MAGELLAN PIPELINE COMPANY, LP — Notice of Amendment

party submissionOfficial PDF32023025NOA_Operator Response to Notice_12082023_(22-240208).pdf#

32023025NOA_Closure Letter_05302025_(22-240208)_text.pdf, page 1Official PDFVIA ELECTRONIC MAIL TO: randy.lentz@oneok.com; jamie.hoskin@oneok.com; charles.misak@oneok.com May 30, 2025 Mr. Randy Lentz EVP, Chief Operating Officer Magellan Pipeline, LLC 909 Lake Carolyn Parkway, Suite 1600 Irving, Texas 75039 RE: CPF 3-2023-025-NOA Dear Mr. Lentz From June 27 through August 25, 2022, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), conducted an inspection of Magellan Pipeline Company, LP’s (Magellan) procedures for Control Room Management in Tulsa, Oklahoma. On September 8, 2023, pursuant to 49 CFR § 190.206, PHMSA issued a Notice of Amendment which proposed amendment of Magellan’s procedures. Magellan submitted its amended procedures on June 17, 2024. PHMSA has reviewed the amended procedures, and it appears that the inadequacies outlined in the Notice of Amendment have been corrected. This letter is to inform you that no further action is necessary, and this case is now closed. Thank you for your cooperation. Sincerely, David Barrett Acting Director, Central Region, OPS Pipeline and Hazardous Materials Safety Administration cc: Jamie Hoskin, SVP, Engineering & Operations: Refined Products, Charles Misak, Director - Integrated Operations Services Asset Integrity,#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 1Official PDFNOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: aaron.milford@magellanlp.com, mark.materna@magellanlp.com September 8, 2023 Mr. Aaron Milford President/CEO Magellan Pipeline, LLC One Williams Center PO Box 22186 Tulsa, OK 74172 CPF 3-2023-025-NOA Dear Mr. Milford: From June 27 through August 25, 2022, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), inspected Magellan Pipeline Company, LP’s (Magellan) procedures for Control Room Management in Tulsa, Oklahoma, by video conference inspection. As a result of the inspection, PHMSA has identified the apparent inadequacies found within Magellan’s plans or procedures. The items inspected and the inadequacies are described below: 1. § 195.444 Leak detection. (a)…. (c)CPM leak detection systems. Each computational pipeline monitoring (CPM) leak detection system installed on a hazardous liquid pipeline must comply with API RP 1130 (incorporated by reference, see §195.3) in operating, maintaining, testing, record keeping and dispatcher training of the system.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 2Magellan’s Procedure 9.02-ADM-081 Computational Pipeline Monitoring was not adequate in referencing how they assure accuracy and calibration of field instrumentation used in the leak detection system. Procedure 9.02-ADM-081 section 1.0 stated, “[T]he purpose of the procedure is to establish a standardized API 1130 (September 2007) compliant method for operating, maintenance, testing, training and record keeping for Computational Pipeline Monitoring (CPM) Tools in use by Magellan.” The procedure addressed testing, maintenance, training and record keeping. Section 3.1.9 referenced API 1149 to support initial threshold setting and section 3.1.8 established a schedule to support review and maintenance of thresholds. The procedure failed to provide how Magellan, through procedure, assured thresholds are maintained through sound instrument calibration procedures. API 1130 (incorporated by reference, see §195.3) section 5.1.3 states, “[T]o maximize and maintain CPM performance, each pipeline company should prepare a CPM instrumentation list and a maintenance and calibration plan with procedures. Additionally, API 1130 section 5.1.1 states, ‘[T]he quality of instrument data can affect the CPM system. Instruments should be selected considering the required measurement accuracy. Ranges and specifications should be carefully matched to pipeline operating design, pressure, flow, temperature, density, viscosity and so on.” During the inspection, Magellan identified two procedures: SIP-ADM-11.01 Change Management and 4.01-ADM-005 Project Commissioning Guideline that related to instrument selection and calibration. However, these were not referenced in the procedure. Also, since two different leak detection procedures were used, there was nothing that clarified the OEM specifications were the same, or that the accuracy and specifications would be implemented as the same without affecting current sensitivity. The procedure needs to be amended to reference Magellan’s procedures and specifications related to the selection and calibration of field instrument tied to CPM to support accuracy of the instrumentation and specifications. If existing procedures are not adequate, they also need to be amended or new procedures developed. 