{"operation":"document","citation":"CPF 32023025NOA","title":"MAGELLAN PIPELINE COMPANY, LP — Notice of Amendment","source_type":"enforcement","agency":"Pipeline and Hazardous Materials Safety Administration","status":"historical","official":true,"published_on":"2023-09-08","effective_on":null,"summary":"CLOSED notice of amendment citing 195.444(c), 195.446(a), 195.446(c)(4), 195.446(d), 195.446(d)(2), 195.446(d)(4), 195.446(e)(2), 195.446(e)(4), 195.446(e)(5), 195.446(g)(1)(i), 195.446(h), 195.446(h)(5), 195.446(h)(6).","machine_formats":{"json":"https://regulus.evalyn.ai/document/phmsa-enforcement-32023025noa.json","markdown":"https://regulus.evalyn.ai/document/phmsa-enforcement-32023025noa.md"},"app_url":"https://regulus.evalyn.ai/document/phmsa-enforcement-32023025noa","source_url":"https://primis.phmsa.dot.gov/enforcement-data/case/32023025NOA","body":"Notice of Amendment involving MAGELLAN PIPELINE COMPANY, LP. PHMSA's enforcement data identifies the cited regulations as 195.444(c),  195.446(a),  195.446(c)(4),  195.446(d),  195.446(d)(2),  195.446(d)(4),  195.446(e)(2),  195.446(e)(4),  195.446(e)(5),  195.446(g)(1)(i),  195.446(h),  195.446(h)(5),  195.446(h)(6). The case was opened on 2023-09-08 and is reported as closed as of 2025-05-30. Open the official case record for notices, responses, orders, and the latest status.\n\nOfficial case documents:\n\n32023025NOA_Closure Letter_05302025_(22-240208).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32023025NOA/32023025NOA_Closure%20Letter_05302025_(22-240208).pdf\n\n32023025NOA_Closure Letter_05302025_(22-240208)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32023025NOA/32023025NOA_Closure%20Letter_05302025_(22-240208)_text.pdf\n\n32023025NOA_Notice of Amendment_09082023_(22-240208).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32023025NOA/32023025NOA_Notice%20of%20Amendment_09082023_(22-240208).pdf\n\n32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32023025NOA/32023025NOA_Notice%20of%20Amendment_09082023_(22-240208)_text.pdf\n\n32023025NOA_Operator Response to Notice_12082023_(22-240208).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32023025NOA/32023025NOA_Operator%20Response%20to%20Notice_12082023_(22-240208).pdf\n\n32023025NOA_Closure Letter_05302025_(22-240208)_text.pdf\n\nVIA ELECTRONIC MAIL TO: randy.lentz@oneok.com; jamie.hoskin@oneok.com;\ncharles.misak@oneok.com\nMay 30, 2025\nMr. Randy Lentz\nEVP, Chief Operating Officer\nMagellan Pipeline, LLC\n909 Lake Carolyn Parkway, Suite 1600\nIrving, Texas 75039\nRE: CPF 3-2023-025-NOA\nDear Mr. Lentz\nFrom June 27 through August 25, 2022, a representative of the Pipeline and Hazardous\nMaterials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code\n(U.S.C.), conducted an inspection of Magellan Pipeline Company, LP’s (Magellan) procedures\nfor Control Room Management in Tulsa, Oklahoma. On September 8, 2023, pursuant to 49 CFR\n§ 190.206, PHMSA issued a Notice of Amendment which proposed amendment of Magellan’s\nprocedures.\nMagellan submitted its amended procedures on June 17, 2024. PHMSA has reviewed the\namended procedures, and it appears that the inadequacies outlined in the Notice of Amendment\nhave been corrected.\nThis letter is to inform you that no further action is necessary, and this case is now closed.\nThank you for your cooperation.\nSincerely,\nDavid Barrett\nActing Director, Central Region, OPS\nPipeline and Hazardous Materials Safety Administration\ncc: Jamie Hoskin, SVP, Engineering & Operations: Refined Products,\nCharles Misak, Director - Integrated Operations Services Asset Integrity,\n\n32023025NOA_Notice of Amendment_09082023_(22-240208)_text.pdf\n\nNOTICE OF AMENDMENT\nVIA ELECTRONIC MAIL TO: aaron.milford@magellanlp.com,\nmark.materna@magellanlp.com\nSeptember 8, 2023\nMr. Aaron Milford\nPresident/CEO\nMagellan Pipeline, LLC\nOne Williams Center\nPO Box 22186\nTulsa, OK 74172\nCPF 3-2023-025-NOA\nDear Mr. Milford:\nFrom June 27 through August 25, 2022, a representative of the Pipeline and Hazardous\nMaterials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code\n(U.S.C.), inspected Magellan Pipeline Company, LP’s (Magellan) procedures for Control Room\nManagement in Tulsa, Oklahoma, by video conference inspection.\nAs a result of the inspection, PHMSA has identified the apparent inadequacies found within\nMagellan’s plans or procedures. The items inspected and the inadequacies are described below:\n1. § 195.444 Leak detection.\n(a)….\n(c)CPM leak detection systems. Each computational pipeline monitoring (CPM) leak\ndetection system installed on a hazardous liquid pipeline must comply with API RP\n1130 (incorporated by reference, see §195.3) in operating, maintaining, testing,\nrecord keeping and dispatcher training of the system.\n\n\n\nMagellan’s Procedure 9.02-ADM-081 Computational Pipeline Monitoring was not adequate in\nreferencing how they assure accuracy and calibration of field instrumentation used in the leak\ndetection system.