ENBRIDGE STORAGE (CUSHING) L.L.C. — Notice of Amendment

party submissionOfficial PDF32024023NOA_Operator Response to Notice_06072024_(23-264643).pdf#

32024023NOA_Closure Letter_12102024_(23-264643)_text.pdf, page 1Official PDFVIA ELECTRONIC MAIL TO: kevin.ruffatto@enbridge.com; stacy.soine@enbridge.com December 10, 2024 Kevin Ruffatto VP, US Operations Enbridge Storage Cushing, LLC 915 N Eldridge Parkway, Suite 1100 Houston, TX 77079 RE: CPF 3-2024-023-NOA Dear Mr. Ruffatto: From September 18 to September 28, 2023, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), conducted an on-site inspection of Enbridge Storage Cushing, LLC (Enbridge Cushing) procedures for Control Room Management (CRM) in Cushing, Oklahoma. As a result of the inspection, Enbridge Cushing was issued a Notice of Amendment on May 10, 2024, which proposed amendment of your procedures Enbridge Cushing submitted its amended procedures on December 6, 2024. My staff reviewed the amended procedures, and it appears that the inadequacies outlined in this Notice of Amendment have been corrected. This letter is to inform you that no further action is necessary, and this case is now closed. Thank you for your cooperation. Sincerely, Gregory A. Ochs Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration cc: Stacy Soine, Advisor Regulatory Compliance, Enbridge Cushing, stacy.soine@enbridge.com#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 1Official PDFNOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: kevin.ruffatto@enbridge.com & eric.anderson@enbridge.com May 10, 2024 Kevin Ruffatto VP, US Operations Enbridge Storage Cushing, LLC 915 N Eldridge Parkway, Suite 1100 Houston, TX 77079 CPF 3-2024-023-NOA Dear Mr. Ruffatto: From September 18 to September 28, 2024, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), conducted an on-site inspection of Enbridge Storage Cushing, LLC (Enbridge Cushing) procedures for Control Room Management (CRM) in Cushing, Oklahoma. As a result of the inspection, PHMSA has identified the apparent inadequacies found within Enbridge Cushing’s plans or procedures. The items inspected, and the inadequacies identified are described below: 1. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following. (1) . . . .#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 2(5) The roles, responsibilities and qualifications of others who have the authority to direct or supersede the specific technical actions of controllers. Enbridge Cushing’s “Cushing CCO Control Room Management Plan Version 8.2,” dated July 13, 2023 (CRM Plan), was not adequate to define the roles, responsibilities and qualifications of others who have the authority to direct or supersede the specific technical actions of controllers. Specifically, CRM Plan sections 3.7.1 and 3.7.2 prohibited Operators and Senior Advisors from directing the actions of operators except to shut down and bring the system to a safe state. It further limited this action to “referencing documented procedures, training or technical information rather than specific operational instructions.” One console did not have a designated Senior Advisor and the Senior Advisors for the other consoles, while qualified, were not trained and authorized to operate the console that lacked a designated Senior Advisor. Also, while the Senior Advisors were, in practice, trained and qualified, the procedure did not contain a requirement for Senior Advisors to be trained and qualified, nor did the procedure state qualifications related to experience requirements for the position that would relate to being competent to direct or supersede the technical actions of a controller. Additionally, the procedure did not address how the required conditions or actions to direct or supersede a controller must be taken, or how to document the event necessitating directing or superseding a controller. While the procedure prohibited the directing of controllers, the procedure was silent on whether superseding the technical actions of a controller was permissible. As written, the procedure language was unclear regarding whether someone was authorized to direct or supersede a controller. The procedure needs to be modified to provide a definition for the terms “direct” and “supersede”. The procedure needs to include a clear statement of Enbridge Cushing’s policy related to these actions. If there are individuals who are authorized to direct or supersede a controller, then Enbridge Cushing must (1) identify those individuals and (2) define the qualifications of the individual(s) who can direct or supersede the technical actions of a controller in the CRM Plan. The procedure must also include the roles and responsibilities of individuals when taking the action to direct or supersede a controller as well as the documentation required for such an event. 2. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . .#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 3(2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays. Enbridge Cushing’s CRM Plan, Alarm Management Plan Version 6.1, dated February 9, 2023 (AMP), and Alarm and Event Philosophy Version 8.1, dated August 22, 2023 (Alarm Event Philosophy), procedures were not adequate to clearly define which points affect pipeline safety. These procedures contained descriptions of how safety related alarms were designated in the Iconics and RTap SCADA systems. From these descriptions, PHMSA inspectors deduced that the related points were safety related. However, after reviewing the safety related points list from the master data base for Iconics and RTap, the safety related points were not consistent between the two SCADA systems. While there are safety related points accepted by the industry to be safety related, the operators must still review their operation, identify points within their system that may affect safety, and then implement those points in their SCADA data base, to include consistency between SCADA systems. Additionally, in the Iconics SCADA system, safety related alarms were considered a critical event with a priority of 1000 and a color of purple. During the inspection, Enbridge Cushing indicated that there were two leak alarms that were considered safety related, but have a severity of 500 which, per Table 6 of the Alarm Event Philosophy, carried an event designation of Medium/Alert and a color of yellow. The Alarm and Event Philosophy explained that in the Iconics SCADA system a "Medium/Alert [is assigned a severity of 500] has black text on yellow background and is the lowest priority." Section 5.4.1.a.i of the Safety Related Device Procedure for the Iconics System stated "Safety-Related alarms in Iconics are identified by: Alarm Priority 1000." A review of the Iconics SCADA Master Database indicated that the two leak alarms were in fact established a priority of 500 when they should have been assigned 1000. The Iconics SCADA system was new as of September 2021 to the control room. Therefore § 195.446(c)(1) is applicable and the operator would need to demonstrate that certain provisions of API RP 1165 are not practical for the SCADA system used. The procedure needs to be amended to identify and define safety related points and associated safety related alarms to provide consistency between the two SCADA systems and support compliance. If it is not practical, then the operator needs to amend their procedure to state why it is not practical for the SCADA system used. 3. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined:#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 4(1) Establish shift lengths and schedule rotations that provide controllers off-duty time sufficient to achieve eight hours of continuous sleep. Enbridge Cushing’s procedures were not adequate to address the rotating on-call schedule for the three Senior Advisors. While Enbridge Cushing indicated that after-hours calls were rare, the qualified controllers could be pressed into service on short notice due to controller absence and console coverage needs. Enbridge Cushing did not have any procedures related to (1) how to handle the after-hour calls if sleep is disrupted and (2) how to address the requirement for eight- hours of continuous sleep and time off after hours worked. The Senior Advisors have 10-hour shifts, Monday through Friday, but Enbridge Cushing also required a rotating call shift. While the on-shift hours of service (HOS) rules apply to all, there also needs to be considerations for the on- call rotating shift and maximum limits for hours-of-service, as required by § 195.446(d)(4). The procedure needs to be amended to provide additional considerations and rules for the Senior Advisors regarding maximum hours of service which may provide for emergency deviations and provide off duty on-call controllers sufficient time to achieve eight hours of continuous sleep. 4. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (g) Operating experience. Each operator must assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures by performing each of the following: (1) Review accidents that must be reported pursuant to §195.50 and §195.52 to determine if control room actions contributed to the event and, if so, correct, where necessary, deficiencies related to: Enbridge Cushing’s procedure was not adequate to: (i) Controller fatigue. Enbridge Cushing’s CRM Plan, Cushing CCO Fatigue Risk Management Plan Version 5.1, dated January 7, 2015 (FRMP), and CCO Incident Investigation Process and Enbridge Incident Investigation Process Version 4.0, dated April 16, 2022 (CCO Process), were not adequate to define how Enbridge Cushing would review accidents that must be reported to determine if control room actions contributed to the event and to correct deficiencies related to Controller fatigue. Specifically, during the inspection, Enbridge Cushing explained a practice that sounded adequate, but was not formalized in its procedures. A review of the Enbridge Incident Investigation Process Version 4.0, dated April 16, 2022 (Incident Investigation Process), revealed that the process failed to include fatigue review. CRM Plan section 8.4 only paraphrased the regulation, referencing a review of Operator fatigue, but failed to actually detail a process for fatigue review.#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 5The procedure needs to be amended to provide a process that defines what will be considered when reviewing incidents to determine if the controllers’ actions contributed to the incident. At the very least the process should include a review of the controllers work schedule that includes off duty hours and a review of the SCADA event log to evaluate alarms and controller response. 5. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: Enbridge Cushing’s CRM Plan section 9.4 was not adequate to demonstrate compliance that Enbridge Cushing had reviewed the training program content to identify potential improvements. Specifically, CRM Plan section 9.4 mentioned “program reviews” with goals of “determining resources required (i.e., number of training days to be scheduled for each Cushing CCO Operator, budget submissions for major expenditures, or additional expertise required for training development, design, or administration)” and to “identify gaps in knowledge or skills, erroneous past or informal training, resulting in supplemental training for all Cushing CCO Operators.” There was also a brief statement that, “Cushing CCO specific content is reviewed each calendar year, not to exceed 15 months, as part of the CRMP annual review.” All of which does not provide (1) what content will be reviewed, (2) how the content will be reviewed to determine whether it meets the requirements to provide for training each controller to carry out the roles and responsibilities defined by the operator. An assessment of the 2022 Training Plan Review, dated February 3, 2022, and Training Meeting Minutes, dated December 7, 2022, demonstrated that much Enbridge Cushing’s review was focused on reviewing the procedure and/or the plan’s language. Simply reviewing the procedure was not adequate to demonstrate compliance. The procedure and records did not demonstrate what content was reviewed and what changes were implemented or recommended, even if none were made. The procedure needs to be amended to provide more detail on how and what content will be reviewed to demonstrate that Enbridge Cushing’s program provides for training each controller to carry out the roles and responsibilities defined by the operator. Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in#

32024023NOA_Notice of Amendment_05102024_(23-264643)_text.pdf, page 6Enforcement Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. § 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. § 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested that Enbridge Cushing maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Gregory A. Ochs, Director, Central Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 3-2024-023-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Gregory A. Ochs Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration cc: Eric Anderson, Sr. Compliance Advisor, Audits and Inspections, US Pipeline Compliance, eric.anderson@enbridge.com Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings#