must develop,
implement, and follow a written integrity management program (IMP) for each hazardous liquid
pipeline that could affect a high consequence area (HCA). 34 An operator’s IMP must include,
among other things, identification of additional actions that can be taken to protect the HCA.35
These are known as preventative and mitigative (P&M) measures.
To identify appropriate P&M measures for each pipeline, an operator must conduct a risk
analysis that evaluates “the likelihood of a pipeline release occurring” on the segment and the
potential consequences to the HCA.36 The risk analysis must include consideration of all risk
factors relevant to the likelihood of a release and potential consequences. The regulation lists a
number of risk factors that must be considered, including, but not limited to: the terrain
surrounding the pipeline segment, including drainage that could act as a conduit for the product
to reach the HCA; the elevation profile; amount of product that could be released; and the
physical support of the pipeline segment.
Appendix C to Part 195 provides additional guidance for implementing an IMP, including
guidance on risk factors. The guidance lists both mandatory and additional factors for operators
to consider when identifying measures to prevent and mitigate the consequences of a pipeline
failure. The factors listed include, among other things, potential natural forces in the area, such
as natural forces in a flood zone.37
Both parties acknowledged that seasonal floods were known to occur on the Yellowstone River
at the location of the Silvertip Pipeline crossing. Evidence also demonstrates that during 2008
through 2011, water level of the river rose each year during June and July. During those years,
water level would rise from a typical non-flood height of approximately 2 feet to a seasonal flood
height of 11 to 12 feet.38 During the 2011 season, the height exceeded 14 feet. Flooding is
33 Pre-Hearing Submittal at 2.
34 § 195.452(a)-(b). “High consequence areas” include commercially navigable waterways, as defined in
§ 195.450, and areas that are unusually sensitive to environmental damage, as defined under § 195.2.
35 § 195.452(f)(6).
36 § 195.452(i)(2).
37 49 C.F.R. Part 195, Appendix C (I)(B)(12).
38 Violation Report, Exhibit B-21. Respondent submitted a report titled “Yellowstone River Historic
Events Timeline” from 2008, which stated that 1998-2007 was “characterized by minimal flooding on



CPF No: 5-2013-5007
Page 9
known to PHMSA as a potential threat to buried pipelines, and PHMSA has communicated to
operators precautions that should be taken when flooding occurs.39 At this particular location,
flooding had previously caused at least one other pipeline to fail, the WBI gas pipeline failure in
June 2009.40 Taken together, all of this information was sufficient to notify Respondent that
flooding should be analyzed as a potential threat to its pipeline.
Respondent contended that certain information caused it to believe flooding could not impact its
pipeline. For example, EMPCo’s pipeline had survived prior flooding events without damage,
including two floods with a higher water level than the flood that ultimately caused the failure.
EMPCo had also performed a depth of cover survey in 2010, which detected cover over its
pipeline had not changed significantly since the last crossing survey. In its written submissions,
EMPCo also noted that the OPS Investigation Report stated that “based on the lack of historical
flooding impacts to this pipeline since 1991, EMPCo may not have known that the river bottom
could change sufficiently to undermine their pipeline.”41
PHMSA disagrees that this information alleviated Respondent from having to analyze the
possibility that flooding could cause a failure. The fact that flooding had not previously caused
an integrity issue for Respondent’s pipeline does not mean future flooding could never cause a
failure. One of the purposes of the integrity management regulations is to anticipate the possible
threats to the pipeline in the future. Given that flooding is a threat in general and that flooding
had caused integrity issues for other pipelines at the same location, it was not reasonable for
EMPCo to assume seasonal flooding would never impact its own pipeline. At a minimum, the
Operator had a duty to evaluate the likelihood of a pipeline release occurring from flooding.
B. Whether Respondent’s Risk Analysis Complied with Applicable Standards
PHMSA reviewed the evidence in the record to determine whether Respondent had prepared a
risk analysis that considered the threat of flooding and relevant risk factors. This review
included Respondent’s Silvertip to Billings 12” Crude Preventive & Mitigative Measures
Analysis Summary (2010 P&M Analysis).42
2010 P&M Analysis. The 2010 P&M Analysis described Respondent’s 69.6-mile Silvertip
It noted the location of block valves, elevation at each station, type of product
Pipeline. tributaries, and no floods on the Yellowstone River.” For the purpose of the report, however, only floods
with a 10% or less probability of occurring were identified. The report did not analyze seasonal flooding.
39 OPS has published Advisory Bulletins related to the impacts of flooding on pipeline systems. See
Advisory Bulletin ADB-93-03, 58 Fed. Reg. 41321 (Aug. 3, 1993); Advisory Bulletin ADB-94-05, 59
Fed. Reg. 55152 (Nov. 3, 1994). See also Potential for Damage to Pipeline Facilities Caused by Flooding
(ADB-11-04), 76 FR 44985 (Jul. 27, 2011); and Potential for Damage to Pipeline Facilities Caused by
Flooding (ADB-2013-02), 78 Fed. Reg. 41991 (Jul. 12, 2013).
40 Violation Report, Exhibit B-16 at 3.
41 Post-hearing Brief at 2-3, quoting Investigation Report at 12.
42 Violation Report Exhibit B-7. The P&M Analysis is dated July 7, 2010.



CPF No: 5-2013-5007
Page 10
transported, line fill capacity, flow rate, and maximum operating pressure. The entire length of
the pipeline was identified as potentially affecting an HCA. Three potential integrity threats to
the Silvertip Pipeline were identified: third-party damage, manufacturing, and external corrosion.
The document then identified and evaluated different P&M measures to address those three
integrity threats.
Besides third-party damage, manufacturing, and external corrosion, the 2010 P&M Analysis did
not identify other threats that could affect the likelihood of a pipeline release. In particular, the
Analysis did not consider the threat of flooding in evaluating the likelihood of a release.
PHMSA also finds several other deficiencies in the 2010 P&M Analysis. The risk analysis
mentioned the types of “nearby HCAs, which include HPOP, OPOP, Drinking Water and USA-
ECO” but did not define them or identify specific HCAs like the Yellowstone River.43 There
was no mention of the terrain surrounding the pipeline near the Yellowstone River or the
possible consequences of a failure at the crossing. In addition, while the elevation of the entire
pipeline is noted, the elevation profile is not evaluated as a risk factor that could impact the
consequences of a failure, such as whether the elevation profile from south to north allows more
product to drain into the Yellowstone than if the pipeline had a flat profile.
There is some discussion of spill size in the section evaluating emergency flow restriction
devices, but only with regard to the threats previously identified. Since flooding is not identified
as a possible failure mode, there is no consideration of the potential amount of product that could
be released as a result of damage at the crossing caused by flooding, such as if there is a
guillotine break in the pipeline. There is also no mention of the physical support of the pipeline
crossing at the Yellowstone River.
For these reasons, PHMSA finds Respondent’s 2010 P&M Analysis did not consider all of the
relevant risk factors in evaluating the likelihood of a release and potential consequences affecting
the HCA. While PHMSA recognizes that Respondent employed certain P&M measures in the
field, including depth of cover surveys and increased patrolling, these measures are not relevant
to this alleged violation, which concerns whether the risk analysis prepared by Respondent
appropriately considered relevant risk factors. Respondent’s other P&M measures are
considered below under Item 2.
In its written submissions and at the hearing, Respondent indicated that additional details of its
risk analysis were contained in other documents, including its 2010 Integrity Management
Program (IMP), 2010 IMP Forms 6.1, 2005 EFRD analysis, 2010 Data Integration and Risk
Assessment Summary, and 2009 integrity threat assessment. Those documents are considered
below.
43 The acronyms presumably refer to the types of HCAs, such as high population areas, other populated
areas, and unusually sensitive drinking water and ecological resource areas.



CPF No: 5-2013-5007
Page 11
2010 IMP Plan. Respondent argued that sections 3 and 6 of its 2010 IMP Plan demonstrated that
it considered time dependent threats such as heavy rains and floods.44
Section 3 of the 2010 IMP Plan discussed the process for data analysis generally, and stated that
segments are to be evaluated with regard to nine pipeline integrity threats listed in ASME
B31.8S.45 Section 6 of the IMP Plan discussed the procedures for evaluating P&M actions. It
described the evaluation process and noted that Form 6.1 should be used to document the
evaluation.
According to Section 6 of the 2010 IMP Plan, the evaluation process required identification of
HCAs and significant threats, including possible causes of failure. Examples of threats given
were third-party damage and corrosion. After identifying HCAs that may be affected and threats
that could cause a failure, Section 6 stated that appropriate risk factors must be considered,
which either increase or reduce risk. The procedure listed a number of risk factors that, at a
minimum, should be evaluated, including: terrain to HCAs and proximity, elevation profile,
waterways, potential volume released, and physical support.
While the procedures in the 2010 IMP Plan indicate the process Respondent should have
followed in performing a risk analysis, the procedures do not, by themselves, show whether this
process was indeed followed for the Silvertip Pipeline at the Yellowstone River crossing. In
particular, the procedures do not demonstrate that Respondent considered the threat of floods.
2010 IMP Form 6.1. The 2010 IMP Form 6.1 was used by EMPCo to document the evaluation
of P&M actions in support of the 2010 P&M Analysis.
46 Respondent submitted two such
forms.47 One was for the identified threat of external corrosion and the other was for the threat
of manufacturing defects. There were no forms identifying other threats that could cause a
pipeline failure, such as the threat of natural forces or flooding.
Both of the forms submitted include evaluation of the risk factors relevant to the identified threat.
Risk factors such as terrain to the HCA, pipeline profile, potential product spillage, and physical
supports were all considered, but since their consideration was limited to the two identified
failure threats, these factors were not considered in regard to the threat of natural forces or
flooding.
Accordingly, the forms submitted do not support Respondent’s assertion that its risk analysis
considered the threat of floods and associated risk factors.
44 Pre-hearing Submittal at 6-7.
45 Pre-hearing Submittal Exhibit 9. ASME B31.8S is not incorporated by reference in § 195.452.
46 Violation Report, Exhibit B-7 at 3.
47 Pre-hearing Submittal Exhibit 10 – Preventative & Mitigative Actions Evaluation, dated July 7, 2010.



CPF No: 5-2013-5007
Page 12
Other Documentation. Respondent asserted that its 2010 P&M Analysis relied upon a
consideration of elevation profile performed in 2005.48 Respondent also referenced its 2010
Data Integration and Risk Assessment Summary, which noted the approximate 1150-foot
elevation change between the two ends of the pipeline and the static pressure at the downstream
end.49
Having reviewed the 2005 Emergency Flow Restricting Device (EFRD) Evaluation and related
materials, PHMSA finds Respondent considered the elevation profile of the pipeline, but there is
inadequate consideration of how the elevation profile impacts the consequences of a pipeline
failure at the Yellowstone River. In particular, there is no consideration of how the elevation
profile could result in crude oil draining into the river in the event of a failure at the crossing.
Respondent also contended that its 2009 integrity assessment “considered the threat of weather-
related and outside forces.”50 In connection with this assertion, Respondent cited to its 2010
IMP Plan, which is already discussed above.
C. Conclusion
Given the history of flooding and impact to other pipelines at this location, the threat of flooding
was relevant to the likelihood of a release occurring on Respondent’s pipeline. Respondent did
not evaluate the likelihood of a release caused by flooding of the Yellowstone River and failed to
consider risk factors relevant to flooding. Accordingly, PHMSA finds Respondent violated
§ 195.452(i)(2) by failing to conduct a risk analysis of the Silvertip Pipeline that considered all
risk factors relevant to the likelihood of a release on the Silvertip Pipeline and potential
consequences affecting the Yellowstone River.
Item 2: The Notice alleged that Respondent violated 49 C.F.R. § 195.452(i)(1), which states:
§ 195.452 Pipeline integrity management in high consequence areas.
(a) . . . .
(i) What preventive and mitigative measures must an operator take to
protect the high consequence area?—(1) General requirements. An
operator must take measures to prevent and mitigate the consequences of a
pipeline failure that could affect a high consequence area. These measures
include conducting a risk analysis of the pipeline segment to identify
additional actions to enhance public safety or environmental protection.
Such actions may include, but are not limited to, implementing damage
prevention best practices, better monitoring of cathodic protection where
corrosion is a concern, establishing shorter inspection intervals, installing
EFRDs on the pipeline segment, modifying the systems that monitor
48 Post-hearing Brief at 5, citing Violation Report Exhibit B-3.
49 Post-hearing Brief at 5, citing Violation Report Exhibit A-15.
50 Pre-hearing Submittal at 7.



CPF No: 5-2013-5007
Page 13
pressure and detect leaks, providing additional training to personnel on
response procedures, conducting drills with local emergency responders
and adopting other management controls.
The Notice alleged that Respondent violated § 195.452(i)(1) by failing to take appropriate
measures to prevent or mitigate the consequences of a failure on the Silvertip Pipeline at the
Yellowstone River crossing. Specifically, the Notice alleged that Respondent failed to operate
remote control valves (RCVs) installed on the Silvertip Pipeline to prevent or mitigate the
consequences of a failure. In addition, the Notice alleged that Respondent failed to take “any
other” P&M measures to address the threat of failure from flooding, such as implementation of
damage prevention best practices, strengthening leak detection systems, undertaking additional
training for response personnel, or addressing the risk of a guillotine failure.51
In its written submissions and at the hearing, Respondent contested the allegation that it failed to
identify and implement appropriate P&M measures. Respondent contended that its written IMP
Plan addressed P&M measures and that EMPCo had adopted those measures at the Yellowstone
River crossing.52 Respondent contended that it “had employed all of the P&M measures
suggested by PHMSA” under the regulation prior to the incident.53
Respondent explained that the P&M measures it employed included conducting a depth of cover
survey several months before the accident, which determined the pipeline had adequate
protection.54 The measures also included actively monitoring river conditions prior to the
accident, having thicker walled pipe and concrete coating, placing the pipe in a rock trench
deeper than otherwise required, having rock cobble placed on top of the pipe trench, hydrostatic
pressure testing, conducting two inline inspections, and increased patrolling during high water.
Respondent argued these P&M measures at the Yellowstone River crossing were “virtually all
P&M measures that could be undertaken to prevent or mitigate flood risk.”55 Respondent also
noted that PHMSA has issued a number of advisory bulletins concerning the risks of flooding
and that EMPCo had adopted the P&M measures noted in the advisories.56
Respondent stated further that the only additional P&M measures possible at the crossing were
temporary shutdown of the pipeline or construction of a new horizontal directionally drilled
(HDD) crossing.57 Respondent contended that HDD is not a requirement under the regulations,
51 Notice at 6.
52 Response at 3.
53 Pre-hearing Submittal at 8 (emphasis in original has been omitted), citing EMPCo IMP Plan, Section
6.4.2.5, Figure 6.2; and Exhibit 11 (summary of P&M measures implemented).
54 Pre-hearing Submittal at 9.
55 Post-hearing Brief at 4-5.
56 Post-hearing Brief at 5.
57 Post-hearing Brief at 6.



CPF No: 5-2013-5007
Page 14
and asserted that OPS agreed at the hearing it was not a requirement.
58 With regard to temporary
shutdown, Respondent noted that it temporarily shut down the pipeline twice prior to the
accident to evaluate and monitor the crossing. Absent an imminent hazard, however,
Respondent asserted there was no regulatory requirement to keep the pipeline shut down for a
prolonged period. Respondent argued that evidence in the record demonstrates that neither
EMPCo nor OPS suspected there was any imminent danger to the pipeline leading up to the
accident.
A. Applicable Standards for Taking P&M Measures
Under the integrity management regulations, operators must take measures to protect the HCA
that could be affected, including measures to prevent and mitigate the consequences of a pipeline
failure.59 Such actions may include, but are not limited to implementing damage prevention best
practices; better monitoring of cathodic protection where corrosion is a concern; establishing
shorter inspection intervals; installing emergency flow restricting devices such as RCVs;
modifying the systems that monitor pressure and detect leaks; providing additional training to
personnel on response procedures; conducting drills with local emergency responders; and
adopting other management controls.
B. Whether Respondent Failed to Take Required P&M Measures
PHMSA considered the evidence in the record to determine whether Respondent violated
§ 195.452(i)(1) as alleged in the Notice by failing to operate RCVs or by failing to take any other
measures.
The evidence in the record demonstrates Respondent took a number of measures in an effort to
prevent or mitigate a pipeline failure at the Yellowstone crossing, including installing its pipeline
in a manner that exceeded certain minimum safety requirements for new pipeline construction,
installing RCVs, conducting ILIs and reviewing data for actionable anomalies, conducting depth
of cover surveys, actively monitoring the river, temporarily shutting down the pipeline, meeting
with local and federal officials, and placing sandbags to protect the closest upstream RCV from
flooding.
While the Notice alleged that Respondent violated § 195.452(i)(1) by failing “to operate RCVs,”
the Notice did not allege when and in what manner the regulation required the valves to be
operated. It was not clear from the Notice whether the allegation was based on an alleged failure
to preemptively shut down the pipeline to “prevent” the accident or to shut down the pipeline
immediately after the failure to “mitigate” the consequences (or both).60 The Violation Report
also did not convey the specific conduct that constituted a probable violation. OPS did not
58 Post-hearing Brief at 6, citing Hearing Transcript at 77.
59 § 195.452(i)(1).
60 Respondent demonstrated that it did preemptively shut down the pipeline on two separate occasions
prior to the failure.



CPF No: 5-2013-5007
Page 15
further develop this alleged violation at the hearing. In its post-hearing recommendation
submitted pursuant to § 190.209(b)(7), the Director recommended that this alleged violation be
withdrawn. Accordingly, PHMSA finds the allegation that Respondent violated § 195.452(i)(1)
by failing to operate RCVs was not proven.
Likewise, with regard to other P&M measures listed in the alleged violation, such as
implementation of damage prevention best practices and strengthening leak detection systems,
OPS did not present any persuasive arguments as to why each of those measures were required
under the regulation and how those measures could have prevented or mitigated the
consequences of a failure. While someone could assume that any additional measures could
have some impact on preventing or mitigating failures, OPS has the burden of proving the
measures alleged in the Notice were, in fact, required as a result of § 195.452(i)(1). The
evidence in the record is insufficient to prove a violation with regard to these allegations.
C. Conclusion
For the reasons stated above, PHMSA finds OPS did not prove that Respondent violated
§ 195.452(i)(1) as alleged in the Notice. Accordingly, this alleged violation is withdrawn.
Item 3: The Notice alleged that Respondent violated 49 C.F.R. § 195.403(a)(3), which states:
§ 195.403 Emergency response training.
(a) Each operator shall establish and conduct a continuing training
program to instruct emergency response personnel to:
(3) Recognize conditions that are likely to cause emergencies, predict
the consequences of facility malfunctions or failures and hazardous liquids
or carbon dioxide spills, and take appropriate corrective action;
The Notice alleged that Respondent failed to effectively train emergency response personnel.
Specifically, the Notice alleged that the supervisor at the control center in Houston, Texas, and
First Line Supervisor at the refinery in Billings, Montana, had not been adequately trained to
recognize and respond to: (1) local environmental conditions that were likely to cause
emergencies, such as localized historic flooding; (2) the consequences of a guillotine failure in
the river; and (3) the unique system configurations, including surge-protected remote controlled
valves that may be closed to mitigate the consequences of a failure.
In its written submissions and at the hearing, EMPCo did not contest the alleged violation, even
though EMPCo stated that it did not necessarily agree with the allegation.
Accordingly, having reviewed the evidence, PHMSA finds Respondent violated § 195.403(a)(3)
by failing to effectively train emergency response personnel.



CPF No: 5-2013-5007
Page 16
Item 4: The Notice alleged that Respondent violated 49 C.F.R. § 195.402(e)(2), which states:
§ 195.402 Procedural manual for operations, maintenance, and
emergencies.
(a) General. Each operator shall prepare and follow for each pipeline
system a manual of written procedures for conducting normal operations
and maintenance activities and handling abnormal operations and
emergencies . . . .
(e) Emergencies. The manual required by paragraph (a) of this section
must include procedures for the following to provide safety when an
emergency condition occurs . . .
(2) Prompt and effective response to a notice of each type [of]
emergency, including fire or explosion occurring near or directly
involving a pipeline facility, accidental release of hazardous liquid or
carbon dioxide from a pipeline facility, operational failure causing a
hazardous condition, and natural disaster affecting pipeline facilities.
The Notice alleged that Respondent failed to prepare written procedures for the prompt and
effective response to a natural disaster affecting its pipeline facility. Specifically, the Notice
alleged that Respondent’s manual of written procedures did not include procedures to respond to
seasonal flooding of the Yellowstone River, such as procedures for emergency shutdown of
pumps, closure of isolating valves, or precautionary purging of the pipeline in areas susceptible
to a release. The Notice alleged that between May 25, 2011, and the date of the incident,
Respondent had notice that the river was experiencing flooding in the area of the pipeline
crossing, but the Company did not have written procedures to instruct emergency response
personnel on how to address the flooding.
In its written submissions and at the hearing, Respondent contested the violation and contended
that EMPCo’s Operations and Maintenance (O&M) manual contained procedures for responding
to emergency conditions. Respondent explained that its O&M manual was comprised of OCC
Operating Instructions for the Montana Crude Pipeline system (OCC Instructions) as well as
Local Operating Instructions for the Silvertip to Laurel and Billings segments (Local
Instructions). These procedures, Respondent contended, “provide detailed instructions for
emergency condition response, including line shutdown, valve closures, surveillance, repair and
testing procedures.”61 Respondent also indicated the Local Instructions required closure of both
upstream and downstream valves to isolate the river crossing.
A. Applicable Standards for Emergency Response Procedures
Each pipeline operator must have written procedures for conducting normal operations and
maintenance activities on the pipeline system and for handling abnormal operations and
emergencies.62
61 Pre-hearing Submittal at 10.
62 § 195.402(a).



CPF No: 5-2013-5007
Page 17
The written procedures for handling emergencies must include, among other things, provisions
for promptly and effectively responding to emergencies. The types of emergencies for which
procedures are required include fire or explosion, accidental release, hazardous conditions, and
natural disasters affecting the pipeline facility.63
B. Whether Respondent’s Procedures Complied with Applicable Standards
PHMSA has reviewed Respondent’s O&M manual comprised of the OCC Instructions and Local
Instructions to determine whether they included provisions for responding to an emergency
involving a natural disaster affecting its pipeline facility.
The OCC Instructions broadly defined an “emergency condition” to include an accidental line
leak, fire or explosion near or involving the pipeline, natural disasters effecting the pipeline, and
controller alarms indicating a line leak.
64 The procedures then required certain actions to be
taken in response to such an “emergency condition.” The OCC Instructions were limited,
however, by addressing only actions taken in response to an accidental line leak. For example,
the procedures instructed controllers to check line pressures and prepare to shut the system down
if the controller “is notified by telephone that a leak has occurred.”65 The controller must also
initiate an emergency shutdown when a “line leak” is known, suspected, or indicated by line
parameters.66 Another provision stated that controllers are required to respond to an emergency
condition “[w]hen a leak is suspected or known.”67
An accidental release is not the only type of emergency that an operator’s procedures must
address. Other types of emergencies, such as “fire or explosion occurring near or directly
involving a pipeline facility” and “natural disaster affecting pipeline facilities” might not involve
a release of product.68 An operator’s procedures must still include provisions to respond to those
emergencies. In the case of a pending natural disaster or flood, a response may involve
preventative actions, such as temporary shutdown or purging if necessary. Respondent’s OCC
Instructions did not require any specific actions to respond to an emergency involving
notification of a natural disaster. The procedures only instructed controllers how to respond to
leaks or accidental releases.
The same deficiency is noted with the Local Instructions. The section of the procedures titled
“Response to an Emergency Condition,” stated that if an emergency condition exists, the
63 § 195.402(e)(2).
64 Pre-hearing Submittal Exhibit 13 – Respondent’s OCC Instructions and Local Instructions. OCC
Instructions, Section 2.6.
65 OCC Instructions, Section 2.6.1.
66 OCC Instructions, Section 2.6.2.
67 OCC Instructions, Section 2.6.3.
68 § 195.402(e)(2).



CPF No: 5-2013-5007
Page 18
pipeline can be shut down by sending a particular station command. But the only situation
specified in which the pipeline must be shut down is “[w]hen a leak is suspected or known.”69
In another section of the Local Instructions, separate from the emergency response procedures,
there was a list of vulnerable locations and valves that can be closed to isolate each location.70
The Yellowstone River was listed as a vulnerable location and valves 4462 and 4461 were listed
as the upstream and downstream valves that may be closed to isolate that location. The list did
not contain any instructions to personnel about when such valves must be closed. In particular,
the procedures did not specify the circumstances in which the Yellowstone River section of the
pipeline must be isolated upon notification of a natural disaster affecting the pipeline. Also, the
list was not actually cross-referenced in the emergency response procedures so that someone
using the emergency procedures would be directed to the list of vulnerable locations and valves.
PHMSA finds Respondent’s procedures did not meet the minimum standard specified in
§ 195.402(e)(2) because the procedures failed to include provisions for responding to a natural
disaster affecting its pipeline facilities.
C. Other Issues Raised by Respondent
Respondent raised a number of other issues with regard to Item 4. First, Respondent objected to
statements in the Notice that it believed were critical of EMPCo for taking measures to respond
to flooding concerns. These measures included confirming depth of cover, reviewing ILI data,
and meeting with governmental officials. Respondent argued that the Notice implied such
precautionary measures “somehow illustrate a failure to adequately prepare for emergency
conditions.”71
To determine Respondent’s compliance with § 195.402(e)(2), PHMSA reviewed Respondent’s
written emergency response procedures, not the measures taken by the Company to respond to
flooding concerns. The statements that Respondent found objectionable did not have an impact
on the conclusion that Respondent’s procedures failed to comply with the standard.
Second, Respondent objected to the allegation in the Notice that Respondent failed to create
“new procedures,” arguing there was no requirement in the regulation to create any new
procedures leading up to the 2011 flooding event and pipeline failure.
Again, when evaluating Respondent’s compliance with § 195.402(e)(2), PHMSA considered the
procedures that were in effect during the relevant time period. The allegation that Respondent
failed to create “new procedures” did not impact the finding of violation.
69 Local Instructions, Section 2.4.1.
70 Local Instructions, Section 10.4.
71 Pre-hearing Submittal at 11.



CPF No: 5-2013-5007
Page 19
Finally, Respondent claimed the conditions that resulted in the accident were largely
unforeseeable because prior to May 2011, the Yellowstone River had not exceeded flood stage
since 1997 and the pipeline had never previously been damaged by flooding.72
Under § 195.402(e)(2), Respondent’s procedures must include, at a minimum, provisions for
responding to an emergency involving a natural disaster affecting its pipeline. Respondent’s
procedures did not meet this minimum standard, regardless of the foreseeability of the accident
that occurred on July 1, 2011.
D. Conclusion
Having reviewed the evidence in the record, PHMSA finds Respondent violated § 195.402(e)(2)
by failing to have written procedures for promptly and effectively responding to a natural
disaster, including flooding, that could affect its pipeline facility.
Item 5: The Notice alleged that Respondent violated 49 C.F.R. § 195.402(e)(4), which states:
§ 195.402 Procedural manual for operations, maintenance, and
emergencies.
(a) . . . .
(e) Emergencies. The manual required by paragraph (a) of this section
must include procedures for the following to provide safety when an
emergency condition occurs . . .
(4) Taking necessary action, such as emergency shutdown or pressure
reduction, to minimize the volume of hazardous liquid or carbon dioxide
that is released from any section of a pipeline system in the event of a
failure.
The Notice alleged that Respondent failed to prepare written procedures to minimize the volume
of hazardous liquid released in the event of a failure. Specifically, the Notice alleged that
Respondent’s procedures did not include instructions for controllers to close RCVs to minimize
the flow of product into water in the event of a suspected release at the Yellowstone River. The
Notice alleged that Respondent’s written control center procedures included instructions for
shutting down pumps and closing valves located at the beginning of the pipeline, but not for the
rapid closure of all appropriate valves, particularly RCV 4462, in the event of a suspected leak
affecting the Yellowstone River.
The Notice alleged that a timeline of control room actions and related records demonstrated that
on the day of the incident, pumps were shut down within 7 minutes of the first SCADA alarm,
but it took 56 minutes for controllers to assess the situation and close RCV 4462 upstream of the
Yellowstone River to stop the flow of oil into the water.
72 Pre-hearing Submittal at 10.



CPF No: 5-2013-5007
Page 20
In its written submissions and at the hearing, Respondent contended that its written control
center procedures had appropriate provisions requiring the shutdown of lines, pump, and valves,
and that those procedures were relied on during the Silvertip incident to shut down pumps and
block valves.73 In particular, Respondent explained the procedures required that pumping units
be shut down whenever a leak is suspected or known. Once shutdown occurs, personnel are to
analyze line parameters to confirm the leak and its location. Field personnel are then advised of
the conditions and block valves are closed to isolate the affected segment. Respondent stated
these instructions included requirements to close both upstream RCV 4462 and downstream
RCV 4461 to isolate the affected segment at the Yellowstone River.
A. Applicable Standards for Procedures to Minimize the Volume of a Release
As stated above, each pipeline operator must have and follow written procedures for conducting
normal operations and maintenance activities on the pipeline system and for handling abnormal
operations and emergencies.74
The written procedures for handling emergencies must include, among other things, provisions
for taking necessary action to minimize the volume released in the event of a pipeline failure,
such as emergency shutdown.75
B. Whether Respondent’s Procedure Complied with Applicable Standards
PHMSA reviewed Respondent’s OCC Instructions and Local Instructions to determine whether
the written procedures required taking necessary action to minimize the volume of a release at
the Yellowstone River.
Section 2.6 of the OCC Instructions and Section 2.4 of the Local Instructions both identified an
“emergency condition” to include any controller alarm function that indicates an accidental line
leak. Sections 2.6.2 and 2.6.3 of the OCC Instructions stated that when a line leak is suspected,
the controller must initiate an emergency shutdown by stopping pump units “and closing line
block valve 1066” and “Laurel block valve 1067.”76 After the line is shut down and block valves
are closed, the procedures stated that appropriate division personnel assume responsibility for
surveillance, repair and testing.
Section 2.4.1 of the Local Instructions stated that if a leak is suspected or known, pumping units
“are shut down in accordance with station instructions. With the line shut down and segmented,
personnel should analyze the line parameters to confirm the leak and determine the segment
where the leak has occurred.”77
73 Pre-hearing Submittal at 11-12.
74 § 195.402(a).
75 § 195.402(e)(4).
76 Pre-hearing Submittal Exhibit 13.
77 Pre-hearing Submittal Exhibit 13.



CPF No: 5-2013-5007
Page 21
Other than closure of valves 1066 and 1067, these procedures did not include instructions for
controllers to close RCVs to isolate segments following an indication of a failure. Valve 1066 is
at the beginning of the Silvertip Pipeline and valve 1067 is at the Laurel Terminal Facility,
downstream of the Yellowstone River.78 The closure of only these two valves is not adequate to
stop the flow of oil into the Yellowstone River if there is a failure at the river crossing. Although
the procedures also stated generally that “line block valves are closed isolating the line in
segments,” the procedures provided no further instructions as to what, if any, valves must be
closed other than valves 1066 and 1067.79
Section 10.4 of the Local Instructions, which is not cross-referenced in the emergency
procedures in Section 2.4, listed “vulnerable locations” on the Silvertip Pipeline and indicated
that each vulnerable location may be isolated using particular valves upstream and downstream.
For the Yellowstone River the list identified RCV 4462 upstream and RCV 4461 downstream.
As noted above, this list did not contain any actual instructions to personnel about when the
valves are required to be closed, including whether personnel must close RCVs 4462 and 4461
upon notification of a leak affecting the Yellowstone River. Also, since it is not cross-referenced
in Section 2.4, someone using the emergency response procedures would not be referred to
Section 10.4.
C. Conclusion
Respondent’s procedures failed to instruct controllers to close RCV 4462 upstream of the
Yellowstone River in the event of a suspected failure at that location. Accordingly, PHMSA
finds Respondent violated § 195.402(e)(4) by failing to have written procedures to minimize the
volume of hazardous liquid released in the event of a failure at the Yellowstone River.
The above findings of violation will be considered prior offenses in any subsequent enforcement
action taken against Respondent.
ASSESSMENT OF PENALTY
Under 49 U.S.C. § 60122, Respondent is subject to an administrative civil penalty not to exceed
$100,000 per violation for each day of the violation, up to a maximum of $1,000,000 for any
related series of violations.80 The Notice proposed a total civil penalty of $1,700,000 for the
alleged violations in Items 1, 2, 4, and 5. The Notice did not propose a penalty for Item 3.
78 Violation Report Exhibit A-1, Appendix 1 at 8.
79 OCC Instructions, Section 2.6.3.
80 The Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, Pub. L. No. 112-90, § 2(a)
(Jan. 3, 2012) increased the maximum penalty for a violation of the pipeline safety standards to $200,000
per violation for each day, up to a maximum of $2,000,000 for a related series of violations.



CPF No: 5-2013-5007
Page 22
In determining the amount of a civil penalty under 49 U.S.C. § 60122 and 49 C.F.R. § 190.225,
PHMSA must consider the following criteria: the nature, circumstances and gravity of the
violation, including adverse impact on the environment; the degree of Respondent’s culpability;
the history of Respondent’s prior offenses; the good faith of Respondent in attempting to comply
with the pipeline safety regulations; and the effect on Respondent’s ability to continue in
business. In addition, PHMSA may consider the economic benefit gained from the violation
and such other matters as justice may require.
In its written submissions and at the hearing, Respondent argued that the proposed penalty is
excessive because it is inconsistent with the statutory penalty maximum for a related series of
violations, and also because it fails to consider all mitigating factors.81 Respondent also stated
there were due process concerns with the proposed penalty.
A. Related Series of Violations
Administrative penalty assessments for violations of the pipeline safety regulations are subject to
the limits set forth in 49 U.S.C. § 60122. At the time of the violation, § 60122(a)(1) stated that a
person who commits a violation is liable for “a civil penalty of not more than $100,000 for each
violation. A separate violation occurs for each day the violation continues. The maximum civil
penalty under this paragraph for a related series of violations is $1,000,000.”
Respondent argued that under this statutory provision, Items 1, 2, 4 and 5 are all a “related series
of violations” and therefore the combined penalty should be no higher than $1,000,000.82
Respondent contended the violations were all one related series because each violation refers to
the same flood event on July 1, 2011, involves the same issues and evidence, and is essentially
duplicative so that they all restate the same violation. In the alternative, Respondent contended
that Items 1 and 2 are “so closely related” and “share the same evidentiary basis” so as to
constitute a single violation.
83 Respondent also contended that Items 4 and 5 constitute a
separate single violation.84
PHMSA has previously addressed what constitutes “a related series of violations” under
§ 60122(a)(1), finding the term refers to a series of daily violations.
85 PHMSA has also
explained that just because multiple violations relate to a single pipeline accident, this does not
necessarily mean all of the violations are a “related series” under the statute. In Colorado
Interstate Gas Company, a case involving propose penalties of $3,364,000, the operator argued
that civil penalties arising from a single accident could not exceed $1,000,000 in total regardless
of the number of violations.86 PHMSA ultimately rejected that argument, explaining that such
81 Post-hearing Brief at 8-9.
82 Pre-hearing Submittal at 14.
83 Post-Hearing Brief at 8-9.
84 Pre-hearing Submittal at 15.
85 Colorado Interstate Gas Co., CPF No. 5-2008-1005, at 12, 2009 WL 5538649 (Nov. 23, 2009).
86 Colorado Interstate Gas, CPF No. 5-2008-1005, at 10-11.



CPF No: 5-2013-5007
Page 23
an interpretation would essentially cap all cases at $1,000,000 because violations can always be
considered somewhat related when they involve the same subject matter as part of the same
accident investigation. This would arbitrarily limit the number of violations PHMSA could
assess penalties for in cases involving multiple serious violations warranting the maximum daily
penalty.
PHMSA recognizes, however, that some separately alleged violations may be so related that they
constitute a single offense for which the Agency should not assess combined penalties exceeding
the limit for a single related series. In this regard, PHMSA was previously guided by U.S.
Supreme Court precedent in Blockburger v. United States, which held that “where the same act
or transaction constitutes a violation of two distinct statutory provisions, the test to be applied to
determine whether there are two offenses or only one, is whether each provision requires proof
of a fact which the other does not.”87 PHMSA has used this rationale in certain cases to ensure
that alleged violations are indeed separate, meaning they each require proof of an additional fact,
or have their “own evidentiary basis.”88
For example, in Colorado Interstate Gas Company, PHMSA found that two separately alleged
violations were essentially the same because both alleged the operator had failed to conduct
adequate oversight of its line locator and both involved the exact same evidence, namely, the
conduct of the employee responsible for overseeing the line locator.89 The two alleged
violations were found to be so related they constituted a single offense, but they were separate
from a third violation, which involved addressing repeated encroachments.
Using the same rationale, PHMSA evaluates below whether any of the violations in the present
case are so related they constitute a single offense. PHMSA also applies the penalty assessment
considerations individually to each of the violations.
Item 1: The Notice proposed a civil penalty of $495,500 for Respondent’s violation of
§ 195.452(i)(2). Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis of its
pipeline that considered the threat of flooding and the risk factors relevant to that threat.
Although Respondent considered the risk factors listed in § 195.452(i)(2) as they related to other
threats, Respondent did not evaluate the likelihood of a release caused by flooding at the
Yellowstone River and therefore did not consider the risk factors relevant to that failure mode.
The proposed penalty amount was based on assertions in the Notice and Violation Report
relevant to the penalty assessment criteria in § 190.225. With regard to the nature, circumstances
and gravity of the violation, including adverse impact on the environment, the Violation Report
87 Blockburger v. United States, 284 U.S. 299, 304, (1932)
88 Colorado Interstate Gas, CPF No. 5-2008-1005, at 12. See also Enbridge Energy Partners, L.P., CPF
No. 3-2008-5011, 2010 WL 6531629 (Aug. 17, 2010); Williams Gas Pipeline Co., CPF No. 5-2009-1003,
2010 WL 6539190 (Oct. 14, 2010); Columbia Gulf Transmission Co., CPF No. 4-2009-1005, 2011 WL
1919519 (Mar. 21, 2011); Kinder Morgan Liquids Terminals LLC, CPF No. 1-2011-5001, 2012 WL
6184429 (Oct. 17, 2012).
89 Colorado Interstate Gas, CPF No. 5-2008-1005, at 14.



