# HOLLY ENERGY PARTNERS - OPERATING, L.P. — Notice of Amendment

- **operation:** document
- **citation:** CPF 32025016NOA
- **title:** HOLLY ENERGY PARTNERS - OPERATING, L.P. — Notice of Amendment
- **source type:** enforcement
- **agency:** Pipeline and Hazardous Materials Safety Administration
- **status:** historical
- **official:** true
- **published on:** 2025-07-14
- **effective on:** Not available
- **summary:** CLOSED notice of amendment citing 195.446(a), 195.446(b), 195.446(b)(5), 195.446(c)(2), 195.446(c)(3), 195.446(c)(4), 195.446(e)(1), 195.446(e)(2), 195.446(e)(3), 195.446(e)(5), 195.446(h), 195.446(h)(6).
- **machine formats:** - **json:** https://regulus.evalyn.ai/document/phmsa-enforcement-32025016noa.json
- **markdown:** https://regulus.evalyn.ai/document/phmsa-enforcement-32025016noa.md
- **app url:** https://regulus.evalyn.ai/document/phmsa-enforcement-32025016noa
- **source url:** https://primis.phmsa.dot.gov/enforcement-data/case/32025016NOA
**body:**

Notice of Amendment involving HOLLY ENERGY PARTNERS - OPERATING, L.P.. PHMSA's enforcement data identifies the cited regulations as 195.446(a),  195.446(b),  195.446(b)(5),  195.446(c)(2),  195.446(c)(3),  195.446(c)(4),  195.446(e)(1),  195.446(e)(2),  195.446(e)(3),  195.446(e)(5),  195.446(h),  195.446(h)(6). The case was opened on 2025-07-14 and is reported as closed as of 2026-02-02. Open the official case record for notices, responses, orders, and the latest status.

Official case documents:

32025016NOA_Closure Letter_02022026_(24-297199).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32025016NOA/32025016NOA_Closure%20Letter_02022026_(24-297199).pdf

32025016NOA_Closure Letter_02022026_(24-297199)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32025016NOA/32025016NOA_Closure%20Letter_02022026_(24-297199)_text.pdf

32025016NOA_Notice of Amendment_07142025_(24-297199).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32025016NOA/32025016NOA_Notice%20of%20Amendment_07142025_(24-297199).pdf

32025016NOA_Notice of Amendment_07142025_(24-297199)_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/32025016NOA/32025016NOA_Notice%20of%20Amendment_07142025_(24-297199)_text.pdf

32025016NOA_Operator Response to Notice_11122025_(24-297199).pdf: https://primis.phmsa.dot.gov/enforcement-documents/32025016NOA/32025016NOA_Operator%20Response%20to%20Notice_11122025_(24-297199).pdf

32025016NOA_Notice of Amendment_07142025_(24-297199)_text.pdf

NOTICE OF AMENDMENT
VIA ELECTRONIC MAIL TO: Steve.Ledbetter@HFSinclair.com;
Tane.Hartman@HFSinclair.com; Charles.Curl@HFSinclair.com
July 14, 2025
Mr. Steven Ledbetter
Chief Executive Officer and President
HF Sinclair Corporation
2323 Victory Avenue, Suite #1400
Dallas, TX 75219
CPF 3-2025-016-NOA
Dear Mr. Ledbetter:
From May 6 through May 23, 2024, representatives of the Pipeline and Hazardous Materials
Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.),
inspected onsite Holly Energy Partners, L.P.’s (Holly Energy)1 plans and procedures for Control
Room Management (CRM) in Artesia, New Mexico.
As a result of the inspection, PHMSA has identified the apparent inadequacies found within
Holly Energy’s plans or procedures. The items inspected and the inadequacies are described
below:
1. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section….
(b) Roles and responsibilities. Each operator must define the roles and
responsibilities of a controller during normal, abnormal, and emergency operating
conditions. To provide for a controller's prompt and appropriate response to
operating conditions, an operator must define each of the following:
1 Holly Energy Partners, L.P., is a wholly owned subsidiary of HF Sinclair Corporation. See
https://www.hollyenergy.com/Home/default.aspx.



