EXXONMOBIL PIPELINE CO — Notice of Probable Violation

party submissionOfficial PDF520135007_Operator Petition for Reconsideration_02122015.pdf#

party submissionOfficial PDF520135007_Operator Request for Hearing and Response to Notice_04242013.pdf#

520135007_Final Order_01232015_text.pdf, page 1Official PDFJANUARY 23, 2015 Mr. Gerald S. Frey Global Pipeline Manager & President ExxonMobil Pipeline Company 800 Bell St., Room 741-D Houston, TX 77002 Re: CPF No. 5-2013-5007 Dear Mr. Frey: Enclosed please find the Final Order issued in the above-referenced case. It makes findings of violation, withdraws one allegation, and assesses a reduced civil penalty of $1,045,000. It further finds that ExxonMobil Pipeline Company has completed the actions specified in the proposed compliance order to comply with the pipeline safety regulations. The penalty payment terms are set forth in the Final Order. This enforcement action closes automatically upon receipt of payment. Service of this Final Order is made pursuant to 49 C.F.R. § 190.5. Thank you for your cooperation in this matter. Sincerely, Jeffrey D. Wiese Associate Administrator for Pipeline Safety Enclosure cc: Mr. Chris Hoidal, Director, Western Region, PHMSA Mr. Bob Hogfoss and Ms. Catherine Little, Hunton & Williams LLP, Bank of America Plaza, Suite 4100, 600 Peachtree Street, N.E., Atlanta, GA 30308 CERTIFIED MAIL – RETURN RECEIPT REQUESTED#

520135007_Final Order_01232015_text.pdf, page 2U.S. DEPARTMENT OF TRANSPORTATION PIPELINE AND HAZARDOUS MATERIALS SAFETY ADMINISTRATION OFFICE OF PIPELINE SAFETY WASHINGTON, D.C. 20590 ___________________________________ In the Matter of ) ExxonMobil Pipeline Company, ) CPF No. 5-2013-5007 ) ) ) Respondent. ) ___________________________________ ) FINAL ORDER On July 2, 2011, pursuant to 49 U.S.C. § 60117, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), initiated an investigation of the records and procedures of ExxonMobil Pipeline Company (EMPCo or Respondent) following a failure of its Silvertip Pipeline in Laurel, Montana, that occurred on July 1, 2011. EMPCo is a subsidiary of Exxon Mobil Corporation and operates approximately 3,800 miles of pipeline transporting crude oil, refined petroleum products, and highly volatile liquids in Texas, Louisiana, and Montana.1 As a result of the inspection, the Director, Western Region, OPS (Director) issued a Notice of Probable Violation, Proposed Civil Penalty, and Proposed Compliance Order (Notice) to Respondent on March 25, 2013. In accordance with 49 C.F.R. § 190.207, the Notice alleged five violations of the pipeline safety regulations, proposed a civil penalty of $1,700,000, and proposed certain corrective action. EMPCo responded to the Notice by letter dated April 24, 2013 (Response). In its Response, Respondent contested four of the five alleged violations and requested a hearing. In advance of the hearing, Respondent submitted additional written materials on July 8, 2013 (Pre-hearing Submittal). OPS also submitted additional materials. In accordance with 49 C.F.R. § 190.211, a hearing was held on July 17, 2013, in Lakewood, Colorado, before a Presiding Official from the Office of Chief Counsel, PHMSA. After the hearing, Respondent submitted additional materials on August 23, 2013 (Post-hearing Brief). Pursuant to § 190.209(b)(7), the Director submitted a written evaluation of Respondent’s response material and recommendation on September 20, 2013. 1 This information was reported by EMPCo for calendar year 2013 pursuant to 49 C.F.R. § 195.49.#

520135007_Final Order_01232015_text.pdf, page 3CPF No: 5-2013-5007 Page 2 BACKGROUND On July 1, 2011, the Silvertip Pipeline operated by EMPCo experienced a failure where the pipeline crosses the Yellowstone River in Laurel, Montana.2 The failure resulted in the release of approximately 1500 barrels (63,000 gallons) of crude oil into the river. The Silvertip Pipeline is 69.6 miles in length and runs from the Silvertip Station near production fields in Elk Basin, Wyoming, to the ExxonMobil refinery in Billings, Montana.3 The pipeline also takes crude oil from an intermediate pump station in Edgar, Montana. The pipeline runs south to north on a 5% to 7% downward slope. The pipeline can drain by gravity into the refinery in Billings. Pumps at the Edgar station are used to boost flow rate and to pull crude oil out of tankage. The pipeline crosses four rivers. At each of the river crossings, the pipeline has a remote controlled valve (RCV) on the upstream side of the crossing and a hand operated valve on the downstream side.4 The RCVs are equipped with a relief valve and bypass line to protect the pipeline from pressure surges caused by the rapid closure of valves and other abnormal hydraulic events. The Silvertip Pipeline crosses beneath the Yellowstone River immediately before the pipeline reaches a terminal facility in Laurel, Montana, about 20 miles upstream from the end of the pipeline. The pipeline crosses the Yellowstone approximately 800 feet east of the Highway 212 bridge.5 Before 1991, the pipeline crossed the river at the bridge span, but EMPCo was required to move a portion of the pipeline so that it crossed under the river to accommodate rebuilding of the bridge.6 At the location of the Yellowstone crossing, the Silvertip pipeline is 12.75-inch outside diameter, 0.500-inch wall thickness, Grade B seamless pipe manufactured by U.S. Steel.7 When the pipeline was re-routed beneath the river in 1991, it was installed using an open cut crossing technique, placing the pipeline in a rock cobble trench at least 6 feet below the river bed. The pipe also had a 1-inch concrete weight coating. 2 EMPCo and OPS were in general agreement on most of the background facts. The primary disagreement regarded the significance of historical flooding on the Yellowstone River, as detailed below. 3 OPS Pipeline Safety Violation Report (Violation Report) (Apr. 19, 2013), Exhibit A-1 – Accident Investigation Report (Investigation Report) at 2 (Oct. 30, 2012). 4 Terms “upstream” and “downstream” refer to relative directions on the pipeline. Upstream is in the direction of the beginning of the pipeline and downstream is in the direction of the end. 5 Violation Report at 2. 6 Post-Hearing Brief at 2. 7 Pre-hearing Submittal Exhibit 8 (Kiefner Report) at 2.#

520135007_Final Order_01232015_text.pdf, page 4CPF No: 5-2013-5007 Page 3 A. Historical Flooding of the Yellowstone River According to OPS, the Yellowstone has historically been prone to seasonal flooding, including increased erosion and scouring since 1991.8 OPS asserted that at the time of the failure, these problems were common knowledge in Laurel and had worsened in 1991 when the Highway 212 bridge was rebuilt in a way that constricted water flow of the Yellowstone, increasing the velocity and scouring of floodwaters. OPS pointed to information maintained by the United States Geologic Survey (USGS), including data from a water gauge approximately 20 miles downriver from the Silvertip crossing.9 The USGS had determined the “flood stage” at this point of the Yellowstone River is a water level of 13.5 feet at the gauge. Between 2008 and 2010, the river typically rose during the spring runoff and summer snow melt and then fell a short period of time later. There were instances when the river would rise multiple times during the same high water season, but water levels would usually drop within a week or two. In 2011, the Yellowstone rose and stayed high for more than a month. The Yellowstone reached the flood stage as measured by the water gauge three times in 2011: on May 25, June 25, and July 1, the date of the Silvertip failure.10 Seasonal flooding of the Yellowstone had previously affected other pipeline operators in the area. In June 2009, flooding and river scouring caused the failure of an 8-inch natural gas pipeline operated by Willison Basin Interstate Pipeline (WBI).11 WBI replaced the 8-inch pipe with a 16-inch line horizontally drilled at a depth of 40-50 feet below the river. Another 8-inch pipeline that had been abandoned by ConocoPhillips became exposed and suffered a rupture sometime between 2009 and 2011.12 After the 2009 WBI failure, EMPCo conducted an inline inspection (ILI) of the Silvertip Pipeline at the Yellowstone crossing and found no anomalies.13 This was in addition to a prior ILI performed in 2004. EMPCo acknowledged the Yellowstone is prone to seasonal flooding, but believed the facts presented by OPS concerning flooding were overstated. EMPCo asserted that federal databases, including the USGS, indicated that high water events on the river since the pipeline was installed were less extreme than past levels. EMPCo also pointed to a report by the Yellowstone River Conservation Council that indicated the period from 1979 to 2007 “was characterized by minimal floods on the tributaries and no floods on the Yellowstone River.”14 8 Violation Report at 4. 9 Investigation Report at 5-6. 10 Investigation Report at 5-6. 11 Violation Report, Exhibit B-16 at 3. 12 Violation Report 4. 13 Response at 2. 14 Response at 2, referencing Pre-hearing Submittal, Exhibit 4 “Yellowstone River Historic Events Timeline” at 5.#

520135007_Final Order_01232015_text.pdf, page 5CPF No: 5-2013-5007 Page 4 Additionally, EMPCo noted that in the past 20 years, three floods had higher levels than the flood level at the time of the July 1, 2011, failure. The first occurred before 1991 when the pipeline was installed; the second occurred in 1997; and the third occurred on May 26, 2011. The 1997 flood, EMPCo asserted, was the highest crest ever recorded for the Yellowstone. EMPCo stated that the Silvertip Pipeline “survived [these previous] high water events, and the Company increased monitoring of the river crossing.”15 Additionally, EMPCo indicated that the OPS Investigation Report acknowledged there was an absence of historical flooding impacts to this pipeline.16 B. Events Leading up to the 2011 Flooding Prior to the flooding in 2011, there were numerous contacts between interested stakeholders and EMPCo concerning the Yellowstone crossing. In August 2010, there was a meeting of Laurel officials, the U.S. Army Corps of Engineers, EMPCo, Cenex Pipeline Company, WBI, and Conoco Phillips that took place at Riverside Park, located slightly east of the Highway 212 bridge on the south side of the Yellowstone River. The meeting concerned erosion of the river bank in that location and the pipelines that ran beneath, including the Silvertip. Laurel officials hoped to obtain assistance in fortifying the south bank to help protect the park.17 Several months later in October 2010, Laurel officials contacted OPS and expressed concern about the pipeline crossings downstream of the Highway 212 bridge due to the seasonal flooding. OPS relayed this information to EMPCo. In December 2010, EMPCo conducted a depth of cover survey at the Yellowstone crossing at the request of OPS, and reconfirmed the findings from a prior survey that the pipeline was “buried in rock and cobble at least five to eight feet below the riverbed.”18 EMPCo submitted the survey report to OPS on January 29, 2011. The survey indicated that the Silvertip “met the required minimum depth of cover for new pipelines, and that the bottom of the river had not changed significantly since the last crossing survey performed in 2002.”19 OPS staff advised EMPCo at the time to “maintain vigilance with respect to the annual flooding of the Yellowstone River especially in the vicinity of their pipeline crossing in Laurel, MT.”20 On May 25, 2011, the Yellowstone reached flood stage level. Laurel officials again contacted OPS with concerns over the erosion of the south bank of the Yellowstone. In turn, OPS contacted EMPCo, which sent employees to Riverside Park in response. On this date, EMPCo shut down the Silvertip for five hours, assessed site conditions, and evaluated data. When no 15 Response at 2. 16 Pre-hearing Submittal at 2, citing Investigation Report at 12. 17 Investigation Report at 3. 18 Investigation Report at 3. 19 Investigation Report at 3-4. The minimum depth of cover for a new pipeline under a river is four feet. Respondent indicated the depth of cover survey was actually performed in 2001. Response at 2. 20 Investigation Report at 4.#

520135007_Final Order_01232015_text.pdf, page 6CPF No: 5-2013-5007 Page 5 anomalies were detected, the Silvertip was restarted and EMPCo began daily monitoring by driving by the location to observe the general area. WBI decided to shut down its pipeline crossing at the Yellowstone because of the floodwaters.21 One week later, on June 1, 2011, Laurel officials sent photographs of the Yellowstone to EMPCo with a recommendation that EMPCo come and assess the situation.22 EMPCo responded via email that the depth of cover at the south bank had been determined to be 12 feet. On June 6, 2011, OPS inspected EMPCo’s integrity management program and most recent ILI data from 2009, finding no actionable pipeline anomalies at the Silvertip’s Yellowstone crossing. The Yellowstone reached the flood stage again on June 25 due to snow melt.23 Laurel personnel began reinforcing the Yellowstone banks on both the north and south sides. They again contacted OPS with concerns over the Silvertip crossing. OPS contacted EMPCo, which shut down the Silvertip for a second time, visited the site, and assessed the situation. EMPCo performed a depth of cover survey in Riverside Park from the south bank of the Yellowstone to RCV 4462, which is the closest upstream valve south of the river crossing. The depth of cover at this point was between 6.7 feet and 8.5 feet. Additionally, on June 25, 2011, EMPCo placed sandbags around RCV 4462 in case the park flooded.24 C. Silvertip Pipeline Failure On July 1, 2011, the Yellowstone River reached the flood stage for the third time in six weeks. At 10:40:43 p.m., Mountain Daylight Time, EMPCo’s Operation Control Center (OCC) in Houston, Texas, received an alarm indicating a pressure drop at RCV 4462, the remote valve immediately upstream of the Yellowstone River crossing. 25 Controller A, who was in charge of the console at the time, did not see the alarm. At 10:41:14, approximately 30 seconds after the first alarm, the controller noticed a second alarm which indicated a booster pump at Edgar Station had automatically shut down because of low suction pressure. The Edgar Station is approximately fourteen miles upstream of Laurel. Believing there might be a leak, Controller A shut down the pumps and RCV 1066 at the beginning of the Silvertip Pipeline at 10:50:39 p.m. He then closed RCV 1067, located approximately one-half mile downstream of the Yellowstone River at the Laurel facility. Three minutes later, Controller A notified a supervisor, who reviewed the trends and alarm logs. At 11:07:32 p.m., the supervisor ordered Controller A to re-open RCV 1067 to allow oil to drain into the Billings refinery. The supervisor then called the First Line Supervisor in the field, who requested a senior technician be added to the call. A discussion ensued as to what caused the Edgar Station pumps to have low suction. After the discussion and review of the relevant data, 21 Violation Report at 5. 22 Investigation Report at 4-5. 23 Investigation Report at 5. 24 Investigation Report at 5. 25 Notice at 1-2.#

