EXXONMOBIL PIPELINE CO — Notice of Amendment

party submissionOfficial PDF520125017M_Operator_Response_and_Request_For_Hearing_12212012.pdf#

520125017M_Notice of Amendment_10102012_text.pdf, page 1Official PDFNOTICE OF AMENDMENT CERTIFIED MAIL – RETURN RECEIPT REQUESTED October 10, 2012 Mr. Gary Pruessing President ExxonMobil Pipeline Company 800 Bell Street, Suite 741D Houston, TX 77022 CPF 5-2012-5017M Dear Mr. Pruessing: During the weeks of December 5, 2011 and April 23, 2012, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code, inspected ExxonMobil Pipeline Company (EMCO)’s program and procedures for Control Room Management (CRM) in Houston, Texas. On the basis of the inspection, PHMSA identified apparent inadequacies within EMCO’s CRM plans or procedures, as described below: 1. §195.446 Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011 and implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. The procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later than August 1, 2012. The training procedures required by paragraph (h) must be implemented no later than August 1, 2012 except that any#

520125017M_Notice of Amendment_10102012_text.pdf, page 2training required by another paragraph of this section must be implemented no later than the deadline for that paragraph. At the time of the inspection, EMCO had not developed a documented process to review their pipeline assets to determine control room locations and the specific control room written procedures to be used. A complete and formal process identifying control locations, specific assets, and applicable written CRM procedures is necessary. EMCO did identify an additional control room in Pasadena, Texas prior to the CRM inspection but it appears that this was an ad hoc addition not based on a formal process for asset review. At the time of this inspection, the plan reviewed by PHMSA did not have an applicability section with procedures, established criteria, and asset information that could be reviewed periodically to identify of additional control rooms. Also, EMCO’s CRM plan did not include a documented process to identify correct form changes, versions, and their incorporation into the plan. 2. §195.446 Control room management. (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following: (1) A controller's authority and responsibility to make decisions and take actions during normal operations; At the time of the inspection, EMCO’s CRM plan did include a section on controller’s roles and responsibilities; however, PHMSA identified a few areas that the CRM procedures did not adequately address. They are: • EMCO is utilizing a “Trouble log” to document events that occur during a controller’s shift but the procedures do not specifically require entries to be added to the trouble log. • EMCO’s CRM did not include a process to review of all EMCO’s manuals, including any O&M and Emergency Procedure, OMIS or other procedural documents to verify that all controller roles and responsibilities had been identified. • EMCO’s CRM did not clearly identify all activities that a controller can and cannot do, e.g. points-off-scan in this section or throughout the other CRM documentation. • EMCO did not include specific cross-training criteria or console combination requirements. For example, generic versus console specific training/cross-training may change controller roles and responsibilities, e.g. checking elevation profiles on line M-70. • EMCO did not consider having the supervisors complete cross-training on what may be considered by the controllers and management as the most difficult console/s, or implement a subject matter expert (SME) call-out process for the most difficult consoles. 3. §195.446 Control room management. (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following: 2#

520125017M_Notice of Amendment_10102012_text.pdf, page 3(2) A controller's role when an abnormal operating condition is detected, even if the controller is not the first to detect the condition, including the controller's responsibility to take specific actions and to communicate with others; (3) A controller's role during an emergency, even if the controller is not the first to detect the emergency, including the controller's responsibility to take specific actions and to communicate with others; and During the inspection, it was noted that EMCO’s leak detection and communication loss parameters were set at historical figures without considering potential consequences. Data parameters and data must be periodically reviewed to understand appropriate values in contrast to only doing what has been done historically. Values used for leak detection regarding deviations, rate of change (ROC), 15 minute, 1 hour, 24 hours must be substantiated through data review. This also applies to the 30-minute communication loss limit. 4. §195.446 Control room management. (b) Roles and responsibilities. Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controller's prompt and appropriate response to operating conditions, an operator must define each of the following: (4) A method of recording controller shift-changes and any hand-over of responsibility between controllers. At the time of the inspection, EMCO had general procedures for shift changes. These procedures, however, did not specify that it is the responsibility of the controller to not turn over control to someone unfit for duty per the training they received concerning fatigue and fitness for service. Also, EMCO’s CRM had a section covering roles and responsibilities that included general procedures for shift change but did not have records that the shift hand over check sheet was implemented by October 1, 2011. Records indicated that the shift hand over check sheet was implemented on November 14, 2011. Also, fatigue training was documented for all but two controllers. This was corrected after the first week of the audit. 5. §195.446 Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: During the inspection, PHMSA conducted a physical walkthrough of the EMCO Control Center. PHMSA inspectors noticed that EMCO has an unwritten process for controllers to review new operating instructions (OI) that includes each controller checking an area called, “the box” for new and/or updated procedures and new information relevant to the operation of the Operations Control Center. EMCO’s CRM procedures did not include this process. Also, EMCO’s written procedures did not specify how the new operating instruction (OI) procedural update check-off box is to be reviewed and documented. A list of individuals or some other methodology to understand who and when each controller has reviewed new procedures is suggested. 3#

