{"operation":"document","citation":"CPF 520125017M","title":"EXXONMOBIL PIPELINE CO — Notice of Amendment","source_type":"enforcement","agency":"Pipeline and Hazardous Materials Safety Administration","status":"historical","official":true,"published_on":"2012-10-10","effective_on":null,"summary":"CLOSED notice of amendment citing 195.446(a), 195.446(b)(1), 195.446(b)(2), 195.446(b)(4), 195.446(c), 195.446(c)(1), 195.446(c)(2), 195.446(c)(3), 195.446(d)(1), 195.446(d)(2), 195.446(d)(4), 195.446(e), 195.446(e)(1), 195.446(e)(2), 195.446(e)(3), 195.446(e)(4), 195.446(e)(5), 195.446(e)(6), 195.446(f)(1), 195.446(g)(2), 195.446(h), 195.446(h)(1), 195.446(h)(2), 195.446(h)(3), 195.446(h)(4), 195.446(h)(5), 195.446(i), 195.446(j)(1), 195.446(j)(2).","machine_formats":{"json":"https://regulus.evalyn.ai/document/phmsa-enforcement-520125017m.json","markdown":"https://regulus.evalyn.ai/document/phmsa-enforcement-520125017m.md"},"app_url":"https://regulus.evalyn.ai/document/phmsa-enforcement-520125017m","source_url":"https://primis.phmsa.dot.gov/enforcement-data/case/520125017M","body":"Notice of Amendment involving EXXONMOBIL PIPELINE CO. PHMSA's enforcement data identifies the cited regulations as 195.446(a),  195.446(b)(1),  195.446(b)(2),  195.446(b)(4),  195.446(c),  195.446(c)(1),  195.446(c)(2),  195.446(c)(3),  195.446(d)(1),  195.446(d)(2),  195.446(d)(4),  195.446(e),  195.446(e)(1),  195.446(e)(2),  195.446(e)(3),  195.446(e)(4),  195.446(e)(5),  195.446(e)(6),  195.446(f)(1),  195.446(g)(2),  195.446(h),  195.446(h)(1),  195.446(h)(2),  195.446(h)(3),  195.446(h)(4),  195.446(h)(5),  195.446(i),  195.446(j)(1),  195.446(j)(2). The case was opened on 2012-10-10 and is reported as closed as of 2013-03-01. Open the official case record for notices, responses, orders, and the latest status.\n\nOfficial case documents:\n\n520125017M_closure letter_03012013.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520125017M/520125017M_closure%20letter_03012013.pdf\n\n520125017M_closure letter_03012013_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520125017M/520125017M_closure%20letter_03012013_text.pdf\n\n520125017M_Notice of Amendment_10102012.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520125017M/520125017M_Notice%20of%20Amendment_10102012.pdf\n\n520125017M_Notice of Amendment_10102012_text.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520125017M/520125017M_Notice%20of%20Amendment_10102012_text.pdf\n\n520125017M_Operator_Response_and_Request_For_Hearing_12212012.pdf: https://primis.phmsa.dot.gov/enforcement-documents/520125017M/520125017M_Operator_Response_and_Request_For_Hearing_12212012.pdf\n\n520125017M_Notice of Amendment_10102012_text.pdf\n\nNOTICE OF AMENDMENT\nCERTIFIED MAIL – RETURN RECEIPT REQUESTED\nOctober 10, 2012\nMr. Gary Pruessing\nPresident\nExxonMobil Pipeline Company\n800 Bell Street, Suite 741D\nHouston, TX 77022\nCPF 5-2012-5017M\nDear Mr. Pruessing:\nDuring the weeks of December 5, 2011 and April 23, 2012, representatives of the Pipeline and\nHazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United\nStates Code, inspected ExxonMobil Pipeline Company (EMCO)’s program and procedures for\nControl Room Management (CRM) in Houston, Texas.\nOn the basis of the inspection, PHMSA identified apparent inadequacies within EMCO’s CRM\nplans or procedures, as described below:\n1. §195.446 Control room management.\n(a) General. This section applies to each operator of a pipeline facility with a controller\nworking in a control room who monitors and controls all or part of a pipeline facility\nthrough a SCADA system. Each operator must have and follow written control room\nmanagement procedures that implement the requirements of this section. The\nprocedures required by this section must be integrated, as appropriate, with the\noperator's written procedures required by § 195.402. An operator must develop the\nprocedures no later than August 1, 2011 and implement the procedures according to\nthe following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and\n(d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011.\nThe procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must\nbe implemented no later than August 1, 2012. The training procedures required by\nparagraph (h) must be implemented no later than August 1, 2012 except that any\n\n\n\ntraining required by another paragraph of this section must be implemented no later\nthan the deadline for that paragraph.\nAt the time of the inspection, EMCO had not developed a documented process to review their\npipeline assets to determine control room locations and the specific control room written\nprocedures to be used. A complete and formal process identifying control locations, specific\nassets, and applicable written CRM procedures is necessary. EMCO did identify an additional\ncontrol room in Pasadena, Texas prior to the CRM inspection but it appears that this was an ad\nhoc addition not based on a formal process for asset review. At the time of this inspection, the\nplan reviewed by PHMSA did not have an applicability section with procedures, established\ncriteria, and asset information that could be reviewed periodically to identify of additional\ncontrol rooms. Also, EMCO’s CRM plan did not include a documented process to identify\ncorrect form changes, versions, and their incorporation into the plan.