2. § 195.444 Leak detection. (a)…. (c) CPM leak detection systems. Each computational pipeline monitoring (CPM) leak detection system installed on a hazardous liquid pipeline must comply with API RP 1130 (incorporated by reference, see §195.3) in operating, maintaining, testing, record keeping and dispatcher training of the system. Magellan’s Procedure 9.02-ADM-081 was inadequate because it did not include all the criteria or situations where initial tests of the CPM system were required. Section 3.1.12 Ensure Initial Testing requires “[E]ach new CPM instance will be tested to verify that it achieves the expected design or expected performance level.” It is unclear what is meant by “instance.” A single reference to “instance” in API 1130 in section 6.1.2 Alarm Response Considerations mentions “past instances of alarm causes,” which clearly is not what the Magellan procedure is referencing. The procedure infers initial testing of a new CPM system. However, the requirement is to test the performance of a CPM application for pipeline systems#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 3that are put under CPM. This could include an existing pipeline where a new CPM System is applied, or an existing CPM system where a new pipeline system is added. The procedure infers it is one of these. The procedure does not consider how it will handle acquisition of the pipeline. For example, how will the operator perform initial testing for an acquired pipeline system that includes the CPM and possibly SCADA system? Another consideration is initial testing for an acquisition of a pipeline system without CPM. How will the operator consider bringing this system into the operator’s CPM and testing? The procedure needs to be amended to address the various conditions when initial testing will be performed. 3. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by §195.402. An operator must develop the procedures no later than August 1, 2011 and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f), and (g) of this section must be implemented no later than October 1, 2011. The procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later than August 1, 2012. The training procedures required by paragraph (h) must be implemented no later than August 1, 2012, except that any training required by another paragraph of this section must be implemented no later than the deadline for that paragraph. Magellan’s Control Room Management (CRM) procedures were not adequate for determining which facilities were control rooms for the purpose of implementing appropriate sections of §195.446. Procedure SIP-ADM-9.02 Section 3.6.2 states, “Annually, not to exceed 15 months, review list of DOT jurisdictional IMP pipelines to ensure applicability of CRM.” A note box, in this same section, states, “NOTE: CRM applies to Department of Transportation (DOT) regulated pipelines subject to integrity testing per §195.452 and is applicable to the control room(s) and Controller(s) that monitor and control those assets. At Magellan, all appliable assets are monitored and controlled at the Tulsa Operations Center by Tulsa based Controller.” Magellan’s position was that they identified and designated a single control room (Tulsa Operations Control Center) and then verified if a pipeline was jurisdictional (subject to integrity testing per §195.452) and ensure that pipeline segment(s) was monitored and controlled by the “jurisdictional” control room. Procedure 9.01-ADM-153 Communicate with Operations Control, identified information, events and tasks that require communication with Operations Control. It was unclear if the items listed were facilities subject to integrity testing per §195.452. This requirement was integral in determining what was monitored and controlled from the designated Tulsa Operations Center.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 4Since Tulsa Operations Control was not specifically designated, one might surmise there might be another operations control. The procedure was missing a review of other assets, in the Magellan pipeline system, that use a SCADA system that can monitor and/or control all or part of a pipeline facility. It was unclear whether individuals are monitoring and controlling these assets within or outside of a facility fence line. For example, the East Tulsa Terminal has a SCADA system and individuals who can monitor and control assets. Magellan decided this was not a control room and all operations must come from the Tulsa Operations Control Center. As another example, there were pump stations that have SCADA systems controlling assets inside the fence, but Magellan was unsure if assets outside the fence could be controlled from an HMI screen connected to a PLC or other such device. A control room is determined by select activities. The functions, at a facility, must be reviewed to evaluate the SCADA capabilities and human functions/tasks performed using that SCADA system. This process of facility reviews and with evaluation criteria was missing from the procedure. The procedure must be amended to provide more definition, criteria, and processes to review all facilities with SCADA, such as PLC, RTU’s and HMI, where an individual can remotely monitor, control, and respond to pipeline conditions, to determine if they are control rooms. 