520125017M_Notice of Amendment_10102012_text.pdf, page 46. §195.446 Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) Implement API RP 1165 (incorporated by reference, see § 195.3) whenever a SCADA system is added, expanded or replaced, unless the operator demonstrates that certain provisions of API RP 1165 are not practical for the SCADA system used; At the time of the inspection, EMCO’s CRM included a general statement that EMCO intended to comply with all regulatory requirements including referenced industry standards including API 1165. EMCO did not include specific procedures to clarify what additions or expansions will require RP1165 implementations. Also, items not specifically addressed were: • A review of all displays for RP1165 compliance and summarize the review including sufficient documentation. • That the display review will include consistency requirements between screens and consoles and also verify that the CRM has color choices that are well defined. At the time of the inspection, there was apparent inconsistency between colors and it was not clear how color usage was described in the CRM, especially for wheat and white. • a requirement to note all display changes made. 7. §195.446 Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays; During the inspection, it was noted that EMCO personnel were able to describe the process for their practice for conducting point-to-point verification, however, the process was not written in the CRM plan. EMCO’s CRM did not include a clear step-by-step process for completing their point-to-point and pseudo point check outs including when and how these are to be performed. 8. §195.446 Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months; 4#

520125017M_Notice of Amendment_10102012_text.pdf, page 5During the review of the EMCO communication plan, PHMSA noted that the plan contained general testing protocols. The tests did not include specific documentation to support that an actual test has occurred and what was actually tested. EMCO’s communication plan did not require verification of what was tested, including appropriate test results, and if whatever did not work was fixed. Specifics regarding when to shut down a pipeline was not required to be included as part of the internal communications plan. Also, EMCO’s communication plan did not require all tests to be documented. Appropriate records will help show that, in the future, Closed Loop Control, ESD or Cascade Shutdown Functions, are implemented consistently across consoles. PHMSA noted that EMCO did not specifically include in their written procedures to continue to review this testing on their West Coast system regarding ESD or Hi pressure switch options. 9. §195.446 Control room management. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (1) Establish shift lengths and schedule rotations that provide controllers off-duty time sufficient to achieve eight hours of continuous sleep; PHMSA noted that EMCO’s Fatigue Risk Management Plan (FRMP) had a number of good attributes. There were, however, a number of areas where PHMSA noted deficiencies in the procedures reviewed. A number of the issues noted were realized when EMCO personnel verbally augmented their written procedures with additional explanation on what is actually accomplished when and by whom. The CRM rule requires operators to formalize their actual actions and processes in a formal written format that includes a complete documentation system. PHMSA also noted that EMCO has executive management involvement and support for their FRMP. The details on what organizational level of involvement are to be included and how this will be implemented was note detailed in the plan. PHMSA also noted the following inadequacies: • EMCO’s FRMP did not consistently use the acronym “FRMP” and the concept of a Fatigue Management Plan in the CRM. PHMSA experienced some confusion when reading the FRMS because of inconsistent use of these terms. • EMCO’s Fatigue Management Plan did not include a description of what would be done if a controller self-reports as being too fatigued to perform pipeline duties. • EMCO’s Fatigue Management Plan did not include additional fatigue mitigation measures (such as standing, radio, lights, temperature controls, double-checking of lists, others checking work, etc.). • EMCO did not add the accident reporting requirements from section 6.2 of the CRM plan to the FRMP. • In section 3.5 (page 71) the next to the last bullet references policies and procedures but the specifics of which policies and procedures were not noted and were not available for review. • EMCO did not clarify in their manual what OCC-1 consists of (example: Sections - 3.8; 3.8.1; 3.8.2). This could cause confusion on the part of the reader or reviewer. 5#

