TAMPA AIRPORT PIPELINE CORPORATION — Notice of Amendment

220136008M_closure Letter_09172014_text.pdf, page 1Official PDFCERTIFIED MAIL - RETURN RECEIPT REQUESTED September 17, 2014 Mr. Robert L. Rose President Tampa Airport Pipeline Corporation P.O. Box 35236 Sarasota, FL 34242 CPF 2-2013-6008M Dear Mr. Rose: On May 15-17, 2013, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Southern Region, Office of Pipeline Safety (OPS) inspected the Tampa Airport Pipeline Corporation (TAPC) control room in Tampa, Florida, pursuant to Chapter 601 of 49 United States Code. As a result of the inspection, the OPS Southern Region issued a Notice of Amendment (NOA) to TAPC on September 9, 2013. Subsequent to the NOA, TAPC amended its control room procedures and provided the OPS Southern Region with documentation of those amendments. Based on our review of the actions taken by TAPC to amend its procedures and the supporting documentation, we have determined that TAPC has complied with the terms of the NOA and that no further action is necessary with regards to the NOA. This case is now closed. Please be advised that this letter refers only to the above referenced order (CPF 2-2013-6008M) and not to any other PHMSA cases, if any. Sincerely, Wayne T. Lemoi Director, Office of Pipeline Safety PHMSA Southern Region#

220136008M_notice of amendment_09092013_text.pdf, page 1Official PDFNOTICE OF AMENDMENT CERTIFIED MAIL - RETURN RECEIPT REQUESTED September 9, 2013 Mr. Robert L. Rose President Tampa Airport Pipeline Corporation P.O. Box 35236 Sarasota, FL 34242 CPF 2-2013-6008M Dear Mr. Rose: On May 15-17, 2013, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Southern Region, Office of Pipeline Safety (OPS) inspected the Tampa Airport Pipeline Corporation (TAPC) control room in Tampa, Florida, pursuant to Chapter 601 of 49 United States Code. On the basis of the inspection, PHMSA has identified apparent inadequacies within TAPC’s written Control Room Management (CRM) procedures, which were contained in TAPC’s Operations & Maintenance Procedure Manual (O&M Manual), as described below: 1. § 195.446 Control room management . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: . . . (1) Implement API RP 1165 (incorporated by reference, see § 195.3) whenever a SCADA system is added, expanded or replaced, unless the operator demonstrates that certain provisions of API RP 1165 are not practical for the SCADA system used; TAPC’s CRM procedures did not clearly define the types of changes to its SCADA system that would constitute additions, expansions, or replacements that require API RP 1165 to be implemented unless the operator demonstrates that certain provisions of API RP 1165 are not practical for the SCADA system used. TAPC’s O&M Manual Section 8.3 did not describe in adequate detail those changes that impact display parameters (such as display symbols, color palettes or anything that affects the controller-machine interface) and would require TAPC to implement API RP 1165.#

220136008M_notice of amendment_09092013_text.pdf, page 22. 3. Section 8.3 also did not explain in adequate detail how TAPC’s SCADA system (which is being upgraded1) will comply with API RP 1165 nor did TAPC include this requirement in its SCADA upgrade contract specifications. In lieu of the preceding, TAPC did not demonstrate that certain provisions of API RP 1165 will not be practical for its upgraded SCADA system. § 195.446 Control room management . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: . . . (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays; TAPC’s CRM procedures did not address the requirement to conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays. Subsequent to the PHMSA inspection, TAPC provided new point-to-point verification procedures (O&M Manual Section 8.5.1) to the PHMSA inspector that required verification when safety devices are replaced, but the new procedures did not require verification when like-for-like replacement of safety-related field instrumentation occurs. § 195.446 Control room management . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: . . . (5) Implement section 5 of API RP 1168 (incorporated by reference, see § 195.3) to establish procedures for when a different controller assumes responsibility, including the content of information to be exchanged. TAPC’s CRM procedures did not have all the checklist items specified in API RP 1168 Section 5 and referenced a non-existent “Operators Shift Change Form.” Subsequent to the PHMSA inspection, TAPC provided revised procedures (TAPC O&M Procedure Manual rev. May 30, 2013) but the new procedures were not clear as to which form is to be used during shift change. Also, although one of the new referenced forms contained the items listed in API RP 1168 Section 5, the form did not require annotation by the controller of “no change” rather than not covering a topic in the event certain operational aspects are not important to an incoming controller. 1 TAPC personnel informed the PHMSA inspector that TAPC has contracted with Curry Controls to upgrade its SCADA system to conform to API 1165 in 2013. As of August 29, 2013, the upgrade is in the design phase. 2#