\nProcedure 9.02-ADM-081 section 1.0 stated, “[T]he purpose of the procedure is to establish a\nstandardized API 1130 (September 2007) compliant method for operating, maintenance, testing,\ntraining and record keeping for Computational Pipeline Monitoring (CPM) Tools in use by\nMagellan.” The procedure addressed testing, maintenance, training and record keeping. Section\n3.1.9 referenced API 1149 to support initial threshold setting and section 3.1.8 established a\nschedule to support review and maintenance of thresholds. The procedure failed to provide how\nMagellan, through procedure, assured thresholds are maintained through sound instrument\ncalibration procedures.\nAPI 1130 (incorporated by reference, see §195.3) section 5.1.3 states, “[T]o maximize and\nmaintain CPM performance, each pipeline company should prepare a CPM instrumentation list\nand a maintenance and calibration plan with procedures. Additionally, API 1130 section 5.1.1\nstates, ‘[T]he quality of instrument data can affect the CPM system. Instruments should be\nselected considering the required measurement accuracy. Ranges and specifications should be\ncarefully matched to pipeline operating design, pressure, flow, temperature, density, viscosity\nand so on.” During the inspection, Magellan identified two procedures: SIP-ADM-11.01 Change\nManagement and 4.01-ADM-005 Project Commissioning Guideline that related to instrument\nselection and calibration. However, these were not referenced in the procedure. Also, since two\ndifferent leak detection procedures were used, there was nothing that clarified the OEM\nspecifications were the same, or that the accuracy and specifications would be implemented as\nthe same without affecting current sensitivity.\nThe procedure needs to be amended to reference Magellan’s procedures and specifications\nrelated to the selection and calibration of field instrument tied to CPM to support accuracy of the\ninstrumentation and specifications. If existing procedures are not adequate, they also need to be\namended or new procedures developed.\n2. § 195.444 Leak detection.\n(a)….\n(c) CPM leak detection systems. Each computational pipeline monitoring (CPM)\nleak detection system installed on a hazardous liquid pipeline must comply with API\nRP 1130 (incorporated by reference, see §195.3) in operating, maintaining, testing,\nrecord keeping and dispatcher training of the system.\nMagellan’s Procedure 9.02-ADM-081 was inadequate because it did not include all the criteria\nor situations where initial tests of the CPM system were required.\nSection 3.1.12 Ensure Initial Testing requires “[E]ach new CPM instance will be tested to verify\nthat it achieves the expected design or expected performance level.” It is unclear what is meant\nby “instance.” A single reference to “instance” in API 1130 in section 6.1.2 Alarm Response\nConsiderations mentions “past instances of alarm causes,” which clearly is not what the\nMagellan procedure is referencing. The procedure infers initial testing of a new CPM system.\nHowever, the requirement is to test the performance of a CPM application for pipeline systems\n\n\n\nthat are put under CPM. This could include an existing pipeline where a new CPM System is\napplied, or an existing CPM system where a new pipeline system is added. The procedure infers\nit is one of these. The procedure does not consider how it will handle acquisition of the pipeline.\nFor example, how will the operator perform initial testing for an acquired pipeline system that\nincludes the CPM and possibly SCADA system? Another consideration is initial testing for an\nacquisition of a pipeline system without CPM. How will the operator consider bringing this\nsystem into the operator’s CPM and testing?\nThe procedure needs to be amended to address the various conditions when initial testing will be\nperformed.\n3. § 195.446 Control room management.\n(a) General. This section applies to each operator of a pipeline facility with a\ncontroller working in a control room who monitors and controls all or part of a\npipeline facility through a SCADA system. Each operator must have and follow\nwritten control room management procedures that implement the requirements of\nthis section. The procedures required by this section must be integrated, as\nappropriate, with the operator's written procedures required by §195.402. An\noperator must develop the procedures no later than August 1, 2011 and must\nimplement the procedures according to the following schedule. The procedures\nrequired by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f), and (g) of this section must\nbe implemented no later than October 1, 2011. The procedures required by\nparagraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later\nthan August 1, 2012. The training procedures required by paragraph (h) must be\nimplemented no later than August 1, 2012, except that any training required by\nanother paragraph of this section must be implemented no later than the deadline\nfor that paragraph.\nMagellan’s Control Room Management (CRM) procedures were not adequate for determining\nwhich facilities were control rooms for the purpose of implementing appropriate sections of\n§195.446. Procedure SIP-ADM-9.02 Section 3.6.2 states, “Annually, not to exceed 15 months,\nreview list of DOT jurisdictional IMP pipelines to ensure applicability of CRM.” A note box, in\nthis same section, states, “NOTE: CRM applies to Department of Transportation (DOT)\nregulated pipelines subject to integrity testing per §195.452 and is applicable to the control\nroom(s) and Controller(s) that monitor and control those assets. At Magellan, all appliable assets\nare monitored and controlled at the Tulsa Operations Center by Tulsa based Controller.”\nMagellan’s position was that they identified and designated a single control room (Tulsa\nOperations Control Center) and then verified if a pipeline was jurisdictional (subject to integrity\ntesting per §195.452) and ensure that pipeline segment(s) was monitored and controlled by the\n“jurisdictional” control room.\nProcedure 9.01-ADM-153 Communicate with Operations Control, identified information, events\nand tasks that require communication with Operations Control. It was unclear if the items listed\nwere facilities subject to integrity testing per §195.452. This requirement was integral in\ndetermining what was monitored and controlled from the designated Tulsa Operations Center.\n\n\n\nSince Tulsa Operations Control was not specifically designated, one might surmise there might\nbe another operations control.\nThe procedure was missing a review of other assets, in the Magellan pipeline system, that use a\nSCADA system that can monitor and/or control all or part of a pipeline facility. It was unclear\nwhether individuals are monitoring and controlling these assets within or outside of a facility\nfence line. For example, the East Tulsa Terminal has a SCADA system and individuals who can\nmonitor and control assets. Magellan decided this was not a control room and all operations\nmust come from the Tulsa Operations Control Center. As another example, there were pump\nstations that have SCADA systems controlling assets inside the fence, but Magellan was unsure\nif assets outside the fence could be controlled from an HMI screen connected to a PLC or other\nsuch device.\nA control room is determined by select activities. The functions, at a facility, must be reviewed\nto evaluate the SCADA capabilities and human functions/tasks performed using that SCADA\nsystem. This process of facility reviews and with evaluation criteria was missing from the\nprocedure.\nThe procedure must be amended to provide more definition, criteria, and processes to review all\nfacilities with SCADA, such as PLC, RTU’s and HMI, where an individual can remotely\nmonitor, control, and respond to pipeline conditions, to determine if they are control rooms.\n4. § 195.446 Control room management.\n(a)….\n(c) Each operator must provide its controllers with the information, tools, processes\nand procedures necessary for the controllers to carry out the roles and\nresponsibility the operator has defined by performing each of the following:\n(1)….\n(4) Test any backup SCADA systems at least once each calendar year, but at\nintervals not to exceed 15 months;\nMagellan’s procedures SIP 9.02-ADM-023 and SIP 9.02-ADM-080 were not adequate to\nthoroughly document the physical test of the backup control systems to demonstrate compliance.\nThere are three procedures related to SCADA testing: SIP 9.02-ADM-023, SIP 9.02-ADM-\n025, SIP 9.02-ADM-079, SIP 9.02-ADM-080. SIP 9.02-ADM-079 addresses robust testing of\nthe SCADA servers annually. SIP 9.02-ADM-025 addresses SCADA test communications. SIP\n9.02-ADM-023 and SIP 9.02-ADM-080 relate to testing the physical back up control\nroom. Missing from SIP 9.02-ADM-023 and SIP 9.02-ADM-080 is a process to document the\ntest, other than a CMS task completion or only if “[a]pplicable” an After-Action\nReview. Procedure SIP 9.02-ADM-080 is titled Backup Control Center Checklist, but there is\nno checklist form to verify the steps were completed as identified in the procedure. Procedures\nSIP 9.02-ADM-023 and SIP 9.02-ADM-080 appear to be related in purpose with slight\ndifferences and the operator could consider merging them for greater effectiveness of the\nprocess.\n\n\n\nMissing from the backup test procedure is how functionality of processes are verified. There is\nno checklist to verify commands sent and respond appropriately, alarm verifications, business\nsystems work, trends are functional, leak detection is working. While they do perform SCADA\nserver tests, it is prudent to understand that just because something works one time, it will not\nwork every time. Compliance documentation needs to include not just the date of the test, but\nwhat was tested and verified as functional\nAlso missing from the backup test procedure is how functionality of processes are verified and\nthen documented. There is no checklist to verify commands sent and respond appropriately,\nalarm verifications, business systems work, trends are functional, and leak detection is working.