\n2. §195.446 Control room management.\n(b) Roles and responsibilities. Each operator must define the roles and responsibilities\nof a controller during normal, abnormal, and emergency operating conditions. To\nprovide for a controller's prompt and appropriate response to operating conditions, an\noperator must define each of the following:\n(1) A controller's authority and responsibility to make decisions and take actions\nduring normal operations;\nAt the time of the inspection, EMCO’s CRM plan did include a section on controller’s roles and\nresponsibilities; however, PHMSA identified a few areas that the CRM procedures did not\nadequately address. They are:\n• EMCO is utilizing a “Trouble log” to document events that occur during a controller’s\nshift but the procedures do not specifically require entries to be added to the trouble log.\n• EMCO’s CRM did not include a process to review of all EMCO’s manuals, including\nany O&M and Emergency Procedure, OMIS or other procedural documents to verify that\nall controller roles and responsibilities had been identified.\n• EMCO’s CRM did not clearly identify all activities that a controller can and cannot do,\ne.g. points-off-scan in this section or throughout the other CRM documentation.\n• EMCO did not include specific cross-training criteria or console combination\nrequirements. For example, generic versus console specific training/cross-training may\nchange controller roles and responsibilities, e.g. checking elevation profiles on line M-70.\n• EMCO did not consider having the supervisors complete cross-training on what may be\nconsidered by the controllers and management as the most difficult console/s, or\nimplement a subject matter expert (SME) call-out process for the most difficult consoles.\n3. §195.446 Control room management.\n(b) Roles and responsibilities. Each operator must define the roles and responsibilities\nof a controller during normal, abnormal, and emergency operating conditions. To\nprovide for a controller's prompt and appropriate response to operating conditions, an\noperator must define each of the following:\n2\n\n\n\n(2) A controller's role when an abnormal operating condition is detected, even if the\ncontroller is not the first to detect the condition, including the controller's\nresponsibility to take specific actions and to communicate with others;\n(3) A controller's role during an emergency, even if the controller is not the first to\ndetect the emergency, including the controller's responsibility to take specific actions\nand to communicate with others; and\nDuring the inspection, it was noted that EMCO’s leak detection and communication loss\nparameters were set at historical figures without considering potential consequences. Data\nparameters and data must be periodically reviewed to understand appropriate values in contrast\nto only doing what has been done historically. Values used for leak detection regarding\ndeviations, rate of change (ROC), 15 minute, 1 hour, 24 hours must be substantiated through data\nreview. This also applies to the 30-minute communication loss limit.\n4. §195.446 Control room management.\n(b) Roles and responsibilities. Each operator must define the roles and responsibilities\nof a controller during normal, abnormal, and emergency operating conditions. To\nprovide for a controller's prompt and appropriate response to operating conditions, an\noperator must define each of the following:\n(4) A method of recording controller shift-changes and any hand-over of responsibility\nbetween controllers.\nAt the time of the inspection, EMCO had general procedures for shift changes. These\nprocedures, however, did not specify that it is the responsibility of the controller to not turn over\ncontrol to someone unfit for duty per the training they received concerning fatigue and fitness for\nservice. Also, EMCO’s CRM had a section covering roles and responsibilities that included\ngeneral procedures for shift change but did not have records that the shift hand over check sheet\nwas implemented by October 1, 2011. Records indicated that the shift hand over check sheet\nwas implemented on November 14, 2011. Also, fatigue training was documented for all but two\ncontrollers. This was corrected after the first week of the audit.\n5. §195.446 Control room management.\n(c) Provide adequate information. Each operator must provide its controllers with the\ninformation, tools, processes and procedures necessary for the controllers to carry out\nthe roles and responsibilities the operator has defined by performing each of the\nfollowing:\nDuring the inspection, PHMSA conducted a physical walkthrough of the EMCO Control Center.