520135007_Final Order_01232015_text.pdf, page 7CPF No: 5-2013-5007 Page 6 the supervisor noticed the low suction pressure alarm had been preceded by a pressure drop at RCV 4462. At 11:36:51 p.m., the Supervisor ordered RCV 4462 closed, which stopped the gravity flow of oil into the river. Approximately 56 minutes had passed since the first alarm was received until RCV 4462 was closed, resulting in a total of about 1500 barrels of crude oil released into the river. OPS sent investigators to the scene of the failure. On July 5, 2011, a Corrective Action Order (CAO) was issued by PHMSA. 26 The CAO required EMPCo to take specific actions before restarting the Silvertip Pipeline. It also required EMPCo to complete additional safety measures before the next flood season, including replacement of the pipeline crossing at the Yellowstone River with a horizontally drilled line. The OPS Investigation Report indicated the pipeline failed as a result of a submerged “guillotine” break in the pipeline near the south shore of the Yellowstone River caused by debris caught on the exposed pipe during flooding, which gradually increased external stress on the pipe until it failed.27 EMPCo’s failure report, prepared by Kiefner & Associates, Inc., similarly concluded that the Silvertip “failed at a girth weld as a result of the effects of external loading that occurred due to exposure to flood conditions.”28 The report concluded further that “the failure mechanism was fatigue crack growth adjacent to a girth weld, followed by ductile fracture of the remaining section due to tensile overload.”29 Ultimately, the cracks were caused by “vortex-induced vibration of the exposed pipe in the river current.”30 The Notice issued on March 25, 2013, alleged that Respondent committed five violations of the pipeline safety regulations in 49 C.F.R. Part 195, as follows: Item 1: The Notice alleged that Respondent violated 49 C.F.R. § 195.452(i)(2), which states: § 195.452 Pipeline integrity management in high consequence areas. (a) Which pipelines are covered by this section? This section applies to each hazardous liquid pipeline and carbon dioxide pipeline that could affect a high consequence area . . . . (i) What preventive and mitigative measures must an operator take to protect the high consequence area?—(1) General requirements. An FINDINGS OF VIOLATION 26 ExxonMobil Pipeline Co., CPF No. 5-2011-5017H , 2011 WL 10796851 (Jul. 5, 2011). Prior enforcement decisions can also be viewed on PHMSA’s website at http://www.phmsa.dot.gov/ pipeline/enforcement (follow link for enforcement since 2002 and then for Actions issued by year). 27 Violation Report at 3-4. 28 Pre-hearing Submittal Exhibit 8 (Kiefner Report) at 1. 29 Kiefner Report at 1. 30 Kiefner Report at 1.#

520135007_Final Order_01232015_text.pdf, page 8CPF No: 5-2013-5007 Page 7 operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection . . . (2) Risk analysis criteria. In identifying the need for additional preventive and mitigative measures, an operator must evaluate the likelihood of a pipeline release occurring and how a release could affect the high consequence area. This determination must consider all relevant risk factors, including, but not limited to: (i) Terrain surrounding the pipeline segment, including drainage systems such as small streams and other smaller waterways that could act as a conduit to the high consequence area; (ii) Elevation profile; . . . (iv) Amount of product that could be released; [and] . . . (vii) Physical support of the pipeline segment such as by a cable suspension bridge; . . . . The Notice alleged that Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis of its pipeline considering all the relevant risk factors. Specifically, the Notice alleged that Respondent prepared a risk analysis of the Silvertip Pipeline in July 2010 to evaluate the likelihood of a pipeline release and possible consequences, but failed to consider the risk of flooding and river bottom scour, as well as certain risk factors relevant to the Yellowstone River crossing. The risk factors that Respondent allegedly failed to consider included the terrain surrounding the pipeline segment; the elevation profile of the pipeline; the amount of product that could be released in a spill; and the physical support of the pipeline segment in the river. The Notice also alleged that Respondent should have considered additional factors listed in Appendix C to 49 C.F.R. Part 195, such as potential natural forces inherent in flood zones and subsidence areas. The Notice alleged the risk of flooding, channel migration, and river bottom scour on the Yellowstone River was a known threat given its history, including at least one prior pipeline failure in the area caused by flooding and impact to other pipelines. EMPCo responded that it had complied with all requirements in the regulation concerning preventative and mitigative risk analysis.31 Specifically, it asserted that its 2010 written integrity management program addressed natural forces such as flooding. Respondent also asserted that an integrity threat assessment conducted in 2009 considered the threat of weather-related and outside forces such as flooding. Based on the threats identified by that integrity assessment, Respondent maintained that its risk analysis considered all of the relevant risk factors, including those specified under § 195.452(i)(2).32 In addition, Respondent argued that the effects of the July 1, 2011, flood were unforeseeable. EMPCo noted that seasonal flooding on the Yellowstone River had never before impacted the 31 Pre-hearing Submittal at 7. 32 Pre-hearing Submittal at 6-7, referencing Exhibits 9 and 10 and Violation Report Exhibit B-7.#

520135007_Final Order_01232015_text.pdf, page 9CPF No: 5-2013-5007 Page 8 Silvertip Pipeline despite several floods with higher levels than the one that caused the failure. Respondent noted that it had assessed the pipeline before the failure and found it had adequate depth of cover with no known anomalies. EMPCo also referenced the OPS Investigation Report which acknowledged “Based on the lack of historical flooding impacts to this pipeline since [it was installed in] 1991, EMPCo may not have known that the river bottom could change sufficiently to undermine their pipeline.”33 A. Applicable Standards for Identifying P&M Measures Under the pipeline safety regulations in 49 C.F.R. Part 195, pipeline operators must develop, implement, and follow a written integrity management program (IMP) for each hazardous liquid pipeline that could affect a high consequence area (HCA). 34 An operator’s IMP must include, among other things, identification of additional actions that can be taken to protect the HCA.35 These are known as preventative and mitigative (P&M) measures. To identify appropriate P&M measures for each pipeline, an operator must conduct a risk analysis that evaluates “the likelihood of a pipeline release occurring” on the segment and the potential consequences to the HCA.36 The risk analysis must include consideration of all risk factors relevant to the likelihood of a release and potential consequences. The regulation lists a number of risk factors that must be considered, including, but not limited to: the terrain surrounding the pipeline segment, including drainage that could act as a conduit for the product to reach the HCA; the elevation profile; amount of product that could be released; and the physical support of the pipeline segment. Appendix C to Part 195 provides additional guidance for implementing an IMP, including guidance on risk factors. The guidance lists both mandatory and additional factors for operators to consider when identifying measures to prevent and mitigate the consequences of a pipeline failure. The factors listed include, among other things, potential natural forces in the area, such as natural forces in a flood zone.37 Both parties acknowledged that seasonal floods were known to occur on the Yellowstone River at the location of the Silvertip Pipeline crossing. Evidence also demonstrates that during 2008 through 2011, water level of the river rose each year during June and July. During those years, water level would rise from a typical non-flood height of approximately 2 feet to a seasonal flood height of 11 to 12 feet.38 During the 2011 season, the height exceeded 14 feet. Flooding is 33 Pre-Hearing Submittal at 2. 34 § 195.452(a)-(b). “High consequence areas” include commercially navigable waterways, as defined in § 195.450, and areas that are unusually sensitive to environmental damage, as defined under § 195.2. 35 § 195.452(f)(6). 36 § 195.452(i)(2). 37 49 C.F.R. Part 195, Appendix C (I)(B)(12). 38 Violation Report, Exhibit B-21. Respondent submitted a report titled “Yellowstone River Historic Events Timeline” from 2008, which stated that 1998-2007 was “characterized by minimal flooding on#

520135007_Final Order_01232015_text.pdf, page 10CPF No: 5-2013-5007 Page 9 known to PHMSA as a potential threat to buried pipelines, and PHMSA has communicated to operators precautions that should be taken when flooding occurs.39 At this particular location, flooding had previously caused at least one other pipeline to fail, the WBI gas pipeline failure in June 2009.40 Taken together, all of this information was sufficient to notify Respondent that flooding should be analyzed as a potential threat to its pipeline. Respondent contended that certain information caused it to believe flooding could not impact its pipeline. For example, EMPCo’s pipeline had survived prior flooding events without damage, including two floods with a higher water level than the flood that ultimately caused the failure. EMPCo had also performed a depth of cover survey in 2010, which detected cover over its pipeline had not changed significantly since the last crossing survey. In its written submissions, EMPCo also noted that the OPS Investigation Report stated that “based on the lack of historical flooding impacts to this pipeline since 1991, EMPCo may not have known that the river bottom could change sufficiently to undermine their pipeline.”41 PHMSA disagrees that this information alleviated Respondent from having to analyze the possibility that flooding could cause a failure. The fact that flooding had not previously caused an integrity issue for Respondent’s pipeline does not mean future flooding could never cause a failure. One of the purposes of the integrity management regulations is to anticipate the possible threats to the pipeline in the future. Given that flooding is a threat in general and that flooding had caused integrity issues for other pipelines at the same location, it was not reasonable for EMPCo to assume seasonal flooding would never impact its own pipeline. At a minimum, the Operator had a duty to evaluate the likelihood of a pipeline release occurring from flooding. B. Whether Respondent’s Risk Analysis Complied with Applicable Standards PHMSA reviewed the evidence in the record to determine whether Respondent had prepared a risk analysis that considered the threat of flooding and relevant risk factors. This review included Respondent’s Silvertip to Billings 12” Crude Preventive & Mitigative Measures Analysis Summary (2010 P&M Analysis).42 2010 P&M Analysis. The 2010 P&M Analysis described Respondent’s 69.6-mile Silvertip It noted the location of block valves, elevation at each station, type of product Pipeline. tributaries, and no floods on the Yellowstone River.” For the purpose of the report, however, only floods with a 10% or less probability of occurring were identified. The report did not analyze seasonal flooding. 39 OPS has published Advisory Bulletins related to the impacts of flooding on pipeline systems. See Advisory Bulletin ADB-93-03, 58 Fed. Reg. 41321 (Aug. 3, 1993); Advisory Bulletin ADB-94-05, 59 Fed. Reg. 55152 (Nov. 3, 1994). See also Potential for Damage to Pipeline Facilities Caused by Flooding (ADB-11-04), 76 FR 44985 (Jul. 27, 2011); and Potential for Damage to Pipeline Facilities Caused by Flooding (ADB-2013-02), 78 Fed. Reg. 41991 (Jul. 12, 2013). 40 Violation Report, Exhibit B-16 at 3. 41 Post-hearing Brief at 2-3, quoting Investigation Report at 12. 42 Violation Report Exhibit B-7. The P&M Analysis is dated July 7, 2010.#

520135007_Final Order_01232015_text.pdf, page 11CPF No: 5-2013-5007 Page 10 transported, line fill capacity, flow rate, and maximum operating pressure. The entire length of the pipeline was identified as potentially affecting an HCA. Three potential integrity threats to the Silvertip Pipeline were identified: third-party damage, manufacturing, and external corrosion. The document then identified and evaluated different P&M measures to address those three integrity threats. Besides third-party damage, manufacturing, and external corrosion, the 2010 P&M Analysis did not identify other threats that could affect the likelihood of a pipeline release. In particular, the Analysis did not consider the threat of flooding in evaluating the likelihood of a release. PHMSA also finds several other deficiencies in the 2010 P&M Analysis. The risk analysis mentioned the types of “nearby HCAs, which include HPOP, OPOP, Drinking Water and USA- ECO” but did not define them or identify specific HCAs like the Yellowstone River.43 There was no mention of the terrain surrounding the pipeline near the Yellowstone River or the possible consequences of a failure at the crossing. In addition, while the elevation of the entire pipeline is noted, the elevation profile is not evaluated as a risk factor that could impact the consequences of a failure, such as whether the elevation profile from south to north allows more product to drain into the Yellowstone than if the pipeline had a flat profile. There is some discussion of spill size in the section evaluating emergency flow restriction devices, but only with regard to the threats previously identified. Since flooding is not identified as a possible failure mode, there is no consideration of the potential amount of product that could be released as a result of damage at the crossing caused by flooding, such as if there is a guillotine break in the pipeline. There is also no mention of the physical support of the pipeline crossing at the Yellowstone River. For these reasons, PHMSA finds Respondent’s 2010 P&M Analysis did not consider all of the relevant risk factors in evaluating the likelihood of a release and potential consequences affecting the HCA. While PHMSA recognizes that Respondent employed certain P&M measures in the field, including depth of cover surveys and increased patrolling, these measures are not relevant to this alleged violation, which concerns whether the risk analysis prepared by Respondent appropriately considered relevant risk factors. Respondent’s other P&M measures are considered below under Item 2. In its written submissions and at the hearing, Respondent indicated that additional details of its risk analysis were contained in other documents, including its 2010 Integrity Management Program (IMP), 2010 IMP Forms 6.1, 2005 EFRD analysis, 2010 Data Integration and Risk Assessment Summary, and 2009 integrity threat assessment. Those documents are considered below. 43 The acronyms presumably refer to the types of HCAs, such as high population areas, other populated areas, and unusually sensitive drinking water and ecological resource areas.#

520135007_Final Order_01232015_text.pdf, page 12CPF No: 5-2013-5007 Page 11 2010 IMP Plan. Respondent argued that sections 3 and 6 of its 2010 IMP Plan demonstrated that it considered time dependent threats such as heavy rains and floods.44 Section 3 of the 2010 IMP Plan discussed the process for data analysis generally, and stated that segments are to be evaluated with regard to nine pipeline integrity threats listed in ASME B31.8S.45 Section 6 of the IMP Plan discussed the procedures for evaluating P&M actions. It described the evaluation process and noted that Form 6.1 should be used to document the evaluation. According to Section 6 of the 2010 IMP Plan, the evaluation process required identification of HCAs and significant threats, including possible causes of failure. Examples of threats given were third-party damage and corrosion. After identifying HCAs that may be affected and threats that could cause a failure, Section 6 stated that appropriate risk factors must be considered, which either increase or reduce risk. The procedure listed a number of risk factors that, at a minimum, should be evaluated, including: terrain to HCAs and proximity, elevation profile, waterways, potential volume released, and physical support. While the procedures in the 2010 IMP Plan indicate the process Respondent should have followed in performing a risk analysis, the procedures do not, by themselves, show whether this process was indeed followed for the Silvertip Pipeline at the Yellowstone River crossing. In particular, the procedures do not demonstrate that Respondent considered the threat of floods. 2010 IMP Form 6.1. The 2010 IMP Form 6.1 was used by EMPCo to document the evaluation of P&M actions in support of the 2010 P&M Analysis. 46 Respondent submitted two such forms.47 One was for the identified threat of external corrosion and the other was for the threat of manufacturing defects. There were no forms identifying other threats that could cause a pipeline failure, such as the threat of natural forces or flooding. Both of the forms submitted include evaluation of the risk factors relevant to the identified threat. Risk factors such as terrain to the HCA, pipeline profile, potential product spillage, and physical supports were all considered, but since their consideration was limited to the two identified failure threats, these factors were not considered in regard to the threat of natural forces or flooding. Accordingly, the forms submitted do not support Respondent’s assertion that its risk analysis considered the threat of floods and associated risk factors. 44 Pre-hearing Submittal at 6-7. 45 Pre-hearing Submittal Exhibit 9. ASME B31.8S is not incorporated by reference in § 195.452. 46 Violation Report, Exhibit B-7 at 3. 47 Pre-hearing Submittal Exhibit 10 – Preventative & Mitigative Actions Evaluation, dated July 7, 2010.#

520135007_Final Order_01232015_text.pdf, page 13CPF No: 5-2013-5007 Page 12 Other Documentation. Respondent asserted that its 2010 P&M Analysis relied upon a consideration of elevation profile performed in 2005.48 Respondent also referenced its 2010 Data Integration and Risk Assessment Summary, which noted the approximate 1150-foot elevation change between the two ends of the pipeline and the static pressure at the downstream end.49 Having reviewed the 2005 Emergency Flow Restricting Device (EFRD) Evaluation and related materials, PHMSA finds Respondent considered the elevation profile of the pipeline, but there is inadequate consideration of how the elevation profile impacts the consequences of a pipeline failure at the Yellowstone River. In particular, there is no consideration of how the elevation profile could result in crude oil draining into the river in the event of a failure at the crossing. Respondent also contended that its 2009 integrity assessment “considered the threat of weather- related and outside forces.”50 In connection with this assertion, Respondent cited to its 2010 IMP Plan, which is already discussed above. C. Conclusion Given the history of flooding and impact to other pipelines at this location, the threat of flooding was relevant to the likelihood of a release occurring on Respondent’s pipeline. Respondent did not evaluate the likelihood of a release caused by flooding of the Yellowstone River and failed to consider risk factors relevant to flooding. Accordingly, PHMSA finds Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis of the Silvertip Pipeline that considered all risk factors relevant to the likelihood of a release on the Silvertip Pipeline and potential consequences affecting the Yellowstone River. Item 2: The Notice alleged that Respondent violated 49 C.F.R. § 195.452(i)(1), which states: § 195.452 Pipeline integrity management in high consequence areas. (a) . . . . (i) What preventive and mitigative measures must an operator take to protect the high consequence area?—(1) General requirements. An operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection. Such actions may include, but are not limited to, implementing damage prevention best practices, better monitoring of cathodic protection where corrosion is a concern, establishing shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the systems that monitor 48 Post-hearing Brief at 5, citing Violation Report Exhibit B-3. 49 Post-hearing Brief at 5, citing Violation Report Exhibit A-15. 50 Pre-hearing Submittal at 7.#

520135007_Final Order_01232015_text.pdf, page 14CPF No: 5-2013-5007 Page 13 pressure and detect leaks, providing additional training to personnel on response procedures, conducting drills with local emergency responders and adopting other management controls. The Notice alleged that Respondent violated § 195.452(i)(1) by failing to take appropriate measures to prevent or mitigate the consequences of a failure on the Silvertip Pipeline at the Yellowstone River crossing. Specifically, the Notice alleged that Respondent failed to operate remote control valves (RCVs) installed on the Silvertip Pipeline to prevent or mitigate the consequences of a failure. In addition, the Notice alleged that Respondent failed to take “any other” P&M measures to address the threat of failure from flooding, such as implementation of damage prevention best practices, strengthening leak detection systems, undertaking additional training for response personnel, or addressing the risk of a guillotine failure.51 In its written submissions and at the hearing, Respondent contested the allegation that it failed to identify and implement appropriate P&M measures. Respondent contended that its written IMP Plan addressed P&M measures and that EMPCo had adopted those measures at the Yellowstone River crossing.52 Respondent contended that it “had employed all of the P&M measures suggested by PHMSA” under the regulation prior to the incident.53 Respondent explained that the P&M measures it employed included conducting a depth of cover survey several months before the accident, which determined the pipeline had adequate protection.54 The measures also included actively monitoring river conditions prior to the accident, having thicker walled pipe and concrete coating, placing the pipe in a rock trench deeper than otherwise required, having rock cobble placed on top of the pipe trench, hydrostatic pressure testing, conducting two inline inspections, and increased patrolling during high water. Respondent argued these P&M measures at the Yellowstone River crossing were “virtually all P&M measures that could be undertaken to prevent or mitigate flood risk.”55 Respondent also noted that PHMSA has issued a number of advisory bulletins concerning the risks of flooding and that EMPCo had adopted the P&M measures noted in the advisories.56 Respondent stated further that the only additional P&M measures possible at the crossing were temporary shutdown of the pipeline or construction of a new horizontal directionally drilled (HDD) crossing.57 Respondent contended that HDD is not a requirement under the regulations, 51 Notice at 6. 52 Response at 3. 53 Pre-hearing Submittal at 8 (emphasis in original has been omitted), citing EMPCo IMP Plan, Section 6.4.2.5, Figure 6.2; and Exhibit 11 (summary of P&M measures implemented). 54 Pre-hearing Submittal at 9. 55 Post-hearing Brief at 4-5. 56 Post-hearing Brief at 5. 57 Post-hearing Brief at 6.#

520135007_Final Order_01232015_text.pdf, page 15CPF No: 5-2013-5007 Page 14 and asserted that OPS agreed at the hearing it was not a requirement. 58 With regard to temporary shutdown, Respondent noted that it temporarily shut down the pipeline twice prior to the accident to evaluate and monitor the crossing. Absent an imminent hazard, however, Respondent asserted there was no regulatory requirement to keep the pipeline shut down for a prolonged period. Respondent argued that evidence in the record demonstrates that neither EMPCo nor OPS suspected there was any imminent danger to the pipeline leading up to the accident. A. Applicable Standards for Taking P&M Measures Under the integrity management regulations, operators must take measures to protect the HCA that could be affected, including measures to prevent and mitigate the consequences of a pipeline failure.59 Such actions may include, but are not limited to implementing damage prevention best practices; better monitoring of cathodic protection where corrosion is a concern; establishing shorter inspection intervals; installing emergency flow restricting devices such as RCVs; modifying the systems that monitor pressure and detect leaks; providing additional training to personnel on response procedures; conducting drills with local emergency responders; and adopting other management controls. B. Whether Respondent Failed to Take Required P&M Measures PHMSA considered the evidence in the record to determine whether Respondent violated § 195.452(i)(1) as alleged in the Notice by failing to operate RCVs or by failing to take any other measures. The evidence in the record demonstrates Respondent took a number of measures in an effort to prevent or mitigate a pipeline failure at the Yellowstone crossing, including installing its pipeline in a manner that exceeded certain minimum safety requirements for new pipeline construction, installing RCVs, conducting ILIs and reviewing data for actionable anomalies, conducting depth of cover surveys, actively monitoring the river, temporarily shutting down the pipeline, meeting with local and federal officials, and placing sandbags to protect the closest upstream RCV from flooding. While the Notice alleged that Respondent violated § 195.452(i)(1) by failing “to operate RCVs,” the Notice did not allege when and in what manner the regulation required the valves to be operated. It was not clear from the Notice whether the allegation was based on an alleged failure to preemptively shut down the pipeline to “prevent” the accident or to shut down the pipeline immediately after the failure to “mitigate” the consequences (or both).60 The Violation Report also did not convey the specific conduct that constituted a probable violation. OPS did not 58 Post-hearing Brief at 6, citing Hearing Transcript at 77. 59 § 195.452(i)(1). 60 Respondent demonstrated that it did preemptively shut down the pipeline on two separate occasions prior to the failure.#

520135007_Final Order_01232015_text.pdf, page 16CPF No: 5-2013-5007 Page 15 further develop this alleged violation at the hearing. In its post-hearing recommendation submitted pursuant to § 190.209(b)(7), the Director recommended that this alleged violation be withdrawn. Accordingly, PHMSA finds the allegation that Respondent violated § 195.452(i)(1) by failing to operate RCVs was not proven. Likewise, with regard to other P&M measures listed in the alleged violation, such as implementation of damage prevention best practices and strengthening leak detection systems, OPS did not present any persuasive arguments as to why each of those measures were required under the regulation and how those measures could have prevented or mitigated the consequences of a failure. While someone could assume that any additional measures could have some impact on preventing or mitigating failures, OPS has the burden of proving the measures alleged in the Notice were, in fact, required as a result of § 195.452(i)(1). The evidence in the record is insufficient to prove a violation with regard to these allegations. C. Conclusion For the reasons stated above, PHMSA finds OPS did not prove that Respondent violated § 195.452(i)(1) as alleged in the Notice. Accordingly, this alleged violation is withdrawn. Item 3: The Notice alleged that Respondent violated 49 C.F.R. § 195.403(a)(3), which states: § 195.403 Emergency response training. (a) Each operator shall establish and conduct a continuing training program to instruct emergency response personnel to: (3) Recognize conditions that are likely to cause emergencies, predict the consequences of facility malfunctions or failures and hazardous liquids or carbon dioxide spills, and take appropriate corrective action; The Notice alleged that Respondent failed to effectively train emergency response personnel. Specifically, the Notice alleged that the supervisor at the control center in Houston, Texas, and First Line Supervisor at the refinery in Billings, Montana, had not been adequately trained to recognize and respond to: (1) local environmental conditions that were likely to cause emergencies, such as localized historic flooding; (2) the consequences of a guillotine failure in the river; and (3) the unique system configurations, including surge-protected remote controlled valves that may be closed to mitigate the consequences of a failure. In its written submissions and at the hearing, EMPCo did not contest the alleged violation, even though EMPCo stated that it did not necessarily agree with the allegation. Accordingly, having reviewed the evidence, PHMSA finds Respondent violated § 195.403(a)(3) by failing to effectively train emergency response personnel.#

520135007_Final Order_01232015_text.pdf, page 17CPF No: 5-2013-5007 Page 16 Item 4: The Notice alleged that Respondent violated 49 C.F.R. § 195.402(e)(2), which states: § 195.402 Procedural manual for operations, maintenance, and emergencies. (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies . . . . (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs . . . (2) Prompt and effective response to a notice of each type [of] emergency, including fire or explosion occurring near or directly involving a pipeline facility, accidental release of hazardous liquid or carbon dioxide from a pipeline facility, operational failure causing a hazardous condition, and natural disaster affecting pipeline facilities. The Notice alleged that Respondent failed to prepare written procedures for the prompt and effective response to a natural disaster affecting its pipeline facility. Specifically, the Notice alleged that Respondent’s manual of written procedures did not include procedures to respond to seasonal flooding of the Yellowstone River, such as procedures for emergency shutdown of pumps, closure of isolating valves, or precautionary purging of the pipeline in areas susceptible to a release. The Notice alleged that between May 25, 2011, and the date of the incident, Respondent had notice that the river was experiencing flooding in the area of the pipeline crossing, but the Company did not have written procedures to instruct emergency response personnel on how to address the flooding. In its written submissions and at the hearing, Respondent contested the violation and contended that EMPCo’s Operations and Maintenance (O&M) manual contained procedures for responding to emergency conditions. Respondent explained that its O&M manual was comprised of OCC Operating Instructions for the Montana Crude Pipeline system (OCC Instructions) as well as Local Operating Instructions for the Silvertip to Laurel and Billings segments (Local Instructions). These procedures, Respondent contended, “provide detailed instructions for emergency condition response, including line shutdown, valve closures, surveillance, repair and testing procedures.”61 Respondent also indicated the Local Instructions required closure of both upstream and downstream valves to isolate the river crossing. A. Applicable Standards for Emergency Response Procedures Each pipeline operator must have written procedures for conducting normal operations and maintenance activities on the pipeline system and for handling abnormal operations and emergencies.62 61 Pre-hearing Submittal at 10. 62 § 195.402(a).#

520135007_Final Order_01232015_text.pdf, page 18CPF No: 5-2013-5007 Page 17 The written procedures for handling emergencies must include, among other things, provisions for promptly and effectively responding to emergencies. The types of emergencies for which procedures are required include fire or explosion, accidental release, hazardous conditions, and natural disasters affecting the pipeline facility.63 B. Whether Respondent’s Procedures Complied with Applicable Standards PHMSA has reviewed Respondent’s O&M manual comprised of the OCC Instructions and Local Instructions to determine whether they included provisions for responding to an emergency involving a natural disaster affecting its pipeline facility. The OCC Instructions broadly defined an “emergency condition” to include an accidental line leak, fire or explosion near or involving the pipeline, natural disasters effecting the pipeline, and controller alarms indicating a line leak. 64 The procedures then required certain actions to be taken in response to such an “emergency condition.” The OCC Instructions were limited, however, by addressing only actions taken in response to an accidental line leak. For example, the procedures instructed controllers to check line pressures and prepare to shut the system down if the controller “is notified by telephone that a leak has occurred.”65 The controller must also initiate an emergency shutdown when a “line leak” is known, suspected, or indicated by line parameters.66 Another provision stated that controllers are required to respond to an emergency condition “[w]hen a leak is suspected or known.”67 An accidental release is not the only type of emergency that an operator’s procedures must address. Other types of emergencies, such as “fire or explosion occurring near or directly involving a pipeline facility” and “natural disaster affecting pipeline facilities” might not involve a release of product.68 An operator’s procedures must still include provisions to respond to those emergencies. In the case of a pending natural disaster or flood, a response may involve preventative actions, such as temporary shutdown or purging if necessary. Respondent’s OCC Instructions did not require any specific actions to respond to an emergency involving notification of a natural disaster. The procedures only instructed controllers how to respond to leaks or accidental releases. The same deficiency is noted with the Local Instructions. The section of the procedures titled “Response to an Emergency Condition,” stated that if an emergency condition exists, the 63 § 195.402(e)(2). 64 Pre-hearing Submittal Exhibit 13 – Respondent’s OCC Instructions and Local Instructions. OCC Instructions, Section 2.6. 65 OCC Instructions, Section 2.6.1. 66 OCC Instructions, Section 2.6.2. 67 OCC Instructions, Section 2.6.3. 68 § 195.402(e)(2).#

