BRIDGER PIPELINE LLC — Notice of Amendment

party submissionOfficial PDF32026009NOA_Operator Response to Notice and Request for Time Extension (REDACTED)_06192026_(25-332208).pdf#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 1Official PDFU.S. Department of Transportation Pipeline and Hazardous Materials Safety Administration 1100 Main Street, Suite 800 Kansas City, MO 64105 (816) 329-3800 NOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: tad.true@truecos.com; Ken.Dockweiler@truecos.com; kevin.pena@truecos.com May 20, 2026 Tad True Chief Operating Officer Bridger Pipeline, LLC 455 North Poplar Street Casper, WY 82602 CPF 3-2026-009-NOA Dear Mr. True: From July 7, 2025, through July 25, 2025, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), conducted an inspection of Bridger Pipeline, LLC (Bridger) procedures for its control room in Casper, Wyoming. As a result of the inspection, PHMSA has identified the apparent inadequacies within Bridger’s control room management plans or procedures. The items inspected, alleged inadequacies, and proposed revisions are described below: 1. § 195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . .#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 2(b) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) Implement API RP 1165 (incorporated by reference, see § 195.3) whenever a SCADA system is added, expanded or replaced, unless the operator demonstrates that certain provisions of API RP 1165 are not practical for the SCADA system used; Bridger’s Control Room Management (CRM) procedures were not adequate to provide its controllers with the information, tools, processes, and procedures necessary for the controllers to carry out the roles and responsibilities the operator defined. Specifically, the CRM procedures did not implement API RP 1165 for when a SCADA system is added, expanded, or replaced. API RP 1165, section 5, states: 5.3 DISPLAY RESPONSE Display sub-system response is a function of both hardware performance and software design. In modern SCADA systems that use client server architecture, both the host (server) and HMI computer (client) can affect the initial display call up time and data refresh rate. Once installed, display response times should be periodically reviewed. Bridger did not utilize an HMI style guide, nor define display call up time or data refresh rate by design in the CRM procedures. A process to review data refresh rates is not included in other sections of the CRM procedures or documentation. Per API RP 1165, section 5.3, display response times should be periodically reviewed. Display call up time and data refresh rate are an aspect of SCADA system performance, and a critical part of the information, tools and processes needed for controllers to carry out roles and responsibilities associated with abnormal operations. Without knowing how the SCADA system is to perform by design, implementing changes can degrade SCADA system performance. This change in performance may go undetected, impacting information, tools and process necessary for the controllers to carry out their roles and responsibilities. Knowing SCADA system performance and how to determine that the current system is performing as originally designed (or better) after implementing a change (hardware or software related) is essential to prompt detection and response to abnormal operations. Abnormal operations, such as non-CPM leak detection systems generated alarms, detection of a cyber breach through the slowdown of processes or receiving information that a valve has been moved on an uncommand basis are all impacted by SCADA system performance display call up time and data refresh rate. Bridger must amend its CRM procedures to include a periodic review of display call up time and data refresh rate, whenever a SCADA system is added, expanded, or replaced, as required by § 195.446(c)(1). 2#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 32. § 195.446 Control Room Management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months; Bridger’s Control Room Management (CRM) procedures did not adequately implement the requirements of internal communication plan testing and verification under § 195.446(c)(3). The CRM procedures in section 3.5, Internal Communication Plan (ICP), stated, “If adequate resources ARE NOT available, steps will be taken to shut down the affected pipeline asset following safe shut down practices. Once a shutdown has been complete, the field personnel performing the shutdown shall communicate to the Control Room the task is complete.” When a pipeline is shutdown and not purged, the pipeline is still in operation. The internal communication plan for manual operations does not adequately describe what will be done to continue safe manual operations for the pipeline when it is shut down and not purged. The CRM procedures or other referenced procedures must be amended to adequately describe what will be done to continue safe manual operations of the pipeline regardless of resource availability when shutdown must continue in manual operations. 3. § 195.446 Control Room Management (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section.… (b) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . 3#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 4(4) Test any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months; and Bridger’s Control Room Management (CRM) procedures were not adequate to effectuate testing any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months, as required by § 195.446(c)(4). The CRM procedures in section 3.9 referenced Appendix F: Backup Control Room Activation. Step 12 of Appendix F stated, "Once back in the Primary Control Room, Controllers will immediately confirm that all normally used programs (SCADA and business network including POEMS and Outlook), and equipment are functional." These procedures did not indicate what form, or documentation will be used to confirm proper functioning when returning to the Primary from the backup. In addition, the seven steps currently identified in section 2.14 of the CRM procedures must be included in Appendix F to ensure proper implementation of the backup test. Furthermore, the procedures did not include documenting whether a server change was necessary when moving back to the Primary. This must be documented when testing any backup SCADA systems. If an issue arises during the transfer back to the Primary, knowing whether a server change was necessary may be required to return all functions to normal and end the test. CRM Form 302, currently used during backup testing, must also identify the duration of the backup test (start times and end times). Bridger CRM procedures also require clarification on what record will be used to document a transfer to the backup location due to an evacuation when an ICP is not activated for manual operation. The CRM procedures in section 2.14, Pipeline Control Room Evacuations, indicated that the backup location would be used for any evacuation, planned or unplanned. However, there was no reference to Form 302 being used should this actual event occur. The procedures must clarify what documentation would be used if an actual event occurred to confirm that the backup location is functioning properly. 4. 195.446 Control room management (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (1) . . . . (2) Identify at least once each calendar month points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual 4#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 5values for periods of time exceeding that required for associated maintenance or operating activities; Bridger’s Control Room Management (CRM) procedures, section 5.9, Monthly SCADA Safety Alarms Reviews, were not adequate to identify at least once each calendar month points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of time exceeding that required for associated maintenance or operating activities, as required by § 195.446(e)(2). Specifically, the procedures failed to include multiple sources of safety alarm data that must be included in the annual review. It also failed to describe how some of these sources of data were prepared. For example, • Off-Scan – A spreadsheet (the Assistant Control Center Supervisor SCADA spreadsheet) was presented during the inspection. It was reported to have the off- scan points listed in this spreadsheet. However, how this spreadsheet was prepared and what conditions were included was not clear in the procedures. Off- scan also needs to include the Flowstate process that would be used to determine if points were not on-scan and the impact to the Flowstate leak detection segment. For Flowstate, when a segment is offline, it is called suspended. This was not included in the monthly review. • Inhibited alarms – A spreadsheet (the Assistant Control Center Supervisor SCADA spreadsheet) was presented during the inspection. The alarm inhibit feature is accomplished in a different way than the off-scan status, yet this was not explained in the procedure (but was included in the same output file). Similarly, Flowstate alarms could also be inhibited but they were not part of the monthly review. PHMSA was also informed that this can be recorded on the PL 913 and 501 forms. This needs to be added to the monthly review process. If any other type of alarm suspension or alarm shelving is used, this needs to be included as part of the monthly review process. • False alarms – False alarms include top activations, chattering alarms, fleeting alarms, and controller identified alarms with incorrect setpoints. False alarms can also be found in PL 913 and 501 forms. For Flowstate, false alarms are documented in Alarm Log. POEMs also has information where controllers document False Alarm. There may be false alarms identified in the operating notices or abnormal operations documentation as well. However, only a portion of these conditions were included in the monthly reviews. • Forced – A spreadsheet ( the Assistant Control Center Supervisor SCADA spreadsheet) was presented during the inspection. It was not clear how a forced value would be identified and placed in the spreadsheet. The current process and procedures did not identify how a forced value occurring at the end device or the PLC would be determined. Flowstate does have a stale data alarm, and this can be found in the alarm log; but it had not been incorporated into the monthly 5#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 6review. It was also not clear how loss of communication would be included in the monthly alarm review. • Manual – During the inspection, manual modes and switching were discussed. While this was not typically done, data had not been reviewed for valves or pumps that may have automatic/manual or local/remote, hand-off-auto, or position indicators available for review. This requires inclusion in the monthly alarm review process. The CRM procedure in section 5.9 requires amendment to include all relevant procedures, reports, and sources of data for various points’ status discussed above. It must also describe the process used to identify or prepare them. In addition, during the discussion on the monthly alarm process, PHMSA identified several definitions used by Bridger that need to be clarified in the procedures or process documentation. Stale Alarms need to be identified by the procedures as an alarm that takes longer than 24 hours to clear. Standing Alarms need to be defined as alarms that have not been cleared. Out-of-Service indication in SCADA needs clarified to indicate that the alarm will still come in to the controller. 