EXXONMOBIL PIPELINE CO — Notice of Amendment

party submissionOfficial PDF32021026NOA_Operator Hearing Request Withdrawn_12082021_(20-187008).pdf#

case documentOfficial PDF32021026NOA_Operator Pre-Hearing Submission_10252021_(20-187008).pdf#

party submissionOfficial PDF32021026NOA_Operator Response to Notice and Request for Hearing and Statement of Issues_07162021_(20-187008).pdf#

32021026NOA_PHC Hearing Scheduled_07292021_(20-187008)_text.pdf, page 1Official PDFJuly 29, 2021 VIA ELECTRONIC MAIL TO: rebekah.r.bennett@exxonmobil.com and gregory.ochs@dot.gov Ms. Rebekah R. Bennett, Esq. General Counsel ExxonMobil Pipeline Company 22777 Springwoods Village Parkway Spring, TX 77389 Mr. Gregory Ochs Director, Central Region Pipeline and Hazardous Materials Safety Administration 901 Locust Street, Suite 480 Kansas City, MO 64106-2641 Re: Notice of Hearing, ExxonMobil Pipeline Company CPF No. 3-2021-026-NOA Dear Ms. Bennett and Mr. Ochs: In accordance with 49 C.F.R. § 190.211, an informal hearing will be held regarding the Notice of Amendment issued by the Pipeline and Hazardous Materials Safety Administration in the above- referenced case. The hearing will take place on November 2, 2021, beginning at 8:30 a.m. Central Time. The hearing will be held via videoconference. I will provide the videoconference information prior to the hearing. At least 10 calendar days prior to the hearing (or by October 25, 2021), both parties must submit and exchange any additional written materials they intend to present at the hearing and the name and email address of each attendee. This information should be provided electronically. Materials not submitted by this date may be excluded. If you have any questions, please do not hesitate to contact me. Sincerely, Larry White Presiding Official cc: Mr. Steven Yatauro, President, ExxonMobil Pipeline Company, steven.a.yatauro@exxonmobil.com Mr. Joseph Hainline, Counsel, Central Region, Office of Pipeline Safety, joseph.hainline@dot.gov#

32021026NOA_Closure Letter_12232021_(20-187008)_text.pdf, page 1Official PDFVIA ELECTRONIC MAIL TO: Christina.s.philbrook@exxonmobil.com December 23, 2021 Steven Yatauro President of Exxon Mobil Pipeline Company Exxon Mobile 22777 Springwoods Village PKWY Spring, TX 77389 steven.a.yatauro@exxonmobil.com, diana.r.skates@exxonmobil.com CPF 3-2021-026-NOA Dear Mr. Yatauro: From July 27 through August 24, 2020, a representative from the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to chapter 601 of 49 United States Code, conducted an on-site pipeline safety inspection of Exxon Mobil’s procedures in Springs, Texas. As a result of the inspection, Exxon Mobil was issued a Notice of Amendment on April 8, 2021, which proposed amendment of your procedures. Exxon Mobil submitted its amended procedures on December 21, 2021. My staff reviewed the amended procedures, and it appears that the inadequacies outlined in this Notice of Amendment have been corrected. This letter is to inform you no further action is necessary and this case is now closed. Thank you for your cooperation. Sincerely, Gregory A. Ochs Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration#