520125017M_Notice of Amendment_10102012_text.pdf, page 610. §195.446 Control room management. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (2) Educate controllers and supervisors in fatigue mitigation strategies and how off- duty activities contribute to fatigue; EMCO’s FRMP had a number of deficiencies noted with respect to educating controllers in fatigue mitigation strategies and associated processes. Each issue identified is detailed below: • EMCO’s procedures did not discuss higher risk operation times and require appropriate fatigue mitigation measure implementation (hours 9-12 of each 12 hour shift, 2-6 am, 3 nights or more rotation). • EMCO did not clarify whether or not section 3.7.2; the first bullet (14 hours) includes shift exchange and commute times. • EMCO did not specify in section 3.2 - Definition of On-Duty Time is to include all hours worked as an employee. • EMCO did not specify in section 3.3 - OCC Shift Supervisor, a description of what will be done if a controller is not fit for duty due to fatigue. • EMCO did not clarify in the plan the role of Supervisors being qualified (all titles included) schedulers, and D-4 Controllers. PHMSA also noted that D-4 Controllers are initially scheduled to work days for an entire year. • EMCO did not state in the plan that no “on-call” controllers are utilized. • Chronic fatigue is not addressed in the plan reviewed. EMCO’s FRMP did not have any notation that chronic fatigue is addressed in the training program for Supervisors and Controllers. • EMCO did not consider including absenteeism as a provision in the monthly review regarding the number of Controllers needed. • EMCO did not state that all remote training associated with fatigue needs to be included in total hours of service (HOS). • EMCO did not include all fatigue mitigation measures on the OCC-1 form and also, did not include risk analysis, times, dates, and shifts worked on the form. • EMCO did not include in their manual that all emergency deviations with respect to time worked will be recorded on the OCC-1 form as verbally described. • EMCO did not include in their written procedures that fatigue management training must be conducted once each calendar year not to exceed 15 months. • EMCO’s personnel discussed the performance review and reward system and the near loss system which included loss and prevention observations (LPO). This area was not detailed in the plan. It is suggested that this area be further developed and the process to be utilized more fully described. This could be a good indicator that a fatigue issue occurred. • EMCO did not have a process to verify that all time-on-task has been included in the fatigue management training module. • EMCO did not include the requirement to review the fatigue management plan for effectiveness each calendar year not to exceed 15 months. 6#

520125017M_Notice of Amendment_10102012_text.pdf, page 711. §195.446 Control room management. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (4) Establish a maximum limit on controller hours-of-service, which may provide for an emergency deviation from the maximum limit if necessary for the safe operation of a pipeline facility. EMCO’s FRMP had a number of deficiencies noted with respect to establishing a maximum limit on controllers HOS. Each issue identified is detailed below: • EMCO’s Fatigue Management Plan did not address unforeseen schedule revisions. • Section 3.7.1 did not clarify whether or not 12 hours includes shift hand-over or shift exchange time and commute time. • Section 3.7.5 did not describe how work hours agree with the rest of the Fatigue Risk Management Plan requirements. For example, the procedure did not define what specifically is meant by abnormal operations as opposed to emergency deviations. 12. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: EMCO’s Alarm Management Plan as presented had a number of good attributes. There were, however, a number of areas where PHMSA noted deficiencies in the procedures reviewed. A number of the issues noted were realized when EMCO personnel verbally augmented their written procedures with additional explanation on what is actually accomplished when and by whom. The CRM rule requires operators to formalize their actual actions and processes in a written format including a complete documentation system. Each issue identified is detailed below: • The definition section of the Alarm Management Plan was not specific enough to ensure all appropriate personnel understand the difference between the following terms; notification, alert, CSE – Critical Safety Equipment, SSCR, tags, OIMS, PV Filtering, inaccurate, false, stale data (noted as old data or white data), suppress versus inhibit and other utilized abbreviations in the definitions. • EMCO did not adequately define how various teams interact for example, Alarm Management Team versus the Alarm Rationalization Team. • Loss Prevention Observations were not included in the Alarm Management Plan. EMCO’s procedures did not fully describe this process and documentation required to support decisions made. • Leak Detection elements were not connected to the Alarm Management Plan. • EMCO’s procedures did not adequately define the difference between “class” versus “priority”. • EMCO’s procedures did not adequately define and consistently use the terms “Critical”, “Major” and “Alert.” EMCO personnel verbally described to PHMSA the meaning of 7#

