MARATHON PIPE LINE LLC — Notice of Amendment

party submissionOfficial PDF32025005NOA_Operator Response to Notice_09182025_(23-264547).pdf#

32025005NOA_Closure Letter_01292026_(23-264547)_text.pdf, page 1Official PDFU.S. Department of Transportation Pipeline and Hazardous Materials Safety VIA ELECTRONIC MAIL TO: rjstamour@marathonpetroleum.com; caleach@marathonpetroleum.com; migray@marathonpetroleum.com 901 Locust Street, Suite 480 Kansas City, MO 64106 January 29, 2026 Mr. Richard St Amour Marathon Pipe Line, LLC 539 South Main Street Findlay, OH 45840 RE: CPF 3-2025-005-NOA Dear Mr. St Amour: From April 17 to May 17, 2023, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), pursuant to Chapter 601 of 49 United States Code (U.S.C.), conducted and inspection of Marathon Pipe Line, LLC’s (Marathon) procedures and records in Findlay, Ohio. On June 16, 2025, pursuant to 49 CFR § 190.206, PHMSA issued a Notice of Amendment which proposed amendment of Marathon’s procedures. Marathon submitted its amended procedures on September 18 and December 5, 2025, and January 28, 2026. PHMSA has reviewed the amended procedures, and it appears that the inadequacies outlined in the Notice of Amendment have been corrected. This letter is to inform you that no further action is necessary, and this case is now closed. Thank you for your cooperation. Sincerely, David Barrett Acting Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration cc: Carlie Leach, Compliance Specialist, Marathon Pipe Line caleach@marathonpetroleum.com Michael J. Gray, Environmental Safety Security Compliance Director, Marathon Pipeline, migray@marathonpetroleum.com#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 1Official PDFNOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: rjstamour@marathonpetroleum.com, jerader@marathonpetroleum.com; Migray@marathonpetroleum.com June 16, 2025 Mr. Richard St Amour Marathon Pipe Line, LLC 539 South Main Street Findlay, OH 45840 CPF 3-2025-005-NOA Dear Mr. St Amour: From April 17 to May 17, 2023, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), pursuant to Chapter 601 of 49 United States Code (U.S.C.), inspected, remotely and on-site, Marathon Pipe Line, LLC’s (Marathon) procedures and records in Findlay, Ohio. As a result of the inspection, PHMSA has identified the apparent inadequacies found within Marathon’s plans or procedures. The items inspected, alleged inadequacies, and proposed revisions are described below: 1. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section…. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays;#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 2Marathon’s procedure, “MPL-OPR-01598-PRS” (August 25, 2021, amend. June 30, 2023), cross-referenced in its “MPL Pipeline Operations Center Control Room Management Plan” (August 25, 2022, amend. October 05, 2023) (CRM Plan) section 6.4, was not adequate to describe the requirements for thorough documentation of point-to-point (P2P) verification per § 195.446(c)(2). “MPL-OPR-01598-PRS” failed to include instructions for the verification and documentation of the values and states between the SCADA system and field end device. It also failed to include a requirement for these conditions to match. “MPL-OPR-01598-PRS” provided an example of verification in section 5.2, “End to End Verification,” that stated, “[c]ompare the readings on a pressure transmitter in the field to the readings of the SCADA display.” Prior to this, section 5.2 noted, “[t]he tolerance of field displays and data communication latency should be taken into consideration when comparing end device displays to SCADA.” This language suggested the information between the end device and SCADA can be different and that result would be considered acceptable to Marathon. Thus, section 5.2 allowed Marathon’s controllers to accept potentially inaccurate information, which could cause a controller to have to perform their roles and responsibilities of operating the pipeline safely without the best information. PHMSA reviewed Marathon’s P2P records for Robinson Rio 81 and identified that several elements, including adequate description, were missing from the verification documentation, which was required to be recorded pursuant to “MPL-OPR-01598-PRS.” For example, Marathon did not document (1) the details of which displays were verified, (2) the actual status or value observed in the field and SCADA (the same response was documented for analog, set point and control points), or (3) the exact same date and time was documented for all 5 points. Thus, Marathon failed to (1) provide adequate instruction to its controllers to conduct P2P verification between SCADA displays and related field equipment and (2) maintain appropriate documentation of P2P verification to determine compliance, per the requirements of §§ 195.446(c)(2), (j)(2). Marathon must formalize its procedures to provide a thorough P2P verification that includes instructions to support consistency and ensure records are maintained to demonstrate all the elements verified pursuant to § 195.446(j)(2). 2. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: 1 Robinson Rio 8 is a Marathon pipeline facility monitored and controlled from the control room.#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 3(1) . . . . (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months; Marathon’s CRM Plan detailing its internal communication plan was not adequate to demonstrate compliance with § 195.446(c)(3). Specifically, Marathon’s “Internal Communication Plan for Manual Operation” did not provide adequate means for manual operation of the pipeline safety, nor did it require adequate documentation of its tests of its internal communication plan at the regulatory timeframe to demonstrate compliance. During the inspection, Marathon stated its policy was to not move product manually through the pipeline system once it manually shuts down the pipeline systems in the event of a SCADA loss. Section 7 of the CRM Plan referenced sections 3.4 and 12.1 of Marathon’s “Operations & Logistics Business Continuity Plan” (July 10, 2023) (O&LBCP), which described the responsibilities of the controllers during a SCADA failure; however, that description did not match what was provided in the CRM Procedures. O&LBCP sections 3.4 and 12.1 did not include detail of what was expected of the controllers during manual operation. Marathon mentioned, during the inspection, that it has its pipeline systems listed to track what has been shut down, but this was not required in either the CRM Plan or O&LBCP. Marathon also did not define who it was that updated this list as systems are communicated as being shut down. The O&LBCP did not address who oversaw reporting field data, the frequency of these reports, or where this information should be recorded for pipeline systems that are still operating. Even when product is not flowing, the pipeline is still considered in operation, and Marathon is still required to patrol and have leak detection in place during the shutdown. Both the CRM Plan and O&LBCP failed to include requirements to report and document abnormal operating conditions, emergencies, and leaks. Marathon did complete tests of its “Internal Communication Plan for Manual Operation” of the pipeline systems for the years 2020, 2021 and 2022. However, Marathon did not maintain records that were adequate to demonstrate compliance with its procedures or § 195.446(c)(3). In 2020 and 2021, Marathon’s records demonstrate that it only completed a portion of the plan by making the "send word now" notification calls and asking employees to review their roles. This was not an adequate demonstration that a full test of Marathon’s Internal Communication Plan for Manual Operation was completed. In 2022, Marathon only conducted a tabletop exercise which was not adequate to demonstrate compliance with § 195.446(c)(3). Per Marathon’s records, the tabletop exercise had a mix of individuals representing different work groups in the session. The session utilized the question/answer process to review procedures. A pre-populated list, by console, was provided to support the drill and identified which systems were currently running to know which systems needed to be shut down. The tabletop exercise did not cover calling in to the control room to manually document field conditions during the shutdown. The control function went to field personnel, which is cause for concern considering the control room personnel are the subject matter experts on managing the system holistically. Not engaging the control room to manage shut down status and monitor for leaks through patrolling and pressure monitoring is a failure of#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 4the testing process. Thus, Marathon’s CRM Plan did not provide adequate means for manual operation of the pipeline safely, nor did it require adequate documentation of its tests of its internal communication plan at the regulatory timeframe to demonstrate compliance with § 195.446(c)(3). Marathon must develop an internal communication plan for the safe manual operation of the pipeline and a procedure to test the plan once each calendar year, not to exceed 15 months. The plan must include verification that the pipeline systems have been shut down, accommodations for leak detection while the line is in the operating status of shutdown, identification of key operating points that will be monitored and methods to report and document field conditions. 3. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (4) Test any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months; and Marathon’s CRM Plan section 8 for testing any backup SCADA systems was inadequate because (1) it did not require enough detail to demonstrate compliance, (2) the tests did not include a test of the backup system, and (3) the procedures were not formalized nor subject to review. As a result, Marathon failed to maintain records adequate to demonstrate that it complied with the regulatory timeframe for testing its backup SCADA system at least once each calendar year, not to exceed 15 months, per the requirements of § 195.446(c)(4). PHMSA reviewed Marathon’s records for its monthly failover of the SCADA servers. Some of the records only included the dates but not the initials of the person who conducted or verified the test. These records included visits to the “hardened area”2 of the control room. These records were created by the SCADA Team, rather than by the control room, so there was no test of the backup system provided. It is important to document which employee(s) did the work as well as the date the work was completed. The SCADA Team developed procedures for these tests, but those procedures were not formalized or controlled. These procedures were only maintained on One Note. Because these procedures were essential for maintaining the SCADA system and related to compliance, they need to be formalized, controlled, and subject to review. 2 “Hardened area” of the control room is Marathon’s term describing an area structurally enhanced to be used to support controllers and control room operations during severe weather.#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 5Marathon conducted a test of Blufton in fall 2020, spring 2021, and fall 2021. However, Marathon did not provide any documentation, other than shift schedules, for these tests conducted in 2020 and 2021. Shift schedules are inadequate to provide adequate detail documenting the test to demonstrate compliance with the requirements of § 195.446(c)(4). Marathon conducted tests in 2022, between April 6 and April 13. Marathon documented the test through a survey completed by the controller who participated in the test. While the survey asked for responses to certain questions, it did not provide enough detail of what was tested to demonstrate that an adequate test was completed. For example, the survey did not include (1) what commands were sent, (2) which alarms were acknowledged, (3) whether printers were working, (4) whether IT business computers were working, (5) whether monitors were working, (6) whether