# Control Room Management FAQs - **operation:** document - **citation:** PHMSA CRM FAQs (2018) - **title:** Control Room Management FAQs - **source type:** guidance - **agency:** Pipeline and Hazardous Materials Safety Administration - **status:** guidance - **official:** true - **published on:** 2018-01-16 - **effective on:** 2018-01-16 - **summary:** Control Room Management Frequently Asked Questions (FAQs) 01/16/2018 The Pipeline and Hazardous Materials Safety Administration (PHMSA) provides written clarification of the pipeline safety regulations (49 CFR Parts 190-199) in the form of frequently asked questions (FAQs), and other guidance materials. These FAQs are intended to clarify, explain, and promote better understanding of issues concerning implementation o - **machine formats:** - **json:** https://regulus.evalyn.ai/document/phmsa-control-room-management-faqs.json - **markdown:** https://regulus.evalyn.ai/document/phmsa-control-room-management-faqs.md - **app url:** https://regulus.evalyn.ai/document/phmsa-control-room-management-faqs - **source url:** https://www.phmsa.dot.gov/pipeline/control-room-management/control-room-management-faqs **body:** Control Room Management Frequently Asked Questions (FAQs) 01/16/2018 The Pipeline and Hazardous Materials Safety Administration (PHMSA) provides written clarification of the pipeline safety regulations (49 CFR Parts 190-199) in the form of frequently asked questions (FAQs), and other guidance materials. These FAQs are intended to clarify, explain, and promote better understanding of issues concerning implementation of the Control Room Management (CRM) regulations, more specifically the control room requirements in the pipeline safety regulations for gas pipeline operators (§ 192.631) and hazardous liquid pipeline operators (§ 195.446), as applicable These FAQs reflect PHMSA’s current application of the regulations to the specific implementation scenarios presented. FAQs are not substantive rules, themselves, and do not create legally enforceable rights, assign duties, or impose new obligations not otherwise contained in the existing regulations and standards, but are provided to help the regulated community understand how to comply with the regulations. However, an operator who is able to demonstrate compliance with the FAQs is likely to be able to demonstrate compliance with the relevant regulations. If a different course of action is taken by a pipeline operator, the operator must be able to demonstrate that their conduct is in accordance with the regulations. Written regulatory interpretations regarding specific situations may also be obtained from PHMSA in accordance with 49 CFR Part 190, § 190.11. Where appropriate, an FAQ may include a citation to the most relevant regulatory provision in the CRM regulations. Since many provisions of the CRM regulations– are interrelated, some FAQs will have applicability beyond just the primary code section referenced. A. General Applicability and Definitions A.01 When does PHMSA plan to initiate inspections on CRM plans and procedures? PHMSA will begin inspecting operators’ control room management plans starting August 1, 2011, which is the deadline for certain portions of the regulations. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.02 Will PHMSA make its CRM inspection checklists available to the public? PHMSA is planning to make inspection checklists publicly available on the CRM website [http://primis.phmsa.dot.gov/crm/index.htm] when they become available, which is anticipated at the end of second quarter of CY 2011. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.03 If the owner of a pipeline contracts for the operation of the pipeline by another party, who is the responsible party for compliance with the CRM rule? The CRM regulations apply to all “operators” of the pipeline. The term operator is defined in 49 CFR 192.3 and 195.2. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.04 If controllers are located in a control room that monitors and controls an intrastate pipeline, but the control room is located in a different state than the actual pipeline, do the CRM regulations apply? Yes. The state or location of the control room operating regulated pipeline facilities does not determine the applicability of the CRM regulation. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.05 How does the term “pipeline facility,” as used in the definitions of Control Room and Controller, relate to other terms such as “pipeline system” that were not used in those definitions? Since both 49 CFR 192.3 and 195.2 define “pipeline facility,” PHMSA found it was better to use the same terminology in both regulations. “Pipeline facility” is defined broadly and includes line pipe, pipelines, pipeline systems, valves, rights-of-way, buildings, and any other equipment used in the transportation of gas and hazardous liquids. Part 192 does not define “pipeline system.” [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.06 Does the CRM rule apply to non-line pipe facilities such as breakout tanks, pumps or compressors? Pipeline facility is defined in 49 CFR 192.3 and 195.2 and means any equipment used in the transportation of gas or hazardous liquids. The CRM regulations apply to control rooms and controllers that remotely monitor and control pipeline facilities, including but not limited to, breakout tanks, pumps, compressors or other equipment along the pipeline. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.07 If a person in a control room monitors a Supervisory Control and Data Acquisition (SCADA) system and directs a technician in the field to manipulate a valve, is that person in the control room considered to be a controller? Yes, a person that has responsibility to monitor a SCADA system and contacts others to initiate corrective actions is considered a controller. Also, a person that has responsibility to monitor a SCADA system and personally initiates corrective action via the SCADA system is also a controller. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.08 If a controller directs a technician in the field to manipulate a valve, or take other action that does not involve use of, or access to, the SCADA system, is the technician in the field considered to be a controller? No, in this scenario the technician is not a controller. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.09 If an individual does not use a computer and display screen, but only monitors several discrete alarm indicator lights from a remote location and initiates action when an alarm (light) occurs, is that person a controller? No, an individual who does not use a computer type interface with a keyboard/mouse, and display screen (or touch-controlled screen) is not considered to be a controller. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.10 If a person monitors a pipeline status indication for non-operational purposes, and does not have assigned responsibility to initiate corrective action, is this person a controller? No. Persons that monitor a pipeline status indication for non-operational purposes, such as business or maintenance personnel, would not normally be considered controllers. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.11 If a local distribution company (LDC) has a short transmission line with a small compressor that is rarely used but operated from the same control room as the distribution system, does it meet the exception in 49 CFR 192.631(a)(1)(ii)? There is no “minimum time of operation” criterion or a “minimum compressor size” criterion associated with the exception in 49 CFR 192.631(a)(1)(ii). Therefore, the full CRM rule would apply to this LDC since the pipeline is controlled by a controller from a control room that meets the requirements of the CRM rule. [§ 192.631(a)(1)] Revised: 7/11/2011 A.12 Does the CRM rule apply to a pipeline that has no SCADA system or control room? No. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.13 How does the CRM rule apply to control rooms for gathering lines? For gathering lines monitored and controlled by a controller in a control room with a SCADA system, the CRM rule applies to the regulated gathering lines as provided in the scope of Parts 192 and Part 195. For example, the CRM rule applies to regulated liquid gathering lines in non-rural areas (see § 195.1), but not certain other regulated rural liquid gathering lines (see § 195.11). As another example, the CRM rule applies to regulated “Type A” gas gathering lines (see § 192.9(c)), which may be treated the same as transmission lines for purposes of § 192.631(a)(1)(ii), but the rule does not apply to regulated “Type B” gas gathering lines (see § 192.9(d)). The CRM rule does not apply to unregulated gas or hazardous liquid gathering lines. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.14 If an operator has more than one control room that independently controls separate pipeline systems, must all control rooms use the same procedures, SCADA displays, shift rotations, alarm management practices, etc? Separate control rooms may have their own specific CRM programs. Each control room management program can be tailored to the unique aspects of the control room and its related pipeline system. PHMSA would expect any differences between the CRM programs to be accounted for in the operator’s controller training and qualifications. If, however, one control room serves as a back-up control room for another control room, then consistency and controller cross-training should be considered, and training and qualification material adjusted as necessary. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.15 Does the CRM rule apply to special applications (e.g., leak detection, batch tracking)? Special applications can be subject to aspects of the CRM regulations. Many of these applications are extensions of the SCADA system that provide operational information through computer displays and/or alarms the controller monitors. Information to/from special applications should be consistent with SCADA displays for the same reasons consistency and accuracy of traditional SCADA displays is critical for controllers. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.16 What are “safety-related” operations and parameters in the CRM rule? For purposes of Control Room Management, PHMSA considers safety-related to mean any operational factor that is necessary to maintain pipeline integrity or that could lead to the recognition of a condition that could impact the integrity of the pipeline, or a developing abnormal or emergency situation. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.17 Are controllers subject to the CRM rule if the SCADA system automatically recognizes abnormal conditions and automatically places the pipeline in a “safe” condition without human controller intervention? Yes, controllers are subject to the CRM rule, independent of the particular automated capabilities of the SCADA System. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.18 If a distribution operator has its own control room with less than 20,000 services, but shares SCADA servers with an operator that has greater than 250,000 services managed by their own control room, does it meet the exception in 49 CFR 192.631(a)(1)? The exception in 49 CFR 192.631(a)(1) is applicable to the control room, not the location of the SCADA server. In this example, the control room with less than 250,000 services being served from that location would meet the exemption for number of services. [§ 192.631(a)(1)] Revised: 9/30/2011 A.19 A gas distribution holding company operates multiple distribution systems in several cities. Each of the operating entities has its own SCADA system and control room. None has any compressor stations. None of the individual entities has over 250,000 services. However, collectively, the holding company has over 250,000 services. Do any of these operating entities meet the exceptions in 49 CFR 192.631(a)(1) if they are owned by the same company? The exceptions in 49 CFR 192.631(a)(1)(i)and (ii) are for the control room. There is no language in the regulation regarding exemptions concerning holding companies or operating entities. Each independent control room in this scenario will meet the exception in 192.631(a)(1)(i) and (ii) and therefore will need to comply with only the requirements for fatigue management, validation, and compliance and deviations. However, if any of these control rooms serve as a back-up for other control rooms, then the combined number of services during back-up conditions may exceed the criteria for the exemption and would be required to comply with the entire CRM rule. [§ 192.631(a)(1)] Original: 6/17/2011 A.20 Does the CRM rule apply to a local control room and station personnel that monitor and control a local operation that is completely within the fenced boundary of the local facility? Field personnel who exclusively operate station equipment within the defined station boundaries (fence lines or property/map boundaries) and who are not responsible for connected pipelines beyond the boundaries are not considered to be remotely monitoring and controlling a pipeline. Therefore, such personnel are not considered to be controllers. However, field personnel who operate station equipment within the station boundaries and also have either full-time or part-time control room operational responsibility for connected regulated pipelines beyond the station boundaries are considered controllers. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.21 Do control rooms located in Canada need to comply with the CRM rules if they control pipelines operating in the United States? If the operational activities in a control room impact pipeline facilities located in the United States, PHMSA will expect those activities to comply with the CRM rules. A coordinated effort between PHMSA and the National Energy Board (NEB) of Canada regarding cross-border pipeline facilities is addressed in the agencies’ written arrangement dated November 2005, which is available on the PHMSA website. [§§ 192.631(a) and 195.446(a)] Original: 6/17/2011 A.22 What does “services” mean in 192.631(a)(1)(i)? “Services” means the number of services as reported on the operators annual report submitted to PHMSA in accordance with 49 CFR 191.11. [§§ 192.631(a)(1)(i)] Original: 6/17/2011 A.23 For off-shore applications, are individuals located on a platform with outbound PHMSA-regulated pipelines considered to be controllers if they only control platform operations (i.e., the transportation pipeline is controlled exclusively by a control room located onshore or on another platform)? No. As long as persons on the platform exclusively operate equipment on the platform, and do not control the pipeline, they are not considered to be controllers subject to the CRM rule. [§§ 192.631(a) and 195.446(a)] Revised: 9/30/2011 A.24 With regard to the exceptions for gas operators in 192.631(a)(1), please clarify the phrase “are limited to either or both of.” Does this mean that if an operator meets either criterion (i) or (ii), only paragraphs (d), (i), and (j) need to be implemented? No. The language in the rule addresses distribution operators, transmission operators, and distribution operators with transmission pipelines as part of their system. To clarify, this phrase means “either” (if only one of the criteria is applicable), or “both” (if both criteria are applicable). If an operator operates only transmission pipeline (no distribution), then criterion (i) is not applicable and the operator must meet criterion (ii) in order to only implement paragraphs (d), (i), and (j). If an operator operates only distribution pipeline (no transmission), then criterion (ii) is not applicable and the operator must meet criterion (i) in order to only implement paragraphs (d), (i), and (j). If an operator has both types of pipelines in its system, it must meet both criteria (i) and (ii) in order to only implement paragraphs (d), (i), and (j). [§§ 192.631(a)(1)] Original: 6/20/2012 B. Roles and Responsibilities B.01 Do roles and responsibilities have to be formally defined and documented? Yes. The rule requires that the operator develop and follow written procedures that implement all applicable requirements of the CRM rule. This includes formal definition and documentation of controller roles and responsibilities in its CRM program. [§§ 192.631(b) and 195.446(b)] Original: 6/17/2011 B.02 Do I need shift hand-over procedures if I do not have 24hour shift coverage? Yes. Anytime a controller completes his/her shift and/or control of the pipeline is transferred from one person to another person, shift hand-over requirements apply, even if there is a portion of time when the control room is planned to be unattended. [§§ 192.631(b)(4) and 195.446(b)(4)] Original: 6/17/2011 B.03 Can a control room supervisor direct or advise a controller on actions to take to complete a safety-related task? A control room supervisor may direct or advise a controller on specific actions to take to complete a safety-related task, if and only if, the supervisor is also a qualified controller. If the supervisor is not a qualified controller (administrative supervisor), then the supervisor may only advise the controller on what general tasks to accomplish, but not the precise actions that would otherwise come from a controller-qualified supervisor. [§§ 192.631(b) and 195.446(b)] Original: 6/17/2011 B.04 What, if any, shift change requirements apply when a controller is temporarily relieved for a brief period of time, such as during a coffee break? The operator’s procedures, training, and practices must address the appropriate level of hand-over of responsibility for short breaks, or other times, when the controller leaves the console. Operator guidelines should consider the controller’s proximity to the console, duration of absence, and the type of alarm interface (e.g., audible vs. visual alarms) in use. An operator’s program for cross-training controllers on multiple consoles can enhance flexibility to backup controllers for short breaks. Based on factors like these, an operator can have more than one strategy in place to ensure adequate console coverage is maintained. [§§ 192.631(b)(4) and 195.446(b)(4)] Original: 6/17/2011 B.05 Must controllers be qualified in all aspects of an operator’s control room? Controllers only need to be qualified on the tasks for which they are assigned roles and responsibilities. In control rooms with multiple desks/consoles, controllers may be qualified only on one desk, or qualified on multiple desks to create more operational flexibility. Some operators may establish special limited roles and responsibilities for reaction to emergency conditions, where an individual is only qualified to return a line segment to normal or shutdown status. [§§ 192.631(b) and 195.446(b)] Original: 6/17/2011 B.06 Who are the individuals described as “others with the authority to direct or supersede the specific technical actions of a controller”? Individuals described as “others with the authority to direct or supersede the specific technical actions of a controller” are individuals that are qualified and authorized to direct or supersede the technical actions of a controller. Operators may have, but are not obligated to have, individuals with this authority. [§§ 192.631(b)(5) and 195.446(b)(5)] Original:01/16/2018 B.07 What are the responsibilities of individuals with the authority to direct or supersede the specific technical actions of a controller? The individuals who invoke the authority to direct or supersede the specific technical actions of a controller are in control of the pipeline and are responsible for all operational actions taken or directed to the controller to take (or not take.) Procedures should account for the occasion when such authority is invoked and situations when the controller disagrees with the order or decision of such an individual. [§§ 192.631(b)(5) and 195.446(b)(5)] Original: 01/16/2018 B.08 What qualifications are required for an individual to be authorized to direct or supersede the specific technical actions of a controller? Any individual that directs or supersedes the specific technical actions of a controller is in control of the pipeline. Therefore, such individuals must be qualified in accordance with Part 