32021026NOA_PHC Hearing Rescheduled_10282021_(20-187008)_text.pdf, page 1Official PDFDate: October 28, 2021 From: Larry White To: File Re: Continuance of Hearing, ExxonMobil Pipeline Company CPF No. 3-2021-026-NOA By electronic mail dated October 28, 2021, Daniel Brink, Counsel for ExxonMobil Pipeline Company, and Joseph Hainline, Counsel for OPS Central Region, submitted a joint request for a continuance of the hearing previously scheduled for November 2, 2021. The request explained that ExxonMobil needed additional time to amend its procedures and submit them for approval by the Regional Director which would make a hearing unnecessary. I granted the request for a continuance until December 10, 2021 which will be the new hearing date if for any reason the amendment of procedures is not completed by that time.#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 1Official PDFNOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: darren.w.woods@exxonmobil.com Christina.s.philbrook@exxonmobil.com April 8, 2021 Darren W. Woods Chairman and CEO Exxon Mobile 22777 Springwoods Village PKWY Spring, TX 77389 CPF 3-2021-026-NOA Dear Mr. Woods: From July 27 through August 24, 2020, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code inspected Exxon Mobil’s (Exxon) procedures for Control Room Operations in Spring, Texas. This Notice is in response to PHMSA’s Control Room Management (CRM) Initiative, which is a national level program that includes inspectors from every region. As a result, you may have received this Notice from a different Regional Director than typical because the CRM Initiative inspections are currently separate from the standard inspection program. Notices and correspondence from other types of inspections will remain unchanged. On the basis of the inspection, PHMSA has identified the apparent inadequacies found within Exxon’s plans or procedures, as described below: 1. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. The procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later than August 1, 2012. The training procedures required by paragraph (h) must be implemented no later than August 1, 2012, except that any training required by another paragraph of this section must be implemented no later than the deadline for that paragraph.#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 2Exxon’s Control Room Management (CRM) plan, dated January 24, 2020, was inadequate because it did not provide a process to determine if a facility is a control room. Exxon personnel stated that they review all facilities on an annual basis to determine if a facility is a control room by applying a matrix of questions to each facility. Exxon completes this exercise each year, but does not have the process developed in its CRM plan. Exxon must amend its procedure to include a written process for how its personnel are to identify facilities as control rooms. 2. § 195.446 Control room management (a) . . . . (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller’s prompt and appropriate response to operating conditions, and operator must define each of the following. (1) . . . . (5) The roles, responsibilities and qualifications of others who have the authority to direct or supersede the specific technical actions of controllers. Exxon’s CRM Plan, dated January 24, 2020, was inadequate because it did not contain any statements related to either allowing or disallowing others to have authority to direct or superseded the specific technical actions of a controller. Exxon’s CRM plan includes statements in several sections of its plan that controllers have the authority to shut down the pipeline. While this is an important aspect under Roles and Responsibilities of a controller, more is needed to have a procedure that is adequate to assure the safe operation of Exxon’s pipelines that are operated by controllers The procedure must be amended to clearly identify all the roles, responsibilities and qualifications of others who have the authority to direct or supersede the specific technical actions of controllers. If Exxon does not allow others to have such authority, Exxon must amend its procedure to so state. 3. § 195.446 Control room management (a) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays; Exxon’s point-to-point (P2P) procedures inadequate to support a thorough evaluation of the point being monitored and controlled from the control room. The procedure is vague in its description and guidance on performing a thorough and accurate P2P verification test. Missing from the procedure was a requirement to record the field value/status found, and the corresponding control room SCADA/HMI value/status, alarm limit set point and verification of alarming, alarm information (priority, color, message, correct audio etc.), and point presentation on all screens verified. Additional information related to the tag name, field device name, RTU/PLC address, general location identification as well as any other mapping information for the point to provide its location and that the correct point has been verified. It is 2#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 3not merely the endpoint value read correctly, but every aspect of that point was verified to be an accurate representation with proper messaging to the controller. The procedure does not provide enough detail to verify mapping of the point through the SCADA system, alarm set points as well as point and alarm attributes. This lack of process can render inconsistent verification and incomplete records. Exxon Mobil recently installed a new SCADA system and are designing a new tool for recording P2P verification. The new template for P2P was reviewed, but the template and procedure still not adequate to meet the requirements of this section. Exxon must amend its procedures to provide guidance and direction to support a thorough and consistent P2P verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays. 