4. § 195.446 Control room management. (a)…. (c) Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibility the operator has defined by performing each of the following: (1)…. (4) Test any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months; Magellan’s procedures SIP 9.02-ADM-023 and SIP 9.02-ADM-080 were not adequate to thoroughly document the physical test of the backup control systems to demonstrate compliance. There are three procedures related to SCADA testing: SIP 9.02-ADM-023, SIP 9.02-ADM- 025, SIP 9.02-ADM-079, SIP 9.02-ADM-080. SIP 9.02-ADM-079 addresses robust testing of the SCADA servers annually. SIP 9.02-ADM-025 addresses SCADA test communications. SIP 9.02-ADM-023 and SIP 9.02-ADM-080 relate to testing the physical back up control room. Missing from SIP 9.02-ADM-023 and SIP 9.02-ADM-080 is a process to document the test, other than a CMS task completion or only if “[a]pplicable” an After-Action Review. Procedure SIP 9.02-ADM-080 is titled Backup Control Center Checklist, but there is no checklist form to verify the steps were completed as identified in the procedure. Procedures SIP 9.02-ADM-023 and SIP 9.02-ADM-080 appear to be related in purpose with slight differences and the operator could consider merging them for greater effectiveness of the process.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 5Missing from the backup test procedure is how functionality of processes are verified. There is no checklist to verify commands sent and respond appropriately, alarm verifications, business systems work, trends are functional, leak detection is working. While they do perform SCADA server tests, it is prudent to understand that just because something works one time, it will not work every time. Compliance documentation needs to include not just the date of the test, but what was tested and verified as functional Also missing from the backup test procedure is how functionality of processes are verified and then documented. There is no checklist to verify commands sent and respond appropriately, alarm verifications, business systems work, trends are functional, and leak detection is working. While these were loosely noted in the 2019 and 2020 in the After-Action Review, one was not completed for the 2021 test because it was not “deemed necessary.” While they do perform SCADA server tests, it is prudent to understand there is more to the backup system test than just server function. Compliance documentation should include not just the date of the test, but what was tested and verified as functional for each console participating in the test. Also important to include in the documentation is which server was in operation during the test, as well as the names of the individuals participating in the test and the start and stop time. The procedure needs to be amended to require documentation that includes verification of all the items listed in procedures SIP 9.02-ADM-023 and SIP 9.02-ADM-080. This should be a form that provides, at a minimum, what was tested and verified as functional for each console participating in the test, the date of the test, the server that was in operation during the test, as well as the names of the individuals participating in the test and the start and stop time. When sending commands, the documentation should include the point for the command/set point and verification through the event log the action was initiated and completed. Also, verification that alarms are presenting and logging to the event log. Any deficiencies identified need to be documented and an action plan for correction. This can be the After-Action Review. 5. § 195.446 Control room management. (a) …. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller’s ability to carry out the roles and responsibilities the operator has define; Magellan’s procedure 9.02-ADM-027 Rev 11 11/01021 Section 1 was not adequate to identify the risks associated with controller fatigue that could inhibit a controller’s ability to carry out their roles and responsibilities. Procedure 902-ADM-027 identified only a few risks that could contribute to controller fatigue. These included non-routine schedules, sedentary nature of work, off duty activities, and commute times. While these are all relevant risk factors, to which fatigue mitigation strategies can be applies, there are more risk considerations. What was not mentioned was environmental factors such as lighting, heating/cooling, ergonomic factors such as chairs and screen glare. There are also diet and health considerations. For example some medications can cause fatigue as well as certain food selections.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 6The procedure needs to be amended to identify all the risk factors (generic and identified control room specific) facing a controller. These identified risks can be utilized to develop risk mitigation strategy. 6. § 195.446 Control room management. (a)…. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller’s ability to carry out the roles and responsibilities the operator has define; (1)…. (2) Educate controllers and supervisor in fatigue mitigation strategies and how off- duty activities contribute to fatigue; Magellan's procedures 9.01-ADM-027 section 6.6 and 9.01-ADM-083 section 3.5.4.7 were not adequate to address fatigue mitigation strategies. The procedure did provide for some fatigue mitigation strategies, but the list of strategies was not complete and so limits what is available to guide training. In reviewing the training content, the LMS course for Fatigue Training did provide peer tips to mitigate fatigue. Most of the tips related to suggestions for off-work recommendations. While these are important, it did not include on -the-job mitigation strategies, such as sit-stand desks, special lighting, exercise equipment, kitchen facilities, etc. The procedures need to be modified to reflect mitigation strategies to address the identified risks associated with controller fatigue. 7. § 195.446 Control room management. (a)…. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller’s ability to carry out the roles and responsibilities the operator has define; (1)…. (4) Establish a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. Magellan's procedure 9.02-ADM-027 Rev 11 11/01/21 was not adequate because it lacked details relevant to filling a controller's position to ensure maximum limits on controller hours-of- service were not violated or to provide for an emergency deviation. The procedure did not describe a step-by-step practice, for how the actual hours worked for a controller could be determined so that fatigue could be a consideration for filling the position when unplanned absence occurs. The operator indicated they use timesheets, which are available after the actual hours were worked. Schedule Pro (now Schedule Board) was used to set the shift schedule and was not updated with actual hours worked. The time sheets recorded controllers time, and these were documented in Ulti Pro. The operator described a process that meshed the#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 7two tools when considering filling a controller absence. The two applications presented a different type of view to the user. This practice was not documented in the procedure. The procedure needs to be amended to define the process to be used when filling a controller absence to maintain hours of service (HOS) or provide for an emergency deviation from the maximum limit for the safe operation of the pipeline. The procedure must include steps that provide the most current controller hours of service to determine who is best to fill an absence. 8. § 195.446 Control room management. (a)…. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarm. An operator’s plan must include provisions to: (1)…. (2) Identify at least once each calendar month points affecting safety that have been taken off scan, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of time exceeding that required for associated maintenance or operating activities. Magellan procedure SIP 9.02-ADM-029 Revision 11 07/14/2021 and SIP 9.02-ADM-030 were not adequate because it did not capture all the effort made to review, monthly, points affecting safety that had forced/manual values and false alarms (the current practice). Procedure SIP 9.02- ADM-030 Revision 22 10/27/2021 was referenced in SIP 9.02-ADM-029 and was also not adequate because it did not adequately define false alarms. Section 5.6 of procedure SIP 9.02-ADM-030 related false alarms to Nuisance Alarms which then described chattering alarms in section 5.7. This section defined chattering as "[Alarms which occur repeatedly over a short period of time (i.e., 3 times per minute)." It did not specifically address false alarms which can be something different than chattering alarms. False alarms are not defined in section 11. Appendix: CMS Task Matrix utilizes "[S]ystem KPI reports ) flood state, chattering/false alarms," monthly. There is a separate requirement to review off-scan, forced or manual values, inhibited points, also monthly. Section 5.3.3 of the procedure defines the KPI for chattering alarms as zero. Procedure SIP 9.02-ADM-008 section 2.2.1 directed controllers to follow the Alarm Response procedure for each alarm, alert, or notice using the Alarm response icon on the SCADA alarm summary page. This would include any false alarms. Procedure SIP 9.02-ADM-021 section 2.1.9 required documenting false alarms in Logmate Notes and further stated that the Test Mode does not require a Logmate note (this is used for testing field devices that can cause false alarms). This section suggested that false alarms are something different than chattering. Procedure SIP 9.02-ADM-081 also identified and evaluated, monthly, points that had been overridden (forced/manual) in the CPM system, as well as false leak alarms. Good work was#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 8being done by the operator to support the extended compliance activity related to 195.446(e)(2). This procedure is not referenced in SIP 9.02-ADM-030. A review of the Logmate false alarm report for various months and comparison of the CPM false alarm report identified numerous CPM false alarms that were not included in the Logmate false alarm report. While procedures required false alarms to be documented in Logmate, it is unclear how CPM documented false alarms. With false alarms being defined as chattering/nuisance alarms, these false alarms from CPM were not being documented. The procedure needs to be amended to broaden the definition of false alarms, define how CPM false alarms are documented in CPM systems and reference SIP 9.02-ADM-081 in SIP 9.02- ADM-030. 