520135007_Final Order_01232015_text.pdf, page 19CPF No: 5-2013-5007 Page 18 pipeline can be shut down by sending a particular station command. But the only situation specified in which the pipeline must be shut down is “[w]hen a leak is suspected or known.”69 In another section of the Local Instructions, separate from the emergency response procedures, there was a list of vulnerable locations and valves that can be closed to isolate each location.70 The Yellowstone River was listed as a vulnerable location and valves 4462 and 4461 were listed as the upstream and downstream valves that may be closed to isolate that location. The list did not contain any instructions to personnel about when such valves must be closed. In particular, the procedures did not specify the circumstances in which the Yellowstone River section of the pipeline must be isolated upon notification of a natural disaster affecting the pipeline. Also, the list was not actually cross-referenced in the emergency response procedures so that someone using the emergency procedures would be directed to the list of vulnerable locations and valves. PHMSA finds Respondent’s procedures did not meet the minimum standard specified in § 195.402(e)(2) because the procedures failed to include provisions for responding to a natural disaster affecting its pipeline facilities. C. Other Issues Raised by Respondent Respondent raised a number of other issues with regard to Item 4. First, Respondent objected to statements in the Notice that it believed were critical of EMPCo for taking measures to respond to flooding concerns. These measures included confirming depth of cover, reviewing ILI data, and meeting with governmental officials. Respondent argued that the Notice implied such precautionary measures “somehow illustrate a failure to adequately prepare for emergency conditions.”71 To determine Respondent’s compliance with § 195.402(e)(2), PHMSA reviewed Respondent’s written emergency response procedures, not the measures taken by the Company to respond to flooding concerns. The statements that Respondent found objectionable did not have an impact on the conclusion that Respondent’s procedures failed to comply with the standard. Second, Respondent objected to the allegation in the Notice that Respondent failed to create “new procedures,” arguing there was no requirement in the regulation to create any new procedures leading up to the 2011 flooding event and pipeline failure. Again, when evaluating Respondent’s compliance with § 195.402(e)(2), PHMSA considered the procedures that were in effect during the relevant time period. The allegation that Respondent failed to create “new procedures” did not impact the finding of violation. 69 Local Instructions, Section 2.4.1. 70 Local Instructions, Section 10.4. 71 Pre-hearing Submittal at 11.#

520135007_Final Order_01232015_text.pdf, page 20CPF No: 5-2013-5007 Page 19 Finally, Respondent claimed the conditions that resulted in the accident were largely unforeseeable because prior to May 2011, the Yellowstone River had not exceeded flood stage since 1997 and the pipeline had never previously been damaged by flooding.72 Under § 195.402(e)(2), Respondent’s procedures must include, at a minimum, provisions for responding to an emergency involving a natural disaster affecting its pipeline. Respondent’s procedures did not meet this minimum standard, regardless of the foreseeability of the accident that occurred on July 1, 2011. D. Conclusion Having reviewed the evidence in the record, PHMSA finds Respondent violated § 195.402(e)(2) by failing to have written procedures for promptly and effectively responding to a natural disaster, including flooding, that could affect its pipeline facility. Item 5: The Notice alleged that Respondent violated 49 C.F.R. § 195.402(e)(4), which states: § 195.402 Procedural manual for operations, maintenance, and emergencies. (a) . . . . (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs . . . (4) Taking necessary action, such as emergency shutdown or pressure reduction, to minimize the volume of hazardous liquid or carbon dioxide that is released from any section of a pipeline system in the event of a failure. The Notice alleged that Respondent failed to prepare written procedures to minimize the volume of hazardous liquid released in the event of a failure. Specifically, the Notice alleged that Respondent’s procedures did not include instructions for controllers to close RCVs to minimize the flow of product into water in the event of a suspected release at the Yellowstone River. The Notice alleged that Respondent’s written control center procedures included instructions for shutting down pumps and closing valves located at the beginning of the pipeline, but not for the rapid closure of all appropriate valves, particularly RCV 4462, in the event of a suspected leak affecting the Yellowstone River. The Notice alleged that a timeline of control room actions and related records demonstrated that on the day of the incident, pumps were shut down within 7 minutes of the first SCADA alarm, but it took 56 minutes for controllers to assess the situation and close RCV 4462 upstream of the Yellowstone River to stop the flow of oil into the water. 72 Pre-hearing Submittal at 10.#

520135007_Final Order_01232015_text.pdf, page 21CPF No: 5-2013-5007 Page 20 In its written submissions and at the hearing, Respondent contended that its written control center procedures had appropriate provisions requiring the shutdown of lines, pump, and valves, and that those procedures were relied on during the Silvertip incident to shut down pumps and block valves.73 In particular, Respondent explained the procedures required that pumping units be shut down whenever a leak is suspected or known. Once shutdown occurs, personnel are to analyze line parameters to confirm the leak and its location. Field personnel are then advised of the conditions and block valves are closed to isolate the affected segment. Respondent stated these instructions included requirements to close both upstream RCV 4462 and downstream RCV 4461 to isolate the affected segment at the Yellowstone River. A. Applicable Standards for Procedures to Minimize the Volume of a Release As stated above, each pipeline operator must have and follow written procedures for conducting normal operations and maintenance activities on the pipeline system and for handling abnormal operations and emergencies.74 The written procedures for handling emergencies must include, among other things, provisions for taking necessary action to minimize the volume released in the event of a pipeline failure, such as emergency shutdown.75 B. Whether Respondent’s Procedure Complied with Applicable Standards PHMSA reviewed Respondent’s OCC Instructions and Local Instructions to determine whether the written procedures required taking necessary action to minimize the volume of a release at the Yellowstone River. Section 2.6 of the OCC Instructions and Section 2.4 of the Local Instructions both identified an “emergency condition” to include any controller alarm function that indicates an accidental line leak. Sections 2.6.2 and 2.6.3 of the OCC Instructions stated that when a line leak is suspected, the controller must initiate an emergency shutdown by stopping pump units “and closing line block valve 1066” and “Laurel block valve 1067.”76 After the line is shut down and block valves are closed, the procedures stated that appropriate division personnel assume responsibility for surveillance, repair and testing. Section 2.4.1 of the Local Instructions stated that if a leak is suspected or known, pumping units “are shut down in accordance with station instructions. With the line shut down and segmented, personnel should analyze the line parameters to confirm the leak and determine the segment where the leak has occurred.”77 73 Pre-hearing Submittal at 11-12. 74 § 195.402(a). 75 § 195.402(e)(4). 76 Pre-hearing Submittal Exhibit 13. 77 Pre-hearing Submittal Exhibit 13.#

520135007_Final Order_01232015_text.pdf, page 22CPF No: 5-2013-5007 Page 21 Other than closure of valves 1066 and 1067, these procedures did not include instructions for controllers to close RCVs to isolate segments following an indication of a failure. Valve 1066 is at the beginning of the Silvertip Pipeline and valve 1067 is at the Laurel Terminal Facility, downstream of the Yellowstone River.78 The closure of only these two valves is not adequate to stop the flow of oil into the Yellowstone River if there is a failure at the river crossing. Although the procedures also stated generally that “line block valves are closed isolating the line in segments,” the procedures provided no further instructions as to what, if any, valves must be closed other than valves 1066 and 1067.79 Section 10.4 of the Local Instructions, which is not cross-referenced in the emergency procedures in Section 2.4, listed “vulnerable locations” on the Silvertip Pipeline and indicated that each vulnerable location may be isolated using particular valves upstream and downstream. For the Yellowstone River the list identified RCV 4462 upstream and RCV 4461 downstream. As noted above, this list did not contain any actual instructions to personnel about when the valves are required to be closed, including whether personnel must close RCVs 4462 and 4461 upon notification of a leak affecting the Yellowstone River. Also, since it is not cross-referenced in Section 2.4, someone using the emergency response procedures would not be referred to Section 10.4. C. Conclusion Respondent’s procedures failed to instruct controllers to close RCV 4462 upstream of the Yellowstone River in the event of a suspected failure at that location. Accordingly, PHMSA finds Respondent violated § 195.402(e)(4) by failing to have written procedures to minimize the volume of hazardous liquid released in the event of a failure at the Yellowstone River. The above findings of violation will be considered prior offenses in any subsequent enforcement action taken against Respondent. ASSESSMENT OF PENALTY Under 49 U.S.C. § 60122, Respondent is subject to an administrative civil penalty not to exceed $100,000 per violation for each day of the violation, up to a maximum of $1,000,000 for any related series of violations.80 The Notice proposed a total civil penalty of $1,700,000 for the alleged violations in Items 1, 2, 4, and 5. The Notice did not propose a penalty for Item 3. 78 Violation Report Exhibit A-1, Appendix 1 at 8. 79 OCC Instructions, Section 2.6.3. 80 The Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, Pub. L. No. 112-90, § 2(a) (Jan. 3, 2012) increased the maximum penalty for a violation of the pipeline safety standards to $200,000 per violation for each day, up to a maximum of $2,000,000 for a related series of violations.#

520135007_Final Order_01232015_text.pdf, page 23CPF No: 5-2013-5007 Page 22 In determining the amount of a civil penalty under 49 U.S.C. § 60122 and 49 C.F.R. § 190.225, PHMSA must consider the following criteria: the nature, circumstances and gravity of the violation, including adverse impact on the environment; the degree of Respondent’s culpability; the history of Respondent’s prior offenses; the good faith of Respondent in attempting to comply with the pipeline safety regulations; and the effect on Respondent’s ability to continue in business. In addition, PHMSA may consider the economic benefit gained from the violation and such other matters as justice may require. In its written submissions and at the hearing, Respondent argued that the proposed penalty is excessive because it is inconsistent with the statutory penalty maximum for a related series of violations, and also because it fails to consider all mitigating factors.81 Respondent also stated there were due process concerns with the proposed penalty. A. Related Series of Violations Administrative penalty assessments for violations of the pipeline safety regulations are subject to the limits set forth in 49 U.S.C. § 60122. At the time of the violation, § 60122(a)(1) stated that a person who commits a violation is liable for “a civil penalty of not more than $100,000 for each violation. A separate violation occurs for each day the violation continues. The maximum civil penalty under this paragraph for a related series of violations is $1,000,000.” Respondent argued that under this statutory provision, Items 1, 2, 4 and 5 are all a “related series of violations” and therefore the combined penalty should be no higher than $1,000,000.82 Respondent contended the violations were all one related series because each violation refers to the same flood event on July 1, 2011, involves the same issues and evidence, and is essentially duplicative so that they all restate the same violation. In the alternative, Respondent contended that Items 1 and 2 are “so closely related” and “share the same evidentiary basis” so as to constitute a single violation. 83 Respondent also contended that Items 4 and 5 constitute a separate single violation.84 PHMSA has previously addressed what constitutes “a related series of violations” under § 60122(a)(1), finding the term refers to a series of daily violations. 85 PHMSA has also explained that just because multiple violations relate to a single pipeline accident, this does not necessarily mean all of the violations are a “related series” under the statute. In Colorado Interstate Gas Company, a case involving propose penalties of $3,364,000, the operator argued that civil penalties arising from a single accident could not exceed $1,000,000 in total regardless of the number of violations.86 PHMSA ultimately rejected that argument, explaining that such 81 Post-hearing Brief at 8-9. 82 Pre-hearing Submittal at 14. 83 Post-Hearing Brief at 8-9. 84 Pre-hearing Submittal at 15. 85 Colorado Interstate Gas Co., CPF No. 5-2008-1005, at 12, 2009 WL 5538649 (Nov. 23, 2009). 86 Colorado Interstate Gas, CPF No. 5-2008-1005, at 10-11.#

520135007_Final Order_01232015_text.pdf, page 24CPF No: 5-2013-5007 Page 23 an interpretation would essentially cap all cases at $1,000,000 because violations can always be considered somewhat related when they involve the same subject matter as part of the same accident investigation. This would arbitrarily limit the number of violations PHMSA could assess penalties for in cases involving multiple serious violations warranting the maximum daily penalty. PHMSA recognizes, however, that some separately alleged violations may be so related that they constitute a single offense for which the Agency should not assess combined penalties exceeding the limit for a single related series. In this regard, PHMSA was previously guided by U.S. Supreme Court precedent in Blockburger v. United States, which held that “where the same act or transaction constitutes a violation of two distinct statutory provisions, the test to be applied to determine whether there are two offenses or only one, is whether each provision requires proof of a fact which the other does not.”87 PHMSA has used this rationale in certain cases to ensure that alleged violations are indeed separate, meaning they each require proof of an additional fact, or have their “own evidentiary basis.”88 For example, in Colorado Interstate Gas Company, PHMSA found that two separately alleged violations were essentially the same because both alleged the operator had failed to conduct adequate oversight of its line locator and both involved the exact same evidence, namely, the conduct of the employee responsible for overseeing the line locator.89 The two alleged violations were found to be so related they constituted a single offense, but they were separate from a third violation, which involved addressing repeated encroachments. Using the same rationale, PHMSA evaluates below whether any of the violations in the present case are so related they constitute a single offense. PHMSA also applies the penalty assessment considerations individually to each of the violations. Item 1: The Notice proposed a civil penalty of $495,500 for Respondent’s violation of § 195.452(i)(2). Respondent violated § 195.452(i)(2) by failing to conduct a risk analysis of its pipeline that considered the threat of flooding and the risk factors relevant to that threat. Although Respondent considered the risk factors listed in § 195.452(i)(2) as they related to other threats, Respondent did not evaluate the likelihood of a release caused by flooding at the Yellowstone River and therefore did not consider the risk factors relevant to that failure mode. The proposed penalty amount was based on assertions in the Notice and Violation Report relevant to the penalty assessment criteria in § 190.225. With regard to the nature, circumstances and gravity of the violation, including adverse impact on the environment, the Violation Report 87 Blockburger v. United States, 284 U.S. 299, 304, (1932) 88 Colorado Interstate Gas, CPF No. 5-2008-1005, at 12. See also Enbridge Energy Partners, L.P., CPF No. 3-2008-5011, 2010 WL 6531629 (Aug. 17, 2010); Williams Gas Pipeline Co., CPF No. 5-2009-1003, 2010 WL 6539190 (Oct. 14, 2010); Columbia Gulf Transmission Co., CPF No. 4-2009-1005, 2011 WL 1919519 (Mar. 21, 2011); Kinder Morgan Liquids Terminals LLC, CPF No. 1-2011-5001, 2012 WL 6184429 (Oct. 17, 2012). 89 Colorado Interstate Gas, CPF No. 5-2008-1005, at 14.#