220136008M_notice of amendment_09092013_text.pdf, page 34. 5. 6. § 195.446 Control room management . . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: . . . (1) Establish shift lengths and schedule rotations that provide controllers off-duty time sufficient to achieve eight hours of continuous sleep; TAPC’s CRM procedures in O&M Manual Section 8.7 did not adequately address how its fatigue mitigation program would reduce the risk associated with controller fatigue. § 195.446 Control room management . . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: . . . (4) Establish a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. TAPC’s CRM procedures did not adequately establish maximum limits on controller hours-of-service (HOS). TAPC’s procedures did not specifically convey that, for its 8-hour shift, it conforms to the following shift holdover guideline: one 16-hour (double shift) (17 hours with hand-over time), or two 10-hour shifts (11 hours with hand-over time) in any sliding 7-day period. Subsequent to the PHMSA inspection, TAPC provided revised procedures (TAPC O&M Procedure Manual rev. May 30, 2013) that provided for two 10-hour shifts (11 hours with hand-over time), but the revised procedures did not restrict this to a sliding 7-day period. TAPC’s procedures did not contain any specific fatigue countermeasures that should be implemented for the below-listed shift hours. - Any and all hours worked between 2:00 a.m. and 6:00 a.m. - Any and all night shifts immediately following three successive nights - Any and all day or night shifts following four successive night shifts unless three nocturnal sleep cycles have been completed TAPC did not have a documented technical basis to show that the operator’s maximum limit on controller HOS is adequate to reduce the risk associated with controller fatigue, and did not have a formal procedure for approving deviations from the maximum HOS limits. Subsequent to the PHMSA inspection, TAPC provided revised procedures (TAPC O&M Procedure Manual rev. May 30, 2013) with general requirements for documenting deviations from procedures and the CRM rule, but the revised procedures did not have a formal HOS deviation procedure. § 195.446 Control room management . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: 3#

220136008M_notice of amendment_09092013_text.pdf, page 47. 8. . . . (1) Review SCADA safety-related alarm operations using a process that ensures alarms are accurate and support safe pipeline operations; TAPC’s CRM procedures in O&M Manual Section 8.8.1 did not describe how TAPC identified safety-related alarms and did not adequately describe a process that ensures alarms are accurate and support safe pipeline operations. The procedure stated, “8.8.1 Safety-Related Alarms TAPC’s designated alarm database, see TAPC Alarm Management Plan. This plan includes identified safety-related alarms. Controllers are trained to understand which alarms are safety-related along with their individual implications. Safety-related specific alarms are critical alarms and do not include low importance alarms such as equipment efficiency alarms or measurement related alarms. For purposes of Control Room Management, PHMSA considers safety-related to mean any operational factor that is necessary to maintain pipeline integrity or that could lead to the recognition of a condition that could impact the integrity of the pipeline, or a developing abnormal or emergency situation.” The above procedure and TAPC’s policies did not require the evaluation each controller’s ability to accurately perceive SCADA display object characteristics (e.g., color, shape, text) that indicate safety-related alarms used in the operator’s SCADA system. § 195.446 Control room management . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: . . . (3) Verify the correct safety-related alarm set-point values and alarm descriptions when associated field instruments are calibrated or changed and at least once each calendar year, but at intervals not to exceed 15 months; TAPC’s CRM procedures did not require the verification of the correct safety-related alarm set-point values and alarm descriptions when associated field instruments are calibrated or changed. Subsequent to the PHMSA inspection, TAPC provided revised procedures (TAPC O&M Procedure Manual rev. May 30, 2013) but the new procedures were not clear that any calibration or change to field instruments required verification of alarm set-points and alarm descriptions. § 195.446 Control room management . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: . . . (5) Monitor the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms; and . . . 4#

220136008M_notice of amendment_09092013_text.pdf, page 5TAPC’s CRM procedures did not convey how TAPC monitors the content and volume of general activity being directed to and required of each controller. O&M Manual section 8.11.5 only “parroted” the federal pipeline safety regulations. Response to this Notice This Notice is provided pursuant to 49 U.S.C. §60108(a) and 49 C.F.R. §190.237. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue a Final Order. If, after opportunity for a hearing, your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.237). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 60 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that Tampa Airport Pipeline Corporation maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/ revision of plans, procedures) and submit the total to Wayne T. Lemoi, Director, Southern Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 2-2013-6008M and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Wayne T. Lemoi Director, Office of Pipeline Safety PHMSA Southern Region Enclosure: Response Options for Pipeline Operators in Compliance Proceedings 5#