9. § 195.446 Control room management. (a)…. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarm. An operator’s plan must include provisions to: (1)…. (4) Review the alarm management plan required by this paragraph at least once each calendar year, but at intervals not exceeding 15 months, to determine the effectiveness of the plan. Magellan's procedure SIP 9.02-ADM-030 Alarm Management Plan Revision 22 10/27/21 for review of the alarm management plan at least once each calendar year, but at intervals not exceeding 15 months, to determine the effectiveness of the plan, was not adequate to demonstrate compliance. The CRM Plan, SIP-9.02-ADM-029 Revision 11 07/14/21 section 3.5.4 references SIP 9.02-ADM-030 for review of the alarm management plan required by §195.446(e)(4). Section 10 of SIP 9.02-ADM-030 offered an alarm system maintenance and improvement process that provided a 5-component process to allow for continuous improvement of the alarm management process. On page 30 of SIP 9.02-ADM-030 the Task Matrix table provided two tasks: (1) Review Alarm Management Plan Annually assigned to the Operations Control Analyst and Generate and (2) facilitate review of Alarm System KPI Reports – Monthly- assigned to the Operations Control Analyst. While the procedure provided requirements for the annual review task, the procedure did not provide a process flow what would be considered in the review, when the review would be completed, how effectiveness would be considered, and how the review would be documented. The procedure needs to be amended to include a process for how the review will be completed and documented as well as criteria for determining effectiveness.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 910. § 195.446 Control room management. (a)…. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarm. An operator’s plan must include provisions to: (1)…. (5) Monitor the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms; Magellan's procedure SIP 9.02-ADM-032 is not adequate to demonstrate compliance to monitor the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms. Table A of the procedure identified several executables and activities conducted by a controller during a shift. This information was collected and charted. The procedure was missing the criteria that would be used to determine if the controller had sufficient time to analyze and react to incoming alarms. The procedure also did not provide how the annual review will be documented to support compliance as required by § 195.446(j)(1). Section 3.1.4, of the procedure acknowledged that the rule did not establish a uniform benchmark for controller workload, which was correct. The expectation was the operator would develop those benchmark/criteria for their operations. While Table A provided measurements, it did not afford metrics to be collected in a count value and it did not afford a metric on what would be an acceptable count level. It also did not convert the counts to time or index, which would be another option for an acceptable standard. In a review of the records and description of their process, Magellan started with counts for the whole control room, for the items identified in Table A, and then worked down to console activity. Then they performed a year-on-year comparison. They used a time factor to turn the count into time then back into monitoring. They used a green line to represent the 5-year average for all alarms presented to the controller day vs. night for same report. They used a similar benchmark for phone call numbers by console and duration. None of this was described in the procedure. Training is considered as 20% of the total time allocated to the controllers’ activity, however this is not covered in Table A of the procedure. Also, the procedure did not substantiate how this value was determined. There was no study to reference, it was an estimate. The procedure needs to be amended to provide criteria or benchmarks to determine controllers have sufficient time to analyze and react to incoming alarms. The procedure needs to describe the practice that is being employed for the review. Also include in the amended procedure directions on how the review will be documented to support compliance.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 1011. § 195.446 Control room management. (a)…. (g) Operating experience. Each operator must assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management (1) Review incidents that must be reported pursuant to 49 CFR part 191 to determine if control room actions contributed to the event and, if so, correct m where necessary, deficiencies related to: (i) Controller fatigue; Magellan's procedures were not adequate to provide a process to review controller fatigue as a potential contribution to reportable incidents and accidents. There are various procedures that related to this requirement in 195.446(g)(1)(i). Procedure 9.02-ADM-011 Rev 52 11/29/2021 in Sections 5.11 - 5.12 provided a requirement to determine if the controller's performance caused or contributed to the event using phone calls, SCADA, CPM, etc., to