520135007_Final Order_01232015_text.pdf, page 25CPF No: 5-2013-5007 Page 24 suggested the violation had the highest level of gravity because it resulted in significant P&M measures being overlooked. The violation was discovered as a result of an accident, and allegedly lasted at least 330 days. The Notice also alleged the violation was a major cause of the accident that occurred on July 1, 2011. Having reviewed the record, PHMSA finds the highest level of gravity is appropriate. While evidence in the record does not support finding the violation caused the accident—as reports submitted by both parties attributed the cause to the forces of the flood and accumulation of debris—the violation contributed to increasing the severity of the consequences of the accident. Respondent’s risk analysis did not identify appropriate measures to prevent or mitigate the consequences of an accident caused by natural forces or flooding. Given that the accident resulted in the release of 1,500 barrels of crude oil, environmental damage to a waterway, and evacuations of persons, PHMSA finds the highest level of gravity is appropriate. The proposed penalty amount was also based on an assertion in the Violation Report that the violation affected Respondent’s entire pipeline system, including more than 5,000 miles of pipeline that could impact an HCA.90 There is not sufficient evidence in the record to support finding the violation affected Respondent’s entire pipeline system. Item 1 was limited to the 69.6-mile Silvertip Pipeline and the accident that occurred on July 1, 2011. Accordingly, the penalty should be reduced to accurately reflect the mileage impacted. With regard to the degree of Respondent’s culpability and good faith, the Violation Report suggested a slightly reduced culpability because Respondent had developed an IMP Plan with P&M risk analyses, but Respondent had not achieved full compliance. Based on a review of the record, this is an accurate assessment of Respondent’s culpability. Respondent had an IMP Plan and had performed a risk analysis, but failed to consider risk factors relevant to a pipeline failure caused by natural forces or flooding. In its written submissions, Respondent contended that the proposed penalty did not consider the good faith exhibited by EMPCo in fully cooperating with all federal, State and local officials “both before the incident occurred—voluntarily taking additional actions to evaluate the risk of flooding—and . . . while responding to and investigating the causes of the incident.”91 Respondent also noted that EMPCo has spent more than $135 million in response and coordination efforts, including three new horizontally drilled river crossings for the Silvertip Pipeline and voluntary settlement with the State of Montana. Respondent contended the proposed penalty should be reduced in light of such cooperation and good faith exhibited. When considering the good faith of a respondent under the assessment criteria, PHMSA looks at the operator’s attempt to comply with the cited regulation prior to occurrence of the violation.92 90 Violation Report at 10. In its annual report submitted pursuant to § 195.49, EMPCo reported that it operates approximately 4,000 miles, not more than 5,000 miles. 91 Pre-hearing Submittal at 15. 92 City of Richmond, Virginia, CPF No. 1-2013-0001, 2014 WL 2875598 (May 2, 2014).#

520135007_Final Order_01232015_text.pdf, page 26CPF No: 5-2013-5007 Page 25 With regard to the actions taken by Respondent to cooperate with officials before and after the accident, PHMSA acknowledges these actions, but finds they were steps that any reasonable and prudent operator should take in light of the circumstances presented.93 Pipeline operators should be responsive to local and federal officials when safety concerns are raised and should work with officials to advance pipeline safety particularly following a significant pipeline accident. While Respondent’s actions are noted, PHMSA finds these efforts do not exhibit the requisite attempt to comply with the regulations prior to the violations, and otherwise do not warrant a reduction to the proposed civil penalty given the gravity of the accident. Accordingly, Respondent is assessed a civil penalty of $345,000 for the violation of § 195.452(i)(2), which is a reduced amount to reflect the correct mileage of pipeline associated with the violation. Item 2: The Notice proposed a civil penalty of $504,500 for Respondent’s violation of § 195.452(i)(1). As discussed above, this alleged violation is withdrawn. Therefore, the civil penalty proposed in the Notice for Item 2 is not assessed. Due to the withdrawal of Item 2, it is not necessary to determine whether Item 1 and Item 2 were a “related series of violations” under 49 U.S.C. § 60122(a)(1), as contended by Respondent. Item 4: The Notice proposed a civil penalty of $600,000 for Respondent’s violation of § 195.402(e)(2). Respondent violated § 195.402(e)(2) by failing to have written procedures for promptly and effectively responding to a natural disaster or flooding. Respondent’s procedures addressed accidental releases, but did not require any specific actions if an emergency condition involves a pending natural disaster or flood. The proposed penalty amount was based on assertions in the Notice and Violation Report relevant to the penalty assessment criteria in § 190.225. With regard to nature, circumstances and gravity of the violation, including adverse impact on the environment, the Violation Report noted the violation contributed to increasing the severity of the consequences of the accident. By not having procedures for preventatively shutting down the pipeline system pending the flood, the Violation Report stated that crude oil was allowed to drain into the Yellowstone River for 56 minutes after the initial notification of release. With regard to the degree of Respondent’s culpability and good faith in attempting to comply, the Violation Report stated that EMPCo was cognizant of the regulatory requirements and took some steps to address the issue, but did not achieve compliance. Of note, EMPCo had emergency response procedures, but the procedures did not include steps for responding to the emergency condition of natural forces and flooding affecting the pipeline. 93 See, e.g., Panhandle Eastern Pipeline Co., CPF No. 3-2008-1002, 2011 WL 2937935 (Jun. 17, 2011) (finding actions taken prior to the incident were not actually aimed at achieving compliance with the cited regulation, and corrective actions taken after the incident were steps a reasonable and prudent operator would take to prevent future incidents).#

520135007_Final Order_01232015_text.pdf, page 27CPF No: 5-2013-5007 Page 26 Based on a review of the evidence in the record, PHMSA finds the above assertions are accurate and the proposed civil penalty amount is supported by the applicable assessment criteria. With regard to the length of the violation, the regulatory obligation to have such procedures began before initial operations of Respondent’s pipeline system commenced.94 Respondent argued that Item 1 and Item 4 are a “related series of violations.” PHMSA finds the violations are not a single related series, because each violation involves a separate regulatory requirement and requires proof of an additional fact. Item 1 concerns the requirement to perform a risk analysis by considering the threat of flooding to identify P&M measures. Item 4 concerns the requirement to have written procedures for responding to a natural disaster or flooding. Item 4 requires proof of an additional fact: that Respondent failed to have emergency procedures for responding to a natural disaster or flooding. Having reviewed the record and considered the assessment criteria, Respondent is assessed a civil penalty of $600,000 for the violation of § 195.402(e)(2). Item 5: The Notice proposed a civil penalty of $100,000 for Respondent’s violation of § 195.402(e)(4). Respondent violated § 195.402(e)(4) by failing to have written procedures to minimize the volume of a release in the event of a failure. Specifically, Respondent’s emergency procedures did not direct controllers to close RCV 4462 upstream of the Yellowstone River upon notification of a possible leak affecting the river. With regard to the nature, circumstances and gravity of the violation, including adverse impact on the environment, the Violation Report asserted that the violation increased the severity of the consequences of the accident. By not having procedures requiring immediate closure of RCV 4462, crude oil was allowed to drain into the Yellowstone River for 56 minutes. With regard to the degree of Respondent’s culpability and good faith in attempting to comply, the Violation Report stated that EMPCo was cognizant of the regulatory requirements and took some steps to address the issue, but did not achieve compliance with the regulatory obligation. Of note, EMPCo had emergency response procedures, but the procedures did not include instructions to close RCVs to minimize the release of crude oil at the Yellowstone River. Based on a review of the evidence in the record, PHMSA finds the above assertions are accurate and the proposed civil penalty amount is supported by the applicable assessment criteria. Respondent argued that Item 4 and Item 5 were a single “related series of violations” because both were based on the same regulatory provision, § 195.402(e). Respondent also contended that both alleged that EMPCo had failed to maintain written procedures for responding to natural disasters, and both cited procedures relating to the closure of valves. For example, Respondent stated that Item 4 alleged EMPCo did not have procedures “such as [for] emergency shutdown of 94 § 195.402(a) requires the manual of procedures “shall be prepared before initial operations of a pipeline system commence.”#

520135007_Final Order_01232015_text.pdf, page 28CPF No: 5-2013-5007 Page 27 pumps and closure of isolating valves,” and Item 5 was similarly based on an allegation that EMPCo lacked procedures for shutting down valves. Item 4 and Item 5 are based on separate regulatory provisions. Item 4 concerned the requirement under § 195.402(e)(2) that Respondent have procedures for responding to an emergency involving flooding of the Yellowstone River. Item 5 concerned the requirement under § 195.402(e)(4) that Respondent have procedures for shutting down its pipeline to minimize the volume of release in the event of a failure at the Yellowstone River. The fact that these requirements are located in separately enumerated paragraphs under § 195.402(e) is merely a product of organization.95 The violations in Item 4 and Item 5 also each required proof of a fact the other did not. Item 4 required proof that Respondent failed to have procedures for responding to flooding, procedures which may involve preventative activities beyond merely shutting down the pipeline following an accident. Item 5, on the other hand, required proof that Respondent failed to have procedures for closing specific RCVs during an emergency shutdown. For these reasons, Item 4 and Item 5 are not a single related series of violations. Respondent also argued Item 1 and Item 5 are a related series. For the same reasons stated above, Item 1 and Item 5 are not a related series. Accordingly, Respondent is assessed a civil penalty of $100,000 for the violation of § 195.402(e)(4). B. Due Process Respondent stated PHMSA’s method of calculating penalties presented a due process concern because the Agency has not adopted a formal penalty policy.96 EMPCo argued that the Administrative Procedure Act (APA) requires that all respondents be informed of “the matters of fact and law asserted” in any enforcement pleading, and this should include enough information so that a respondent “understands the issues and is afforded full opportunity to present its defense at a hearing.”97 EMPCo stated that the Notice did not explain how the penalty was calculated or whether the proposed penalty was for multi-day violations. EMPCo stated further that while “some explanation of how the penalty was derived” is often provided after a request for a hearing, no such information is provided at the start of the enforcement action. This practice, EMPCo asserted, forces the regulated community to request a hearing in order to evaluate the penalty 95 See Kinder Morgan, CPF No. 1-2011-5001, at 9 (finding a single paragraph of the code may constitute multiple requirements for which the operator is responsible for compliance). 96 Post-hearing Brief at 9. 97 Pre-hearing Submittal at 16.#

520135007_Final Order_01232015_text.pdf, page 29CPF No: 5-2013-5007 Page 28 information. Thus, EMPCo asserted “PHMSA’s failure to expressly allege multi-day or statutory maximum claims in its Notice violates the due process requirements of the APA.”98 PHMSA has considered Respondent’s position, but disagrees with several of its premises. First, it is not necessary for operators to request a hearing in order to receive information concerning the assessment factors and how they contributed to a proposed penalty. The assessment factors are listed in § 190.225 and operators are free to submit information relevant to those factors to support reducing or withdrawing a penalty. In addition, under § 190.208(c), respondents may request a copy of the case file at any time.99 The case file includes the Violation Report, which is the evidentiary support for the allegations in the Notice. The Violation Report also describes the facts relevant to each of the penalty assessment factors and how those factors influenced the proposed penalty, including duration of the violation.100 For example, the Violation Report in the present case indicated that the violation in Item 1 occurred for a period of 330 days between August 6, 2010, and July 1, 2011.101 PHMSA also provides to respondents upon request, a general outline of how civil penalties are calculated.102 All of this material may be received and reviewed by a respondent before or after responding to a notice of probable violation, regardless of whether or not a hearing is requested. In this case, EMPCo received a copy of the Violation Report shortly after responding to the Notice and was free to respond to the information in its written submissions and at the hearing. Accordingly, PHMSA finds there was sufficient information to afford Respondent an opportunity to present its defense to the proposed penalty. C. Other Considerations Under 49 U.S.C. § 60122 and 49 C.F.R. § 190.225, PHMSA must consider the history of Respondent’s prior offenses and the effect of the penalty on Respondent’s ability to continue in business. The Violation Report noted a total of six prior offenses in the five-year period prior to issuance of the Notice. Respondent did not claim the penalties would affect its ability to continue in business. D. Conclusion In summary, having reviewed the record and considered the assessment criteria for each of the Items cited above, Respondent is assessed a total civil penalty of $1,045,000. 98 Pre-hearing Submittal at 16. 99 Section 190.208 was adopted in 2013, codifying existing practice. Administrative Procedures; Updates and Technical Corrections, 78 Fed. Reg. 58897 (Sept. 25, 2013). 100 See, e.g., Violation Report at 8-13 (describing assessment criteria influencing the penalty for Item 1). 101 Violation Report at 9. 102 See 78 Fed. Reg. 58897, 58901 (explaining that a general outline of how civil penalties are calculated is provided upon request).#