\nWhile these were loosely noted in the 2019 and 2020 in the After-Action Review, one was not\ncompleted for the 2021 test because it was not “deemed necessary.” While they do perform\nSCADA server tests, it is prudent to understand there is more to the backup system test than just\nserver function. Compliance documentation should include not just the date of the test, but what\nwas tested and verified as functional for each console participating in the test. Also important to\ninclude in the documentation is which server was in operation during the test, as well as the\nnames of the individuals participating in the test and the start and stop time.\nThe procedure needs to be amended to require documentation that includes verification of all the\nitems listed in procedures SIP 9.02-ADM-023 and SIP 9.02-ADM-080. This should be a form\nthat provides, at a minimum, what was tested and verified as functional for each console\nparticipating in the test, the date of the test, the server that was in operation during the test, as\nwell as the names of the individuals participating in the test and the start and stop time. When\nsending commands, the documentation should include the point for the command/set point and\nverification through the event log the action was initiated and completed. Also, verification that\nalarms are presenting and logging to the event log. Any deficiencies identified need to be\ndocumented and an action plan for correction. This can be the After-Action Review.\n5. § 195.446 Control room management.\n(a) ….\n(d) Fatigue mitigation. Each operator must implement the following methods to\nreduce the risk associated with controller fatigue that could inhibit a controller’s\nability to carry out the roles and responsibilities the operator has define;\nMagellan’s procedure 9.02-ADM-027 Rev 11 11/01021 Section 1 was not adequate to identify\nthe risks associated with controller fatigue that could inhibit a controller’s ability to carry out\ntheir roles and responsibilities.\nProcedure 902-ADM-027 identified only a few risks that could contribute to controller fatigue.\nThese included non-routine schedules, sedentary nature of work, off duty activities, and\ncommute times. While these are all relevant risk factors, to which fatigue mitigation strategies\ncan be applies, there are more risk considerations. What was not mentioned was environmental\nfactors such as lighting, heating/cooling, ergonomic factors such as chairs and screen glare.\nThere are also diet and health considerations. For example some medications can cause fatigue\nas well as certain food selections.\n\n\n\nThe procedure needs to be amended to identify all the risk factors (generic and identified control\nroom specific) facing a controller. These identified risks can be utilized to develop risk\nmitigation strategy.\n6. § 195.446 Control room management.\n(a)….\n(d) Fatigue mitigation. Each operator must implement the following methods to\nreduce the risk associated with controller fatigue that could inhibit a controller’s\nability to carry out the roles and responsibilities the operator has define;\n(1)….\n(2) Educate controllers and supervisor in fatigue mitigation strategies and how off-\nduty activities contribute to fatigue;\nMagellan's procedures 9.01-ADM-027 section 6.6 and 9.01-ADM-083 section 3.5.4.7 were not\nadequate to address fatigue mitigation strategies. The procedure did provide for some fatigue\nmitigation strategies, but the list of strategies was not complete and so limits what is available to\nguide training. In reviewing the training content, the LMS course for Fatigue Training did\nprovide peer tips to mitigate fatigue. Most of the tips related to suggestions for off-work\nrecommendations. While these are important, it did not include on -the-job mitigation strategies,\nsuch as sit-stand desks, special lighting, exercise equipment, kitchen facilities, etc.\nThe procedures need to be modified to reflect mitigation strategies to address the identified risks\nassociated with controller fatigue.\n7. § 195.446 Control room management.\n(a)….\n(d) Fatigue mitigation. Each operator must implement the following methods to\nreduce the risk associated with controller fatigue that could inhibit a controller’s\nability to carry out the roles and responsibilities the operator has define;\n(1)….\n(4) Establish a maximum limit on controller hours-of-service, which may provide\nfor an emergency deviation from the maximum limit if necessary for the safe\noperation of a pipeline facility.\nMagellan's procedure 9.02-ADM-027 Rev 11 11/01/21 was not adequate because it lacked\ndetails relevant to filling a controller's position to ensure maximum limits on controller hours-of-\nservice were not violated or to provide for an emergency deviation.\nThe procedure did not describe a step-by-step practice, for how the actual hours worked for a\ncontroller could be determined so that fatigue could be a consideration for filling the position\nwhen unplanned absence occurs. The operator indicated they use timesheets, which are available\nafter the actual hours were worked. Schedule Pro (now Schedule Board) was used to set the shift\nschedule and was not updated with actual hours worked. The time sheets recorded controllers\ntime, and these were documented in Ulti Pro. The operator described a process that meshed the\n\n\n\ntwo tools when considering filling a controller absence. The two applications presented a\ndifferent type of view to the user. This practice was not documented in the procedure.