4. § 195.446 Control room management (a) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months; Exxon’s Control Room Management (CRM) Plan, dated January 24, 2020, was inadequate because it did not provide enough detail in the internal communication plan for the safe manual operation of the pipeline. There were two conditions identified in the CRM Plan; a single point of failure, and a HUB Procedure. The single point failure indicates that the field or interconnects should monitor and call hourly to the controller, but it does not support how the controller is to document this information and incorporate it into the overall operation of the pipeline. The HUB procedure enlists a field controls personnel to go to the communications hub point and test the point with a SCADA technician. They never engage the controller except to notify them of the test. In a real case scenario, if this option is employed, the controller has no procedure or guidance on what to do, how to direct the actions of field personnel at the Hub, how to document the information being relayed between the control room and field, or how to incorporate that information to operate the system. While Exxon tests the HUB procedure frequently, it has never been tested with a controller. Exxon must amend its procedure to provide enough detail in the internal communication plan for the safe manual operation of the pipeline to provide adequate means for the safe manual operation of the pipeline. The procedure must include guidance for the controller to consistently document information, from the field, related to the single point failure process. The procedure must also be amended to include the control room in the HUB Test Procedure. Information should be relayed to the control room and the field technician should take direction from the controller. The procedure needs to support how this manual information requested and received, from the field to the controller, will be either incorporated as supplemental information to SCADA information or as a stand-alone process of operating the system in full manual mode (if required). The procedure also needs to include defining the official record when this occurs and where it will be maintained. 3#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 45. § 195.446 Control room Management (a) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (5) Implement section 5 of API RP 1168 (incorporated by reference, see § 195.3) to establish procedures for when a different controller assumes responsibility, including the content of information to be exchanged. Exxon's CRM plan, dated January 24, 2020, was inadequate because it did not require the outgoing and oncoming controllers to sign the 12-hour Shift Log at the end of the shift turnover meeting. The procedure states that "the outgoing Controller is expected to have the oncoming Controller sign the 12- hour Shift Log documenting that it has been reviewed". There is no date or time or acknowledgement by the outgoing controller when the shift change occurred. Exxon Mobil indicated that when the oncoming controller signs in to SCADA, this is the official time and date stamp; however, the procedure does not state this. Also, the procedure does not adequately describe what Exxon considers the official documentation for shift change. The official shift change documentation, in practice, is called a "packet" that consists of three separate documents: The Operations Control Center Controller Check List, EMPCo Controller 12 Hour Shift Log, and the upcoming Oil Plan. These three documents are all paper. Documents are gathered, stapled and maintained for records. The individual documents do not have administrative controls where, if separated, they could be matched back together. To be more specific, there is no consistency of date, shift, console or controller, to align the documents together. This was evident during the inspection because Exxon had to separate the documents and scan them to prepare for the inspection. When they were trying to provide the packet, it was difficult to discern, by all, they had the right record for that packet. A comparison review of the procedure shift change requirements to the requirements of API 1168 Section 5 (incorporated by reference at § 195.446(c)(5)), it is difficult to verify that any of the items defined in API 1168 5.3.1 - 5.3.7 are incorporated into the shift turnover discussion. The checklist encompasses some of the items, but these seem to be more of a checklist for the oncoming controller to orient themselves to the console operations rather than a discussion check list. Exxon must amend its procedure to adequately describe what must happen and be documented when a different controller assumes responsibility, including the content of information to be exchanged. The procedure should include at a minimum, the documents required for the complete turn over, expectations for completion of all documents, consistent document formatting to assemble the packet and what the official time and date stamp is for when the shift turnover occurs; including the console and personnel involved in the exchange. It should also include clarification regarding the checklist, these are items (API 1168 5.3.1 - 5.3.7) that are to be discussed and were discussed between controllers at the time of shift turnover. 6. § 195.446 Control room management. (a) . . . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (1) . . . . 