CPF No: 5-2013-5007
Page 24
suggested the violation had the highest level of gravity because it resulted in significant P&M
measures being overlooked. The violation was discovered as a result of an accident, and
allegedly lasted at least 330 days. The Notice also alleged the violation was a major cause of the
accident that occurred on July 1, 2011.
Having reviewed the record, PHMSA finds the highest level of gravity is appropriate. While
evidence in the record does not support finding the violation caused the accident—as reports
submitted by both parties attributed the cause to the forces of the flood and accumulation of
debris—the violation contributed to increasing the severity of the consequences of the accident.
Respondent’s risk analysis did not identify appropriate measures to prevent or mitigate the
consequences of an accident caused by natural forces or flooding. Given that the accident
resulted in the release of 1,500 barrels of crude oil, environmental damage to a waterway, and
evacuations of persons, PHMSA finds the highest level of gravity is appropriate.
The proposed penalty amount was also based on an assertion in the Violation Report that the
violation affected Respondent’s entire pipeline system, including more than 5,000 miles of
pipeline that could impact an HCA.90 There is not sufficient evidence in the record to support
finding the violation affected Respondent’s entire pipeline system. Item 1 was limited to the
69.6-mile Silvertip Pipeline and the accident that occurred on July 1, 2011. Accordingly, the
penalty should be reduced to accurately reflect the mileage impacted.
With regard to the degree of Respondent’s culpability and good faith, the Violation Report
suggested a slightly reduced culpability because Respondent had developed an IMP Plan with
P&M risk analyses, but Respondent had not achieved full compliance. Based on a review of the
record, this is an accurate assessment of Respondent’s culpability. Respondent had an IMP Plan
and had performed a risk analysis, but failed to consider risk factors relevant to a pipeline failure
caused by natural forces or flooding.
In its written submissions, Respondent contended that the proposed penalty did not consider the
good faith exhibited by EMPCo in fully cooperating with all federal, State and local officials
“both before the incident occurred—voluntarily taking additional actions to evaluate the risk of
flooding—and . . . while responding to and investigating the causes of the incident.”91
Respondent also noted that EMPCo has spent more than $135 million in response and
coordination efforts, including three new horizontally drilled river crossings for the Silvertip
Pipeline and voluntary settlement with the State of Montana. Respondent contended the
proposed penalty should be reduced in light of such cooperation and good faith exhibited.
When considering the good faith of a respondent under the assessment criteria, PHMSA looks at
the operator’s attempt to comply with the cited regulation prior to occurrence of the violation.92
90 Violation Report at 10. In its annual report submitted pursuant to § 195.49, EMPCo reported that it
operates approximately 4,000 miles, not more than 5,000 miles.
91 Pre-hearing Submittal at 15.
92 City of Richmond, Virginia, CPF No. 1-2013-0001, 2014 WL 2875598 (May 2, 2014).



CPF No: 5-2013-5007
Page 25
With regard to the actions taken by Respondent to cooperate with officials before and after the
accident, PHMSA acknowledges these actions, but finds they were steps that any reasonable and
prudent operator should take in light of the circumstances presented.93 Pipeline operators should
be responsive to local and federal officials when safety concerns are raised and should work with
officials to advance pipeline safety particularly following a significant pipeline accident. While
Respondent’s actions are noted, PHMSA finds these efforts do not exhibit the requisite attempt
to comply with the regulations prior to the violations, and otherwise do not warrant a reduction
to the proposed civil penalty given the gravity of the accident.
Accordingly, Respondent is assessed a civil penalty of $345,000 for the violation of
§ 195.452(i)(2), which is a reduced amount to reflect the correct mileage of pipeline associated
with the violation.
Item 2: The Notice proposed a civil penalty of $504,500 for Respondent’s violation of
§ 195.452(i)(1). As discussed above, this alleged violation is withdrawn. Therefore, the civil
penalty proposed in the Notice for Item 2 is not assessed.
Due to the withdrawal of Item 2, it is not necessary to determine whether Item 1 and Item 2 were
a “related series of violations” under 49 U.S.C. § 60122(a)(1), as contended by Respondent.
Item 4: The Notice proposed a civil penalty of $600,000 for Respondent’s violation of
§ 195.402(e)(2). Respondent violated § 195.402(e)(2) by failing to have written procedures for
promptly and effectively responding to a natural disaster or flooding. Respondent’s procedures
addressed accidental releases, but did not require any specific actions if an emergency condition
involves a pending natural disaster or flood.
The proposed penalty amount was based on assertions in the Notice and Violation Report
relevant to the penalty assessment criteria in § 190.225. With regard to nature, circumstances
and gravity of the violation, including adverse impact on the environment, the Violation Report
noted the violation contributed to increasing the severity of the consequences of the accident. By
not having procedures for preventatively shutting down the pipeline system pending the flood,
the Violation Report stated that crude oil was allowed to drain into the Yellowstone River for 56
minutes after the initial notification of release.
With regard to the degree of Respondent’s culpability and good faith in attempting to comply,
the Violation Report stated that EMPCo was cognizant of the regulatory requirements and took
some steps to address the issue, but did not achieve compliance. Of note, EMPCo had
emergency response procedures, but the procedures did not include steps for responding to the
emergency condition of natural forces and flooding affecting the pipeline.
93 See, e.g., Panhandle Eastern Pipeline Co., CPF No. 3-2008-1002, 2011 WL 2937935 (Jun. 17, 2011)
(finding actions taken prior to the incident were not actually aimed at achieving compliance with the cited
regulation, and corrective actions taken after the incident were steps a reasonable and prudent operator
would take to prevent future incidents).



CPF No: 5-2013-5007
Page 26
Based on a review of the evidence in the record, PHMSA finds the above assertions are accurate
and the proposed civil penalty amount is supported by the applicable assessment criteria. With
regard to the length of the violation, the regulatory obligation to have such procedures began
before initial operations of Respondent’s pipeline system commenced.94
Respondent argued that Item 1 and Item 4 are a “related series of violations.” PHMSA finds the
violations are not a single related series, because each violation involves a separate regulatory
requirement and requires proof of an additional fact. Item 1 concerns the requirement to perform
a risk analysis by considering the threat of flooding to identify P&M measures. Item 4 concerns
the requirement to have written procedures for responding to a natural disaster or flooding. Item
4 requires proof of an additional fact: that Respondent failed to have emergency procedures for
responding to a natural disaster or flooding.
Having reviewed the record and considered the assessment criteria, Respondent is assessed a
civil penalty of $600,000 for the violation of § 195.402(e)(2).
Item 5: The Notice proposed a civil penalty of $100,000 for Respondent’s violation of
§ 195.402(e)(4). Respondent violated § 195.402(e)(4) by failing to have written procedures to
minimize the volume of a release in the event of a failure. Specifically, Respondent’s emergency
procedures did not direct controllers to close RCV 4462 upstream of the Yellowstone River upon
notification of a possible leak affecting the river.
With regard to the nature, circumstances and gravity of the violation, including adverse impact
on the environment, the Violation Report asserted that the violation increased the severity of the
consequences of the accident. By not having procedures requiring immediate closure of RCV
4462, crude oil was allowed to drain into the Yellowstone River for 56 minutes.
With regard to the degree of Respondent’s culpability and good faith in attempting to comply,
the Violation Report stated that EMPCo was cognizant of the regulatory requirements and took
some steps to address the issue, but did not achieve compliance with the regulatory obligation.
Of note, EMPCo had emergency response procedures, but the procedures did not include
instructions to close RCVs to minimize the release of crude oil at the Yellowstone River.
Based on a review of the evidence in the record, PHMSA finds the above assertions are accurate
and the proposed civil penalty amount is supported by the applicable assessment criteria.
Respondent argued that Item 4 and Item 5 were a single “related series of violations” because
both were based on the same regulatory provision, § 195.402(e). Respondent also contended that
both alleged that EMPCo had failed to maintain written procedures for responding to natural
disasters, and both cited procedures relating to the closure of valves. For example, Respondent
stated that Item 4 alleged EMPCo did not have procedures “such as [for] emergency shutdown of
94 § 195.402(a) requires the manual of procedures “shall be prepared before initial operations of a
pipeline system commence.”



CPF No: 5-2013-5007
Page 27
pumps and closure of isolating valves,” and Item 5 was similarly based on an allegation that
EMPCo lacked procedures for shutting down valves.
Item 4 and Item 5 are based on separate regulatory provisions. Item 4 concerned the requirement
under § 195.402(e)(2) that Respondent have procedures for responding to an emergency
involving flooding of the Yellowstone River. Item 5 concerned the requirement under
§ 195.402(e)(4) that Respondent have procedures for shutting down its pipeline to minimize the
volume of release in the event of a failure at the Yellowstone River. The fact that these
requirements are located in separately enumerated paragraphs under § 195.402(e) is merely a
product of organization.95
The violations in Item 4 and Item 5 also each required proof of a fact the other did not. Item 4
required proof that Respondent failed to have procedures for responding to flooding, procedures
which may involve preventative activities beyond merely shutting down the pipeline following
an accident. Item 5, on the other hand, required proof that Respondent failed to have procedures
for closing specific RCVs during an emergency shutdown. For these reasons, Item 4 and Item 5
are not a single related series of violations.
Respondent also argued Item 1 and Item 5 are a related series. For the same reasons stated
above, Item 1 and Item 5 are not a related series.
Accordingly, Respondent is assessed a civil penalty of $100,000 for the violation of
§ 195.402(e)(4).
B. Due Process
Respondent stated PHMSA’s method of calculating penalties presented a due process concern
because the Agency has not adopted a formal penalty policy.96 EMPCo argued that the
Administrative Procedure Act (APA) requires that all respondents be informed of “the matters of
fact and law asserted” in any enforcement pleading, and this should include enough information
so that a respondent “understands the issues and is afforded full opportunity to present its
defense at a hearing.”97
EMPCo stated that the Notice did not explain how the penalty was calculated or whether the
proposed penalty was for multi-day violations. EMPCo stated further that while “some
explanation of how the penalty was derived” is often provided after a request for a hearing, no
such information is provided at the start of the enforcement action. This practice, EMPCo
asserted, forces the regulated community to request a hearing in order to evaluate the penalty
95 See Kinder Morgan, CPF No. 1-2011-5001, at 9 (finding a single paragraph of the code may constitute
multiple requirements for which the operator is responsible for compliance).
96 Post-hearing Brief at 9.
97 Pre-hearing Submittal at 16.



CPF No: 5-2013-5007
Page 28
information. Thus, EMPCo asserted “PHMSA’s failure to expressly allege multi-day or
statutory maximum claims in its Notice violates the due process requirements of the APA.”98
PHMSA has considered Respondent’s position, but disagrees with several of its premises. First,
it is not necessary for operators to request a hearing in order to receive information concerning
the assessment factors and how they contributed to a proposed penalty. The assessment factors
are listed in § 190.225 and operators are free to submit information relevant to those factors to
support reducing or withdrawing a penalty. In addition, under § 190.208(c), respondents may
request a copy of the case file at any time.99 The case file includes the Violation Report, which
is the evidentiary support for the allegations in the Notice. The Violation Report also describes
the facts relevant to each of the penalty assessment factors and how those factors influenced the
proposed penalty, including duration of the violation.100 For example, the Violation Report in
the present case indicated that the violation in Item 1 occurred for a period of 330 days between
August 6, 2010, and July 1, 2011.101 PHMSA also provides to respondents upon request, a
general outline of how civil penalties are calculated.102 All of this material may be received and
reviewed by a respondent before or after responding to a notice of probable violation, regardless
of whether or not a hearing is requested.
In this case, EMPCo received a copy of the Violation Report shortly after responding to the
Notice and was free to respond to the information in its written submissions and at the hearing.
Accordingly, PHMSA finds there was sufficient information to afford Respondent an
opportunity to present its defense to the proposed penalty.
C. Other Considerations
Under 49 U.S.C. § 60122 and 49 C.F.R. § 190.225, PHMSA must consider the history of
Respondent’s prior offenses and the effect of the penalty on Respondent’s ability to continue in
business. The Violation Report noted a total of six prior offenses in the five-year period prior to
issuance of the Notice. Respondent did not claim the penalties would affect its ability to
continue in business.
D. Conclusion
In summary, having reviewed the record and considered the assessment criteria for each of the
Items cited above, Respondent is assessed a total civil penalty of $1,045,000.
98 Pre-hearing Submittal at 16.
99 Section 190.208 was adopted in 2013, codifying existing practice. Administrative Procedures; Updates
and Technical Corrections, 78 Fed. Reg. 58897 (Sept. 25, 2013).
100 See, e.g., Violation Report at 8-13 (describing assessment criteria influencing the penalty for Item 1).
101 Violation Report at 9.
102 See 78 Fed. Reg. 58897, 58901 (explaining that a general outline of how civil penalties are calculated
is provided upon request).



CPF No: 5-2013-5007
Page 29
Payment of the civil penalty must be made within 20 days of service. Federal regulations
(49 C.F.R. § 89.21(b)(3)) require such payment to be made by wire transfer through the Federal
Reserve Communications System (Fedwire), to the account of the U.S. Treasury. Detailed
instructions are contained in the enclosure. Questions concerning wire transfers should be
directed to: Financial Operations Division (AMK-325), Federal Aviation Administration, Mike
Monroney Aeronautical Center, P.O. Box 269039, Oklahoma City, Oklahoma 73125-4915. The
Financial Operations Division telephone number is (405) 954-8845.
Failure to pay the $1,045,000 civil penalty will result in accrual of interest at the current annual
rate in accordance with 31 U.S.C. § 3717, 31 C.F.R. § 901.9 and 49 C.F.R. § 89.23. Pursuant to
those same authorities, a late penalty charge of six percent (6%) per annum will be charged if
payment is not made within 110 days of service. Failure to pay the civil penalty may result in
referral of the matter to the Attorney General for action in a district court of the United States.
COMPLIANCE ORDER
Under 49 U.S.C. § 60118(a), each person who engages in the transportation of hazardous liquids
by pipeline or who owns or operates a pipeline facility is required to comply with the applicable
safety standards established under chapter 601.
The Notice proposed a compliance order with respect to the violation of § 195.403(a)(3)
(Item 3), which would have required EMPCo to train its controllers in recognizing and taking
appropriate action for conditions that could cause emergencies.
The Director indicated that Respondent has completed the actions specified in the proposed
compliance order. Accordingly, it is not necessary to include the compliance terms in this Order.
Under 49 C.F.R. § 190.243, Respondent may submit a petition for reconsideration of this Final
Order to the Associate Administrator for Pipeline Safety, PHMSA, 1200 New Jersey Avenue SE,
East Building, 2nd Floor, Washington, D.C. 20590, no later than 20 days after receipt of the
Final Order. Any petition submitted must contain a statement of the issue(s) and meet all other
requirements of § 190.243. The filing of a petition automatically stays the payment of any civil
penalty assessed. If Respondent submits payment of the civil penalty, the Final Order becomes
the final administrative decision and the right to petition for reconsideration is waived. The
terms and conditions of this Final Order are effective upon service in accordance with § 190.5.
_____________________________ ____________________
Jeffrey D. Wiese Date Issued
Associate Administrator
for Pipeline Safety

520135007_NOPV PCP PCO_03252013_text.pdf

NOTICE OF PROBABLE VIOLATION
PROPOSED CIVIL PENALTY
and
PROPOSED COMPLIANCE ORDER
CERTIFIED MAIL - RETURN RECEIPT REQUESTED
FAX TO: 713-656-8232
March 25, 2013
Mr. Gary Pruessing
President
ExxonMobil Pipeline Company
800 Bell Street
Room 741-D
Houston, Texas 77002
CPF 5-2013-5007
Dear Mr. Pruessing:
On July 2, 2011, a representative of the Pipeline and Hazardous Materials Safety Administration
(PHMSA), Office of Pipeline Safety (OPS), pursuant to Chapter 601 of 49 United States Code,
responded to a failure on ExxonMobil Pipeline Company’s (EMPCO) Silvertip Pipeline System at
Laurel, Montana. The 69.6-mile Silvertip Pipeline System (Silvertip Pipeline) is a 12” diameter
transmission pipeline that transports crude oil from the company’s Silvertip Pump Station near
Belfry, Montana, northwards to the Billings Refinery via Laurel. The Silvertip Pipeline crosses
the Yellowstone River approximately 800 feet east of the Highway 212 (Failure Site). The
pipeline segment at the Failure Site potentially “could affect” a High Consequence Area (HCA)
under PHMSA’s integrity management regulations due to the impacts that a pipeline failure could
have on the Yellowstone River and other environmentally sensitive areas.
At approximately 10:40 p.m. mountain daylight time (MDT) on July 1, 2011, the Silvertip
Pipeline failed at this Yellowstone River crossing, releasing approximately 1500 barrels of crude
oil over the next hour (Failure). The Failure was reported to the National Response Center on July
1



2, 2011, at approximately 12:19 a.m. MDT. The oil discharged directly into the Yellowstone
River at flood stage and fouled nearby agricultural fields, pastures and lawns along the banks
downstream of Laurel.
The Failure was first detected by EMPCO’s Operations Control Center (OCC) in Houston, Texas.
The OCC houses the company’s Supervisory Control and Data Acquisition (SCADA) system for
all EMPCO pipelines, including the Silvertip Pipeline. The company’s various pipelines are
segregated so that similar types of pipelines are operated from a single console at the OCC. The
console that monitored and controlled the Silvertip Pipeline at the time of the Failure was known
as Console #2, from which 12 different pipeline systems were operated.
On the evening of July 1, 2011, Console #2 was being controlled by Controller “A.” At 10:40:43
p.m., an alarm went off on Console #2, indicating a drop in line pressure at Remote Control Valve
(RCV) 4462, located immediately upstream and south of the Yellowstone River crossing.
Controller A apparently did not see or recognize this alarm. However, at 10:41:14 p.m. MDT, he
did notice a second alarm indicating that the booster pump at the Edgar Pump Station, located
approximately 14 miles upstream from Laurel, had automatically shut down because of a “low
suction pressure” alarm. Based on this information, Controller A believed that he might have a
leak and shut down the pumps at the head of the Silvertip Pipeline and closed the originating
valve (RCV 1066) at 10:50:39 p.m. MDT to stop the flow of crude oil into the pipeline. He then
closed RCV 1067, located approximately one-half mile downstream and north of the Yellowstone
River crossing, at 10:57:15 p.m. MDT.
Three minutes later, Controller A notified his supervisor, who reviewed the trends and alarm logs
and at 11:07:32 p.m. MDT directed Controller A to re-open RCV 1067 to allow oil to drain into
the Billings refinery. The supervisor initiated a telephone call to the First Line Supervisor in the
field, who asked for a senior technician to be added to the call. These three individuals discussed
what might have caused the Edgar pumps to go down on low suction. After further discussion and
review of the SCADA data, the OCC Supervisor noticed for the first time that the initial alarm had
actually been precipitated by a pressure drop at RCV 4462. The supervisor finally ordered RCV
4462 to be closed at 11:36:51 p.m. MDT, which stopped the gravity flow of crude oil into the
Yellowstone River. This occurred approximately 56 minutes after the first alarm, a delay that
allowed approximately 1063 additional barrels of crude oil to contaminate the river.
According to EMPCO’s own internal investigation and PHMSA’s failure investigation report, the
cause of the Failure was a submerged “guillotine” break in the pipeline near the south shore of the
river. Debris caught on the exposed pipe during the flooding gradually increased external stress on
the pipe until it ultimately failed.
Following the release, PHMSA issued a Corrective Action Order [CPF No. 5-2011-5017H] dated
July 5, 2011, that required EMPCO to take certain actions before restarting the Silvertip Pipeline,
and complete additional safety measures before the 2012 flood season. These actions included the
replacement of the Yellowstone River crossing with a horizontally directionally drilled line.
The Failure was presaged by numerous indications over the past 20 years that the Yellowstone
River was prone to seasonal flooding, including that the river had experienced increased erosion
2



and scouring from recent floods, that another pipeline in the vicinity had failed in 2009 due to
flooding, and a series of warnings from City of Laurel officials who expressed concerns to
EMPCO about the safety of the Silvertip Pipeline for at least a year prior to the Failure.
Recurring problems with flooding and scouring of the Yellowstone River near Laurel had been
common knowledge in Laurel for years. These problems had apparently worsened since 1991,
when the Highway 212 Bridge was constructed in a manner that constricted water flow in the river
and increased the velocity and scouring of floodwaters.
Within approximately 500 feet and “upriver” of the Failure Site, there were three other
transmission pipelines, one of which had experienced a recent failure due to flooding and river
scouring. Specifically, on June 7, 2009, an 8” natural gas pipeline operated by Williston Basin
Interstate Pipeline (WBI) had failed under the Yellowstone River as a result of erosion and
flooding. In response to that failure, WBI replaced it with a 16-inch line horizontally directionally
drilled (HDD) at a depth of 40-50 feet below the river. In the aftermath of the WBI failure,
ConocoPhillips abandoned its 8-inch crude oil pipeline and filled it with nitrogen. It was later
determined after the Failure that the ConocoPhillips line also ruptured sometime between 2009-
2011.
On August 6, 2010, City officials held a meeting, of various government officials, EMPCO, and
representatives of two other pipeline operators (WBI and ConocoPhillips) to view the south bank
of the river and to express the City’s concerns about the continuing erosion downstream of the
Highway 212 Bridge. Several months later, City officials contacted PHMSA again with the same
concerns. The agency again communicated this information to EMPCO, whose response was to
conduct a depth of cover survey in December 2010. Upon receipt of that study, EMPCO
concluded that the existing depth of cover was a minimum of five feet in the river.
The following spring brought new flooding. In May 2011, both PHMSA and Laurel officials
expressed to EMPCO their continuing concerns about flood conditions on the Yellowstone River,
including the area downstream of the Highway 212 Bridge at the future Failure Site, where it was
evident that the erosion on the south bank was extensive and continuing. In June, it became
apparent that the river, which normally receded after a few weeks, was still at flood stage, thus
increasing the risk of scouring, erosion, and the accumulation of debris that could potentially
damage the Silvertip Pipeline.
City of Laurel officials contacted EMPCO on multiple occasions between May 25 and June 24,
2011, to express concerns about the safety of the Silvertip Pipeline. On these two dates, EMPCO
shut down the line for several hours to assess the situation but decided each time to resume
operations. However, on May 25, WBI decided to shut down its “trenched” 16-inch natural gas
pipeline located under the Yellowstone River, within a few hundred feet of the Silvertip Pipeline
crossing, because of the high floodwaters.1
1 This line was later replaced with a HDD crossing in 2012.
3



As a result of PHMSA’s post-failure investigation, it appears that EMPCO has committed
probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations.
The probable violations are:
1. §195.452 Pipeline integrity management in high consequence areas.
(i) What preventive and mitigative measures must an operator take to protect the
high consequence area?
(2) Risk analysis criteria. In identifying the need for additional preventive and
mitigative measures, an operator must evaluate the likelihood of a pipeline release
occurring and how a release could affect the high consequence area. This
determination must consider all relevant risk factors, including, but not limited to:
(i) Terrain surrounding the pipeline segment, including drainage systems such as
small streams and other smaller waterways that could act as a conduit to the high
consequence area;
(ii) Elevation profile;
(iii) Characteristics of the product transported;
(iv) Amount of product that could be released;
(v) Possibility of a spillage in a farm field following the drain tile into a waterway;
(vi) Ditches alongside a roadway the pipeline crosses;
(vii) Physical support of the pipeline segment such as by a cable suspension bridge;
(viii) Exposure of the pipeline to operating pressure exceeding established maximum
operating pressure.
Under PHMSA’s integrity management regulations, EMPCO was required to conduct a risk
analysis of each pipeline segment that could adversely affect an HCA in the event of a hazardous
liquid spill. For at least two years prior to the Failure, EMPCO failed to consider all relevant risk
factors in identifying the need for additional preventive and mitigative (P&M) measures in its
integrity management program (IMP) for the Silvertip Pipeline. In the risk analysis used as the
conceptual basis to develop appropriate P&M measures, entitled Silvertip to Billings 12” Crude
Preventive and Mitigative Measures Analysis Summary, dated July 7, 2010 (2010 P&M Plan),
EMPCO failed to consider all relevant risk factors, as required under 49 C.F.R. § 195.452(i)(2), in
evaluating the likelihood of a pipeline release that could affect the Yellowstone River.
In its 2010 P&M Plan, EMPCO failed to consider a number of factors that could have
significantly affected the potential impact of a failure on this particular pipeline segment,
particularly at the Yellowstone River crossing near Laurel. These factors included: the terrain
surrounding the pipeline segment, including drainage systems; the elevation profile of the
pipeline; the amount of product that could be released in a spill; and the physical support of the
pipeline segment in the river. Other factors that EMPCO should have considered for this segment
are listed in Appendix C to 49 C.F.R. Part 195, Guidance for Implementation of Integrity
Management Program. The guidance lists additional factors that operators should potentially
consider in its IMP, including “potential natural forces inherent in the area (flood zones,
earthquakes, subsidence areas, etc.).”
4



The risk of flooding on the Yellowstone River was a known threat that could cause the pipe in the
river to lose physical support and potentially rupture. The Yellowstone River had a history of
extensive seasonal flooding, channel migration, and river bottom scour that should have been
considered in the risk analysis. As noted above, this history of flooding had seriously impacted
other pipeline operators in the vicinity of the Failure Site.
EMPCO’s failure to recognize the risk of flooding and river bottom scour as part of its 2010 P&M
Plan, particularly after the 2009 and 2010 flood seasons, resulted in an integrity management plan
that failed to properly address known risks to the integrity of the Silvertip Pipeline at the Failure
Site. EMPCO should have made changes after the WBI failure in June 2009 and yet did not make
changes after the August 6, 2010 meeting with the City of Laurel. The prolonged flooding of the
Yellowstone River in the weeks prior to the Failure did, in fact, lead to excessive erosion and river
scouring, a loss of pipeline support caused by high water volume and detritus, and the ultimate
guillotine failure of the pipeline. Respondent’s failure, over an extended period of time, to
recognize these threats as part of its risk analysis was a major cause of the Failure.
2. §195.452 Pipeline integrity management in high consequence areas.
(i) What preventive and mitigative measures must an operator take to protect the
high consequence area?
(1) General requirements. An operator must take measures to prevent and mitigate
the consequences of a pipeline failure that could affect a high consequence area.
These measures include conducting a risk analysis of the pipeline segment to identify
additional actions to enhance public safety or environmental protection. Such actions
may include, but are not limited to, implementing damage prevention best practices,
better monitoring of cathodic protection where corrosion is a concern, establishing
shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the
systems that monitor pressure and detect leaks, providing additional training to
personnel on response procedures, conducting drills with local emergency responders
and adopting other management controls.
Consistent with its failure to conduct a risk analysis that recognized the potential for flooding of
the Yellowstone River, EMPCO failed to take P&M Measures required by § 195.452 (i) (1) that
could have mitigated the consequences of a pipeline failure due to flooding. The Silvertip
Pipeline was originally designed and constructed in the 1950’s, more than 20 years prior to the
adoption of PHMSA’s regulatory program. At some time after the line had been in operation, the
valves upstream of river crossings as well as other strategic valves were modified to allow remote
operation. The current configuration of the pipeline includes four remote control valves (RCVs) -
a type of Emergency Flow Restricting Device – installed immediately upstream of four river
crossings (Clark Fork, Rock Creek, Yellowstone River-Laurel, and Yellowstone River-Billings)
along the Silvertip Pipeline. These RCVs were designed to allow controllers to remotely isolate
the pipeline in the event of a failure that could spill crude oil into waterways or other
environmentally sensitive areas. The RCVs on the Silvertip Pipeline were also equipped with
surge-relief bypasses, which protected the pipeline from pressures that could potentially damage
the pipe upon rapid closure.
5



While the RCVs were installed for the purpose of mitigating the consequences of a
failure, EMPCO failed to take any action to operate the RCVs in a manner that would actually
prevent or mitigate the consequences of a failure potentially affecting the Yellowstone River. In
addition, it failed to take any other P&M Measures that could have potentially addressed such a
threat, including the possible implementation of other damage prevention best practices,
strengthening leak detection systems, undertaking additional training for its personnel to respond
effectively in the event of a spill, or addressing the risk of a guillotine failure due to flooding.
3. §195.403 Emergency Response Training.
(a) Each operator shall establish and conduct a continuing training program to
instruct emergency response personnel to:
(3) Recognize conditions that are likely to cause emergencies, predict the
consequences of facility malfunctions or failures and hazardous liquids or carbon
dioxide spills, and take appropriate corrective action;
EMPCO failed to establish and conduct a continuing training program to instruct emergency
response personnel to recognize conditions likely to cause emergencies, to predict the
consequences of crude oil spills, or to take appropriate corrective actions. Specifically, the
company did not effectively train the controllers and supervisors at the OCC to recognize
conditions likely to cause emergencies during flooding, to predict the consequences of facility
malfunctions, failures, or hazardous liquid spills, or to take appropriate corrective actions.
EMPCO staff stated in post-failure interviews that it was their practice to drain crude away from a
release and that because the Silvertip Pipeline gravity-flowed into the Laurel refinery, anything
but a guillotine failure would allow crude oil to drain away from the release.
Following “low pressure” alarms at 10:40 p.m. MDT and shutdown of pumps at 10:47 p.m. MDT,
Controller A requested assistance from his OCC Supervisor, who assumed control of Silvertip
Pipeline operations at approximately 11:00 p.m. MDT. He called the First Line Supervisor in
Billings, Montana, who then conferenced in a Senior Field Technician. Each of these individuals
was aware of the high levels of flooding that had been occurring since mid-May on the
Yellowstone River. Nevertheless, it took until 11:36 p.m. for these three EMPCO individuals to
determine that a release had occurred near the Yellowstone River and oil could be flowing into the
river.
From their actions following the first alarm on the date of the Failure, it is apparent that neither
the OCC Supervisor nor the First Line Supervisor had been adequately trained to recognize and
properly respond to the: 1) local environmental conditions that were likely to cause emergencies,
e.g., localized historic flooding; 2) the consequences of a guillotine failure in the river; or 3) the
unique system configurations, e.g., surge-protected RCVs that could have mitigated the
consequences of the Failure. Had the controllers and supervisors been trained to know the
elevation profile of the pipeline adjacent to the river and the design of the RCVs, they would have
been able to make the decision to close the RCVs upstream of the Yellowstone River crossing
more quickly.
6



4. §195.402 Procedural manual for operations, maintenance, and emergencies.
(a) General. Each operator shall prepare and follow for each pipeline system a
manual of written procedures for conducting normal operations and maintenance
activities and handling abnormal operations and emergencies….
(e) Emergencies. The manual required by paragraph (a) of this section must include
procedures for the following to provide safety when an emergency condition occurs;
(2) Prompt and effective response to a notice of each type emergency, including fire
or explosion occurring near or directly involving a pipeline facility, accidental release
of hazardous liquid or carbon dioxide from a pipeline facility, operational failure
causing a hazardous condition, and natural disaster affecting pipeline facilities.
EMPCO violated § 195.402(e)(2) by failing to have written procedures for taking prompt and
effective action to protect the Silvertip Pipeline after receiving notice of a natural disaster
affecting the company’s pipeline facilities. Specifically, EMPCO’s manual failed to include
procedures to respond to seasonal flooding of the Yellowstone River.
Beginning on or before May 25, 2011 and continuing through the date of the Failure, EMPCO had
notice that the Yellowstone River was experiencing flooding at Laurel that adversely affected the
safety of the Silvertip Pipeline, yet the company had no written procedures in place to address a
natural disaster of this type. The company’s response during the month prior to the Failure was to
visit Laurel, meet with City and other government officials, shut down the line for several hours
on two separate occasions while evaluating data, monitor the water levels daily, and to place
sandbags around RCV 4462 in Laurel’s Riverside Park to protect the valve in case it was flooded.
The company, however, had no written procedures on how its emergency response personnel
should address flooding. Since the portion of the line that was buried in the Yellowstone River
was neither visible nor easily accessible, such procedures needed to address potential actions such
as emergency shutdown of pumps and closure of isolating valves or even precautionary purging of
the pipeline in areas susceptible to a release. For example, on May 25, 2011, WBI shut down its
open-cut 16-inch gas pipeline within a few hundred feet of the Failure Site due to concerns about
flooding. Although EMPCO also shut down its line on May 25th and June 24th, both shutdowns
were only for a few hours. There is no indication that EMPCO initiated or implemented any new
procedures to respond to the 2011 flooding of the Yellowstone River.
5. §195.402 Procedural manual for operations, maintenance, and emergencies.
(a) General. Each operator shall prepare and follow for each pipeline system a
manual of written procedures for conducting normal operations and maintenance
activities and handling abnormal operations and emergencies….
(e) Emergencies. The manual required by paragraph (a) of this section must include
procedures for the following to provide safety when an emergency condition occurs;
(4) Taking necessary action, such as emergency shutdown or pressure reduction, to
minimize the volume of hazardous liquid or carbon dioxide that is released from any
section of a pipeline in the event of a failure.
7



EMPCO violated § 195.402(e)(4) by failing to have written procedures for taking necessary action
to minimize the volume of oil potentially released from any section of the Silvertip Pipeline in the
event of a failure. The Silvertip Pipeline was physically equipped with RCVs upstream of each
major water crossing that could be remotely actuated by pipeline controllers in Houston.
However, the EMPCO procedures in place at the time of the Failure did not include instructions to
close the RCVs upstream of waterways in a manner designed to minimize the flow of product into
the water in the event of a suspected release.
EMPCO’s OCC operating instructions (OI) at the time of the Failure instructed EMPCO
controllers to shut down the originating pumps and close the valves at the beginning of the
Silvertip Pipeline. However, the OIs did not include procedures for the rapid closure of all
appropriate valves if the controller suspected a leak. In particular, EMPCO lacked written
procedures for shutting down RCV 4462 in the event of a suspected leak that could affect the
Yellowstone River. The first indication of a possible release on the date of the Failure, given the
history of flooding and the City’s concerns about this pipeline should have prompted an
immediate emergency shutdown of the system, including pumps and all isolating valves.
During PHMSA’s failure investigation, EMPCO provided a timeline of OCC controller actions,
supervisor actions and SCADA recorded events. This timeline shows the pumps at the originating
station were shut down within seven minutes of the first SCADA alarm. These actions were done
in accordance with the EMPCO emergency procedures in place at the time of the spill. It took 56
minutes, however, for the supervisors to correctly assess the situation and close RCV 4662
immediately upstream of the Yellowstone River to stop the flow of oil into the river. Failure to
close this valve resulted in considerably more crude oil being spilled into the Yellowstone River.
As part of this investigation, EMPCO personnel were asked why the OIs did not include a
requirement to immediately close all RCVs after a possible leak, especially if each RCV could be
quickly closed without concerns of overpressurization. EMPCO staff said it was their practice to
drain crude away from a release and that because the Silvertip Pipeline gravity flowed into the
Laurel refinery, anything but a guillotine failure would allow crude oil to drain away from the
release. However, the Failure was a guillotine failure and EMPCO’s procedures did not address
the proper response to a guillotine failure. By failing to have a procedure in place to address such
a failure, the pipeline continued to drain into the Yellowstone River for approximately 56 minutes
after the initial alarm and allowed an additional 1,063 barrels of oil to pollute the river.
Proposed Civil Penalty
Under 49 United States Code, § 60122, you are subject to a civil penalty not to exceed $200,000
per violation per day the violation persists up to a maximum of $2,000,000 for a related series of
violations. For violations occurring prior to January 3, 2012, the maximum penalty may not
exceed $100,000 per violation per day, with a maximum penalty not to exceed $1,000,000 for a
related series of violations. The Compliance Officer has reviewed the circumstances and
supporting documentation involved in the above probable violations and has recommended that
you be preliminarily assessed a civil penalty of $1.7 million as follows:
8