\nThe procedure needs to be amended to define the process to be used when filling a controller\nabsence to maintain hours of service (HOS) or provide for an emergency deviation from the\nmaximum limit for the safe operation of the pipeline. The procedure must include steps that\nprovide the most current controller hours of service to determine who is best to fill an absence.\n8. § 195.446 Control room management.\n(a)….\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarm. An\noperator’s plan must include provisions to:\n(1)….\n(2) Identify at least once each calendar month points affecting safety that have been\ntaken off scan, have had alarms inhibited, generated false alarms, or that have had\nforced or manual values for periods of time exceeding that required for associated\nmaintenance or operating activities.\nMagellan procedure SIP 9.02-ADM-029 Revision 11 07/14/2021 and SIP 9.02-ADM-030 were\nnot adequate because it did not capture all the effort made to review, monthly, points affecting\nsafety that had forced/manual values and false alarms (the current practice). Procedure SIP 9.02-\nADM-030 Revision 22 10/27/2021 was referenced in SIP 9.02-ADM-029 and was also not\nadequate because it did not adequately define false alarms.\nSection 5.6 of procedure SIP 9.02-ADM-030 related false alarms to Nuisance Alarms which then\ndescribed chattering alarms in section 5.7. This section defined chattering as \"[Alarms which\noccur repeatedly over a short period of time (i.e., 3 times per minute).\" It did not specifically\naddress false alarms which can be something different than chattering alarms. False alarms are\nnot defined in section 11. Appendix: CMS Task Matrix utilizes \"[S]ystem KPI reports ) flood\nstate, chattering/false alarms,\" monthly. There is a separate requirement to review off-scan,\nforced or manual values, inhibited points, also monthly. Section 5.3.3 of the procedure defines\nthe KPI for chattering alarms as zero.\nProcedure SIP 9.02-ADM-008 section 2.2.1 directed controllers to follow the Alarm Response\nprocedure for each alarm, alert, or notice using the Alarm response icon on the SCADA alarm\nsummary page. This would include any false alarms.\nProcedure SIP 9.02-ADM-021 section 2.1.9 required documenting false alarms in Logmate\nNotes and further stated that the Test Mode does not require a Logmate note (this is used for\ntesting field devices that can cause false alarms). This section suggested that false alarms are\nsomething different than chattering.\nProcedure SIP 9.02-ADM-081 also identified and evaluated, monthly, points that had been\noverridden (forced/manual) in the CPM system, as well as false leak alarms. Good work was\n\n\n\nbeing done by the operator to support the extended compliance activity related to 195.446(e)(2).\nThis procedure is not referenced in SIP 9.02-ADM-030.\nA review of the Logmate false alarm report for various months and comparison of the CPM false\nalarm report identified numerous CPM false alarms that were not included in the Logmate false\nalarm report. While procedures required false alarms to be documented in Logmate, it is unclear\nhow CPM documented false alarms. With false alarms being defined as chattering/nuisance\nalarms, these false alarms from CPM were not being documented.\nThe procedure needs to be amended to broaden the definition of false alarms, define how CPM\nfalse alarms are documented in CPM systems and reference SIP 9.02-ADM-081 in SIP 9.02-\nADM-030.\n9. § 195.446 Control room management.\n(a)….\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarm. An\noperator’s plan must include provisions to:\n(1)….\n(4) Review the alarm management plan required by this paragraph at least once\neach calendar year, but at intervals not exceeding 15 months, to determine the\neffectiveness of the plan.\nMagellan's procedure SIP 9.02-ADM-030 Alarm Management Plan Revision 22 10/27/21\nfor review of the alarm management plan at least once each calendar year, but at intervals not\nexceeding 15 months, to determine the effectiveness of the plan, was not adequate to\ndemonstrate compliance. The CRM Plan, SIP-9.02-ADM-029 Revision 11 07/14/21 section\n3.5.4 references SIP 9.02-ADM-030 for review of the alarm management plan required by\n§195.446(e)(4).\nSection 10 of SIP 9.02-ADM-030 offered an alarm system maintenance and improvement\nprocess that provided a 5-component process to allow for continuous improvement of the alarm\nmanagement process. On page 30 of SIP 9.02-ADM-030 the Task Matrix table provided two\ntasks: (1) Review Alarm Management Plan Annually assigned to the Operations Control Analyst\nand Generate and (2) facilitate review of Alarm System KPI Reports – Monthly- assigned to the\nOperations Control Analyst. While the procedure provided requirements for the annual review\ntask, the procedure did not provide a process flow what would be considered in the review, when\nthe review would be completed, how effectiveness would be considered, and how the review\nwould be documented.\nThe procedure needs to be amended to include a process for how the review will be completed\nand documented as well as criteria for determining effectiveness.\n\n\n\n10. § 195.446 Control room management.\n(a)….\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarm. An\noperator’s plan must include provisions to:\n(1)….\n(5) Monitor the content and volume of general activity being directed to and\nrequired of each controller at least once each calendar year, but at intervals not\nexceeding 15 months, that will assure controllers have sufficient time to analyze and\nreact to incoming alarms;\nMagellan's procedure SIP 9.02-ADM-032 is not adequate to demonstrate compliance to monitor\nthe content and volume of general activity being directed to and required of each controller at\nleast once each calendar year, but at intervals not exceeding 15 months, that will assure\ncontrollers have sufficient time to analyze and react to incoming alarms.\nTable A of the procedure identified several executables and activities conducted by a controller\nduring a shift. This information was collected and charted. The procedure was missing the\ncriteria that would be used to determine if the controller had sufficient time to analyze and react\nto incoming alarms. The procedure also did not provide how the annual review will be\ndocumented to support compliance as required by § 195.446(j)(1). Section 3.1.4, of the\nprocedure acknowledged that the rule did not establish a uniform benchmark for controller\nworkload, which was correct. The expectation was the operator would develop those\nbenchmark/criteria for their operations. While Table A provided measurements, it did not afford\nmetrics to be collected in a count value and it did not afford a metric on what would be an\nacceptable count level. It also did not convert the counts to time or index, which would be\nanother option for an acceptable standard. In a review of the records and description of their\nprocess, Magellan started with counts for the whole control room, for the items identified in\nTable A, and then worked down to console activity. Then they performed a year-on-year\ncomparison. They used a time factor to turn the count into time then back into monitoring. They\nused a green line to represent the 5-year average for all alarms presented to the controller day vs.\nnight for same report. They used a similar benchmark for phone call numbers by console and\nduration. None of this was described in the procedure.\nTraining is considered as 20% of the total time allocated to the controllers’ activity, however this\nis not covered in Table A of the procedure. Also, the procedure did not substantiate how this\nvalue was determined. There was no study to reference, it was an estimate.\nThe procedure needs to be amended to provide criteria or benchmarks to determine controllers\nhave sufficient time to analyze and react to incoming alarms. The procedure needs to describe\nthe practice that is being employed for the review. Also include in the amended procedure\ndirections on how the review will be documented to support compliance.\n\n\n\n11. § 195.446 Control room management.\n(a)….\n(g) Operating experience. Each operator must assure that lessons learned from its\noperating experience are incorporated, as appropriate, into its control room\nmanagement\n(1) Review incidents that must be reported pursuant to 49 CFR part 191 to\ndetermine if control room actions contributed to the event and, if so, correct m\nwhere necessary, deficiencies related to:\n(i) Controller fatigue;\nMagellan's procedures were not adequate to provide a process to review controller fatigue as\na potential contribution to reportable incidents and accidents. There are various procedures that\nrelated to this requirement in 195.446(g)(1)(i). Procedure 9.02-ADM-011 Rev 52 11/29/2021 in\nSections 5.11 - 5.12 provided a requirement to determine if the controller's performance caused\nor contributed to the event using phone calls, SCADA, CPM, etc., to be documented on the\nSupervisor's check list form. There was no mention of a review of possible fatigue, but it does,\nin Section 5.12, direct a D&A test, if it was determined controllers’ performance contributed to\nthe incident. There is no relationship built between the controller's performance and possible\nfatigue. How and if fatigue is ever evaluated could not be determined from the procedure.\nProcedure 9.02-ADM-033 Rev 23 05/12/2020 Investigation Event Procedure did not mention a\nrequirement for investigating events and if control room actions related to fatigue. For that\nmatter, it was silent on the requirement to review any of the items in 195.446(g)(1)(i-vi). The\nprocedures were also interrelated, but did not reference one another.