520125017M_Notice of Amendment_10102012_text.pdf, page 8each term is actually “CR”, “HiAud”, and “HiNoAud” respectively. Also, the plan did not identify the associated referenced colors. EMCO’s plan did not include an explanation of how these priorities can also affect audible alarm indications. • EMCO did not address stale data and forced data (whether at the PLC/RTU or SCADA level) and that these must be reviewed monthly. • Section 4.12 did not include a specific interval for an internal audit. The use of “periodic” is not considered adequate. 13. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (1) Review SCADA safety-related alarm operations using a process that ensures alarms are accurate and support safe pipeline operations; EMCO’s Alarm Management Plan, specifically as the plan relates to ensuring alarms are accurate and support safe pipeline operations, was not fully developed. There were a number of areas where PHMSA noted deficiencies in the procedures reviewed. Each issue identified is detailed below: • EMCO’s CRM did not adequately define which alarms are Safety Related Alarms. • EMCO did not include a detailed process for conducting their monthly alarm review process. • EMCO did not adequately define rate-of-change (ROC) alarms that are to be included in the plan with respect to various set points and purpose. • EMCO did not include a discussion around the use of trouble logs and associated maintenance in the plan. • EMCO did not include consideration of using a HAZOPs review to provide additional information concerning the Alarm Management plan. • The EMCO Alarm Management plan did not include soft-pseudo points and a discussion around these types of points. • EMCO did not define the difference between “Critical” and “Operations Critical” in the CRM document. • EMCO did not define all associated metrics in all referenced sections. • If EMCO is not going to use alarm groupings then eliminate this discussion from the Alarm Management Plan. 14. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (2) Identify at least once each calendar month points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of time exceeding that required for associated maintenance or operating activities; 8#

520125017M_Notice of Amendment_10102012_text.pdf, page 9EMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to identifying points affecting safety that have been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms, or that have had forced or manual values for periods of time exceeding that required for associated maintenance or operating activities. Each specific issue is identified below: • EMCO did not include in their written procedures how suppression techniques will be implemented and this was not included in the Alarm Management Plan. • In Section 4.8.3 - EMCO did not identify who can take points “Off-Scan” or “Out-of- Service” and whether or not this will ever be performed. If this is to be performed, EMCO’s plan did not explain under what conditions this will be allowed. • EMCO did not define what alarm provision attributes per point can be changed by the controller and what will be used routinely in the system. • EMCO did not define inhibit functions, how inhibited points will be reviewed, if individual parameters are inhibited, and how inhibited parameters will be corrected. Also, EMCO did not explain what roles or job functions can inhibit points and individual alarm parameters. • EMCO’s audit forms did not include what problem was identified, what was done to correct the problem, when the correction was implemented and when the condition was found. • EMCO did not state in the Alarm Management Plan that the “White M” on the display means the equipment is in manual mode. • EMCO did not include a “not to exceed” timeframe in section 4.8.1 Alarm Attribute. It currently addresses alarm settings and a review “after significant operating experience.” • EMCO did not include that “False” alarms must be reviewed and reported on a monthly basis and that corrective actions must be noted. • Chronic Alarm Management or Equipment failure issues are addressed through the trouble log but this was not included in the Alarm Management plan. • EMCO did not include in the CRM plan a discussion about how controllers have input into alarm descriptors and how their understanding is confirmed. • EMCO did not include in the operating instructions, a statement that alarm set point limits are available to the controller. 15. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (3) Verify the correct safety-related alarm setpoint values and alarm descriptions when associated field instruments are calibrated or changed and at least once each calendar year, but at intervals not to exceed 15 months. EMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to verifying the correct safety-related alarm set point values and alarm descriptions when associated field instruments are calibrated or changed. Each issue is identified below: 9#