520135007_Final Order_01232015_text.pdf, page 30CPF No: 5-2013-5007 Page 29 Payment of the civil penalty must be made within 20 days of service. Federal regulations (49 C.F.R. § 89.21(b)(3)) require such payment to be made by wire transfer through the Federal Reserve Communications System (Fedwire), to the account of the U.S. Treasury. Detailed instructions are contained in the enclosure. Questions concerning wire transfers should be directed to: Financial Operations Division (AMK-325), Federal Aviation Administration, Mike Monroney Aeronautical Center, P.O. Box 269039, Oklahoma City, Oklahoma 73125-4915. The Financial Operations Division telephone number is (405) 954-8845. Failure to pay the $1,045,000 civil penalty will result in accrual of interest at the current annual rate in accordance with 31 U.S.C. § 3717, 31 C.F.R. § 901.9 and 49 C.F.R. § 89.23. Pursuant to those same authorities, a late penalty charge of six percent (6%) per annum will be charged if payment is not made within 110 days of service. Failure to pay the civil penalty may result in referral of the matter to the Attorney General for action in a district court of the United States. COMPLIANCE ORDER Under 49 U.S.C. § 60118(a), each person who engages in the transportation of hazardous liquids by pipeline or who owns or operates a pipeline facility is required to comply with the applicable safety standards established under chapter 601. The Notice proposed a compliance order with respect to the violation of § 195.403(a)(3) (Item 3), which would have required EMPCo to train its controllers in recognizing and taking appropriate action for conditions that could cause emergencies. The Director indicated that Respondent has completed the actions specified in the proposed compliance order. Accordingly, it is not necessary to include the compliance terms in this Order. Under 49 C.F.R. § 190.243, Respondent may submit a petition for reconsideration of this Final Order to the Associate Administrator for Pipeline Safety, PHMSA, 1200 New Jersey Avenue SE, East Building, 2nd Floor, Washington, D.C. 20590, no later than 20 days after receipt of the Final Order. Any petition submitted must contain a statement of the issue(s) and meet all other requirements of § 190.243. The filing of a petition automatically stays the payment of any civil penalty assessed. If Respondent submits payment of the civil penalty, the Final Order becomes the final administrative decision and the right to petition for reconsideration is waived. The terms and conditions of this Final Order are effective upon service in accordance with § 190.5. _____________________________ ____________________ Jeffrey D. Wiese Date Issued Associate Administrator for Pipeline Safety#

520135007_NOPV PCP PCO_03252013_text.pdf, page 1Official PDFNOTICE OF PROBABLE VIOLATION PROPOSED CIVIL PENALTY and PROPOSED COMPLIANCE ORDER CERTIFIED MAIL - RETURN RECEIPT REQUESTED FAX TO: 713-656-8232 March 25, 2013 Mr. Gary Pruessing President ExxonMobil Pipeline Company 800 Bell Street Room 741-D Houston, Texas 77002 CPF 5-2013-5007 Dear Mr. Pruessing: On July 2, 2011, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), pursuant to Chapter 601 of 49 United States Code, responded to a failure on ExxonMobil Pipeline Company’s (EMPCO) Silvertip Pipeline System at Laurel, Montana. The 69.6-mile Silvertip Pipeline System (Silvertip Pipeline) is a 12” diameter transmission pipeline that transports crude oil from the company’s Silvertip Pump Station near Belfry, Montana, northwards to the Billings Refinery via Laurel. The Silvertip Pipeline crosses the Yellowstone River approximately 800 feet east of the Highway 212 (Failure Site). The pipeline segment at the Failure Site potentially “could affect” a High Consequence Area (HCA) under PHMSA’s integrity management regulations due to the impacts that a pipeline failure could have on the Yellowstone River and other environmentally sensitive areas. At approximately 10:40 p.m. mountain daylight time (MDT) on July 1, 2011, the Silvertip Pipeline failed at this Yellowstone River crossing, releasing approximately 1500 barrels of crude oil over the next hour (Failure). The Failure was reported to the National Response Center on July 1#

520135007_NOPV PCP PCO_03252013_text.pdf, page 22, 2011, at approximately 12:19 a.m. MDT. The oil discharged directly into the Yellowstone River at flood stage and fouled nearby agricultural fields, pastures and lawns along the banks downstream of Laurel. The Failure was first detected by EMPCO’s Operations Control Center (OCC) in Houston, Texas. The OCC houses the company’s Supervisory Control and Data Acquisition (SCADA) system for all EMPCO pipelines, including the Silvertip Pipeline. The company’s various pipelines are segregated so that similar types of pipelines are operated from a single console at the OCC. The console that monitored and controlled the Silvertip Pipeline at the time of the Failure was known as Console #2, from which 12 different pipeline systems were operated. On the evening of July 1, 2011, Console #2 was being controlled by Controller “A.” At 10:40:43 p.m., an alarm went off on Console #2, indicating a drop in line pressure at Remote Control Valve (RCV) 4462, located immediately upstream and south of the Yellowstone River crossing. Controller A apparently did not see or recognize this alarm. However, at 10:41:14 p.m. MDT, he did notice a second alarm indicating that the booster pump at the Edgar Pump Station, located approximately 14 miles upstream from Laurel, had automatically shut down because of a “low suction pressure” alarm. Based on this information, Controller A believed that he might have a leak and shut down the pumps at the head of the Silvertip Pipeline and closed the originating valve (RCV 1066) at 10:50:39 p.m. MDT to stop the flow of crude oil into the pipeline. He then closed RCV 1067, located approximately one-half mile downstream and north of the Yellowstone River crossing, at 10:57:15 p.m. MDT. Three minutes later, Controller A notified his supervisor, who reviewed the trends and alarm logs and at 11:07:32 p.m. MDT directed Controller A to re-open RCV 1067 to allow oil to drain into the Billings refinery. The supervisor initiated a telephone call to the First Line Supervisor in the field, who asked for a senior technician to be added to the call. These three individuals discussed what might have caused the Edgar pumps to go down on low suction. After further discussion and review of the SCADA data, the OCC Supervisor noticed for the first time that the initial alarm had actually been precipitated by a pressure drop at RCV 4462. The supervisor finally ordered RCV 4462 to be closed at 11:36:51 p.m. MDT, which stopped the gravity flow of crude oil into the Yellowstone River. This occurred approximately 56 minutes after the first alarm, a delay that allowed approximately 1063 additional barrels of crude oil to contaminate the river. According to EMPCO’s own internal investigation and PHMSA’s failure investigation report, the cause of the Failure was a submerged “guillotine” break in the pipeline near the south shore of the river. Debris caught on the exposed pipe during the flooding gradually increased external stress on the pipe until it ultimately failed. Following the release, PHMSA issued a Corrective Action Order [CPF No. 5-2011-5017H] dated July 5, 2011, that required EMPCO to take certain actions before restarting the Silvertip Pipeline, and complete additional safety measures before the 2012 flood season. These actions included the replacement of the Yellowstone River crossing with a horizontally directionally drilled line. The Failure was presaged by numerous indications over the past 20 years that the Yellowstone River was prone to seasonal flooding, including that the river had experienced increased erosion 2#

520135007_NOPV PCP PCO_03252013_text.pdf, page 3and scouring from recent floods, that another pipeline in the vicinity had failed in 2009 due to flooding, and a series of warnings from City of Laurel officials who expressed concerns to EMPCO about the safety of the Silvertip Pipeline for at least a year prior to the Failure. Recurring problems with flooding and scouring of the Yellowstone River near Laurel had been common knowledge in Laurel for years. These problems had apparently worsened since 1991, when the Highway 212 Bridge was constructed in a manner that constricted water flow in the river and increased the velocity and scouring of floodwaters. Within approximately 500 feet and “upriver” of the Failure Site, there were three other transmission pipelines, one of which had experienced a recent failure due to flooding and river scouring. Specifically, on June 7, 2009, an 8” natural gas pipeline operated by Williston Basin Interstate Pipeline (WBI) had failed under the Yellowstone River as a result of erosion and flooding. In response to that failure, WBI replaced it with a 16-inch line horizontally directionally drilled (HDD) at a depth of 40-50 feet below the river. In the aftermath of the WBI failure, ConocoPhillips abandoned its 8-inch crude oil pipeline and filled it with nitrogen. It was later determined after the Failure that the ConocoPhillips line also ruptured sometime between 2009- 2011. On August 6, 2010, City officials held a meeting, of various government officials, EMPCO, and representatives of two other pipeline operators (WBI and ConocoPhillips) to view the south bank of the river and to express the City’s concerns about the continuing erosion downstream of the Highway 212 Bridge. Several months later, City officials contacted PHMSA again with the same concerns. The agency again communicated this information to EMPCO, whose response was to conduct a depth of cover survey in December 2010. Upon receipt of that study, EMPCO concluded that the existing depth of cover was a minimum of five feet in the river. The following spring brought new flooding. In May 2011, both PHMSA and Laurel officials expressed to EMPCO their continuing concerns about flood conditions on the Yellowstone River, including the area downstream of the Highway 212 Bridge at the future Failure Site, where it was evident that the erosion on the south bank was extensive and continuing. In June, it became apparent that the river, which normally receded after a few weeks, was still at flood stage, thus increasing the risk of scouring, erosion, and the accumulation of debris that could potentially damage the Silvertip Pipeline. City of Laurel officials contacted EMPCO on multiple occasions between May 25 and June 24, 2011, to express concerns about the safety of the Silvertip Pipeline. On these two dates, EMPCO shut down the line for several hours to assess the situation but decided each time to resume operations. However, on May 25, WBI decided to shut down its “trenched” 16-inch natural gas pipeline located under the Yellowstone River, within a few hundred feet of the Silvertip Pipeline crossing, because of the high floodwaters.1 1 This line was later replaced with a HDD crossing in 2012. 3#

520135007_NOPV PCP PCO_03252013_text.pdf, page 4As a result of PHMSA’s post-failure investigation, it appears that EMPCO has committed probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations. The probable violations are: 1. §195.452 Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (2) Risk analysis criteria. In identifying the need for additional preventive and mitigative measures, an operator must evaluate the likelihood of a pipeline release occurring and how a release could affect the high consequence area. This determination must consider all relevant risk factors, including, but not limited to: (i) Terrain surrounding the pipeline segment, including drainage systems such as small streams and other smaller waterways that could act as a conduit to the high consequence area; (ii) Elevation profile; (iii) Characteristics of the product transported; (iv) Amount of product that could be released; (v) Possibility of a spillage in a farm field following the drain tile into a waterway; (vi) Ditches alongside a roadway the pipeline crosses; (vii) Physical support of the pipeline segment such as by a cable suspension bridge; (viii) Exposure of the pipeline to operating pressure exceeding established maximum operating pressure. Under PHMSA’s integrity management regulations, EMPCO was required to conduct a risk analysis of each pipeline segment that could adversely affect an HCA in the event of a hazardous liquid spill. For at least two years prior to the Failure, EMPCO failed to consider all relevant risk factors in identifying the need for additional preventive and mitigative (P&M) measures in its integrity management program (IMP) for the Silvertip Pipeline. In the risk analysis used as the conceptual basis to develop appropriate P&M measures, entitled Silvertip to Billings 12” Crude Preventive and Mitigative Measures Analysis Summary, dated July 7, 2010 (2010 P&M Plan), EMPCO failed to consider all relevant risk factors, as required under 49 C.F.R. § 195.452(i)(2), in evaluating the likelihood of a pipeline release that could affect the Yellowstone River. In its 2010 P&M Plan, EMPCO failed to consider a number of factors that could have significantly affected the potential impact of a failure on this particular pipeline segment, particularly at the Yellowstone River crossing near Laurel. These factors included: the terrain surrounding the pipeline segment, including drainage systems; the elevation profile of the pipeline; the amount of product that could be released in a spill; and the physical support of the pipeline segment in the river. Other factors that EMPCO should have considered for this segment are listed in Appendix C to 49 C.F.R. Part 195, Guidance for Implementation of Integrity Management Program. The guidance lists additional factors that operators should potentially consider in its IMP, including “potential natural forces inherent in the area (flood zones, earthquakes, subsidence areas, etc.).” 4#

520135007_NOPV PCP PCO_03252013_text.pdf, page 5The risk of flooding on the Yellowstone River was a known threat that could cause the pipe in the river to lose physical support and potentially rupture. The Yellowstone River had a history of extensive seasonal flooding, channel migration, and river bottom scour that should have been considered in the risk analysis. As noted above, this history of flooding had seriously impacted other pipeline operators in the vicinity of the Failure Site. EMPCO’s failure to recognize the risk of flooding and river bottom scour as part of its 2010 P&M Plan, particularly after the 2009 and 2010 flood seasons, resulted in an integrity management plan that failed to properly address known risks to the integrity of the Silvertip Pipeline at the Failure Site. EMPCO should have made changes after the WBI failure in June 2009 and yet did not make changes after the August 6, 2010 meeting with the City of Laurel. The prolonged flooding of the Yellowstone River in the weeks prior to the Failure did, in fact, lead to excessive erosion and river scouring, a loss of pipeline support caused by high water volume and detritus, and the ultimate guillotine failure of the pipeline. Respondent’s failure, over an extended period of time, to recognize these threats as part of its risk analysis was a major cause of the Failure. 2. §195.452 Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (1) General requirements. An operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection. Such actions may include, but are not limited to, implementing damage prevention best practices, better monitoring of cathodic protection where corrosion is a concern, establishing shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the systems that monitor pressure and detect leaks, providing additional training to personnel on response procedures, conducting drills with local emergency responders and adopting other management controls. Consistent with its failure to conduct a risk analysis that recognized the potential for flooding of the Yellowstone River, EMPCO failed to take P&M Measures required by § 195.452 (i) (1) that could have mitigated the consequences of a pipeline failure due to flooding. The Silvertip Pipeline was originally designed and constructed in the 1950’s, more than 20 years prior to the adoption of PHMSA’s regulatory program. At some time after the line had been in operation, the valves upstream of river crossings as well as other strategic valves were modified to allow remote operation. The current configuration of the pipeline includes four remote control valves (RCVs) - a type of Emergency Flow Restricting Device – installed immediately upstream of four river crossings (Clark Fork, Rock Creek, Yellowstone River-Laurel, and Yellowstone River-Billings) along the Silvertip Pipeline. These RCVs were designed to allow controllers to remotely isolate the pipeline in the event of a failure that could spill crude oil into waterways or other environmentally sensitive areas. The RCVs on the Silvertip Pipeline were also equipped with surge-relief bypasses, which protected the pipeline from pressures that could potentially damage the pipe upon rapid closure. 5#