\nPHMSA inspectors noticed that EMCO has an unwritten process for controllers to review new\noperating instructions (OI) that includes each controller checking an area called, “the box” for\nnew and/or updated procedures and new information relevant to the operation of the Operations\nControl Center. EMCO’s CRM procedures did not include this process. Also, EMCO’s written\nprocedures did not specify how the new operating instruction (OI) procedural update check-off\nbox is to be reviewed and documented. A list of individuals or some other methodology to\nunderstand who and when each controller has reviewed new procedures is suggested.\n3\n\n\n\n6. §195.446 Control room management.\n(c) Provide adequate information. Each operator must provide its controllers with the\ninformation, tools, processes and procedures necessary for the controllers to carry out\nthe roles and responsibilities the operator has defined by performing each of the\nfollowing:\n(1) Implement API RP 1165 (incorporated by reference, see § 195.3) whenever a\nSCADA system is added, expanded or replaced, unless the operator demonstrates that\ncertain provisions of API RP 1165 are not practical for the SCADA system used;\nAt the time of the inspection, EMCO’s CRM included a general statement that EMCO intended\nto comply with all regulatory requirements including referenced industry standards including\nAPI 1165. EMCO did not include specific procedures to clarify what additions or expansions\nwill require RP1165 implementations. Also, items not specifically addressed were:\n• A review of all displays for RP1165 compliance and summarize the review including\nsufficient documentation.\n• That the display review will include consistency requirements between screens and\nconsoles and also verify that the CRM has color choices that are well defined. At the\ntime of the inspection, there was apparent inconsistency between colors and it was not\nclear how color usage was described in the CRM, especially for wheat and white.\n• a requirement to note all display changes made.\n7. §195.446 Control room management.\n(c) Provide adequate information. Each operator must provide its controllers with the\ninformation, tools, processes and procedures necessary for the controllers to carry out\nthe roles and responsibilities the operator has defined by performing each of the\nfollowing:\n(2) Conduct a point-to-point verification between SCADA displays and related field\nequipment when field equipment is added or moved and when other changes that\naffect pipeline safety are made to field equipment or SCADA displays;\nDuring the inspection, it was noted that EMCO personnel were able to describe the process for\ntheir practice for conducting point-to-point verification, however, the process was not written in\nthe CRM plan. EMCO’s CRM did not include a clear step-by-step process for completing their\npoint-to-point and pseudo point check outs including when and how these are to be performed.\n8. §195.446 Control room management.\n(c) Provide adequate information. Each operator must provide its controllers with the\ninformation, tools, processes and procedures necessary for the controllers to carry out\nthe roles and responsibilities the operator has defined by performing each of the\nfollowing:\n(3) Test and verify an internal communication plan to provide adequate means for\nmanual operation of the pipeline safely, at least once each calendar year, but at\nintervals not to exceed 15 months;\n4\n\n\n\nDuring the review of the EMCO communication plan, PHMSA noted that the plan contained\ngeneral testing protocols. The tests did not include specific documentation to support that an\nactual test has occurred and what was actually tested. EMCO’s communication plan did not\nrequire verification of what was tested, including appropriate test results, and if whatever did not\nwork was fixed. Specifics regarding when to shut down a pipeline was not required to be\nincluded as part of the internal communications plan. Also, EMCO’s communication plan did\nnot require all tests to be documented. Appropriate records will help show that, in the future,\nClosed Loop Control, ESD or Cascade Shutdown Functions, are implemented consistently across\nconsoles. PHMSA noted that EMCO did not specifically include in their written procedures to\ncontinue to review this testing on their West Coast system regarding ESD or Hi pressure switch\noptions.\n9. §195.446 Control room management.