all comms were working, etc. The CRM Plan, section 8.4, required, “documentation of the BPOC activation [to] be recorded using the POC Backup Activation Checklist and maintained by the POC performing the BPOC.” Thus, Marathon’s procedures were inadequate to demonstrate that tests of backup SCADA systems were conducted adequately and within the regulatory timeframe specified in § 195.446(c)(4). Marathon must formalize its procedures used to perform the monthly failover test and documentation. It must also develop procedures to test the backup SCADA system, including the functioning backup center, server, and all equipment that makes up the back up control center. The amended procedure must require documentation of the test, including, but not limited to, identifying the functioning server during the test, start and end time, controller(s) on duty, alarm/event function, phones, command functions, etc. 4. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (1) . . . . (3) Verify the correct safety-related alarm set-point values and alarm descriptions when associated field instruments are calibrated or changed and at least once each calendar year, but at intervals not to exceed 15 months; Marathon’s “Alarm Management Plan” (May 2, 2023) (ALMP) and its CRM Plan were not sufficiently detailed to adequately verify the correct safety-related alarm set-point values and alarm descriptions at least once each calendar year, but at intervals not to exceed 15 months, per § 195.446(e)(3). As a result of its inadequate procedures, Marathon did not provide records to demonstrate they verified all safety related alarms each calendar year not to exceed 15 months for the years 2020, 2021, and 2022.#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 6Sections 13.4 of the CRM Plan, 22.2, and 22.5 of Marathon’s ALMP provided that, “Safety Related alarm setpoint values and alarm descriptions (SCADA names) must be verified at least once each calendar year, but at intervals not to exceed 15 months.” Section 22.5 of the ALMP stated “Work Orders are assigned for Safety Related alarms that need to be tested and verified and to each field location where those alarms exist.” Marathon indicated to PHMSA during the inspection that Work Orders are created for all alarms, whether the alarm requires field testing or not. Marathon relied on the field work order activity and field process to demonstrate compliance. Marathon provided two procedures to demonstrate the process of set point verification: Major Pressure Relief valve DOT inspection Task List (Task List) and MPL – Pressure Control Device DOT Compliance (MPL MNT-00966-PRS). Step 3 of the Inspection Procedures section of the Task List directed the field technician to “[n]otify the OC (Operations Center) to ‘Off Scan’ the device being inspected.” Taking the point off scan in SCADA system will result in no alarm being received in the control room from the field PLC. MPL MNT-00966- PRS section 4.1, “Roles and Responsibilities for the Technician,” stated, “[a]t the end of the inspection of the pressure monitoring devices, [the technician must confirm] with the POC or MPC equivalent the correct receipt of the data points by the POC.” There is conflict between these two documents that undermined determination of compliance. The execution of Step 3 renders the information required for in section 4.1 unobtainable. While individual alarm verifications were presented for inspection, Marathon did not provide a record that confirmed all points had been verified each calendar year not to exceed 15 months. Marathon did indicate to PHMSA, following the inspection, that it did monitor alarm verifications monthly through administrative reports, however, no such reports were provided for inspection. Additionally, the process defined through Marathon’s procedure did not verify the correct safety related alarm description, as required by § 195.446(e)(3). Marathon also has a CPM Leak Detection system that generates alarms which are passed to SCADA in digital format to present to the controller. The alarm set point is not static, rather it is dynamic and is based on complex algorithms and coefficients. Marathon personnel indicated they review the false alarms frequently and adjust coefficients to support improved leak detection alarming accuracy. These are safety related alarms, as acknowledged by Marathon and have not been part of the work order process for all other alarms described in the process above. Thus, Marathon did not provide a record that it verified the all safety-related alarm set-point values and alarm descriptions were correct when associated field instruments were calibrated or changed and at least once each calendar year, but at intervals not to exceed 15 months, per the requirements of § 195.446(e)(3). Marathon must amend its “Alarm Management Plan” (May 2, 2023) (ALMP) and its CRM Plan in detail to verify the correct safety-related alarm set-point values and alarm descriptions at least once each calendar year, but at intervals not to exceed 15 months, per § 195.446(e)(3). Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 CFR § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Enforcement Proceedings.#

32025005NOA_Notice of Amendment_06162025_(23-264547)_text.pdf, page 7Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. § 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. § 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 CFR § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that Marathon maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Gregory A. Ochs, Director, Central Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 3-2025-005-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, David Barrett Acting Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration cc: Jennifer Rader, Advanced Compliance Professional, jerader@marathonpetroleum.com Michael J. Gray, Environmental Safety Security Compliance Director, MiGray@marathonpetroleum.com Enclosures: Response Options for Pipeline Operators in Enforcement Proceedings#