192, Subpart N—Qualification of Pipeline Personnel or Part 195, Subpart G—Qualification of Pipeline Personnel, as applicable (i.e., OQ requirements). Such individuals would not necessarily need to be as broadly qualified as a controller. However, such individuals must be qualified to dictate operational decisions commensurate with their authority and responsibilities, in accordance with §§ 192.631(h) or 195.446(h). For operators with multiple pipelines or systems, an individual’s qualifications must specify which system, console, control room, and/or portions that are under their authority. [§§ 192.631(b)(5) and 195.446(b)(5)] Original: 01/16/2018 B.09 When must operators define the roles, responsibilities and qualifications of others with the authority to direct or supersede the specific technical actions of a controller (i.e., when is the compliance deadline)? After March 24, 2017, if the operator chooses to have individuals authorized to direct or supersede the specific technical actions of a controller; then roles, responsibilities and qualification must be established by the time of implementation. [§§ 192.631(b)(5) and 195.446(b)(5)] Original: 01/16/2018 B.10 Must an operator establish roles, responsibilities and qualifications of others with the authority to direct or supersede the specific technical actions of a controller if the operator does not intend to allow such individuals? No, but the operator should establish a written policy disallowing such individuals. [§§ 192.631(b)(5) and 195.446(b)(5)] Original: 01/16/2018 C. Provide Adequate Information C.01 Is point-to-point verification required for all SCADA points or only safety-related SCADA points? The requirement is to verify all safety-related points in the SCADA system. This would also include calculated (software generated) points that are safety-related. Safety related points often, but do not necessarily, have alarms associated with them. Examples of points that may be considered safety related (and therefore would need to be verified when changes are made to field equipment or SCADA displays) include, but may not be limited to: Status of main line valves Mainline pressures and flow rates Tank levels Station in local Control Personnel in normally unmanned station Station inlet and discharge pressures Pump/compressor status Leak Detection Pressure Regulator inlet and outlet pressures PLC/RTU Communications Status Emergency Shutdown Status Odorant alarms Composition alarms, such as H2S and Water content Filtering equipment levels-scrubbers/dehy Flame, gas and vapor detectors Power supply indications (Low Battery, AC power failure, UPS failure) Security monitoring [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.02 What constitutes an adequate point-to-point verification? Principally, the process should verify the actual physical location and sequence among other devices and equipment at the location; and verify the data, information and any control or alarm functions to/from the point are being accurately represented on all SCADA displays on which it resides. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.03 If changes are made to a SCADA display only, with no change to field equipment, do 49 CFR 192.631(c)(2) and 195.446(c)(2) require a point-to-point verification between the SCADA display and related field equipment? Yes. The rule requires that point-to-point verifications between SCADA displays and related field equipment be conducted when changes are made to the field equipment or SCADA displays associated with safety-related points. In this case, such verification ensures any unintended errors that may have occurred during changes in SCADA displays are identified and corrected. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.04 What is required in a “point-to-point verification between SCADA displays and related field equipment,” and what type of documentation should be generated and maintained? Point-to-point verification means confirming that the input or output of each field instrument is accurately and reliably reflected in the SCADA information presented to the controller. Operators should document the actual field parameters, as measured in the field, and the corresponding SCADA display information, to record that the SCADA information displays accurately reflect field measurements. The date and names of individuals involved in the verification should also be recorded as a means to help demonstrate thoroughness and authenticity. Alarm set-point values should also be checked at the same time. Operators should remember that this may also apply to changes that are the result of pressure restrictions. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.05 Must field devices be operated during a point-to-point verification between SCADA displays and related field equipment? Operation of field devices is the most rigorous method of performing point-to-point verifications, but may not be practical in some situations. For example, closing main line valves to verify SCADA position indication might be too disruptive to system operation. In such cases, applying a simulated signal at the field instrumentation might be justified. Operators should develop point-to-point verification procedures with a view toward the most rigorous and all encompassing verification approach that is practical. The application of simulated signals should be used sparingly, and be configured as close to the actual field devices as possible. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.06 Can point-to-point verifications be performed by a sampling process? No. All those points specified in the rule that have changed must be verified. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 6/17/2011 C.07 What is the intent and general expectation for complying with the requirements for testing and verifying an internal communication plan for manual pipeline operation? The intent of this requirement is that operators perform exercises or drills to assure that communication plans will be effective during an actual emergency involving loss of all SCADA system functions or other systems relying on SCADA data such as leak detection. Functions that must be verified during testing include, but are not limited to, (1) communication between and among operational and maintenance personnel using voice, fax, messaging, radio, etc., and (2) communication of pipeline operational data such as dial-in polling of field equipment, manually reading gauges and field instrumentation, etc. Note that equipment and modes of communication that are likely to be inoperable during a manual operation scenario should not be used during the test. Problems identified during exercises/drills should be corrected promptly and the effectiveness of corrective actions should be explicitly verified at the next exercise/drill. Operators should also document and review related tasks required of controllers and field personnel during these type events. Operators should also verify that training and operator qualification programs include these tasks. [§§ 192.631(c)(3) and 195.446(c)(3)] Original: 6/17/2011 C.08 What types of systems are considered “backup SCADA systems,” e.g., computers, software, telecommunication systems, others? Backup SCADA systems are independent or redundant systems that provide similar functionality to the primary SCADA system. Backup systems can be as simple as a redundant server and as complex as an entire backup control room with duplicate SCADA and communication systems. These systems are often located in a geographically diverse location not susceptible to a single natural disaster such as a hurricane or earthquake that might impact the primary system. Backup SCADA systems are unique to each pipeline system, and may not necessarily duplicate all of the performance and functionality of the primary system. Regardless of the nature, extent or location of any back-up SCADA system, all of its specified functional capabilities need to be verified annually. [§§ 192.631(c)(4) and 195.446(c)(4)] Original: 6/17/2011 C.09 In the event of a SCADA failure, what is meant by an adequate means for manual operation of the pipeline safely? If an operator does not intend to continue operating the pipeline in the event of a catastrophic SCADA failure, then only procedures to safely perform a controlled shutdown and maintain and monitor pipeline integrity need to be in place. If an operator chooses to continue all, or partial, pipeline operations in the event of a catastrophic SCADA failure, the rule requires that operators have some reliable means to monitor and operate the pipeline system manually. The nature and extent of the means used to monitor and operate the pipeline under such circumstances must be commensurate with (i) the level of operational performance being maintained during the SCADA outage (e.g., reduced operational capabilities, continued full pressure operation, etc.), (ii) the functional capability of the command-and-control infrastructure that would be available during a SCADA outage (e.g., disaster recovery center, local station manning, emergency communications systems, etc.), (iii) the availability and location of field personnel to monitor and operate the pipeline, and (iv) the logistics for manual overrides of equipment. [§§ 192.631(c)(3) and 195.446(c)(3)] Original: 6/17/2011 C.10 If no unusual events occurred during an entire shift, would a shift hand-over procedure still have to be performed? Yes. The CRM regulations require the operator to define the information that will be transferred during shift turnover and the process by which this information is exchanged. The fact that no unusual events occurred is in itself information that an incoming controller is expected to know. [§§ 192.631(c)(5) and 195.446(c)(5)] Original: 6/17/2011 C.11 If an operator has a controller on regular day shifts only (e.g., 8-5 M-F) and uses callouts to handle off-shift needs, is a shift hand-over process still needed, since the same person would be returning the next day? Yes. Even if the same person is scheduled to return, the controller may unexpectedly have to be replaced as the result of illness or other circumstance