\n(d) Fatigue mitigation. Each operator must implement the following methods to reduce\nthe risk associated with controller fatigue that could inhibit a controller's ability to\ncarry out the roles and responsibilities the operator has defined:\n(1) Establish shift lengths and schedule rotations that provide controllers off-duty time\nsufficient to achieve eight hours of continuous sleep;\nPHMSA noted that EMCO’s Fatigue Risk Management Plan (FRMP) had a number of good\nattributes. There were, however, a number of areas where PHMSA noted deficiencies in the\nprocedures reviewed. A number of the issues noted were realized when EMCO personnel\nverbally augmented their written procedures with additional explanation on what is actually\naccomplished when and by whom. The CRM rule requires operators to formalize their actual\nactions and processes in a formal written format that includes a complete documentation system.\nPHMSA also noted that EMCO has executive management involvement and support for their\nFRMP. The details on what organizational level of involvement are to be included and how this\nwill be implemented was note detailed in the plan. PHMSA also noted the following\ninadequacies:\n• EMCO’s FRMP did not consistently use the acronym “FRMP” and the concept of a\nFatigue Management Plan in the CRM. PHMSA experienced some confusion when\nreading the FRMS because of inconsistent use of these terms.\n• EMCO’s Fatigue Management Plan did not include a description of what would be done\nif a controller self-reports as being too fatigued to perform pipeline duties.\n• EMCO’s Fatigue Management Plan did not include additional fatigue mitigation\nmeasures (such as standing, radio, lights, temperature controls, double-checking of lists,\nothers checking work, etc.).\n• EMCO did not add the accident reporting requirements from section 6.2 of the CRM plan\nto the FRMP.\n• In section 3.5 (page 71) the next to the last bullet references policies and procedures but\nthe specifics of which policies and procedures were not noted and were not available for\nreview.\n• EMCO did not clarify in their manual what OCC-1 consists of (example: Sections - 3.8;\n3.8.1; 3.8.2). This could cause confusion on the part of the reader or reviewer.\n5\n\n\n\n10. §195.446 Control room management.\n(d) Fatigue mitigation. Each operator must implement the following methods to reduce\nthe risk associated with controller fatigue that could inhibit a controller's ability to\ncarry out the roles and responsibilities the operator has defined:\n(2) Educate controllers and supervisors in fatigue mitigation strategies and how off-\nduty activities contribute to fatigue;\nEMCO’s FRMP had a number of deficiencies noted with respect to educating controllers in\nfatigue mitigation strategies and associated processes. Each issue identified is detailed below:\n• EMCO’s procedures did not discuss higher risk operation times and require appropriate\nfatigue mitigation measure implementation (hours 9-12 of each 12 hour shift, 2-6 am, 3\nnights or more rotation).\n• EMCO did not clarify whether or not section 3.7.2; the first bullet (14 hours) includes\nshift exchange and commute times.\n• EMCO did not specify in section 3.2 - Definition of On-Duty Time is to include all hours\nworked as an employee.\n• EMCO did not specify in section 3.3 - OCC Shift Supervisor, a description of what will\nbe done if a controller is not fit for duty due to fatigue.\n• EMCO did not clarify in the plan the role of Supervisors being qualified (all titles\nincluded) schedulers, and D-4 Controllers. PHMSA also noted that D-4 Controllers are\ninitially scheduled to work days for an entire year.\n• EMCO did not state in the plan that no “on-call” controllers are utilized.\n• Chronic fatigue is not addressed in the plan reviewed. EMCO’s FRMP did not have any\nnotation that chronic fatigue is addressed in the training program for Supervisors and\nControllers.\n• EMCO did not consider including absenteeism as a provision in the monthly review\nregarding the number of Controllers needed.\n• EMCO did not state that all remote training associated with fatigue needs to be included\nin total hours of service (HOS).\n• EMCO did not include all fatigue mitigation measures on the OCC-1 form and also, did\nnot include risk analysis, times, dates, and shifts worked on the form.\n• EMCO did not include in their manual that all emergency deviations with respect to time\nworked will be recorded on the OCC-1 form as verbally described.\n• EMCO did not include in their written procedures that fatigue management training must\nbe conducted once each calendar year not to exceed 15 months.\n• EMCO’s personnel discussed the performance review and reward system and the near\nloss system which included loss and prevention observations (LPO). This area was not\ndetailed in the plan. It is suggested that this area be further developed and the process to\nbe utilized more fully described. This could be a good indicator that a fatigue issue\noccurred.\n• EMCO did not have a process to verify that all time-on-task has been included in the\nfatigue management training module.\n• EMCO did not include the requirement to review the fatigue management plan for\neffectiveness each calendar year not to exceed 15 months.\n6\n\n\n\n11. §195.446 Control room management.