5. 195.446 Control room management (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (1) . . . . (3) Verify the correct safety-related alarm set-point values and alarm descriptions when associated field instruments are calibrated or changed and at least once each calendar year, but at intervals not to exceed 15 months; Bridger’s CRM procedures were not adequate to verify the correct safety-related alarm set-point values and alarm descriptions when associated field instruments are calibrated or changed at least once each calendar year, but at intervals not to exceed 15 months, as required by § 195.446(e)(3). The CRM procedure in sections 5.10 through 5.11 did not address how calibration of field instruments, including that of pressure switches providing low pressure alarms, are verified to be the correct values. The procedure must be amended to include calibration of field instruments. 6#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 76. 195.446 Control room management (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (j) Compliance and deviations. An operator must maintain for review during inspection: (1) Records that demonstrate compliance with the requirements of this section. Bridger’s CRM procedure was not adequate to ensure that records demonstrating compliance with § 195.446(j)(1) were maintained. For example, § 195.446(e)(2) is the monthly alarm review process requirement. Identified deficiencies found during the monthly alarm review process need to result in a record that demonstrates how the deficiencies were addressed, per the requirement of § 195.446(e)(6). Additionally, while the CRM plan in section 5.12, Controller Workload Review, indicated that steps will be made to address any deficiencies, it did not state that a record that will demonstrate the deficiencies were addressed. Each of the different elements in § 195.446(e)(1) through (e)(5) must have a process resulting in a record to demonstrate that deficiencies were addressed to satisfy the requirements of § 195.446(j)(1). The CRM procedure must be amended to address the lack of record generation. 7. § 195.446 Control room management (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. . . . (b) . . . . (g) Operating experience. Each operator must assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures by performing each of the following: (1) Review accidents that must be reported pursuant to § 195.50 and 195.52 to determine if control room actions contributed to the event and, if so, correct, where necessary, deficiencies related to: (i) Controller fatigue; (ii) Field equipment; (iii) The operation of any relief device; (iv) Procedures; (v) SCADA system configuration; and (vi) SCADA system performance. 7#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 8Bridger’s CRM procedures were not adequate to ensure that lessons learned from its operating experience are incorporated, as appropriate, into its CRM procedures. Specifically, the procedures failed to identify how each of the required conditions under (g)(1) would be reviewed for a deficiencies and corrections. The procedures did not define what would be reviewed for accidents to determine if the control room actions contributed to the event, such as the alarm and event log. The procedures did not define how a deficiency in controller fatigue, field equipment, the operation of any relief device, procedures, SCADA system configuration and SCADA system performance would be found or determined to exist. In addition, Section 7 of the CRM procedures referred to the Operations and Maintenance Manual Section 7.7 Emergency Procedures. Section 7.7 was called Post Accident Review and references 49 CFR § 195.402(e)(9). Section 7.7 stated a post-accident review shall commence within 45 days of an accident no longer being classified as an emergency event. It was not clear in procedures what would cause an event to be considered no longer an emergency. The procedures must be amended to ensure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures and all aspects of § 195.446 (g)(1) are reviewed. Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 CFR § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Enforcement Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. § 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. § 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under § 190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 CFR § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of 8#

32026009NOA_Notice of Amendment_05202026_(25-332208)_text.pdf, page 9this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that Bridger Pipeline, LLC maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to the Director, Central Region, Pipeline and Hazardous Materials Safety Administration, Office of Pipeline Safety. In correspondence concerning this matter, please refer to CPF 3-2026-009-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, AJ McKean Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings cc: Ken Dockweiler, Director Government and Control Center, ken.dockweiler@truecos.com Kevin Pena, Pipeline Compliance Coordinator, kevin.pena@truecos.com 9#