520125017M_Notice of Amendment_10102012_text.pdf, page 10• EMCO did not have an adequate and complete procedure for their E&I design practice in section 9.7 and 11 and how the interface will work in the Alarm Management Plan. • EMCO’s documentation did not include a requirement that information about set point values, “as found” and “as left” are to be recorded during the Alarm Management Plan’s alarm set point review that occurs once each calendar year not to exceed to 15 months. 16. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (4) Review the alarm management plan required by this paragraph at least once each calendar year, but at intervals not exceeding 15 months, to determine the effectiveness of the plan; EMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to reviewing the alarm management plan at least once each calendar year, but at intervals not exceeding 15 months, to determine the effectiveness of the plan. Each issue is identified below: • EMCO did not include that the Alarm Management Plan must be reviewed once each calendar year not to exceed 15 months for effectiveness. • The format EMCO is utilizing for recording the effectiveness of their CRM has not been created. 17. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (5) Monitor the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms; and EMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to monitoring the content and volume of general activity being directed to and required of each controller at least once each calendar year, but at intervals not exceeding 15 months, that will assure controllers have sufficient time to analyze and react to incoming alarms. Each issue is identified below: • EMCO’s Alarm Management Plan did not include adequate formality around monitoring the content and volume of alarms received per console and how various metrics will lead to additional console creation. The workload study discussed during the inspection and associated planning has not been implemented, finalized or reflected in the plan. • EMCO did not address that all cross-training is to be considered added duties and must be considered in any overall volume of activity review. 10#

520125017M_Notice of Amendment_10102012_text.pdf, page 11• EMCO did not consider the number of temporary alarm set-point changes in the volume of activity considerations. • Metrics regarding Day/Night shift and weekend versus week metrics have not been finalized. • Slack line conditions, timer setting requirements, number of points, and number of commands were not included in the work load study. • The appropriate criterion for acceptable controller performance has not been developed. 18. §195.446 Control room management. (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator's plan must include provisions to: (6) Address deficiencies identified through the implementation of paragraphs (e)(1) through (e)(5) of this section. EMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to addressing deficiencies identified through the implementation of paragraphs (e)(1) through (e)(5) of this section. Each issue is identified below: • Deficiency documentation was not adequately developed and did not include the information regarding when a situation was found and then corrected and what was done to correct the problem. • A method to prioritize deficiencies found was not included and discussed in the Alarm Management Plan. • EMCO’s Alarm Management plan procedures did not provide adequate detail to perform the effectiveness review and what actions will be included as part of the effectiveness review. 19. §195.446 Control room management. (f) Change management. Each operator must assure that changes that could affect control room operations are coordinated with the control room personnel by performing each of the following: (1) Implement section 7 of API RP 1168 (incorporated by reference, see § 195.3) for control room management change and require coordination between control room representatives, operator's management, and associated field personnel when planning and implementing physical changes to pipeline equipment or configuration; and (2) Require its field personnel to contact the control room when emergency conditions exist and when making field changes that affect control room operations. EMCO’s Change Management Plan as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to implementing section 7 of API RP 1168 for control room management change and requiring coordination between control room representatives, operator's management, and associated field personnel when planning and implementing physical changes to pipeline equipment or configuration. Each issue is identified below: 11#