Holly Energy’s CRM Plan, (rev. 13, effective December 15, 2023) (CRM Plan) was inadequate
because it failed to define the roles and responsibilities of a controller during normal, abnormal,
and emergency operating conditions, per the requirements of § 195.446(b). Specifically, the
CRM Plan failed to define how a controller is expected to respond to different leak detection
alarms. Holly Energy used three leak detection systems in the control room: Pipeline Manager
(PLM), Sim Suite and ATMOS. Each leak detection system had a different alarm system. The
different leak detection alarms that were presented to controllers was not described in the CRM
Plan procedure or the Alarm Management Plan, (ver. 1.0, effective July 28, 2011) (ALM Plan).
The CRM Plan, section 17.9, only provided a high-level overview of how each system functions
to detect leaks. While the ATMOS system was functioning on one two-mile stretch of pipeline
on a single console, this was a different alarm than the alarm detailed in the CRM Plan.
Holly Energy’s procedures must be amended to describe the different leak alarms that can be
presented to a controller, define what they represent, and define the controller’s expected
response depending on the alarm. For example, whether a different controller response is
expected between a warning alarm and a leak alarm.
2. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section….
(b) Roles and responsibilities. Each operator must define the roles and
responsibilities of a controller during normal, abnormal, and emergency operating
conditions. To provide for a controller's prompt and appropriate response to
operating conditions, an operator must define each of the following:
(1) . . . .
(5) The roles, responsibilities and qualifications of others who have the authority to
direct or supersede the specific technical actions of controllers.
Holly Energy’s CRM Plan was not adequate because it did not define the roles, responsibilities
and qualifications of others who have the authority to direct or supersede the specific technical
actions of controllers, per the requirements of § 195.446(b)(5). CRM Plan, section 2.8, described
who can direct or supersede the specific technical actions of controllers, and that those
individuals were “DOT OQ qualified” and “have the expertise to know when conditions or
situations warrant the necessity to use their authority to direct or supersede the technical actions
of a Controller” as well as how to implement and document the action. DOT OQ Qualifications
relates to many covered tasks that have no bearing on the covered tasks required to be a trained
and qualified controller. Additionally, what type of “expertise” is required to know when
“conditions or situations warrant the necessity to use their authority to direct or supersede the
technical actions of a Controller.” This was not adequate because it was not specific enough to
define what qualifications are required for an individual to have authority to direct or supersede a
controller.



CRM Plan, section 9.6 Team Training, identified other individuals who would be reasonably
expected to collaborate with controllers. Section 9.6 did not describe how it would be
communicated who the individuals are who have authority to direct or supersede the specific
technical actions of controllers to those identified as others and controllers. Section 9.6 also did
not describe the process for documenting the communication of these roles and responsibilities
to individuals with such authority.
The CRM Plan must be amended to provide a requirement for the qualification of those with
authority to direct or supersede the specific technical actions of controllers, the method of
communication with these individuals, and the timing of when the initial communication will be
made to new controllers and others new to their roles.
3. § 195.446 Control Room Management.
(a)General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) . . . .
(2) Conduct a point-to-point verification between SCADA displays and related field
equipment when field equipment is added or moved and when other changes that
affect pipeline safety are made to field equipment or SCADA displays.
Holly Energy’s CRM Plan and ALM Plan were not adequate to define safety related points nor
how they are determined, per the requirements of § 195.446(c)(2). The ALM Plan, section 2,
defined “Safety Related Alarm” as “[a]ny alarm that affects safe operation of the pipeline. Any
operational factor that is necessary to maintain pipeline integrity or that could lead to the
recognition of a condition that could impact the integrity of the pipeline, or a developing
abnormal or emergency situation. This includes but is not limited to; deviation of rate, high
pressure, high level, and gas detector alarms.” Table 1 of the CRM Plan provided a definition
for “Safety Related Operations” as, “any operational factor that is necessary to maintain pipeline
integrity or that could lead to the recognition of a condition that could impact the integrity of the
pipeline, or a developing abnormal or emergency situation.” What was not defined was a point
affecting safety.
ALM Plan section 1.4 stated, “HEP has a process in place to ensure that SCADA safety related
alarms are accurate, and they support safe operations of the pipeline.” However, neither the
ALM Plan nor the CRM Plan offered what this process is. CRM Plan, section 31, contains a
“Safety Related Point Flow Chart” that provides flow charts equipment and operational
conditions that support determination of whether a point is safety related. There is no reference



to these flow charts in either the CRM Plan or the ALM Plan. The procedures did not contain
any instructions on (1) when to use the flow charts, (2) which employee is responsible to
determine if a point is safety related, and (3) how the determination will be documented. In
practice, Holly Energy controllers would use SCADA tags that are designated safety related at
the front of the alarm description. This was not identified in the procedure.
Because Holly Energy has established an alarming system that can be generated from both the
field Programmable Logic Controllers (PLC) and the SCADA system, the system of tagging
safety related alarms should be standardized and clarified in procedure. It is unclear if the flow
charts contained in CRM Plan, section 31, are utilized by field personnel when designing and
constructing the field PLCs. In practice, all alarming occurs at the PLC for safety related alarms.
This practice has not been defined in procedure.
The procedure must be amended to provide more instruction on who, when, and how the “Safety
Related Point Flow Charts” will be employed to designate a point and alarm safety related.
There needs to be clarification on whether the field is using this process or if it is strictly for the
SCADA controllers. In addition, the method of identifying safety related alarms to the controller
using the word “SAFETY” in front of the alarm description must be in the procedure, as well as
an explanation of the process used for alarming at the PLC and matching it to SCADA tags that
are also receiving an analogue value.
4. § 195.446 Control Room Management.
(a)General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) . . . .
(2) Conduct a point-to-point verification between SCADA displays and related field
equipment when field equipment is added or moved and when other changes that
affect pipeline safety are made to field equipment or SCADA displays.
Holly Energy’s CRM Plan was not adequate because its procedure for conducting a thorough
point-to-point (P2P) verification was insufficient to demonstrate compliance with §
195.446(c)(2). Specifically, CRM Plan, section 32, provided an inadequate procedure to verify
points between SCADA and the field. CRM Plan, section 33, provided the P2P verification
check-out sheet. The check-out sheet was not referenced in the procedure to document the
verification, nor did it match the verification requirements established in CRM Plan sections 32
and 33. The check-out sheet did not include: the date, the name of the field tech, the name of the
Control Center representative, documentation of analog values following verification, and



recording verification of displays. Additionally, there was no space to document point value or
status conditions, and the form did not capture whether the point was tested in live or simulated
mode.
Holly Energy presented for inspection a P2P verification form for Pathfinder/Sanford and Station
10. However, this was a different form than the check-out sheet. It was the form used for the
Sinclair Transportation control room prior to the Holly Energy-Sinclair merger.
If this is the form Holly Energy plans to use for P2P verification, this should be detailed in its
CRM Plan. The CRM Plan also did not include a process to retest the point and document the
test and the result in the event the point failed the P2P verification. Furthermore, the procedure
failed to include verification of the SCADA tag to the end device and verification of the
sequence of the device on the pipeline and its match to the SCADA display placement.
The CRM Plan and its associated form need to be amended to include recording of the analog
values and status comparison confirmations, recording the displays that were verifying the
SCADA tag to the end device, the sequence of the device on the pipeline, its match to reviewed
and verified SCADA display placement, and documentation of whether the point was verified
live or simulated. The CRM Plan also must include a process to retest the point and document
the test and test result in the event the point failed the initial P2P verification. These items
identified in the amended procedure and form will provide a thorough P2P verification in
compliance with § 195.446(c)(2).
5. § 195.446 Control Room Management
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) . . . .
(3) Test and verify an internal communication plan to provide adequate means for
manual operation of the pipeline safely, at least once each calendar year, but at
intervals not to exceed 15 months.
Holly Energy’s CRM Plan, section 4, was not adequate to provide means for manual operation of
the pipeline safely, as required by § 195.446(c)(3). Specifically, the CRM Plan lacked detail to
support the controller’s step-by-step response to loss of communication or SCADA, how
complete shutdown of field facilities will be verified, how field personnel will be dispatched to
key locations, and how the manual readings will be communicated and documented. It also
failed to include how abnormal and emergency conditions will be reported and how monitoring
leaks will be conducted and reported.



CRM Plan, section 4.1.2, only restated the regulation, section 4.5 provided roles and responsibilities
to notify field personnel to manually operate, and section 4.6 referenced Operations and
Maintenance Manual (effective June 10, 2024) (O&M Manual), section 4.1.2.3,
2 which provided
very high-level duties of the controller to notify field personal and to document names of field
personnel at each location and all changes that were made, as well as the time communication was
restored. The O&M Manual did not provide any specific plans related to an internal
communication plan for the manual operation of the pipeline safely.
CRM Plan, section 17.1.7, “Manual Operation,” did not directly relate to manual operations.
Rather, it addressed the controllers’ responsibilities during abnormal operations. CRM Plan,
section 17.9.2, “Procedure for Monitoring of Idle or Shut in Pipeline Segments and Factors to
Consider Investigating Pressure Variances,” provided guidance on how to manually monitor and
evaluate the pipeline to identify leaks. These procedures did not include considerations for leak
monitoring during manual operations in the event of loss of communication to a large area or
total loss of SCADA.
Holly Energy utilized a “Job Plan Form” to prepare for its annual backup control room failover
test. Holly Energy also utilized this form to document and facilitate a combined test for the
Internal Communication Plan requirement, as defined in CRM Plan, section 4.8. CRM Plan,
section 26(A)(iv), “Control Center Failover Plan,” required the test be developed through the
“Job Plan Form” process. However, there was no requirement for the Internal Communication
Plan test to be developed in the Job Plan Form. A review of the “Job Plan Form” records,
documenting the tests for the years 2021, 2022 and 2023, identified that the language used, to
frame the test, is almost identical for each test. Holly Energy used the “Job Plan Form” to
develop a plan, each year, for the Internal Communication Plan for manual operation of the
pipeline. Holly Energy had no formal Internal Communication Plan that provided the controller
detailed steps to follow for: initiating the manual shutdown of the hazardous liquid pipelines,
dispatching of field personnel to the gas transmission pipeline key location, the documents used
to record manual field readings, the frequency for field personnel to report field conditions, how
abnormal operations and emergencies will be reported to the control room, or how leak detection
will be supported.
Holly Energy must amend its procedures to create a formalized Internal Communication Plan for
the manual operation of the pipeline safely that includes: detailed steps to follow to initiate the
manual shutdown of the hazardous liquid pipelines, the dispatching of field personnel to the gas
transmission pipeline key locations, the documents used to record manual field readings, the
frequency for field personnel to report field conditions, how abnormal operations and
emergencies will be reported to the control room, and leak detection will be supported. The
procedures must also be amended to define the test of the internal communication plan that
includes all the different elements of the plan, including a minimum time duration to gather
enough field readings to evaluate effectiveness off the plan. Additionally, the test procedure also
needs to conduct an evaluation of the test to determine effectiveness and modify as needed.
2 This was an incorrect reference; O&M Manual section 6.10 should have been referenced.



6. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(c) Provide adequate information. Each operator must provide its controllers with
the information, tools, processes and procedures necessary for the controllers to
carry out the roles and responsibilities the operator has defined by performing each
of the following:
(1) . . . .
(4) Test any backup SCADA systems at least once each calendar year, but at
intervals not to exceed 15 months.
Holly Energy’s CRM Plan was not adequate to test any backup SCADA systems at least once
each calendar year, but at intervals not to exceed 15 months, per the requirements of
§ 195.446(c)(4). Specifically, the CRM Plan lacked a detailed process for transferring operations
from the primary control room to the back-up control room. CRM Plan, section 26, “Control
Center Failover Plan,” directed controllers to “shut down the appropriate assets under his control
using normal operating procedures” and stated:
Each Controller shall take the Console Procedure Book with schedules and phone
lists for their respective console to the Secondary Control Center. Notifications
will need to be made to all HEP Terminals, associated Refineries, and third-party
customers as soon as practical that Operations have evacuated the Primary
Control Center and are relocating to the Secondary Control Center.
The CRM Plan included a map and directions to the backup control room facility. It also
included instructions on how to switch from the primary to secondary SCADA system. CRM
Plan section 26 (A)(iv) stated, “[t]here are many reasons for switching from the Primary Control
Center to the Secondary Control Center. This makes it difficult to write a specific procedure to
move from the Secondary Control Center to the Primary Control Center prior to knowing why
you switched to the Secondary Control Center.” While there may be many reasons to switch
control centers, the process to switch should be standardized to manage a successful transition.
Transferring servers, phones, accessing building space, powering up consoles, in that order or
reversed, should not require much deviation. Per CRM Plan, section 26 (A)(iv), Holly Energy
required a Job Plan to be written to relocate to the backup control center based on the specific
reason for the relocation. The CRM Plan was missing a process to return personnel and transfer
control back to the primary control room.
CRM Plan, section 26(A)(iv), provided considerations of what to include in the Job Plan, but
provided no details of how to test the backup SCADA systems. No form or checklist was
provided. Holly Energy documented SCADA testing on a “Lessons Learned” form. This
documentation was a practice that was not directed through procedure to be used to document
the test. This form provided a summary of what went well, what failed, and what, if any,
corrective actions needed to be taken. The CRM Plan did not have a standardized form to



provide a consistent test protocol and test documentation of the back-up SCADA system. The
CRM Plan also failed to include a required duration for the test.
The CRM Plan needs to be amended to provide the full process for the controllers to move the
control room, transfer control, and return back to the primary control room. The CRM Plan also
needs to define all elements that are to be tested and documented during the test. This also needs
to include a form to provide consistency for all consoles.
7. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator's plan must include provisions to:
(1) Review SCADA safety-related alarm operations using a process that ensures
alarms are accurate and support safe pipeline operations.
Holly Energy’s CRM Plan was not adequate to ensure alarms are accurate and support safe
pipeline operations, per the requirements of § 195.446(e)(1). CRM Plan, section 2.3.1, stated
that Holly Energy’s controllers must, “[g]enerate work requests for equipment failures,
mechanical problems and SCADA alarms.” Section 6.8.1 stated, “[s]afety related alarms found
out of calibration, in fault or otherwise not operating as designed will have a work order assigned
by the controller responding to the alarm.” In practice, as described by Holly Energy during the
inspection, when a controller discovered an alarm was malfunctioning or inaccurate, the
controller created a ticket in the SAP application. The process to create a ticket in SAP was not
defined in the procedure. Absent a defined process, consistency of work orders cannot be
ensured; thereby undermining the process used for reviewing SCADA safety-related alarm
operations. While the CRM Plan did require the safety-related alarm list to be reviewed monthly
by the Alarm Management Group and for the group to develop an action plan to address the
process for correcting critical safety related alarms, there was no detail or expectation for how
long alarms could be in repair mode or escalation if the workorder exceeded the return to service
expectation.
The CRM Plan needs to be amended to provide more detail on the current practice of creating
workorders for malfunctioning or inaccurate alarms and the monthly review process, including
expectations for return to service and escalation if workorder expectations are exceeded.
8. § 195.446 Control room management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow



written control room management procedures that implement the requirements
of this section. . . .
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms.
An operator's plan must include provisions to:
(1) . . . .
(2) Identify at least once each calendar month points affecting safety that have
been taken off scan in the SCADA host, have had alarms inhibited,
generated false alarms, or that have had forced or manual values for
periods of time exceeding that required for associated maintenance or
operating activities.
Holly Energy’s CRM Plan Section 6.18.1 was not adequate to identify at least once each calendar
month points affecting safety that have been taken off scan in the SCADA host, have had alarms
inhibited, generated false alarms, or that have had forced or manual values for periods of time
exceeding that required for associated maintenance or operating activities as required by
§ 195.446(e)(2).
Holly Energy’s CRM Plan, Section 6.18.1, only paraphrased the regulation. It did not provide
details on (1) how Holly Energy’s employees would collect the prescribed information, (2) how
Holly Energy’s employees would evaluate the information against the associated maintenance or
operating activities, and (3) how deficiencies identified through the process would be addressed.
The CRM Plan also did not provide a process that described Holly Energy’s practice for identifying
false alarms and including these in the monthly alarm review.3
The procedure must be amended to provide details on how to identify and correct at least once
each month points affecting safety that have been taken off scan in the SCADA host, have had
alarms inhibited, generated false alarms, or that have had forced or manual values for periods of
time exceeding that required for associated maintenance or operating activities as required by
§ 195.446(e)(2). The procedure must include who is accountable for gathering, reviewing and
reporting the data, the source of the data, the date taken out of service (off-scan, inhibited,
forced/manual) and returned to service, document the reason the point or alarm was taken out of
service, a process to compare the duration of out of service to the maintenance activity,
identification of the deficient points and return to service as soon as possible. It must also include
how false alarms will be documented and reviewed.
9. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
3 PHMSA’s Control Room Management Frequently Asked Questions (FAQs) (effective Jan. 16, 2018) address false
alarms. FAQ E.02 states “[f]or the purpose of the CRM regulations, any alarm that is presented to the controller that
did not accurately reflect the actual operational parameter or condition, or an alarm that can mislead a controller to
believe a condition exists, but that does not exist, is considered a false alarm.”



written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator's plan must include provisions to:
(1) . . . .
(3) Verify the correct safety-related alarm set-point values and alarm descriptions
when associated field instruments are calibrated or changed and at least once each
calendar year, but at intervals not to exceed 15 months.
Holly Energy’s CRM Plan was not adequate to verify the correct safety-related alarm set-point
values and alarm descriptions when associated field instruments are calibrated or changed at
least once each calendar year, but at intervals not to exceed 15 months, as required by
§ 195.446(e)(3). The CRM Plan, section 6.1.1, simply restated the regulation requirement with
no instruction on how to conduct this review. Section 6.17.1 stated, “[t]he HEP Alarm Analyst
Senior will annually review the SCADA safety related alarms.” A method to identify and list the
safety related alarms and descriptions, and document the verification findings, was not included
in the procedure. The CRM Plan did include procedures used in the field for calibrations, and
these included notification of the control room and verification of alarm set points. But they did
not include alarm descriptions. Also, there was no reference to how the control room would
document and verify this activity had been completed to demonstrate compliance. Holly Energy
was relying on the field to complete the calibration and documentation.
The CRM Plan must be amended to provide details to conduct the verification of the correct
safety-related alarm set-point values and alarm descriptions when associated field instruments
are calibrated or changed, at least once each calendar year, but at intervals not to exceed 15
months, to demonstrate compliance with § 195.446(e)(3). The CRM Plan must detail who is
responsible for conducting the annual review; documentation that includes the listing of all
safety related alarms, set points, and descriptions; the standard those set points will be verified
to; and documentation of deficiencies and associated corrections. For field instrument changes
and calibrations, the CRM Plan must include a process to document that all verifications were
made with the field personnel in SCADA for the set points and descriptions.
10. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(e) Alarm management. Each operator using a SCADA system must have a written
alarm management plan to provide for effective controller response to alarms. An
operator's plan must include provisions to:
(1) . . . .



(5) Review the alarm management plan required by this paragraph at least once
each calendar year, but at intervals not exceeding 15 months, to determine the
effectiveness of the plan.
Holly Energy’s CRM Plan, section 6.17.2.1, did not have adequate details to ensure that the
effectiveness of the alarm management plan would be reviewed at least once each calendar year,
but at intervals not exceeding 15 months to determine the effectiveness of the plan, as required
by § 195.446(e)(5). Specifically, CRM Plan, section 6.17.2.1 only paraphrased the regulation
and identified the personnel responsible to conduct the review. Missing from the CRM Plan was
what would be evaluated as part of the review, metrics for determining effectiveness, and how
deficiencies would be addressed and resulting plan modifications.
The CRM Plan must be amended to include the details of what will be reviewed to determine
effectiveness of the alarm management plan. For example, the CRM Plan could include a review
of KPIs to determine whether the alarm management plan meets the expected performance
outcomes, a review to determine whether the work order ticket process facilitates quick repair, an
evaluation to verify set points are not being changed without knowledge through the MOC, etc.
As appropriate, the CRM Plan must include some criteria that determines the effectiveness of the
plan.
11. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(h) Training. Each operator must establish a controller training program and
review the training program content to identify potential improvements at least
once each calendar year, but at intervals not to exceed 15 months. An operator's
program must provide for training each controller to carry out the roles and
responsibilities defined by the operator. In addition, the training program must
include the following elements:
Holly Energy’s CRM Plan did not adequately describe the training program and process to
review the training program content once each calendar year not to exceed 15 months, as
required by § 195.446(h). Holly Energy developed and implemented a compliant training
program; however, they did not define any of it in the CRM Plan. CRM Plan, section 9,
provided a very high level of training components and in many subsections paraphrased the
regulation. CRM Plan section 9.8.1 stated:
The HEP Training Program contains a process for managing changes to the
course materials due to technological advances, regulatory requirements,
procedural revisions, Lessons Learned captured during Incident Investigation,
and through Controller feedback, etc. During the annual review of the Control
Room Management Plan, the Review Board will discuss the Controller training



process and make updates, if necessary, to the process and this section. This
will be documented in the summary overview document referenced in CRMP
Section 1.5.
Because the training program is a stand-alone program and is currently a practice rather than a
procedure, the content review process was not documented. The CRM Plan must be modified to
describe the training program, how it provides for training each controller to carry out the roles
and responsibilities defined by the operator, and detail how the annual review of the training
program content will be conducted and documented.
12. § 195.446 Control Room Management.
(a) General. This section applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or part of a
pipeline facility through a SCADA system. Each operator must have and follow
written control room management procedures that implement the requirements of
this section.…
(b) . . . .
(h) Training. Each operator must establish a controller training program and
review the training program content to identify potential improvements at least
once each calendar year, but at intervals not to exceed 15 months. An operator's
program must provide for training each controller to carry out the roles and
responsibilities defined by the operator. In addition, the training program must
include the following elements:
(1) . . . .
(6) Control room team training and exercises that include both controllers and other
individuals, defined by the operator, who would reasonably be expected to
operationally collaborate with controllers (control room personnel) during normal,
abnormal or emergency situations. Operators must comply with the team training
requirements under this paragraph no later than January 23, 2018.
Holly Energy’s CRM Plan did not adequately define who was required to participate in the team
training meeting, per the requirements of § 195.446(h)(6). CRM Plan, section 9.6.1, identified
other individuals, defined by Holly Energy, who would reasonably be expected to operationally
collaborate with controllers (control room personnel) during normal, abnormal or emergency
situations. However, the CRM Plan was vague in how the team training will be conducted.
Holly Energy used the list contained in CRM Plan section 9.6.1, to act as a speakers list. These
individuals were invited to make presentations to the controllers. This process offered the
controllers opportunities to ask questions and interact and network with some of the identified
individuals. However, these identified individuals were not invited to participate in the team
training meeting. The CRM Plan should be modified to allow for controllers and other
individuals to participate as equal members in the team training meeting. The meetings must
include at least one controller.



Response to this Notice
This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 CFR § 190.206. Enclosed as
part of this Notice is a document entitled Response Options for Pipeline Operators in
Enforcement Proceedings.
Please refer to this document and note the response options. Be advised that all material you
submit in response to this enforcement action is subject to being made publicly available. If you
believe that any portion of your responsive material qualifies for confidential treatment under
5 U.S.C. § 552(b), along with the complete original document you must provide a second copy
of the document with the portions you believe qualify for confidential treatment redacted and an
explanation of why you believe the redacted information qualifies for confidential treatment
under 5 U.S.C. § 552(b).
Following the receipt of this Notice, you have 30 days to submit written comments, revised
procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of
receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this
Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in
this Notice without further notice to you and to issue an Order Directing Amendment. If your
plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend
your plans or procedures to correct the inadequacies (49 CFR § 190.206). If you are not
contesting this Notice, we propose that you submit your amended procedures to my office within
30 days of receipt of this Notice. This period may be extended by written request for good
cause. Once the inadequacies identified herein have been addressed in your amended procedures,
this enforcement action will be closed.
It is requested (not mandated) that Holly Energy LP maintain documentation of the safety
improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of
plans, procedures) and submit the total to the
- **truncated:** true
- **body characters:** 42341