that prevents the controller from returning to duty the next day as planned. Even if the same individual returns the next morning, the shift hand-over process will help ensure no critical information has been forgotten. [§§ 192.631(c)(5) and 195.446(c)(5)] Original: 6/17/2011 C.12 If an operator upgrades or modifies a portion of its SCADA system that results in some changes to the SCADA display, and the display symbols unaffected by the upgrade/modification are different than those recommended in API RP 1165, would the operator need to update all SCADA screens (even those that were not modified or upgraded) so that all would use the same symbols? APIRP 1165, Section 8 must be implemented in accordance with 49 CFR 192.631(c)(1) and 195.446(c)(1), which state in part "[c]reating a standard, consistent set of symbols is essential to efficient and understandable display design.” If such changes impacted only a certain group of consoles in the control room, and assigned controllers and qualified control room supervisors do not cross-train on or move from these consoles to unchanged consoles, then API RP 1165 may be appropriately limited to the affected group of consoles. [§§ 192.631(c)(1) and 195.446(c)(1)] Original: 6/17/2011 C.13 When testing the “backup SCADA system,” must the test include restoration of, and transfer of control back to, the primary SCADA system? To ensure that the backup SCADA system will function as designed to support the safe operation of the pipeline in the event the primary SCADA system being unavailable, PHMSA would expect that returning the pipeline operation to the primary SCADA control be a part of the process and procedures. [§§ 192.631(c)(4) and 195.446(c)(4)] Original: 6/17/2011 C.14 With respect to testing and verification of backup manual operations, is the intent to test every manual operation or to test the capability to execute the backup plans, procedures, and processes? Operators must test and verify that its internal communications plan can effectually implement backup manual operations in the event of a SCADA system failure. The test and verification process must be designed to confirm that the operator has adequate personnel, procedures, processes, communications infrastructure, and manual command-and-control capabilities to assure safe, reliable operations and pipeline integrity when operating manually. Such testing should (i) verify the sufficient and timely deployment of qualified personnel to field locations necessary to adequately operate equipment and monitor pipeline integrity, (ii) establish, supplement, and/or verify performance of its communications or command center, and (iii) exercise critical decision-making processes. Testing and verification should address all types of actions necessary to mobilize manual operations. Testing and verification should be performed on at least a representative sampling of the processes and equipment intended to be used during backup operations. [§§ 192.631(c)(4) and 195.446(c)(4)] Revised: 6/20/2012 C.15 If an operator upgrades or modifies a portion of an existing SCADA system (e.g., upgrades to later version of SCADA software or upgrades to larger/faster hard drives), must the operator implement API RP 1165 with respect to the upgrade/modification? Operators must delineate what does and does not constitute the need to implement API RP 1165 within their plans and procedures. The CRM rule requires that the operator implement API RP 1165 whenever a SCADA system is added, expanded, or replaced. Routine upgrades or modifications of existing SCADA systems that do not impact display parameters, such as operating system, application software or hard drive upgrades do not necessarily require implementation of API RP 1165. However, changes that impact display parameters (such as display symbols, color palettes, or anything that affects the controller-machine interface) would require implementation of API RP 1165. [§§ 192.631(c)(1) and 195.446(c)(1)] Original: 6/17/2011 C.16 Is a Master-Slave SCADA configuration considered a backup system requiring an annual test as stated in 49 CFR 192.631(c)(4) and 195.446(c)(4)? Yes. The slave unit should be tested annually to verify it is capable of performing its designed capabilities. [§§ 192.631(c)(4) and 195.446(c)(4)] Original: 6/17/2011 C.17 Are operators required to incorporate built-in automatic safety actions into their SCADA systems? Operators may incorporate automatic SCADA safety actions into their SCADA systems, but this practice is not required in the CRM rule. However, automatic safety actions should be considered when testing and verification requirements are reviewed. [§§ 192.631(c) and 195.446(c)] Original: 6/17/2011 C.18 If an operator experiences an actual SCADA failure that results in the back-up SCADA system being pressed into service, can the operator claim that event as testing and verifying their back-up SCADA system? Yes. As long as an adequate representative sampling of functions are performed, verified and documented during back-up operations. Operators may be able to use alarm and event