520125017M_Notice of Amendment_10102012_text.pdf, page 12• EMCO’s Management of Change (MOC) documentation did not describe the actual changes made and what was changed in accordance with the verbal representations of EMCO personnel during the inspection including addressing formality associated with the MOC closure process (sign-off). • EMCO’s calibrating procedures for reviewing alarm set points did not include all applicable details as described verbally by EMCO personnel during the inspection. • EMCO did not incorporate the use of “the box” for controllers to review recent changes and modifications to OIs or equipment. • EMCO did not include asset changes in the CRM manual regarding the SCCR or MOC process. 20. §195.446 Control room management. (g) Operating experience. Each operator must assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures by performing each of the following: (2) Include lessons learned from the operator's experience in the training program required by this section. EMCO’s procedures for operating experience as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to including lessons learned from the operator's experience in the training program required by this section. Each issue is identified below: • The root cause analysis technique used by EMCO, taproot, was not included in the CRM manual. • The parties responsible for performing the root cause analysis were not identified. • Consider amending the “Near Loss & Loss Investigation Reporting Guide” to state the following: “Determine if Control Room actions or INACTIONS contributed to the event. If so, their deficiencies contributed to:” • Training in not required to be reviewed for consistency with procedures to ensure no erroneous training is conducted. • The operating experience section of the CRM manual did not include all operating experience of note being communicated to the controllers (lessons learned, other selected of value, emails noting specific experience considerations) as described verbally during the inspection. 21. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: 12#

520125017M_Notice of Amendment_10102012_text.pdf, page 13EMCO’s procedures for training as presented had a number of areas where PHMSA noted general deficiencies in the training procedures reviewed. Each issue as identified below: • EMCO’s training section lacked adequate detail and requires more content, substance, and formality to meet the requirements/intent of the code. • EMCO’s use of the terms, “Experienced controllers” and “Inexperienced controllers” is not consistently implemented through-out the training section. • New system asset training has not been addressed in EMCO’s training section of the CRM plan. Class room training, hydraulic review, simulation, and beginning low flow conditions have not been included in the manual. • EMCO has not reviewed controller and cross-training assessment documentation. Hours of Service (HOS) for individuals in training and receiving span-of-control of 1:1 training has not been addressed by signing, (with date and time) the shift change document. • EMCO has not defined what “promptly” means regarding identified improvement implementation. • EMCO has not documented all elements of training in their training plan. • EMCO has not included interviews with supervisors as well as a trainee’s activities in their training plan. Also, EMCO has not constructed formality and implementation references associated with identified improvements in training. • EMCO has not included procedures to cross-check to confirm O&M, Emergency, CRM, and other specific plan sections are addressed in the Roles and Responsibility section and that all roles and responsibilities are covered in the CRM training program. • EMCO has not included the training module completed list for controllers and supervisors in their training plan. • EMCO has not included the power point presentations that are used for controller training in their plan. • EMCO had not emphasized that controllers should “Think leak first” in the training material. • EMCO has not addressed explicitly explaining differences between consoles in the training section (Console 7 versus console 3). 22. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1) Responding to abnormal operating conditions likely to occur simultaneously or in sequence; EMCO’s procedures for training did not include responding to abnormal operating conditions likely to occur simultaneously or in sequence; 13#

520125017M_Notice of Amendment_10102012_text.pdf, page 1423. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (2) Use of a computerized simulator or non-computerized (tabletop) method for training controllers to recognize abnormal operating conditions; EMCO’s procedures for training as presented had a number of areas where PHMSA noted general deficiencies in the training procedures reviewed with respect to the use of a computerized simulator or non-computerized (tabletop) method for training controllers to recognize abnormal operating conditions. Each issue is identified below: • EMCO did not adequately address information about OCC participation in field driven tabletop exercises or spill drills as verbally described by EMCO personnel during the inspection. • EMCO plan does not include consideration for working with executive management to allow controller input to the selection of field tabletop scenarios. 24. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (3) Training controllers on their responsibilities for communication under the operator's emergency response procedures; EMCO has not included simulating AOCs not addressed elsewhere, (communication outages for example) in their training procedures. 25. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (4) Training that will provide a controller a working knowledge of the pipeline system, especially during the development of abnormal operating conditions; and 14#