520135007_NOPV PCP PCO_03252013_text.pdf, page 6While the RCVs were installed for the purpose of mitigating the consequences of a failure, EMPCO failed to take any action to operate the RCVs in a manner that would actually prevent or mitigate the consequences of a failure potentially affecting the Yellowstone River. In addition, it failed to take any other P&M Measures that could have potentially addressed such a threat, including the possible implementation of other damage prevention best practices, strengthening leak detection systems, undertaking additional training for its personnel to respond effectively in the event of a spill, or addressing the risk of a guillotine failure due to flooding. 3. §195.403 Emergency Response Training. (a) Each operator shall establish and conduct a continuing training program to instruct emergency response personnel to: (3) Recognize conditions that are likely to cause emergencies, predict the consequences of facility malfunctions or failures and hazardous liquids or carbon dioxide spills, and take appropriate corrective action; EMPCO failed to establish and conduct a continuing training program to instruct emergency response personnel to recognize conditions likely to cause emergencies, to predict the consequences of crude oil spills, or to take appropriate corrective actions. Specifically, the company did not effectively train the controllers and supervisors at the OCC to recognize conditions likely to cause emergencies during flooding, to predict the consequences of facility malfunctions, failures, or hazardous liquid spills, or to take appropriate corrective actions. EMPCO staff stated in post-failure interviews that it was their practice to drain crude away from a release and that because the Silvertip Pipeline gravity-flowed into the Laurel refinery, anything but a guillotine failure would allow crude oil to drain away from the release. Following “low pressure” alarms at 10:40 p.m. MDT and shutdown of pumps at 10:47 p.m. MDT, Controller A requested assistance from his OCC Supervisor, who assumed control of Silvertip Pipeline operations at approximately 11:00 p.m. MDT. He called the First Line Supervisor in Billings, Montana, who then conferenced in a Senior Field Technician. Each of these individuals was aware of the high levels of flooding that had been occurring since mid-May on the Yellowstone River. Nevertheless, it took until 11:36 p.m. for these three EMPCO individuals to determine that a release had occurred near the Yellowstone River and oil could be flowing into the river. From their actions following the first alarm on the date of the Failure, it is apparent that neither the OCC Supervisor nor the First Line Supervisor had been adequately trained to recognize and properly respond to the: 1) local environmental conditions that were likely to cause emergencies, e.g., localized historic flooding; 2) the consequences of a guillotine failure in the river; or 3) the unique system configurations, e.g., surge-protected RCVs that could have mitigated the consequences of the Failure. Had the controllers and supervisors been trained to know the elevation profile of the pipeline adjacent to the river and the design of the RCVs, they would have been able to make the decision to close the RCVs upstream of the Yellowstone River crossing more quickly. 6#

520135007_NOPV PCP PCO_03252013_text.pdf, page 74. §195.402 Procedural manual for operations, maintenance, and emergencies. (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies…. (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs; (2) Prompt and effective response to a notice of each type emergency, including fire or explosion occurring near or directly involving a pipeline facility, accidental release of hazardous liquid or carbon dioxide from a pipeline facility, operational failure causing a hazardous condition, and natural disaster affecting pipeline facilities. EMPCO violated § 195.402(e)(2) by failing to have written procedures for taking prompt and effective action to protect the Silvertip Pipeline after receiving notice of a natural disaster affecting the company’s pipeline facilities. Specifically, EMPCO’s manual failed to include procedures to respond to seasonal flooding of the Yellowstone River. Beginning on or before May 25, 2011 and continuing through the date of the Failure, EMPCO had notice that the Yellowstone River was experiencing flooding at Laurel that adversely affected the safety of the Silvertip Pipeline, yet the company had no written procedures in place to address a natural disaster of this type. The company’s response during the month prior to the Failure was to visit Laurel, meet with City and other government officials, shut down the line for several hours on two separate occasions while evaluating data, monitor the water levels daily, and to place sandbags around RCV 4462 in Laurel’s Riverside Park to protect the valve in case it was flooded. The company, however, had no written procedures on how its emergency response personnel should address flooding. Since the portion of the line that was buried in the Yellowstone River was neither visible nor easily accessible, such procedures needed to address potential actions such as emergency shutdown of pumps and closure of isolating valves or even precautionary purging of the pipeline in areas susceptible to a release. For example, on May 25, 2011, WBI shut down its open-cut 16-inch gas pipeline within a few hundred feet of the Failure Site due to concerns about flooding. Although EMPCO also shut down its line on May 25th and June 24th, both shutdowns were only for a few hours. There is no indication that EMPCO initiated or implemented any new procedures to respond to the 2011 flooding of the Yellowstone River. 5. §195.402 Procedural manual for operations, maintenance, and emergencies. (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies…. (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs; (4) Taking necessary action, such as emergency shutdown or pressure reduction, to minimize the volume of hazardous liquid or carbon dioxide that is released from any section of a pipeline in the event of a failure. 7#

520135007_NOPV PCP PCO_03252013_text.pdf, page 8EMPCO violated § 195.402(e)(4) by failing to have written procedures for taking necessary action to minimize the volume of oil potentially released from any section of the Silvertip Pipeline in the event of a failure. The Silvertip Pipeline was physically equipped with RCVs upstream of each major water crossing that could be remotely actuated by pipeline controllers in Houston. However, the EMPCO procedures in place at the time of the Failure did not include instructions to close the RCVs upstream of waterways in a manner designed to minimize the flow of product into the water in the event of a suspected release. EMPCO’s OCC operating instructions (OI) at the time of the Failure instructed EMPCO controllers to shut down the originating pumps and close the valves at the beginning of the Silvertip Pipeline. However, the OIs did not include procedures for the rapid closure of all appropriate valves if the controller suspected a leak. In particular, EMPCO lacked written procedures for shutting down RCV 4462 in the event of a suspected leak that could affect the Yellowstone River. The first indication of a possible release on the date of the Failure, given the history of flooding and the City’s concerns about this pipeline should have prompted an immediate emergency shutdown of the system, including pumps and all isolating valves. During PHMSA’s failure investigation, EMPCO provided a timeline of OCC controller actions, supervisor actions and SCADA recorded events. This timeline shows the pumps at the originating station were shut down within seven minutes of the first SCADA alarm. These actions were done in accordance with the EMPCO emergency procedures in place at the time of the spill. It took 56 minutes, however, for the supervisors to correctly assess the situation and close RCV 4662 immediately upstream of the Yellowstone River to stop the flow of oil into the river. Failure to close this valve resulted in considerably more crude oil being spilled into the Yellowstone River. As part of this investigation, EMPCO personnel were asked why the OIs did not include a requirement to immediately close all RCVs after a possible leak, especially if each RCV could be quickly closed without concerns of overpressurization. EMPCO staff said it was their practice to drain crude away from a release and that because the Silvertip Pipeline gravity flowed into the Laurel refinery, anything but a guillotine failure would allow crude oil to drain away from the release. However, the Failure was a guillotine failure and EMPCO’s procedures did not address the proper response to a guillotine failure. By failing to have a procedure in place to address such a failure, the pipeline continued to drain into the Yellowstone River for approximately 56 minutes after the initial alarm and allowed an additional 1,063 barrels of oil to pollute the river. Proposed Civil Penalty Under 49 United States Code, § 60122, you are subject to a civil penalty not to exceed $200,000 per violation per day the violation persists up to a maximum of $2,000,000 for a related series of violations. For violations occurring prior to January 3, 2012, the maximum penalty may not exceed $100,000 per violation per day, with a maximum penalty not to exceed $1,000,000 for a related series of violations. The Compliance Officer has reviewed the circumstances and supporting documentation involved in the above probable violations and has recommended that you be preliminarily assessed a civil penalty of $1.7 million as follows: 8#

520135007_NOPV PCP PCO_03252013_text.pdf, page 9Item number PENALTY 1 $495,500 2 $504,500 4 $600,000 5 $100,000 Proposed Compliance Order With respect to item 3, pursuant to 49 United States Code § 60118, the Pipeline and Hazardous Materials Safety Administration proposes to issue a Compliance Order to ExxonMobil. Please refer to the Proposed Compliance Order, which is enclosed and made a part of this Notice. Response to this Notice Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance Proceedings. Please refer to this document and note the response options. All material submit in response to this enforcement action may be made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue a Final Order. In your correspondence on this matter, please refer to CPF 5-2013-5007 and for each document you submit, please provide a copy in electronic format whenever possible. This Notice does not address any potential civil or criminal liability that EMPCO may have for violations of any other federal laws arising from or otherwise related to the events or conduct giving rise to this Notice or to the consequences or damages resulting from the July 1, 2011 failure. Sincerely, Chris Hoidal Director, Western Region Pipeline and Hazardous Materials Safety Administration Enclosure: Response Options for Pipeline Operators in Compliance Proceedings 9#

520135007_NOPV PCP PCO_03252013_text.pdf, page 10PROPOSED COMPLIANCE ORDER Pursuant to 49 United States Code§ 60118, the Pipeline and Hazardous Materials Safety Administration (PHMSA) proposes to issue to Exxon Mobil Pipeline Company a Compliance Order incorporating the following remedial requirement to ensure compliance with the pipeline safety regulations: 1. In regard to Item Number 3 of the Notice pertaining to emergency response training, ExxonMobil must train all controllers, future and existing, on all ExxonMobil hazardous liquid pipelines to recognize conditions that are likely to cause emergencies, predict the consequences of facility malfunctions, failures, or hazardous liquids spills, and take appropriate corrective action. 2. ExxonMobil must provide documentation of the completed training to the Director, Western Region, within 30 days. 3. It is requested (not mandated) that ExxonMobil maintain documentation of the safety improvement costs associated with fulfilling this Compliance Order and submit the total to Chris Hoidal, Director, Western Region, Pipeline and Hazardous Materials Safety Administration. It is requested that these costs be reported in two categories: 1) total cost associated with preparation/revision of plans, procedures, studies and analyses, and 2) total cost associated with replacements, additions and other changes to pipeline infrastructure. 10#