be documented on the Supervisor's check list form. There was no mention of a review of possible fatigue, but it does, in Section 5.12, direct a D&A test, if it was determined controllers’ performance contributed to the incident. There is no relationship built between the controller's performance and possible fatigue. How and if fatigue is ever evaluated could not be determined from the procedure. Procedure 9.02-ADM-033 Rev 23 05/12/2020 Investigation Event Procedure did not mention a requirement for investigating events and if control room actions related to fatigue. For that matter, it was silent on the requirement to review any of the items in 195.446(g)(1)(i-vi). The procedures were also interrelated, but did not reference one another. Procedure 9.02-ADM-027 Fatigue Risk Management Procedure section 5.10 stated, “[C]onsider potential contribution of controller fatigue to incidents and accidents during investigations, and after-action reviews (AAR). Moving back to 9.02-ADM-011 section 5.17 states, [P]ost event, prepare and coordinate After Action Review.” Within the AAR, Activity 44 of the Contributing Factors Review, required a Yes/No response to Controller fatigue. There was an associated note: “[R]eview Fatigue Investigation White Paper if suspected contributor/cause.” Procedure SIP-ADM-13.02 Incident Investigations, 13-FORM-1302, required the Operations Controls group to determine if Operations Controls actions caused or contributed to an event. Once again the form required a Yes/No response for Controller fatigue. What was missing from these processes was how they objectively and consistently determine or raise suspicion that fatigue could have contributed or caused a reportable event. This determination should not be left to an individual controller self-report or an opinion of peer or supervisor. The procedure needs to be amended to include, for reportable items, a process to review the items identified in §195.446(g)(1)(i). Also, the procedure needs to include a clear and consistent process on how the operator will evaluate the controller’s fatigue level and apply that to determining if fatigue was a contributing factor to reportable events as well as the Code Red investigations, since they are reviewing fatigue quarterly.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 1112. § 195.446 Control room management. (a)…. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year but at intervals not to exceed 15 months. An operator’s program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: Magellan's procedure SIP 9.01-ADM-083 Revision 11 11/01/2021 which addressed the review of the controller training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months, was not adequate to describe their process and support compliance. Magellan does not have a specific procedure to describe how the review was to be performed. They used 09-FORM-0122 to complete their review. The form was not static and changed each year to accommodate different action plans. The operator described several activities they use to gather information through supervisor meetings, the OP CAT Advisory Team, and controller feedback, all of which was not mentioned in the procedure. They did not have any of the working documents such as surveys, meeting minutes, suggestion email, etc., to provide as a basis for the review outcomes. Documentation, to demonstrate compliance, needs to include all surveys, studies, reviews, etc., that support the outcome/findings (identified potential improvements) of the training content review. This should also include documentation of appropriate changes to the training content and program. The procedure must be amended to include the activities utilized for the review as well as maintaining all working documents that support the results and action steps. These changes should be reflected in a change log for follow up or similar documentation. 13. § 195.446 Control room management. (a) …. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator’s program must provide for training each controller to carry out the roles and responsibilities define by the operator. In addition, the training program must include the following elements: (1) …. (5) For pipeline set ups that are periodically, but infrequently used, providing an opportunity for controllers to review relevant procedures in advance of their application. Magellan’s procedure SIP 9.02-ADM-029 Revision 11, 07/14/2021 was not adequate to demonstrate compliance because, in section 3.8.5, it largely restated the code with the additional reference of two procedures SIP 9.02-ADM-17 and SIP-ADM-9.02.