4#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 5(4) Establish a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. Exxon’s Control Room Management (CRM) Plan, dated January 24, 2020, was inadequate because it did not provide information related to shift schedules and Hours of Service (HOS) for controllers who work under 8-hour shifts. In a review of shift schedules, it was identified that there were HOS deviations for controllers who normally work 8 hour shifts. These individuals serve in roles that do not fill a regular console shift position. However, they are qualified and fill in periodically to cover shifts. During this review, controller’s shift coverage hours of service violated working more than 5 shifts in a row, in some cases 7 shifts in a row, without the required time off. However, in these cases, they did not exceed the maximum total hours worked (65 hours) because of the combination of 8-hour and 12-hour shifts. The HOS deviations are set up for 12-hour shifts and do not take in to account controllers working 8-hour shifts and 12-hours shifts. The procedure does not take into consideration maximum HOS in a rolling 7- day period, which can support monitoring HOS for multiple shifts workers as well as 12-hour shift workers. Exxon must amend its procedure(s) to include information related to the 8-hour shifts worked by qualified controllers in the control room, and provide HOS guidelines the encompass both 8-hour shifts and 12-hour shifts, especially since some controllers work both. 7. § 195.446 Control room management (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator’s plan must include provisions to: (1)… (2) Identify at least once each calendar month points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of exceeding that required for associated maintenance or operating activities. Exxon’s Control Room Management (CRM) plan, dated January 24, 2020, was inadequate because it did not address the monthly identification, recording, review, and analysis of points that have been taken off scan, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of time exceeding that required for associated maintenance or operating activities. While section 4.8.1 of the CRM plan describes how to manage a point being taken off-scan, out of service or disabled, section 4.8.4 addresses False Alarms, sections 4.8.2 and 4.9.1.5 address Inhibited Points, and Table 4 Alarm Metric Reporting addresses Inhibited Alarms and Off-Scan (sic Point/Alarm) Review, the procedure lacks process detail. There is no mention in the procedure about how Exxon manages or monitors forced or manual values in SCADA, which includes the monthly review. Exxon’s CRM plan fails to provide specific guidance to address the requirements of this monthly requirement. The procedure lacks how process for how to gather information, what is to be considered in the review, who will perform the review, what information will be reported out from the review, and any action steps based on the findings of the review. The procedure must be amended to include the requirements related to points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of exceeding that required for associated maintenance or operating activities. 5#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 68. § 195.446 Control room management (a) . . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator’s plan must include provisions to: (1) . . . . (4) Review the alarm management plan required by this paragraph at least once each calendar year, but at intervals not exceeding 15 months, to determine the effectiveness of the plan; Exxon’s Control Room Management (CRM) Plan, dated January 24, 2020, was inadequate because it did not state what criteria will be used for determination of effectiveness. Exxon explained that it reviews the year end results of the Alarm Performance Metrics, and modifies the metrics for the following year. However, this process is not described in the procedure. The procedure discusses reviewing the alarm system, but does not explain what such a review should include. Deficiencies identified will be assigned corrective action plans which are to be reviewed and documented. The documentation was a line item in the Controls Catalogue, which also was not represented in the procedure. The procedure must be amended to include the criteria and process for the review that would provide a determination of the alarm management plan’s effectiveness. 9. § 195.446 Control room management (a) . . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator’s plan must include provisions to: (1) . . . . (5) Monitor the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms; Exxon’s Control Room Management Plan, dated January 24, 2020, was inadequate because it did not have criteria identified on how Exxon will determine that a controller has sufficient time to analyze and react to incoming alarms. The procedure identifies various items that are considered, and data that is collected and aggregated for the review. These items relate to the quantity of activity, such as number of telephone calls or number of alarms per hour. However, there is no conversion of the quantity to time, or a benchmark on what quantity is acceptable or too high for a controller to manage. The expectation is to determine if a controller has adequate time to be able to identify, verify and respond to alarms. Since Exxon did not have a stated standard, there was no bench mark to verify compliance. Exxon Mobil must amend the procedure to provide criteria and metrics that support the study results as to whether controllers have sufficient time to analyze and react to incoming alarms. The procedure also needs to provide recommendations to remedy deficiencies found in the analysis. 6#

32021026NOA_Notice of Amendment_04082021_(20-187008)_text.pdf, page 7Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Enforcement Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that Exxon Mobil maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Gregory A. Ochs, Director, Central Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 3-2021-026-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Gregory A. Ochs Director, Central Region, OPS Pipeline and Hazardous Materials Safety Administration cc: Christina Philbrook, Regulatory Compliance Supervisor Christina.s.philbrook@exxonmobil.com Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings 7#