520135007_closure letter_07092015_text.pdf, page 1Official PDFCERTIFIED MAIL - RETURN RECEIPT REQUESTED July 9, 2015 Mr. Gerald Frey President ExxonMobil Pipeline Company 800 Bell Street, Room 741-D P.O. Box 2220 Houston, TX 77002 CPF 5-2013-5007 Dear Mr. Frey: On January 23, 2015, the Pipeline and Hazardous Materials Safety Administration (PHMSA) issued to ExxonMobil Pipeline Company a Final Order in the above-referenced case. This Order included a Compliance Order and Civil Penalty assessment. Based on our review of the documentation you provided and confirmation of payment of the civil penalty, it has been determined that you have complied with the terms of this Order. Accordingly, this case is now closed and no further action is contemplated with respect to the matters involved in this case. Thank you for your cooperation in this matter. Sincerely, Chris Hoidal Director, Western Region Pipeline and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 P. Katchmar#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 1Official PDFJune 12, 2015 Mr. Gerald S. Frey Global Pipeline Manager & President ExxonMobil Pipeline Company 22777 Springwoods Village Parkway E3.5A.521 Spring, Texas 77389 Re: CPF No. 5-2013-5007 Dear Mr. Frey: Enclosed is the decision on the petition for reconsideration filed by ExxonMobil Pipeline Company in the above-referenced case. For the reasons explained in the decision, the petition is denied. When the civil penalty assessed in the final order has been paid, this enforcement action will be closed. This decision constitutes the final administrative action in this proceeding. Service of the decision is made pursuant to 49 C.F.R. § 190.5. Thank you for your cooperation in this matter. Sincerely, Jeffrey D. Wiese Associate Administrator for Pipeline Safety Enclosure cc: Mr. Chris Hoidal, Director, Western Region, PHMSA Mr. Bob Hogfoss and Ms. Catherine Little, Hunton & Williams LLP, Bank of America Plaza, Suite 4100, 600 Peachtree Street, N.E., Atlanta, GA 30308 CERTIFIED MAIL – RETURN RECEIPT REQUESTED PHC-20: B. Fred/V. Tsaganos: jrs: x63529: 6/3/15 J:/Pipeline/Orders Pending with PHP/CPF No. 5-2013-5007 ExxonMobil Pipeline Company#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 2U.S. DEPARTMENT OF TRANSPORTATION PIPELINE AND HAZARDOUS MATERIALS SAFETY ADMINISTRATION OFFICE OF PIPELINE SAFETY WASHINGTON, D.C. 20590 ___________________________________ In the Matter of ) ExxonMobil Pipeline Company, ) CPF No. 5-2013-5007 ) ) ) Petitioner. ) ___________________________________ ) DECISION ON PETITION FOR RECONSIDERATION On July 1, 2011, the Silvertip Pipeline operated by ExxonMobil Pipeline Company (EMPCo or Petitioner) experienced a failure in Laurel, Montana. The failure occurred during a flood event and resulted in the release of approximately 1,500 barrels of crude oil into the Yellowstone River, causing environmental damage and forcing the evacuation of approximately 42 people.1 Following an investigation by the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), the Director, Western Region, issued a Notice of Probable Violation, Proposed Civil Penalty, and Proposed Compliance Order to EMPCo on March 25, 2013 (Notice). The Notice alleged that EMPCo committed five violations of the pipeline safety regulations in connection with the accident, proposed a civil penalty of $1,700,000, and proposed corrective action. EMPCo requested a hearing on the Notice, which was held July 17, 2013, in Lakewood, Colorado. On January 23, 2015, pursuant to 49 C.F.R. § 190.213, PHMSA issued a Final Order, finding EMPCo had committed four of the five violations that were alleged in the Notice. The order assessed a civil penalty of $1,045,000 for the violations, and found that EMPCo had already completed the proposed compliance order. On February 12, 2015, EMPCo filed a Petition for Reconsideration of the Final Order (Petition) seeking reconsideration of three of the violations and elimination or reduction of the civil penalty. Specifically, the Company sought the withdrawal of the findings that it had violated 49 C.F.R. §§ 195.452(i)(2) (Item 1), 195.402(e)(2) (Item 4), and 195.402(e)(4) (Item 5). 1 For additional information regarding the accident, see pp. 2-6 of the Final Order issued to ExxonMobil Pipeline Co., CPF No. 5-2013-5007, 2015 WL 780721 (Jan. 23, 2015). Enforcement decisions can be viewed on PHMSA’s website at http://www.phmsa.dot.gov/ pipeline/enforcement (follow links for enforcement since 2002 and then enforcement actions issued by year).#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 3CPF No. 5-2013-5007 Page 2 Under 49 C.F.R. § 190.243, an operator may petition for reconsideration of a final order. PHMSA may grant or deny, in whole or in part, a petition for reconsideration without further proceedings. Item 1 in the Final Order found that EMPCo had violated 49 C.F.R. § 195.452(i)(2), which states: § 195.452 Pipeline integrity management in high consequence areas. (a) Which pipelines are covered by this section? This section applies to each hazardous liquid pipeline and carbon dioxide pipeline that could affect a high consequence area . . . . (i) What preventive and mitigative measures must an operator take to protect the high consequence area?—(1) General requirements. An operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection . . . (2) Risk analysis criteria. In identifying the need for additional preventive and mitigative measures, an operator must evaluate the likelihood of a pipeline release occurring and how a release could affect the high consequence area. This determination must consider all relevant risk factors, including, but not limited to: (i) Terrain surrounding the pipeline segment, including drainage systems such as small streams and other smaller waterways that could act as a conduit to the high consequence area; (ii) Elevation profile; . . . (iv) Amount of product that could be released; [and] . . . (vii) Physical support of the pipeline segment such as by a cable suspension bridge; . . . . The Final Order determined that EMPCo had violated § 195.452(i)(2) by failing to conduct a risk analysis that evaluated the likelihood of its pipeline experiencing a release caused by flooding, and by failing to consider risk factors relevant to flooding. The Final Order found that seasonal floods were known to occur at the Yellowstone River and that such flooding had caused prior incidents in the area of the Silvertip pipeline. PHMSA found that EMPCo had a duty under § 195.452(i)(2) to include in its risk analysis an evaluation of the likelihood that the Silvertip pipeline could experience a release caused by flooding. The Final Order reviewed the relevant records and procedures of EMPCo to determine if the Company met its obligation to evaluate the likelihood of a release from flooding. PHMSA found that EMPCo had conducted a risk analysis that identified three potential integrity threats: third- party damage, manufacturing, and external corrosion. EMPCo had not identified flooding of the Yellowstone River as a threat that could affect the likelihood of a pipeline release. In addition, EMPCo had not evaluated risk factors relevant to flooding. For these reasons, the Final Order found EMPCo had committed a violation.#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 4CPF No. 5-2013-5007 Page 3 In its Petition, EMPCo maintained that it had performed a risk assessment and analysis that “expressly evaluated the risk of flooding both generally on the Silvertip Pipeline and at the Yellowstone River crossing specifically.”2 EMPCo contended further that it had concluded flooding was not a significant risk. To support its position, EMPCo cited to the Company’s Silvertip to Billings 12” Crude Preventive & Mitigative Measures Analysis Summary (2010 P&M Analysis), Integrity Management Program (2010 IMP Plan), and Integrity Management Program Form 6.1 (2010 IMP Form 6.1). Each of these documents were discussed in the Final Order. They were found not to demonstrate compliance with § 195.452(i)(2) because they did not show EMPCo evaluated the likelihood of a release from flooding. In its Petition, EMPCo has not identified any specific provision in these documents that it believes was overlooked or misrepresented in the Final Order. PHMSA reconsiders these documents below, but finds they still fail to demonstrate compliance. 2010 P&M Analysis – EMPCo’s P&M Analysis identified three potential integrity threats to the Silvertip Pipeline: third-party damage, manufacturing, and external corrosion.3 The Analysis did not identify other threats that could affect the likelihood of a pipeline release, including the threat of flooding. While the document did identify and evaluate various P&M measures, those measures only addressed the three integrity threats identified, not flooding. The documentation does not support Petitioner’s contention that it evaluated the risk of flooding or that it concluded flooding was not a significant risk. 2010 IMP Plan – EMPCo’s IMP Plan had procedures for performing a risk analysis, but merely having procedures does not prove the Company followed them by evaluating the risks of flooding. When these documents were originally submitted by EMPCo, they had certain sentences highlighted to emphasize that segments are “evaluated for the relative significance of the nine ASME B31.8S threats.”4 The IMP Plan demonstrates that EMPCo had a written process for performing a risk analysis, including evaluating segments for the threats listed in ASME B31.8S, but the procedures alone do not demonstrate the process was followed or that EMPCo actually analyzed the risk of flooding. 2010 IMP Form 6.1 – EMPCo’s IMP Form 6.1 was used to document the evaluation of preventive and mitigative actions in support of the 2010 P&M Analysis.5 The documents consist of two separate forms. The first identified moderate external corrosion as a threat and discussed the threats and risk drivers, measures to reduce risk, and risk reduction results. The second evaluation identified a manufacturing threat and provided the same type of discussion. There were no forms identifying the threat of natural forces or flooding, and none that indicated risk factors were considered in regard to the specific threat of natural forces or flooding. 2 Petition at 3. 3 OPS Pipeline Safety Violation Report (Violation Report) (Apr. 19, 2013), Exhibit B-7. 4 EMPCo Pre-hearing Submittal (Jul. 8, 2013), Exhibit 9, p. 83. ASME/ANSI B31.8S is a consensus standard related to integrity management of gas pipelines. See 49 C.F.R. § 192.7. 5 Pre-hearing Submittal, Exhibit 10.#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 5CPF No. 5-2013-5007 Page 4 Accordingly, the IMP Forms do not demonstrate that EMPCo performed a risk analysis that considered flooding as a threat. Having reconsidered the documentation cited by Petitioner, PHMSA confirms its finding that the documents fail to demonstrate EMPCo evaluated the likelihood of a release from flooding. Petitioner also noted that the Final Order withdrew Item 2 in the Notice, and argued that Item 1 should also be withdrawn because the Company’s arguments were the same for both items. PHMSA withdrew Item 2 after finding that OPS failed to prove EMPCo had committed a violation of § 195.452(i)(1).6 Item 1 and Item 2 concerned two separate regulatory requirements and the withdrawal of Item 2 had no bearing on the finding of violation in Item 1. For the reasons stated above, PHMSA does not find cause to disturb the finding in the Final Order that EMPCo violated § 195.452(i)(2). Items 4 and 5 in the Final Order found that EMPCo had violated 49 C.F.R. § 195.402(e)(2) and (e)(4), respectively, which state: § 195.402 Procedural manual for operations, maintenance, and emergencies. (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies . . . . (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs . . . (2) Prompt and effective response to a notice of each type [of] emergency, including fire or explosion occurring near or directly involving a pipeline facility, accidental release of hazardous liquid or carbon dioxide from a pipeline facility, operational failure causing a hazardous condition, and natural disaster affecting pipeline facilities . . . . (4) Taking necessary action, such as emergency shutdown or pressure reduction, to minimize the volume of hazardous liquid or carbon dioxide that is released from any section of a pipeline system in the event of a failure. Item 4 of the Final Order determined that EMPCo had violated § 195.402(e)(2) by failing to have procedures for responding to natural disasters, such as seasonal flooding of the Yellowstone River. The Final Order evaluated EMPCo’s written emergency procedures and found that while they defined “emergency condition” broadly to include natural disasters, the procedures only 6 Final Order at 15. Petitioner incorrectly suggested that PHMSA withdrew Item 2 because the facts were too similar to Item 1. Petition at 5, n. 2. The Final Order withdrew Item 2 based on a finding that OPS failed to prove a violation of § 195.452(i)(1).#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 6CPF No. 5-2013-5007 Page 5 provided instructions for responding to accidental leaks. Instructions to address other types of emergencies, such as fires and natural disasters which may not involve an immediate leak, were not included in the procedures. Item 5 of the Final Order determined that EMPCo had violated § 195.402(e)(4) by failing to have procedures requiring the closure of remote control valves (RCVs) to minimize the volume of oil released into the Yellowstone River during a failure. The Final Order reviewed EMPCo’s emergency procedures and found they only required closing valves at the beginning of the pipeline and at the Laurel Terminal Facility, which is downstream of the river. Closure of only these two valves is not adequate to minimize the flow of oil into the Yellowstone River if there is a failure at the river crossing. The procedures did not require immediate closure of the nearest upstream RCV from the river. In its Petition, EMPCo contends that it had the requisite procedures in place, including procedures to respond to emergency conditions and to identify RCVs to isolate the Yellowstone River. To the extent there were deficiencies in the implementation of these procedures, or if improvements could be made to the procedures themselves, Respondent argued that it would not constitute a violation . Respondent also argued that Items 4 and 5 were based on the same factual allegations and were so related they should be withdrawn or their penalties reduced. Petitioner essentially raises arguments that are already discussed in the Final Order. PHMSA evaluated EMPCo’s written emergency procedures in the Order and concluded they did not contain the necessary instructions for personnel to respond to natural disasters and to minimize the volume of oil released. PHMSA has consistently held that an operator’s procedures may be found in violation if the procedures fail to contain elements that are required or if the procedures do not provide the level of safety mandated by the regulation.7 Respondent has failed to demonstrate the findings of violation in Items 4 and 5 were in error. The Final Order also addressed Petitioner’s argument that Items 4 and 5 are “related” and should be withdrawn or their penalties reduced. The Final Order rejected this argument, finding the violations were based on separate regulatory provisions and constituted violations of separate regulatory requirements. Each violation also required proof of an additional fact the other did not. For these reasons, the Final Order determined they were not “a related series of violations.” Even if it had been determined that the violations were “a related series,” their combined penalties would not exceed the maximum allowed under 49 U.S.C. § 60122.8 7 See, e.g., Sunoco Pipeline L.P., CPF No. 1-2009-5003, Item 1, 2011 WL 7416422 (Nov. 25, 2011) (stating that “[p]rocedures that are ineffective or that do not provide an acceptable level of safety may be found in noncompliance”). 8 At the time of the violations, the maximum administrative penalty was $100,000 per violation for each day of the violation, up to a maximum of $1,000,000 “for a related series of violations.” The Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011, Pub. L. No. 112-90, § 2(a) (Jan. 3, 2012) increased the maximum to $200,000 per day, up to $2,000,000 for a related series.#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 7CPF No. 5-2013-5007 Page 6 Accordingly, having reconsidered the record, PHMSA confirms its finding that EMPCo’s procedures did not comply with § 195.402(e)(2) and (4), as set forth in Items 4 and 5 of the Final Order, respectively. Strict Liability Finally, EMPCo contends that the Final Order relies on a theory of “strict liability” to support the imposition of civil penalties. Under this theory, EMPCo argues that PHMSA is inappropriately holding the Company liable for the Silvertip pipeline accident even though “the Company was in compliance with the rules . . . both before and at the time of the incident.”9 EMPCo argues that under the Pipeline Safety Act, PHMSA does not have authority to impose strict liability, and “must base all enforcement on documented findings of violations.”10 EMPCo contends that it met all applicable safety standards, and the pipeline accident occurred due to a flood that was beyond its control. EMPCo’s notion that it was in compliance with the regulations at the time of the accident is refuted by the findings of violation documented in the Final Order, and confirmed in this Decision. Specifically, EMPCo violated the following regulations: 49 C.F.R. §§ 195.452(i)(2) (Item 1); 195.403(a)(3) (Item 3); 195.402(e)(2) (Item 4); and 195.402(e)(4) (Item 5). Under the Pipeline Safety Act, “a person that [PHMSA] decides, after written notice and an opportunity for a hearing, has violated section 60114(b), 60114(d), or 60118(a) of this title or a regulation prescribed or order issued under this chapter is liable to the United States Government for a civil penalty . . . .”11 EMPCo committed violations of the pipeline safety regulations, and is therefore liable for civil penalties in this administrative proceeding.12 When assessing a civil penalty, PHMSA considers a number of assessment criteria. 13 If a violation is the result of circumstances beyond the control of an operator, PHMSA may find cause to reduce or withdraw the proposed penalty after weighing the other assessment criteria. In this case, Petitioner’s failure to complete an appropriate risk analysis and to prepare appropriate emergency response procedures was not the result of circumstances beyond its control. Moreover, these violations contributed to increasing the severity of the consequences of an accident: crude oil drained into the Yellowstone River for 56 minutes after the first alarm indicated a pressure drop at the location of the river crossing, causing significant environmental damage and forcing the evacuation of approximately 42 people. . Accordingly, PHMSA finds no reason to reduce the penalty assessed in the Final Order. 9 Petition at 3. 10 Petition at 3. 11 49 U.S.C. § 60122(a)(1). 12 Petitioner’s attempt to distinguish the Pipeline Safety Act (PSA) from the Clean Water Act (CWA) does not help its position. Like the PSA, the CWA holds parties liable for a “violation” of that statute and the implementing regulations. 33 U.S.C. § 1321(b)(6)(A), (f)(2). 13 49 U.S.C. § 60122(b) and 49 C.F.R. § 190.225.#

520135007_Decision on Petition for Reconsideration_06122015_text.pdf, page 8CPF No. 5-2013-5007 Page 7 For the above reasons, the Petition for Reconsideration filed by EMPCo is denied. Payment of the $1,045,000 civil penalty assessed in the Final Order is now due and must be made within 20 days of service of this Decision. Federal regulations (49 C.F.R. § 89.21(b)(3)) require such payment to be made by wire transfer through the Federal Reserve Communications System (Fedwire), to the account of the U.S. Treasury. Detailed instructions are contained in the enclosure. Questions concerning wire transfers should be directed to: Financial Operations Division (AMK-325), Federal Aviation Administration, Mike Monroney Aeronautical Center, P.O. Box 269039, Oklahoma City, Oklahoma 73125-4915. The Financial Operations Division telephone number is (405) 954-8845. Failure to pay the $1,045,000 civil penalty will result in accrual of interest at the current annual rate in accordance with 31 U.S.C. § 3717, 31 C.F.R. § 901.9 and 49 C.F.R. § 89.23. Pursuant to those same authorities, a late penalty charge of six percent (6%) per annum will be charged if payment is not made within 110 days of service. Failure to pay the civil penalty may result in referral of the matter to the Attorney General for action in a district court of the United States. This Decision on Petition for Reconsideration is the final administrative action in this proceeding. _____________________________ ____________________ Jeffrey D. Wiese Date Issued Associate Administrator for Pipeline Safety#