520125017M_Notice of Amendment_10102012_text.pdf, page 15EMCO’s procedures for training as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to providing a controller a working knowledge of the pipeline system, especially during the development of abnormal operating conditions. EMCO must amend their procedures to address each issue as identified below: • EMCO did not include HAZOPS, trouble logs, and other monthly reviews of lessons learned in their training program. • EMCO did not include covering older selected lesson learned (war stories) with new controllers in their training section. • EMCO did not incorporate operating experience components into their training program, specifically those identified through section G review as discussed verbally during the inspection. 26. §195.446 Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (5) For pipeline operating setups that are periodically, but infrequently used, providing an opportunity for controllers to review relevant procedures in advance of their application. EMCO’s procedures for training as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to pipeline operating setups that are periodically, but infrequently used, providing an opportunity for controllers to review relevant procedures in advance of their application. Each issue as identified below: • EMCO did not include seldom used procedures/set-ups in the training section (example: the leased two lines from DOE regarding flowing at a specific rate once a year and reverse flow considerations.) • EMCO did not include equipment position regarding power failure (well heads fail closed, some tank valves failed closed other equipment does not) in their training program. 27. §195.446 Control room management. (i) Compliance validation. Upon request, operators must submit their procedures to PHMSA or, in the case of an intrastate pipeline facility regulated by a State, to the appropriate State agency. At the time of the inspection, EMCO’s procedures for compliance validation did not include a log to document CRM plan requests and the operator’s response to the requests in section 8.0. EMCO’s procedures did not include the date of the request to submit their plan, the date of the plan submittal, the person’s title responsible for submitting the plans, and the person to whom the plan is submitted. 15#

520125017M_Notice of Amendment_10102012_text.pdf, page 1628. §195.446 Control room management. (j) Compliance and deviations. An operator must maintain for review during inspection: (1) Records that demonstrate compliance with the requirements of this section; and EMCO’s procedures for compliance and deviations as presented had a number of areas where PHMSA noted deficiencies in the procedures reviewed with respect to the requirement that operators must maintain for review during inspection, records that demonstrate compliance with the requirements of this section. EMCO must amend their procedures to address each issue as identified below: • EMCO’s procedures did not ensure that the documentation of deviations applies to all aspects of the CRM plan, not just fatigue and hours of service. • EMCO’s procedures did not provide sufficient detail to know how documentation of deviations will be pulled together for future reference. • EMCO’s procedures did not include information about the various electronic record storage media and associated durations (Tape drive, on SCADA system live data retrieval, I drive, email storage) are utilized as described verbally during the inspection. 29. §195.446 Control room management. (j) Compliance and deviations. An operator must maintain for review during inspection: (2) Documentation to demonstrate that any deviation from the procedures required by this section was necessary for the safe operation of the pipeline facility. At the time of the inspection, EMCO’s procedures did not ensure that deviations must be required as a result of pipeline safety considerations or that the reason for the deviation regarding pipeline safety impact is documented or ensure routine and cyclical deviations are addressed in the CRM manual. Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.237. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue a Final Order. 16#

520125017M_Notice of Amendment_10102012_text.pdf, page 17If, after opportunity for a hearing, your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.237). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that EMCO maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Chris Hoidal, Director, Western Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 5-2012-5017M and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Chris Hoidal Director, Western Region Pipeline and Hazardous Materials Safety Administration Enclosure: Response Options for Pipeline Operators in Compliance Proceedings cc: PHP-60 Compliance Registry PHP-500 P. Katchmar (#136984) 17#

520125017M_closure letter_03012013_text.pdf, page 1Official PDFCERTIFIED MAIL – RETURN RECEIPT REQUESTED March 1, 2013 Mr. Gary Pruessing President ExxonMobil Pipeline Company 800 Bell Street, Suite 741D Houston, TX 77022 CPF 5-2012-5017M Closure Letter Dear Mr. Pruessing: During the weeks of December 5, 2011 and April 23, 2012, representatives from the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to chapter 601 of 49 United States Code, conducted an on-site pipeline safety inspection of ExxonMobil’s procedures in Houston, Texas. As a result of the inspection, ExxonMobil was issued a Notice of Amendment on October 10, 2012, which proposed amendment of your procedures. ExxonMobil submitted its amended procedures on December 21, 2012, and again on February 22, 2013. My staff reviewed the amended procedures, and it appears that the inadequacies outlined in this Notice of Amendment have been corrected. This letter is to inform you no further action is necessary and this case is now closed. Thank you for your cooperation. Sincerely, Chris Hoidal Director, Western Region Pipeline and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 P. Katchmar (#136984)#