Item number PENALTY
1 $495,500
2 $504,500
4 $600,000
5 $100,000
Proposed Compliance Order
With respect to item 3, pursuant to 49 United States Code § 60118, the Pipeline and Hazardous
Materials Safety Administration proposes to issue a Compliance Order to ExxonMobil. Please
refer to the Proposed Compliance Order, which is enclosed and made a part of this Notice.
Response to this Notice
Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in
Compliance Proceedings. Please refer to this document and note the response options. All
material submit in response to this enforcement action may be made publicly available. If you
believe that any portion of your responsive material qualifies for confidential treatment under 5
U.S.C. 552(b), along with the complete original document you must provide a second copy of the
document with the portions you believe qualify for confidential treatment redacted and an
explanation of why you believe the redacted information qualifies for confidential treatment under
5 U.S.C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a
waiver of your right to contest the allegations in this Notice and authorizes the Associate
Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to
you and to issue a Final Order.
In your correspondence on this matter, please refer to CPF 5-2013-5007 and for each document
you submit, please provide a copy in electronic format whenever possible.
This Notice does not address any potential civil or criminal liability that EMPCO may
have for violations of any other federal laws arising from or otherwise related to the events or
conduct giving rise to this Notice or to the consequences or damages resulting from the July 1,
2011 failure.
Sincerely,
Chris Hoidal
Director, Western Region
Pipeline and Hazardous Materials Safety Administration
Enclosure: Response Options for Pipeline Operators in Compliance Proceedings
9



PROPOSED COMPLIANCE ORDER
Pursuant to 49 United States Code§ 60118, the Pipeline and Hazardous Materials Safety
Administration (PHMSA) proposes to issue to Exxon Mobil Pipeline Company a
Compliance Order incorporating the following remedial requirement to ensure compliance
with the pipeline safety regulations:
1. In regard to Item Number 3 of the Notice pertaining to emergency response
training, ExxonMobil must train all controllers, future and existing, on all
ExxonMobil hazardous liquid pipelines to recognize conditions that are likely to
cause emergencies, predict the consequences of facility malfunctions, failures, or
hazardous liquids spills, and take appropriate corrective action.
2. ExxonMobil must provide documentation of the completed training to the Director,
Western Region, within 30 days.
3. It is requested (not mandated) that ExxonMobil maintain documentation of the
safety improvement costs associated with fulfilling this Compliance Order and
submit the total to Chris Hoidal, Director, Western Region, Pipeline and Hazardous
Materials Safety Administration. It is requested that these costs be reported in two
categories: 1) total cost associated with preparation/revision of plans, procedures,
studies and analyses, and 2) total cost associated with replacements, additions and
other changes to pipeline infrastructure.
10

520135007_closure letter_07092015_text.pdf

CERTIFIED MAIL - RETURN RECEIPT REQUESTED
July 9, 2015
Mr. Gerald Frey
President
ExxonMobil Pipeline Company
800 Bell Street, Room 741-D
P.O. Box 2220
Houston, TX 77002
CPF 5-2013-5007
Dear Mr. Frey:
On January 23, 2015, the Pipeline and Hazardous Materials Safety Administration (PHMSA)
issued to ExxonMobil Pipeline Company a Final Order in the above-referenced case. This
Order included a Compliance Order and Civil Penalty assessment. Based on our review of
the documentation you provided and confirmation of payment of the civil penalty, it has been
determined that you have complied with the terms of this Order.
Accordingly, this case is now closed and no further action is contemplated with respect to the
matters involved in this case. Thank you for your cooperation in this matter.
Sincerely,
Chris Hoidal
Director, Western Region
Pipeline and Hazardous Materials Safety Administration
cc: PHP-60 Compliance Registry
PHP-500 P. Katchmar

520135007_Decision on Petition for Reconsideration_06122015_text.pdf

June 12, 2015
Mr. Gerald S. Frey
Global Pipeline Manager & President
ExxonMobil Pipeline Company
22777 Springwoods Village Parkway
E3.5A.521
Spring, Texas 77389
Re: CPF No. 5-2013-5007
Dear Mr. Frey:
Enclosed is the decision on the petition for reconsideration filed by ExxonMobil Pipeline
Company in the above-referenced case. For the reasons explained in the decision, the petition is
denied. When the civil penalty assessed in the final order has been paid, this enforcement action
will be closed. This decision constitutes the final administrative action in this proceeding.
Service of the decision is made pursuant to 49 C.F.R. § 190.5.
Thank you for your cooperation in this matter.
Sincerely,
Jeffrey D. Wiese
Associate Administrator
for Pipeline Safety
Enclosure
cc: Mr. Chris Hoidal, Director, Western Region, PHMSA
Mr. Bob Hogfoss and Ms. Catherine Little, Hunton & Williams LLP,
Bank of America Plaza, Suite 4100, 600 Peachtree Street, N.E., Atlanta, GA 30308
CERTIFIED MAIL – RETURN RECEIPT REQUESTED
PHC-20: B. Fred/V. Tsaganos: jrs: x63529: 6/3/15
J:/Pipeline/Orders Pending with PHP/CPF No. 5-2013-5007 ExxonMobil Pipeline
Company



U.S. DEPARTMENT OF TRANSPORTATION
PIPELINE AND HAZARDOUS MATERIALS SAFETY ADMINISTRATION
OFFICE OF PIPELINE SAFETY
WASHINGTON, D.C. 20590
___________________________________
In the Matter of )
ExxonMobil Pipeline Company, ) CPF No. 5-2013-5007
)
)
)
Petitioner. )
___________________________________ )
DECISION ON PETITION FOR RECONSIDERATION
On July 1, 2011, the Silvertip Pipeline operated by ExxonMobil Pipeline Company (EMPCo or
Petitioner) experienced a failure in Laurel, Montana. The failure occurred during a flood event
and resulted in the release of approximately 1,500 barrels of crude oil into the Yellowstone
River, causing environmental damage and forcing the evacuation of approximately 42 people.1
Following an investigation by the Pipeline and Hazardous Materials Safety Administration
(PHMSA), Office of Pipeline Safety (OPS), the Director, Western Region, issued a Notice of
Probable Violation, Proposed Civil Penalty, and Proposed Compliance Order to EMPCo on
March 25, 2013 (Notice). The Notice alleged that EMPCo committed five violations of the
pipeline safety regulations in connection with the accident, proposed a civil penalty of
$1,700,000, and proposed corrective action.
EMPCo requested a hearing on the Notice, which was held July 17, 2013, in Lakewood,
Colorado. On January 23, 2015, pursuant to 49 C.F.R. § 190.213, PHMSA issued a Final Order,
finding EMPCo had committed four of the five violations that were alleged in the Notice. The
order assessed a civil penalty of $1,045,000 for the violations, and found that EMPCo had
already completed the proposed compliance order.
On February 12, 2015, EMPCo filed a Petition for Reconsideration of the Final Order (Petition)
seeking reconsideration of three of the violations and elimination or reduction of the civil
penalty. Specifically, the Company sought the withdrawal of the findings that it had violated
49 C.F.R. §§ 195.452(i)(2) (Item 1), 195.402(e)(2) (Item 4), and 195.402(e)(4) (Item 5).
1 For additional information regarding the accident, see pp. 2-6 of the Final Order issued to ExxonMobil
Pipeline Co., CPF No. 5-2013-5007, 2015 WL 780721 (Jan. 23, 2015). Enforcement decisions can be
viewed on PHMSA’s website at http://www.phmsa.dot.gov/ pipeline/enforcement (follow links for
enforcement since 2002 and then enforcement actions issued by year).



CPF No. 5-2013-5007
Page 2
Under 49 C.F.R. § 190.243, an operator may petition for reconsideration of a final order.
PHMSA may grant or deny, in whole or in part, a petition for reconsideration without further
proceedings.
Item 1 in the Final Order found that EMPCo had violated 49 C.F.R. § 195.452(i)(2), which
states:
§ 195.452 Pipeline integrity management in high consequence areas.
(a) Which pipelines are covered by this section? This section applies to
each hazardous liquid pipeline and carbon dioxide pipeline that could
affect a high consequence area . . . .
(i) What preventive and mitigative measures must an operator take to
protect the high consequence area?—(1) General requirements. An
operator must take measures to prevent and mitigate the consequences of a
pipeline failure that could affect a high consequence area. These measures
include conducting a risk analysis of the pipeline segment to identify
additional actions to enhance public safety or environmental protection . . .
(2) Risk analysis criteria. In identifying the need for additional
preventive and mitigative measures, an operator must evaluate the
likelihood of a pipeline release occurring and how a release could affect
the high consequence area. This determination must consider all relevant
risk factors, including, but not limited to:
(i) Terrain surrounding the pipeline segment, including drainage
systems such as small streams and other smaller waterways that could
act as a conduit to the high consequence area;
(ii) Elevation profile; . . .
(iv) Amount of product that could be released; [and] . . .
(vii) Physical support of the pipeline segment such as by a cable
suspension bridge; . . . .
The Final Order determined that EMPCo had violated § 195.452(i)(2) by failing to conduct a risk
analysis that evaluated the likelihood of its pipeline experiencing a release caused by flooding,
and by failing to consider risk factors relevant to flooding. The Final Order found that seasonal
floods were known to occur at the Yellowstone River and that such flooding had caused prior
incidents in the area of the Silvertip pipeline. PHMSA found that EMPCo had a duty under
§ 195.452(i)(2) to include in its risk analysis an evaluation of the likelihood that the Silvertip
pipeline could experience a release caused by flooding.
The Final Order reviewed the relevant records and procedures of EMPCo to determine if the
Company met its obligation to evaluate the likelihood of a release from flooding. PHMSA found
that EMPCo had conducted a risk analysis that identified three potential integrity threats: third-
party damage, manufacturing, and external corrosion. EMPCo had not identified flooding of the
Yellowstone River as a threat that could affect the likelihood of a pipeline release. In addition,
EMPCo had not evaluated risk factors relevant to flooding. For these reasons, the Final Order
found EMPCo had committed a violation.



CPF No. 5-2013-5007
Page 3
In its Petition, EMPCo maintained that it had performed a risk assessment and analysis that
“expressly evaluated the risk of flooding both generally on the Silvertip Pipeline and at the
Yellowstone River crossing specifically.”2 EMPCo contended further that it had concluded
flooding was not a significant risk. To support its position, EMPCo cited to the Company’s
Silvertip to Billings 12” Crude Preventive & Mitigative Measures Analysis Summary (2010
P&M Analysis), Integrity Management Program (2010 IMP Plan), and Integrity Management
Program Form 6.1 (2010 IMP Form 6.1).
Each of these documents were discussed in the Final Order. They were found not to demonstrate
compliance with § 195.452(i)(2) because they did not show EMPCo evaluated the likelihood of a
release from flooding. In its Petition, EMPCo has not identified any specific provision in these
documents that it believes was overlooked or misrepresented in the Final Order. PHMSA
reconsiders these documents below, but finds they still fail to demonstrate compliance.
2010 P&M Analysis – EMPCo’s P&M Analysis identified three potential integrity threats to the
Silvertip Pipeline: third-party damage, manufacturing, and external corrosion.3 The Analysis did
not identify other threats that could affect the likelihood of a pipeline release, including the threat
of flooding. While the document did identify and evaluate various P&M measures, those
measures only addressed the three integrity threats identified, not flooding. The documentation
does not support Petitioner’s contention that it evaluated the risk of flooding or that it concluded
flooding was not a significant risk.
2010 IMP Plan – EMPCo’s IMP Plan had procedures for performing a risk analysis, but merely
having procedures does not prove the Company followed them by evaluating the risks of
flooding. When these documents were originally submitted by EMPCo, they had certain
sentences highlighted to emphasize that segments are “evaluated for the relative significance of
the nine ASME B31.8S threats.”4 The IMP Plan demonstrates that EMPCo had a written
process for performing a risk analysis, including evaluating segments for the threats listed in
ASME B31.8S, but the procedures alone do not demonstrate the process was followed or that
EMPCo actually analyzed the risk of flooding.
2010 IMP Form 6.1 – EMPCo’s IMP Form 6.1 was used to document the evaluation of
preventive and mitigative actions in support of the 2010 P&M Analysis.5 The documents consist
of two separate forms. The first identified moderate external corrosion as a threat and discussed
the threats and risk drivers, measures to reduce risk, and risk reduction results. The second
evaluation identified a manufacturing threat and provided the same type of discussion. There
were no forms identifying the threat of natural forces or flooding, and none that indicated risk
factors were considered in regard to the specific threat of natural forces or flooding.
2 Petition at 3.
3 OPS Pipeline Safety Violation Report (Violation Report) (Apr. 19, 2013), Exhibit B-7.
4 EMPCo Pre-hearing Submittal (Jul. 8, 2013), Exhibit 9, p. 83. ASME/ANSI B31.8S is a consensus
standard related to integrity management of gas pipelines. See 49 C.F.R. § 192.7.
5 Pre-hearing Submittal, Exhibit 10.



CPF No. 5-2013-5007
Page 4
Accordingly, the IMP Forms do not demonstrate that EMPCo performed a risk analysis that
considered flooding as a threat.
Having reconsidered the documentation cited by Petitioner, PHMSA confirms its finding that the
documents fail to demonstrate EMPCo evaluated the likelihood of a release from flooding.
Petitioner also noted that the Final Order withdrew Item 2 in the Notice, and argued that Item 1
should also be withdrawn because the Company’s arguments were the same for both items.
PHMSA withdrew Item 2 after finding that OPS failed to prove EMPCo had committed a
violation of § 195.452(i)(1).6 Item 1 and Item 2 concerned two separate regulatory requirements
and the withdrawal of Item 2 had no bearing on the finding of violation in Item 1.
For the reasons stated above, PHMSA does not find cause to disturb the finding in the Final
Order that EMPCo violated § 195.452(i)(2).
Items 4 and 5 in the Final Order found that EMPCo had violated 49 C.F.R. § 195.402(e)(2)
and (e)(4), respectively, which state:
§ 195.402 Procedural manual for operations, maintenance, and
emergencies.
(a) General. Each operator shall prepare and follow for each pipeline
system a manual of written procedures for conducting normal operations
and maintenance activities and handling abnormal operations and
emergencies . . . .
(e) Emergencies. The manual required by paragraph (a) of this section
must include procedures for the following to provide safety when an
emergency condition occurs . . .
(2) Prompt and effective response to a notice of each type [of]
emergency, including fire or explosion occurring near or directly
involving a pipeline facility, accidental release of hazardous liquid or
carbon dioxide from a pipeline facility, operational failure causing a
hazardous condition, and natural disaster affecting pipeline facilities . . . .
(4) Taking necessary action, such as emergency shutdown or pressure
reduction, to minimize the volume of hazardous liquid or carbon dioxide
that is released from any section of a pipeline system in the event of a
failure.
Item 4 of the Final Order determined that EMPCo had violated § 195.402(e)(2) by failing to have
procedures for responding to natural disasters, such as seasonal flooding of the Yellowstone
River. The Final Order evaluated EMPCo’s written emergency procedures and found that while
they defined “emergency condition” broadly to include natural disasters, the procedures only
6 Final Order at 15. Petitioner incorrectly suggested that PHMSA withdrew Item 2 because the facts
were too similar to Item 1. Petition at 5, n. 2. The Final Order withdrew Item 2 based on a finding that
OPS failed to prove a violation of § 195.452(i)(1).



CPF No. 5-2013-5007
Page 5
provided instructions for responding to accidental leaks. Instructions to address other types of
emergencies, such as fires and natural disasters which may not involve an immediate leak, were
not included in the procedures.
Item 5 of the Final Order determined that EMPCo had violated § 195.402(e)(4) by failing to have
procedures requiring the closure of remote control valves (RCVs) to minimize the volume of oil
released into the Yellowstone River during a failure. The Final Order reviewed EMPCo’s
emergency procedures and found they only required closing valves at the beginning of the
pipeline and at the Laurel Terminal Facility, which is downstream of the river. Closure of only
these two valves is not adequate to minimize the flow of oil into the Yellowstone River if there is
a failure at the river crossing. The procedures did not require immediate closure of the nearest
upstream RCV from the river.
In its Petition, EMPCo contends that it had the requisite procedures in place, including
procedures to respond to emergency conditions and to identify RCVs to isolate the Yellowstone
River. To the extent there were deficiencies in the implementation of these procedures, or if
improvements could be made to the procedures themselves, Respondent argued that it would not
constitute a violation . Respondent also argued that Items 4 and 5 were based on the same
factual allegations and were so related they should be withdrawn or their penalties reduced.
Petitioner essentially raises arguments that are already discussed in the Final Order. PHMSA
evaluated EMPCo’s written emergency procedures in the Order and concluded they did not
contain the necessary instructions for personnel to respond to natural disasters and to minimize
the volume of oil released. PHMSA has consistently held that an operator’s procedures may be
found in violation if the procedures fail to contain elements that are required or if the procedures
do not provide the level of safety mandated by the regulation.7 Respondent has failed to
demonstrate the findings of violation in Items 4 and 5 were in error.
The Final Order also addressed Petitioner’s argument that Items 4 and 5 are “related” and should
be withdrawn or their penalties reduced. The Final Order rejected this argument, finding the
violations were based on separate regulatory provisions and constituted violations of separate
regulatory requirements. Each violation also required proof of an additional fact the other did
not. For these reasons, the Final Order determined they were not “a related series of violations.”
Even if it had been determined that the violations were “a related series,” their combined
penalties would not exceed the maximum allowed under 49 U.S.C. § 60122.8
7 See, e.g., Sunoco Pipeline L.P., CPF No. 1-2009-5003, Item 1, 2011 WL 7416422 (Nov. 25, 2011)
(stating that “[p]rocedures that are ineffective or that do not provide an acceptable level of safety may be
found in noncompliance”).
8 At the time of the violations, the maximum administrative penalty was $100,000 per violation for each
day of the violation, up to a maximum of $1,000,000 “for a related series of violations.” The Pipeline
Safety, Regulatory Certainty, and Job Creation Act of 2011, Pub. L. No. 112-90, § 2(a) (Jan. 3, 2012)
increased the maximum to $200,000 per day, up to $2,000,000 for a related series.



CPF No. 5-2013-5007
Page 6
Accordingly, having reconsidered the record, PHMSA confirms its finding that EMPCo’s
procedures did not comply with § 195.402(e)(2) and (4), as set forth in Items 4 and 5 of the Final
Order, respectively.
Strict Liability
Finally, EMPCo contends that the Final Order relies on a theory of “strict liability” to support the
imposition of civil penalties. Under this theory, EMPCo argues that PHMSA is inappropriately
holding the Company liable for the Silvertip pipeline accident even though “the Company was in
compliance with the rules . . . both before and at the time of the incident.”9 EMPCo argues that
under the Pipeline Safety Act, PHMSA does not have authority to impose strict liability, and
“must base all enforcement on documented findings of violations.”10 EMPCo contends that it
met all applicable safety standards, and the pipeline accident occurred due to a flood that was
beyond its control.
EMPCo’s notion that it was in compliance with the regulations at the time of the accident is
refuted by the findings of violation documented in the Final Order, and confirmed in this
Decision. Specifically, EMPCo violated the following regulations: 49 C.F.R. §§ 195.452(i)(2)
(Item 1); 195.403(a)(3) (Item 3); 195.402(e)(2) (Item 4); and 195.402(e)(4) (Item 5).
Under the Pipeline Safety Act, “a person that [PHMSA] decides, after written notice and an
opportunity for a hearing, has violated section 60114(b), 60114(d), or 60118(a) of this title or a
regulation prescribed or order issued under this chapter is liable to the United States Government
for a civil penalty . . . .”11 EMPCo committed violations of the pipeline safety regulations, and is
therefore liable for civil penalties in this administrative proceeding.12
When assessing a civil penalty, PHMSA considers a number of assessment criteria.
13 If a
violation is the result of circumstances beyond the control of an operator, PHMSA may find
cause to reduce or withdraw the proposed penalty after weighing the other assessment criteria.
In this case, Petitioner’s failure to complete an appropriate risk analysis and to prepare
appropriate emergency response procedures was not the result of circumstances beyond its
control. Moreover, these violations contributed to increasing the severity of the consequences of
an accident: crude oil drained into the Yellowstone River for 56 minutes after the first alarm
indicated a pressure drop at the location of the river crossing, causing significant environmental
damage and forcing the evacuation of approximately 42 people. . Accordingly, PHMSA finds
no reason to reduce the penalty assessed in the Final Order.
9 Petition at 3.
10 Petition at 3.
11 49 U.S.C. § 60122(a)(1).
12 Petitioner’s attempt to distinguish the Pipeline Safety Act (PSA) from the Clean Water Act (CWA)
does not help its position. Like the PSA, the CWA holds parties liable for a “violation” of that statute and
the implementing regulations. 33 U.S.C. § 1321(b)(6)(A), (f)(2).
13 49 U.S.C. § 60122(b) and 49 C.F.R. § 190.225.



CPF No. 5-2013-5007
Page 7
For the above reasons, the Petition for Reconsideration filed by EMPCo is denied. Payment of
the $1,045,000 civil penalty assessed in the Final Order is now due and must be made within 20
days of service of this Decision.
Federal regulations (49 C.F.R. § 89.21(b)(3)) require such payment to be made by wire transfer
through the Federal Reserve Communications System (Fedwire), to the account of the U.S.
Treasury. Detailed instructions are contained in the enclosure. Questions concerning wire
transfers should be directed to: Financial Operations Division (AMK-325), Federal Aviation
Administration, Mike Monroney Aeronautical Center, P.O. Box 269039, Oklahoma City,
Oklahoma 73125-4915. The Financial Operations Division telephone number is (405) 954-8845.
Failure to pay the $1,045,000 civil penalty will result in accrual of interest at the current annual
rate in accordance with 31 U.S.C. § 3717, 31 C.F.R. § 901.9 and 49 C.F.R. § 89.23. Pursuant to
those same authorities, a late penalty charge of six percent (6%) per annum will be charged if
payment is not made within 110 days of service. Failure to pay the civil penalty may result in
referral of the matter to the Attorney General for action in a district court of the United States.
This Decision on Petition for Reconsideration is the final administrative action in this
proceeding.
_____________________________ ____________________
Jeffrey D. Wiese Date Issued
Associate Administrator
for Pipeline Safety

## Provenance

- Official: Yes
- Source: <https://primis.phmsa.dot.gov/enforcement-data/case/520135007>
- Source ID: `phmsa-enforcement`
- SHA-256: `1abba2895b9118c32885d1d8ead82636fdb3895d4ca3bc8e7143d9511c6bfe0e`
- Retrieved: 2026-08-20T04:44:44.458Z
- Exported: 2026-08-22T21:57:50.472Z
- Document slug: `phmsa-enforcement-520135007`

### Source metadata

```json
{
  "cpf": "520135007",
  "operator": "EXXONMOBIL PIPELINE CO",
  "region": "Western",
  "pipelineType": "INTERSTATE LIQUID ONSHORE",
  "caseStatus": "CLOSED",
  "citedSections": [
    "195.402(e)(2)",
    "195.402(e)(4)",
    "195.403(a)(3)",
    "195.452(i)(1)",
    "195.452(i)(2)"
  ],
  "dataAsOf": "08/04/2026 12PM",
  "caseDataAsOf": "2026-08-04",
  "attachmentCount": 10,
  "attachments": [
    {
      "name": "520135007_closure letter_07092015.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_closure%20letter_07092015.pdf",
      "bytes": 28981,
      "category": "agency_document"
    },
    {
      "name": "520135007_closure letter_07092015_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_closure%20letter_07092015_text.pdf",
      "bytes": 4437,
      "category": "agency_document"
    },
    {
      "name": "520135007_Decision on Petition for Reconsideration_06122015.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Decision%20on%20Petition%20for%20Reconsideration_06122015.pdf",
      "bytes": 469924,
      "category": "agency_document"
    },
    {
      "name": "520135007_Decision on Petition for Reconsideration_06122015_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Decision%20on%20Petition%20for%20Reconsideration_06122015_text.pdf",
      "bytes": 35628,
      "category": "agency_document"
    },
    {
      "name": "520135007_Final Order_01232015.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Final%20Order_01232015.pdf",
      "bytes": 1374167,
      "category": "agency_document"
    },
    {
      "name": "520135007_Final Order_01232015_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Final%20Order_01232015_text.pdf",
      "bytes": 131941,
      "category": "agency_document"
    },
    {
      "name": "520135007_NOPV PCP PCO_03252013.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_NOPV%20PCP%20PCO_03252013.pdf",
      "bytes": 456222,
      "category": "agency_document"
    },
    {
      "name": "520135007_NOPV PCP PCO_03252013_text.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_NOPV%20PCP%20PCO_03252013_text.pdf",
      "bytes": 47840,
      "category": "agency_document"
    },
    {
      "name": "520135007_Operator Petition for Reconsideration_02122015.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Operator%20Petition%20for%20Reconsideration_02122015.pdf",
      "bytes": 137854,
      "category": "party_submission"
    },
    {
      "name": "520135007_Operator Request for Hearing and Response to Notice_04242013.pdf",
      "url": "https://primis.phmsa.dot.gov/enforcement-documents/520135007/520135007_Operator%20Request%20for%20Hearing%20and%20Response%20to%20Notice_04242013.pdf",
      "bytes": 498443,
      "category": "party_submission"
    }
  ],
  "extractedAgencyDocumentCount": 4,
  "attachmentPolicy": "Official attachment links are retained. Agency-issued documents may also include a verified local PDF and page-level text representation.",
  "jurisdiction": "US",
  "operatorName": "EXXONMOBIL PIPELINE CO"
}
```