\n(d) Fatigue mitigation. Each operator must implement the following methods to reduce\nthe risk associated with controller fatigue that could inhibit a controller's ability to\ncarry out the roles and responsibilities the operator has defined:\n(4) Establish a maximum limit on controller hours-of-service, which may provide for\nan emergency deviation from the maximum limit if necessary for the safe operation of\na pipeline facility.\nEMCO’s FRMP had a number of deficiencies noted with respect to establishing a maximum\nlimit on controllers HOS. Each issue identified is detailed below:\n• EMCO’s Fatigue Management Plan did not address unforeseen schedule revisions.\n• Section 3.7.1 did not clarify whether or not 12 hours includes shift hand-over or shift\nexchange time and commute time.\n• Section 3.7.5 did not describe how work hours agree with the rest of the Fatigue Risk\nManagement Plan requirements. For example, the procedure did not define what\nspecifically is meant by abnormal operations as opposed to emergency deviations.\n12. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\nEMCO’s Alarm Management Plan as presented had a number of good attributes. There were,\nhowever, a number of areas where PHMSA noted deficiencies in the procedures reviewed. A\nnumber of the issues noted were realized when EMCO personnel verbally augmented their\nwritten procedures with additional explanation on what is actually accomplished when and by\nwhom. The CRM rule requires operators to formalize their actual actions and processes in a\nwritten format including a complete documentation system. Each issue identified is detailed\nbelow:\n• The definition section of the Alarm Management Plan was not specific enough to ensure\nall appropriate personnel understand the difference between the following terms;\nnotification, alert, CSE – Critical Safety Equipment, SSCR, tags, OIMS, PV Filtering,\ninaccurate, false, stale data (noted as old data or white data), suppress versus inhibit and\nother utilized abbreviations in the definitions.\n• EMCO did not adequately define how various teams interact for example, Alarm\nManagement Team versus the Alarm Rationalization Team.\n• Loss Prevention Observations were not included in the Alarm Management Plan.\nEMCO’s procedures did not fully describe this process and documentation required to\nsupport decisions made.\n• Leak Detection elements were not connected to the Alarm Management Plan.\n• EMCO’s procedures did not adequately define the difference between “class” versus\n“priority”.\n• EMCO’s procedures did not adequately define and consistently use the terms “Critical”,\n“Major” and “Alert.” EMCO personnel verbally described to PHMSA the meaning of\n7\n\n\n\neach term is actually “CR”, “HiAud”, and “HiNoAud” respectively. Also, the plan did\nnot identify the associated referenced colors. EMCO’s plan did not include an\nexplanation of how these priorities can also affect audible alarm indications.\n• EMCO did not address stale data and forced data (whether at the PLC/RTU or SCADA\nlevel) and that these must be reviewed monthly.\n• Section 4.12 did not include a specific interval for an internal audit. The use of\n“periodic” is not considered adequate.\n13. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(1) Review SCADA safety-related alarm operations using a process that ensures\nalarms are accurate and support safe pipeline operations;\nEMCO’s Alarm Management Plan, specifically as the plan relates to ensuring alarms are\naccurate and support safe pipeline operations, was not fully developed. There were a number of\nareas where PHMSA noted deficiencies in the procedures reviewed. Each issue identified is\ndetailed below:\n• EMCO’s CRM did not adequately define which alarms are Safety Related Alarms.\n• EMCO did not include a detailed process for conducting their monthly alarm review\nprocess.\n• EMCO did not adequately define rate-of-change (ROC) alarms that are to be included in\nthe plan with respect to various set points and purpose.\n• EMCO did not include a discussion around the use of trouble logs and associated\nmaintenance in the plan.\n• EMCO did not include consideration of using a HAZOPs review to provide additional\ninformation concerning the Alarm Management plan.\n• The EMCO Alarm Management plan did not include soft-pseudo points and a discussion\naround these types of points.\n• EMCO did not define the difference between “Critical” and “Operations Critical” in the\nCRM document.\n• EMCO did not define all associated metrics in all referenced sections.\n• If EMCO is not going to use alarm groupings then eliminate this discussion from the\nAlarm Management Plan.\n14. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(2) Identify at least once each calendar month points affecting safety that have been\ntaken off scan in the SCADA host, have had alarms inhibited, generated false alarms,\nor that have had forced or manual values for periods of time exceeding that required\nfor associated maintenance or operating activities;\n8\n\n\n\nEMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to identifying points affecting safety that\nhave been taken off scan in the SCADA host, have had alarms inhibited, generated false alarms,\nor that have had forced or manual values for periods of time exceeding that required for\nassociated maintenance or operating activities. Each specific issue is identified below:\n• EMCO did not include in their written procedures how suppression techniques will be\nimplemented and this was not included in the Alarm Management Plan.\n• In Section 4.8.3 - EMCO did not identify who can take points “Off-Scan” or “Out-of-\nService” and whether or not this will ever be performed. If this is to be performed,\nEMCO’s plan did not explain under what conditions this will be allowed.\n• EMCO did not define what alarm provision attributes per point can be changed by the\ncontroller and what will be used routinely in the system.\n• EMCO did not define inhibit functions, how inhibited points will be reviewed, if\nindividual parameters are inhibited, and how inhibited parameters will be corrected.\nAlso, EMCO did not explain what roles or job functions can inhibit points and individual\nalarm parameters.\n• EMCO’s audit forms did not include what problem was identified, what was done to\ncorrect the problem, when the correction was implemented and when the condition was\nfound.\n• EMCO did not state in the Alarm Management Plan that the “White M” on the display\nmeans the equipment is in manual mode.\n• EMCO did not include a “not to exceed” timeframe in section 4.8.1 Alarm Attribute. It\ncurrently addresses alarm settings and a review “after significant operating experience.”\n• EMCO did not include that “False” alarms must be reviewed and reported on a monthly\nbasis and that corrective actions must be noted.\n• Chronic Alarm Management or Equipment failure issues are addressed through the\ntrouble log but this was not included in the Alarm Management plan.\n• EMCO did not include in the CRM plan a discussion about how controllers have input\ninto alarm descriptors and how their understanding is confirmed.\n• EMCO did not include in the operating instructions, a statement that alarm set point\nlimits are available to the controller.\n15. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(3) Verify the correct safety-related alarm setpoint values and alarm descriptions\nwhen associated field instruments are calibrated or changed and at least once each\ncalendar year, but at intervals not to exceed 15 months.\nEMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to verifying the correct safety-related alarm\nset point values and alarm descriptions when associated field instruments are calibrated or\nchanged. Each issue is identified below:\n9\n\n\n\n• EMCO did not have an adequate and complete procedure for their E&I design practice in\nsection 9.7 and 11 and how the interface will work in the Alarm Management Plan.\n• EMCO’s documentation did not include a requirement that information about set point\nvalues, “as found” and “as left” are to be recorded during the Alarm Management Plan’s\nalarm set point review that occurs once each calendar year not to exceed to 15 months.\n16. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(4) Review the alarm management plan required by this paragraph at least once each\ncalendar year, but at intervals not exceeding 15 months, to determine the effectiveness\nof the plan;\nEMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to reviewing the alarm management plan at\nleast once each calendar year, but at intervals not exceeding 15 months, to determine the\neffectiveness of the plan. Each issue is identified below:\n• EMCO did not include that the Alarm Management Plan must be reviewed once each\ncalendar year not to exceed 15 months for effectiveness.\n• The format EMCO is utilizing for recording the effectiveness of their CRM has not been\ncreated.\n17. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(5) Monitor the content and volume of general activity being directed to and required\nof each controller at least once each calendar year, but at intervals not exceeding 15\nmonths, that will assure controllers have sufficient time to analyze and react to\nincoming alarms; and\nEMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to monitoring the content and volume of\ngeneral activity being directed to and required of each controller at least once each calendar year,\nbut at intervals not exceeding 15 months, that will assure controllers have sufficient time to\nanalyze and react to incoming alarms. Each issue is identified below:\n• EMCO’s Alarm Management Plan did not include adequate formality around monitoring\nthe content and volume of alarms received per console and how various metrics will lead\nto additional console creation. The workload study discussed during the inspection and\nassociated planning has not been implemented, finalized or reflected in the plan.\n• EMCO did not address that all cross-training is to be considered added duties and must\nbe considered in any overall volume of activity review.\n10\n\n\n\n• EMCO did not consider the number of temporary alarm set-point changes in the volume\nof activity considerations.\n• Metrics regarding Day/Night shift and weekend versus week metrics have not been\nfinalized.\n• Slack line conditions, timer setting requirements, number of points, and number of\ncommands were not included in the work load study.\n• The appropriate criterion for acceptable controller performance has not been developed.\n18. §195.446 Control room management.\n(e) Alarm management. Each operator using a SCADA system must have a written\nalarm management plan to provide for effective controller response to alarms. An\noperator's plan must include provisions to:\n(6) Address deficiencies identified through the implementation of paragraphs (e)(1)\nthrough (e)(5) of this section.\nEMCO’s Alarm Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to addressing deficiencies identified\nthrough the implementation of paragraphs (e)(1) through (e)(5) of this section. Each issue is\nidentified below:\n• Deficiency documentation was not adequately developed and did not include the\ninformation regarding when a situation was found and then corrected and what was done\nto correct the problem.\n• A method to prioritize deficiencies found was not included and discussed in the Alarm\nManagement Plan.\n• EMCO’s Alarm Management plan procedures did not provide adequate detail to perform\nthe effectiveness review and what actions will be included as part of the effectiveness\nreview.\n19. §195.446 Control room management.\n(f) Change management. Each operator must assure that changes that could affect\ncontrol room operations are coordinated with the control room personnel by\nperforming each of the following:\n(1) Implement section 7 of API RP 1168 (incorporated by reference, see § 195.3) for\ncontrol room management change and require coordination between control room\nrepresentatives, operator's management, and associated field personnel when planning\nand implementing physical changes to pipeline equipment or configuration; and\n(2) Require its field personnel to contact the control room when emergency conditions\nexist and when making field changes that affect control room operations.\nEMCO’s Change Management Plan as presented had a number of areas where PHMSA noted\ndeficiencies in the procedures reviewed with respect to implementing section 7 of API RP 1168\nfor control room management change and requiring coordination between control room\nrepresentatives, operator's management, and associated field personnel when planning and\nimplementing physical changes to pipeline equipment or configuration. Each issue is identified\nbelow:\n11\n\n\n\n• EMCO’s Management of Change (MOC) documentation did not describe the actual\nchanges made and what was changed in accordance with the verbal representations of\nEMCO personnel during the inspection including addressing formality associated with\nthe MOC closure process (sign-off).\n• EMCO’s calibrating procedures for reviewing alarm set points did not include all\napplicable details as described verbally by EMCO personnel during the inspection.\n• EMCO did not incorporate the use of “the box” for controllers to review recent changes\nand modifications to OIs or equipment.\n• EMCO did not include asset changes in the CRM manual regarding the SCCR or MOC\nprocess.\n20. §195.446 Control room management.\n(g) Operating experience. Each operator must assure that lessons learned from its\noperating experience are incorporated, as appropriate, into its control room\nmanagement procedures by performing each of the following:\n(2) Include lessons learned from the operator's experience in the training program\nrequired by this section.\nEMCO’s procedures for operating experience as presented had a number of areas where PHMSA\nnoted deficiencies in the procedures reviewed with respect to including lessons learned from the\noperator's experience in the training program required by this section. Each issue is identified\nbelow:\n• The root cause analysis technique used by EMCO, taproot, was not included in the CRM\nmanual.\n• The parties responsible for performing the root cause analysis were not identified.\n• Consider amending the “Near Loss & Loss Investigation Reporting Guide” to state the\nfollowing: “Determine if Control Room actions or INACTIONS contributed to the event.\nIf so, their deficiencies contributed to:”\n• Training in not required to be reviewed for consistency with procedures to ensure no\nerroneous training is conducted.\n• The operating experience section of the CRM manual did not include all operating\nexperience of note being communicated to the controllers (lessons learned, other selected\nof value, emails noting specific experience considerations) as described verbally during\nthe inspection.\n21. §195.446 Control room management.