\nProcedure 9.02-ADM-027 Fatigue Risk Management Procedure section 5.10 stated, “[C]onsider\npotential contribution of controller fatigue to incidents and accidents during investigations, and\nafter-action reviews (AAR). Moving back to 9.02-ADM-011 section 5.17 states, [P]ost event,\nprepare and coordinate After Action Review.” Within the AAR, Activity 44 of the Contributing\nFactors Review, required a Yes/No response to Controller fatigue. There was an associated note:\n“[R]eview Fatigue Investigation White Paper if suspected contributor/cause.”\nProcedure SIP-ADM-13.02 Incident Investigations, 13-FORM-1302, required the Operations\nControls group to determine if Operations Controls actions caused or contributed to an event.\nOnce again the form required a Yes/No response for Controller fatigue.\nWhat was missing from these processes was how they objectively and consistently determine or\nraise suspicion that fatigue could have contributed or caused a reportable event. This\ndetermination should not be left to an individual controller self-report or an opinion of peer or\nsupervisor.\nThe procedure needs to be amended to include, for reportable items, a process to review the\nitems identified in §195.446(g)(1)(i). Also, the procedure needs to include a clear and consistent\nprocess on how the operator will evaluate the controller’s fatigue level and apply that to\ndetermining if fatigue was a contributing factor to reportable events as well as the Code Red\ninvestigations, since they are reviewing fatigue quarterly.\n\n\n\n12. § 195.446 Control room management.\n(a)….\n(h) Training. Each operator must establish a controller training program and\nreview the training program content to identify potential improvements at least\nonce each calendar year but at intervals not to exceed 15 months. An operator’s\nprogram must provide for training each controller to carry out the roles and\nresponsibilities defined by the operator. In addition, the training program must\ninclude the following elements:\nMagellan's procedure SIP 9.01-ADM-083 Revision 11 11/01/2021 which addressed the review\nof the controller training program content to identify potential improvements at least once each\ncalendar year, but at intervals not to exceed 15 months, was not adequate to describe their\nprocess and support compliance. Magellan does not have a specific procedure to describe how\nthe review was to be performed. They used 09-FORM-0122 to complete their review. The form\nwas not static and changed each year to accommodate different action plans. The operator\ndescribed several activities they use to gather information through supervisor meetings, the OP\nCAT Advisory Team, and controller feedback, all of which was not mentioned in the\nprocedure. They did not have any of the working documents such as surveys, meeting minutes,\nsuggestion email, etc., to provide as a basis for the review outcomes. Documentation, to\ndemonstrate compliance, needs to include all surveys, studies, reviews, etc., that support the\noutcome/findings (identified potential improvements) of the training content review. This should\nalso include documentation of appropriate changes to the training content and program.\nThe procedure must be amended to include the activities utilized for the review as well as\nmaintaining all working documents that support the results and action steps. These changes\nshould be reflected in a change log for follow up or similar documentation.\n13. § 195.446 Control room management.\n(a) ….\n(h) Training. Each operator must establish a controller training program and\nreview the training program content to identify potential improvements at least\nonce each calendar year, but at intervals not to exceed 15 months. An operator’s\nprogram must provide for training each controller to carry out the roles and\nresponsibilities define by the operator. In addition, the training program must\ninclude the following elements:\n(1) ….\n(5) For pipeline set ups that are periodically, but infrequently used, providing an\nopportunity for controllers to review relevant procedures in advance of their\napplication.\nMagellan’s procedure SIP 9.02-ADM-029 Revision 11, 07/14/2021 was not adequate to\ndemonstrate compliance because, in section 3.8.5, it largely restated the code with the additional\nreference of two procedures SIP 9.02-ADM-17 and SIP-ADM-9.02.\n\n\n\nMagellan described a practice for identifying pipeline operating set-ups that were periodically\n(but infrequently) used and providing the controllers an opportunity to review relevant\nprocedures in advance of their use. Magellan's practice was built into the batch tracking\nschedule system that identified a meter that has not turned for more than 90 days and weighed\nthat against scheduled movement 3 days to 3 weeks out – there was nothing for same\nday. An email results, and during shift change this is the information controllers need to monitor\nand, if needed, operating procedures may need to be reviewed. There was no other list of\nidentified procedures to cover activities such as pigging, purging, bi-directional lines, etc., which\nmay not be identified from the batch tracking schedule system.