IMTT-PIPELINE — Warning Letter

120165009W_Warning Letter_09282016_text.pdf, page 1Official PDFWARNING LETTER OVERNIGHT EXPRESS DELIVERY September 28, 2016 Michael Morganti, Terminal Manager IMTT-Pipeline 250 East 22nd Street Bayonne, New Jersey 07002 CPF 1-2016-5009W Dear Mr. Morganti: From November 4 - 8, 2013, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), pursuant to Chapter 601 of 49 United States Code inspected IMTT-Pipeline (IMTT) Control Room Management Plan, Effective Date: July 2013 (CRMP) and referenced IMTT Operations, Maintenance and Emergency Manual dated July 2013 (OM&E) along with other related materials and records in Bayonne, New Jersey. As a result of the inspection, it appears that you have committed probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations. The items inspected and the probable violations are: 1. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. The procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later than August 1, 2012. The training procedures required by paragraph (h) must be implemented no later than August 1, 2012, except that any training required by another paragraph of this section must be implemented no later than the deadline for that paragraph. IMTT failed to have its control room management procedures readily available in its control rooms as prescribed in §195.446(a). Pursuant to §195.446(a), the procedures required by this section must be#

120165009W_Warning Letter_09282016_text.pdf, page 21-2016-5009W integrated, as appropriate, with the operator's written procedures, required by § 195.402. Section 195.402 states that the appropriate parts of the manual of written procedures for conducting normal operations and maintenance activities, and handling abnormal operations and emergencies shall be kept at locations where operations and maintenance activities are conducted. During this inspection, a PHMSA inspector visited the primary control room at Bergen Point facility (Bergen Control Room) and the backup control room at 5th Street Terminal (5th Street Control Room) in Bayonne, New Jersey. A controller was monitoring the pipeline from the console at the Bergen Control Room. 1. 2. The PHMSA inspector requested to look at the CRMP. IMTT did not have a hard copy of the CRMP at the control room. The PHMSA inspector requested to view the CRMP electronically through the intranet. IMTT indicated that there was no service available to complete connection to its network. IMTT did not have a hard copy or electronically-accessible copy of the CRMP in either the Bergen Control Room or the 5th Street Control Room. Additionally, the CRMP, Section 2. Roles and Responsibilities, Subsection 2.5 Controller Manuals states that the “Controllers have access to the IMTT OM&E Manual to reference all essential operational procedures and process. . . This manual is available on the console in hardcopy format and electronically via intranet.” The CRMP is a different document from the OM&E. IMTT did have a hard copy of the OM&E at the Bergen Control Room; however, it does not address all the requirements under the control room management rule prescribed in §195.446, as these items are more fully addressed under the CRMP. 2. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. . . (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following: (1) A controller's authority and responsibility to make decisions and take actions during normal operations; IMTT failed to follow the CRMP, Section 2 Roles and Responsibilities, Subsection 2.2 IMTT Authority and Responsibility in accordance with §195.446(b)(1), as prescribed in §195.446(a). Pursuant to section §195.446(a), each operator must have and follow written control room management procedures that implement the requirements §195.446. Section 195.446(b)(1) requires operators to define a controller's authority and responsibility to make decisions and take actions during normal operations. Subsection 2.2 IMTT Authority and Responsibility states that “IMTT prohibits anyone other than an OQ- qualified Controller to have access to the SCADA system and/or make any remote operational decisions. In addition, the Control Room is secured to prevent unauthorized access to the SCADA system.” However, during the site visit at the Bergen Control Room, the PHMSA inspector observed that there were no locks on the door, or other means to prevent unauthorized access to the control room. 120165009W_Warning Letter_09282016 Page 2 of 6#

120165009W_Warning Letter_09282016_text.pdf, page 31-2016-5009W Moreover, the CRMP, Section Introduction, Subsection 1.5 Control Room Security states that “IMTT is implementing a new SCADA system (anticipated implementation by end of 2013) that will offer additional security measures, such as unique log-in IDs.” At the time of this inspection, IMTT did not require a password login for its SCADA system. Consequently, IMTT did not assure that only individuals qualified in control room management may “have access to the SCADA system and/or make any remote operational decisions” in accordance with its procedures. 3. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. . . (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following: (1) . . . (4) A method of recording controller shift-changes and any hand-over of responsibility between controllers. IMTT failed to follow the CRMP, Section 2 Roles and Responsibilities, Subsection 2.6 IMTT Shift Turnover Tracking in accordance with §195.446(b)(4), as prescribed in §195.446(a). Pursuant to §195.446(a), each operator must have and follow written control room management procedures that implement the requirements §195.446. Section 195.446(b)(4) requires operators to define a method of recording controller shift-changes and any hand- over of responsibility between controllers. The CRMP, Subsection 2.6. Shift Turnover Tracking refers to the Shift Change Procedure in the OM&E for specific tracking requirements. IMTT provided OM&E Section 402. The Shift Change Procedure is located in the OM&E Section 402, Section 4.3. In Subsection 4.3.1 it states that the “[r]equired documents must be completed by the Controller during shift and prior to shift change. Upon completion of shift change, documents are stored on a secured server. These documents are maintained for a period of {time} (emphasis added).” Subsection 4.3.3.1. Outgoing Controller contains the following list of tasks for the outgoing controller: 1. 2. 3. 4. Complete all required shift documentation as identified in Section 4.3.1. Update Shift Change Turnover Log with information on expected outages. As discussion begins, date/time stamp the shift turnover form. Discuss shift information and events with oncoming Controller and answer any questions that are posed. (emphasis added) However, IMTT was unable to produce any completed forms or documents for shift changes that are referenced in its OM&E Section 402 and CRMP for 2013. The CRMP has a section for forms, but none 120165009W_Warning Letter_09282016 Page 3 of 6#

120165009W_Warning Letter_09282016_text.pdf, page 41-2016-5009W of the forms are related to shift change. Also, IMTT did not prescribe a timeframe for maintaining the records. Additionally, Subsection 4.3.2 Information Requirement states: “The Controller will document all critical data and events that transpired during shift. Information to be documented includes: ….” IMTT did produce a log book that contains information on operational and maintenance activities, but it did not show the time spent during the shift turnover or topics covered. The log book does not ensure that the essential information was discussed. In conclusion, IMTT could not provide the documentation that was required to be completed in accordance with its procedures. 4. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (1) . . . (4) Establish a maximum limit on controller HOS, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. IMTT failed to follow the CRMP, Section 4. Fatigue Management and Mitigation Program, Subsection 4.5 Ongoing Scheduling and Shift Change Analysis in accordance with §195.446(d)(4), as prescribed in §195.446(a). Pursuant to §195.446(a), an operator must have and follow written control room management procedures that implement the requirements §195.446. Section 195.446(d)(4) requires operators to establish a maximum limit on controller hours-of-service (HOS), which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. During the inspection, the PHMSA inspector reviewed Section 4.5 Ongoing Scheduling and Shift Change Analysis, of the July 2013 edition of the CRMP, which states that “the Fatigue Risk Manager performs scheduling and shift change analysis annually to identify potential areas of concern and identify enhancements for handling fatigue (emphasis added).” Subsequently, the PHMSA inspector requested to review the prior version of the control room management procedures so the associated record would correspond. IMTT offered the control room management procedures that had an effective date of August 1, 2011. Section 4.5 Ongoing Scheduling and Shift Change Analysis of the aforementioned procedure states: “To ensure proper fatigue mitigation strategies are in place, the Fatigue Risk Manager performs scheduling and shift change analysis quarterly to identify potential areas of concern and identify enhancements for handling fatigue (emphasis added).” Since the August 1, 2011 edition of the CRMP was in effect in 2012, the PHMSA inspector requested IMTT to provide records of its scheduling and shift change analysis for 2012. IMTT could not provide records to demonstrate that it conducted quarterly analyses during 2012 in accordance with its procedure. 120165009W_Warning Letter_09282016 Page 4 of 6#

120165009W_Warning Letter_09282016_text.pdf, page 51-2016-5009W 5. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: . . . (4) Establish a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. IMTT’s CRMP failed to address how many qualified controllers must be on staff to ensure safe operations in accordance with §195.446(d)(4), as prescribed in §195.446(a). Pursuant to §195.446(a), an operator must have written control room management procedures that implement the requirements §195.446. Section 195.446(d)(4) requires an operator to implement a method that establishes a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. The CRMP Section 4 Fatigue Management and Mitigation Program includes a third-party schedule assessment. Neither the CRMP, nor the third-party schedule assessment, contained details about the number of qualified controllers that must be on staff to avoid chronic or routine deviations from hours-of- service limits and to account for holidays, sick leave, and other (non-controller) duties. During the inspection, IMTT produced a form called “Person reporting Deviation” dated 12/13/12. This form states that “the Control Center is currently working two full-time Controllers and one Qualified Supervisor to ensure continued pipeline safety.” IMTT did not include sufficient information in this form to ensure this amount of controllers is appropriate for its operations. The PHMSA inspector requested to review the prior versions of the control room management procedures. IMTT offered the PHMSA inspector the control room management procedures that had an effective date of August 1, 2011. Section 4 Fatigue Management and Mitigation Program, Subsection 4.4.1 Shift Length of the aforementioned procedure states that “[d]eviation from this schedule in response to Emergency Situations is described in Section 10.2.1 and the external documents outlined in that section (emphasis added).” Subsection 10.2.1 states that the “Pipeline Supervisor documents the deviation on the form, gathers all supporting data associated with the deviation, and routes it through the Pipeline Manager for review and approval. The Pipeline Supervisor will retain a signed copy of the form in a secured location on the intranet to be reviewed during annual CRM program review (emphasis added).” IMTT produced the form called “Person reporting Deviation” dated 12/13/12. This form was not reviewed, approved, signed, and dated. IMTT completed, signed, and dated this form on November 3, 2013. Under 49 United States Code, § 60122, you are subject to a civil penalty not to exceed $200,000 per violation per day the violation persists up to a maximum of $2,000,000 for a related series of violations. For violations occurring prior to January 4, 2012, the maximum penalty may not exceed $100,000 per We have reviewed the circumstances and supporting documents involved in this case, and have decided not to conduct additional enforcement action or penalty assessment proceedings at this time. We advise 120165009W_Warning Letter_09282016 Page 5 of 6#

120165009W_Warning Letter_09282016_text.pdf, page 61-2016-5009W you to correct the items identified in this letter. Failure to do so will result in IMTT being subject to additional enforcement action. No reply to this letter is required. If you choose to reply, in your correspondence please refer to CPF 1- 2016-5009W. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Sincerely, Byron Coy, PE Director, Eastern Region Pipeline and Hazardous Materials Safety Administration 120165009W_Warning Letter_09282016 Page 6 of 6#