logs generated during back up operations to help demonstrate that an adequate representative sampling of functions were tested. [§§ 192.631(c)(4) and 195.446(c)(4)] Original: 6/17/2011 C.19 If an operator expands or replaces a SCADA system, when must the SCADA system be in compliance with the API RP 1165 and alarm management requirements? In such cases, if it is not practical for the SCADA system to be in immediate compliance with CRM requirements, operators must document the deviation in accordance with paragraph (j)(2) of the CRM rule. The documentation must demonstrate why immediate compliance with all CRM requirements is not practical, how the deviation is necessary for safe operation, and include a justified project timeline that includes an indication when full compliance is to be attained. [§§ 192.631(c), (e), and (j) and 195.446(c), (e), and (j)] Original: 6/17/2011 63 C.20 When must point-to-point verification be completed following field changes or SCADA display changes? PHMSA expects operators to diligently and promptly complete actions required by the rule. PHMSA inspectors will assess an operator's plans, procedures and associated records to evaluate the operator’s process for completing point-to-point verification in a timely manner. Operators may include multiple timing criteria within their procedures for completing point-to-point verifications. Although there may be others, two examples of timing criteria are: data points already being used in the control room; and data points being added or checked out as a part of a system enhancement or replacement. Those data points already being used by controllers should be verified the same day a verification process became necessary. Those data points being added or checked out as a part of a major system enhancement or replacement should be verified before those data points are turned over to controllers for use. [§§ 192.631(c)(2) and 195.446(c)(2)] Original: 9/30/2011 D. Fatigue Mitigation D.01 What activities are considered to be off-duty time for a controller? Off-duty is defined as time in which the controller is not performing any work, duties, meetings, training, or other assignments for the operator. The controller’s commute time to and from work, and any time which the controller is not working for the operator is considered off-duty time. [§§ 192.631(d)(1) and 195.446(d)(1)] Original: 6/17/2011 D.02 What on-duty time must be included in the tabulation of duty hours for fatigue mitigation consideration? Hours of service include time while an individual is performing controller activities, including shift-change and overlap, on-call duties, events, emergency or spill drills, meetings, training, receiving or providing performance reviews and all other time the individual performs activities for the operator. Any and all non-controller type duties a controller performs for the operator are considered on-duty time for fatigue mitigation purposes. Note that on-duty time must also be tracked and tabulated for individuals that are not normally performing controller duties, but that might be called on to perform controller duties on short notice if needed (such as qualified supervisors or others who are maintaining their qualified controller status). [§§ 192.631(d)(1) and 195.446(d)(1)] Original: 6/17/2011 D.03 What minimum time should be scheduled between shifts to provide controllers off-duty time sufficient to achieve eight hours of continuous sleep? Controllers must have an opportunity for eight hours of continuous sleep between shifts. PHMSA encourages at least ten continuous hours of off-duty time to allow for commutes and other personal activities prior to going to sleep or after waking up. Shorter/longer commute times or the availability of nearby sleep facilities may influence the appropriate amount of off-duty time. [§§ 192.631(d)(1) and 195.446(d)(1)] Original: 6/17/2011 D.04 What are some specific elements that should be included as part of a fatigue mitigation training and education program? The following are examples of elements that should be considered as part of fatigue mitigation training and education: Sleep physiology, sleep hygiene and sleep pathologies Sleep deprivation effects on work performance Circadian rhythm effects on work performance Time on task fatigue effects on work performance The effects of prescription and over-the-counter drugs on sleep and performance Fatigue countermeasures Fatigue modeling Quantifying the potential contribution of fatigue to incidents and accidents How off-duty activities contribute to fatigue Fatigue effects on highway driving performance Employer-specific policies and procedures related to fatigue management Individual-specific employee differences that may impact fatigue Fatigue mitigation strategies based upon the preceding information [§§ 192.631(d)(2) and (3) and 195.446(d)(2) and (3)] Original: 6/17/2011 D.05 What are some examples of fatigue mitigation tactics (countermeasures)? The operator is responsible for determining the fatigue risks that exist in its - **truncated:** true - **body characters:** 86692