\nThe procedure needs to be amended to describe the practice in place to support and demonstrate\ncompliance with this section. Additionally, the procedure needs to include other infrequent\noperations that may not be identified through the batch track schedule system.\n14. § 195.446 Control room management.\n(a)….\n(h) Training. Each operator must establish a controller training program and\nreview the training program content to identify potential improvements at least\nonce each calendar year but at intervals not to exceed 15 months. An operator’s\nprogram must provide for training each controller to carry out the roles and\nresponsibilities defined by the operator. In addition, the training program must\ninclude the following elements:\n(1)….\n(6) Control room team training and exercises that include both controllers and\nother individuals, defined by the operator, who would reasonably be expected to\noperationally collaborate with controllers (control room personnel) during normal,\nabnormal or emergency situations. Operators must comply with the team training\nrequirements under this paragraph no later than January 23, 2018.\nMagellan’s procedures SIP 9.02-ADM-029 Revision 11 07/14/2021 CRM Plan was not adequate\nbecause it did not include the requirement for Team Training as required by §195.446(h)(6).\nProcedure SIP 9.02-ADM-083 Revision 11 11/01/2021 section 3.5.6 was also not adequate\nbecause it did not require the three operational modes of normal, abnormal, and emergency\nsituations. It also failed to include any type of soft skill training that would support various\nbehavioral and communication issues that can arise in any of the three modes.\nMagellan employed primarily Computer Based Training (CBT) for Team Training. While it can\nbe a reasonable option for some level of Team Training, it cannot be the sole source. The\nregulation requires \"Control Room Team Training and exercises that include both controllers and\nother individuals define by the operator.” The FAQ provided further guidance that “at least one\ncontroller be present in Team Training sessions.\" A CBT is not adequate to demonstrate\ncompliance because a CBT is individual training. The procedure also included a variety of\nemergency type response drills that controllers may be included in as participants. SIP 9.02-\nADM-083 section 3.4.7 required the controllers complete a minimum of 1 drill/test or Code Red\ntest each year. However, these drills, typically focus on an emergency and not an emerging\n\n\n\nevent, which is the expectation for Team Training exercises and training. There should be an\nattempt to rotate all controllers and \"others\" through the Team Training sessions and continue to\nsupplement with CBTs as appropriate.\nMagellan’s procedure SIP 2.01-ADM 001 Training Matrix (Magellan Wide) under Element 2\nidentified job roles required to complete team training every 24 months. Those job titles or\ngroups included field, ops mangers, ops supervisors, scheduling, and controllers. The concern\nwith the procedures is that while it described who must attend and what topics may be covered\nand how often training is to occur for controllers and others, it falls short of defining who is\nresponsible for developing and conducting team training and how to engage the \"others\" with\ncontrollers. The responsibility to “[e]nsure completion of control room team training,” was\nassigned to the Supervisor of Operations Control Applications in section 3.5. All this means is\nthe Supervisor needs to make sure the controller has completed the required training. It appears\nthe operator was taking advantage of various drills, tabletops and public outreach drills\nOPA/FRP, CBTs and crediting those as team training. While elements of these drills and events\nhave similarities of what can be covered in team training, they are not a substitute for a well\nthought out and engaging team training session.\nThe procedure needs to be amended to include language required in §195.446(h)(6). It also\nneeds to identify who is responsible to plan and implement team training sessions and exercises\nand require team training and exercises to include the operational modes of normal, abnormal\nand emergency situations. The procedure needs that include soft skills, with “others” and\ncontrollers together.\nResponse to this Notice\nThis Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as\npart of this Notice is a document entitled Response Options for Pipeline Operators in\nCompliance Proceedings.\nPlease refer to this document and note the response options. Be advised that all material you\nsubmit in response to this enforcement action is subject to being made publicly available. If you\nbelieve that any portion of your responsive material qualifies for confidential treatment under 5\nU.S.C. § 552(b), along with the complete original document you must provide a second copy of\nthe document with the portions you believe qualify for confidential treatment redacted and an\nexplanation of why you believe the redacted information qualifies for confidential treatment\nunder 5 U.S.","truncated":true,"body_characters":41756}