\n(h) Training. Each operator must establish a controller training program and review\nthe training program content to identify potential improvements at least once each\ncalendar year, but at intervals not to exceed 15 months. An operator's program must\nprovide for training each controller to carry out the roles and responsibilities defined\nby the operator. In addition, the training program must include the following\nelements:\n12\n\n\n\nEMCO’s procedures for training as presented had a number of areas where PHMSA noted\ngeneral deficiencies in the training procedures reviewed. Each issue as identified below:\n• EMCO’s training section lacked adequate detail and requires more content, substance,\nand formality to meet the requirements/intent of the code.\n• EMCO’s use of the terms, “Experienced controllers” and “Inexperienced controllers” is\nnot consistently implemented through-out the training section.\n• New system asset training has not been addressed in EMCO’s training section of the\nCRM plan. Class room training, hydraulic review, simulation, and beginning low flow\nconditions have not been included in the manual.\n• EMCO has not reviewed controller and cross-training assessment documentation. Hours\nof Service (HOS) for individuals in training and receiving span-of-control of 1:1 training\nhas not been addressed by signing, (with date and time) the shift change document.\n• EMCO has not defined what “promptly” means regarding identified improvement\nimplementation.\n• EMCO has not documented all elements of training in their training plan.\n• EMCO has not included interviews with supervisors as well as a trainee’s activities in\ntheir training plan. Also, EMCO has not constructed formality and implementation\nreferences associated with identified improvements in training.\n• EMCO has not included procedures to cross-check to confirm O&M, Emergency, CRM,\nand other specific plan sections are addressed in the Roles and Responsibility section and\nthat all roles and responsibilities are covered in the CRM training program.\n• EMCO has not included the training module completed list for controllers and\nsupervisors in their training plan.\n• EMCO has not included the power point presentations that are used for controller training\nin their plan.\n• EMCO had not emphasized that controllers should “Think leak first” in the training\nmaterial.\n• EMCO has not addressed explicitly explaining differences between consoles in the\ntraining section (Console 7 versus console 3).\n22. §195.446 Control room management.\n(h) Training. Each operator must establish a controller training program and review\nthe training program content to identify potential improvements at least once each\ncalendar year, but at intervals not to exceed 15 months. An operator's program must\nprovide for training each controller to carry out the roles and responsibilities defined\nby the operator. In addition, the training program must include the following\nelements:\n(1) Responding to abnormal operating conditions likely to occur simultaneously or in\nsequence;\nEMCO’s procedures for training did not include responding to abnormal operating conditions\nlikely to occur simultaneously or in sequence;\n13\n\n\n\n23. §195.446 Control room management.\n(h) Training. Each operator must establish a controller training program and review\nthe training program content to identify potential improvements at least once each\ncalendar year, but at intervals not to exceed 15 months. An operator's program must\nprovide for training each controller to carry out the roles and responsibilities defined\nby the operator. In addition, the training program must include the following\nelements:\n(2) Use of a computerized simulator or non-computerized (tabletop) method for\ntraining controllers to recognize abnormal operating conditions;\nEMCO’s procedures for training as presented had a number of areas where PHMSA noted\ngeneral deficiencies in the training procedures reviewed with respect to the use of a\ncomputerized simulator or non-computerized (tabletop) method for training controllers to\nrecognize abnormal operating conditions. Each issue is identified below:\n• EMCO did not adequately address information about OCC participation in field driven\ntabletop exercises or spill drills as verbally described by EMCO personnel during the\ninspection.\n• EMCO plan does not include consideration for working with executive management to\nallow controller input to the selection of field tabletop scenarios.\n24. §195.446 Control room management.\n(h) Training. Each operator must establish a controller training program and review\nthe training program content to identify potential improvements at least once each\ncalendar year, but at intervals not to exceed 15 months. An operator's program must\nprovide for training each controller to carry out the roles and responsibilities defined\nby the operator. In addition, the training program must include the following\nelements:\n(3) Training contr","truncated":true,"body_characters":49002}