#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 12Magellan described a practice for identifying pipeline operating set-ups that were periodically (but infrequently) used and providing the controllers an opportunity to review relevant procedures in advance of their use. Magellan's practice was built into the batch tracking schedule system that identified a meter that has not turned for more than 90 days and weighed that against scheduled movement 3 days to 3 weeks out – there was nothing for same day. An email results, and during shift change this is the information controllers need to monitor and, if needed, operating procedures may need to be reviewed. There was no other list of identified procedures to cover activities such as pigging, purging, bi-directional lines, etc., which may not be identified from the batch tracking schedule system. The procedure needs to be amended to describe the practice in place to support and demonstrate compliance with this section. Additionally, the procedure needs to include other infrequent operations that may not be identified through the batch track schedule system. 14. § 195.446 Control room management. (a)…. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year but at intervals not to exceed 15 months. An operator’s program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1)…. (6) Control room team training and exercises that include both controllers and other individuals, defined by the operator, who would reasonably be expected to operationally collaborate with controllers (control room personnel) during normal, abnormal or emergency situations. Operators must comply with the team training requirements under this paragraph no later than January 23, 2018. Magellan’s procedures SIP 9.02-ADM-029 Revision 11 07/14/2021 CRM Plan was not adequate because it did not include the requirement for Team Training as required by §195.446(h)(6). Procedure SIP 9.02-ADM-083 Revision 11 11/01/2021 section 3.5.6 was also not adequate because it did not require the three operational modes of normal, abnormal, and emergency situations. It also failed to include any type of soft skill training that would support various behavioral and communication issues that can arise in any of the three modes. Magellan employed primarily Computer Based Training (CBT) for Team Training. While it can be a reasonable option for some level of Team Training, it cannot be the sole source. The regulation requires "Control Room Team Training and exercises that include both controllers and other individuals define by the operator.” The FAQ provided further guidance that “at least one controller be present in Team Training sessions." A CBT is not adequate to demonstrate compliance because a CBT is individual training. The procedure also included a variety of emergency type response drills that controllers may be included in as participants. SIP 9.02- ADM-083 section 3.4.7 required the controllers complete a minimum of 1 drill/test or Code Red test each year. However, these drills, typically focus on an emergency and not an emerging#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 13event, which is the expectation for Team Training exercises and training. There should be an attempt to rotate all controllers and "others" through the Team Training sessions and continue to supplement with CBTs as appropriate. Magellan’s procedure SIP 2.01-ADM 001 Training Matrix (Magellan Wide) under Element 2 identified job roles required to complete team training every 24 months. Those job titles or groups included field, ops mangers, ops supervisors, scheduling, and controllers. The concern with the procedures is that while it described who must attend and what topics may be covered and how often training is to occur for controllers and others, it falls short of defining who is responsible for developing and conducting team training and how to engage the "others" with controllers. The responsibility to “[e]nsure completion of control room team training,” was assigned to the Supervisor of Operations Control Applications in section 3.5. All this means is the Supervisor needs to make sure the controller has completed the required training. It appears the operator was taking advantage of various drills, tabletops and public outreach drills OPA/FRP, CBTs and crediting those as team training. While elements of these drills and events have similarities of what can be covered in team training, they are not a substitute for a well thought out and engaging team training session. The procedure needs to be amended to include language required in §195.446(h)(6). It also needs to identify who is responsible to plan and implement team training sessions and exercises and require team training and exercises to include the operational modes of normal, abnormal and emergency situations. The procedure needs that include soft skills, with “others” and controllers together. Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. § 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. § 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under §190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within#

32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf, page 1430 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested that Magellan Pipeline Company, LP maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Gregory Ochs, Director, Central Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 3-2023-025-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Gregory Ochs Director, Central Region, OPS Pipeline and Hazardous Materials Safety Administration cc: Mark Materna, Director Pipeline Integrity mark.materna@magellanlp.com Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings#