PANTHER OPERATING COMPANY, LLC — Warning Letter

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 1Official PDFWARNING LETTER VIA E-MAILTO MR. MATTHEW ROLAND March 24, 2021 Mr. Matthew Rowland CEO Third Coast Midstream, LLC 1501 McKinney, Suite 800 Houston, TX 77010 CPF 5-2021-004-WL Dear Mr. Rowland: From July 13, 2020 through July 17, 2020, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to Chapter 601 of 49 United States Code (U.S.C.), performed a virtual inspection of the Third Coast Midstream, LLC (Third Coast), control rooms located in Houston and Texas City, Texas. The inspection covered procedures, records, and virtual observations. As a result of the inspection, it is alleged that you have committed probable violations of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations (CFR). The items inspected and the probable violations are: 1. § 195.446 - Control room management. (a) General. This section applies to each operator of a pipeline facility with a controller working in a control room who monitors and controls all or part of a pipeline facility through a SCADA system. Each operator must have and follow#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 2written control room management procedures that implement the requirements of this section. The procedures required by this section must be integrated, as appropriate, with the operator's written procedures required by § 195.402. An operator must develop the procedures no later than August 1, 2011, and must implement the procedures according to the following schedule. The procedures required by paragraphs (b), (c)(5), (d)(2) and (d)(3), (f) and (g) of this section must be implemented no later than October 1, 2011. The procedures required by paragraphs (c)(1) through (4), (d)(1), (d)(4), and (e) must be implemented no later than August 1, 2012. The training procedures required by paragraph (h) must be implemented no later than August 1, 2012, except that any training required by another paragraph of this section must be implemented no later than the deadline for that paragraph. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1) … (6) Control room team training and exercises that include both controllers and other individuals, defined by the operator, who would reasonably be expected to operationally collaborate with controllers (control room personnel) during normal, abnormal or emergency situations. Operators must comply with the team training requirements under this paragraph no later than January 23, 2018. Third Coast did not establish team trainings and exercises until August 2018. Section 195.446(a) states that the training procedures required by paragraph (h) must be implemented no later than August 1, 2012, except that any training required by another paragraph of this section must be implemented no later than the deadline for that paragraph. Section 195.446(h)(6) states that control room team training and exercises that include both controllers and other individuals, defined by the operator, who would reasonably be expected to operationally collaborate with controllers (control room personnel) during normal, abnormal or emergency situations. This section requires that operators comply with the team training requirements under this paragraph no later than January 23, 2018. Third Coast’s training program manual shows that team training was not identified in the manual until the revision dated August 13, 2019, approximately seven months after the regulatory deadline for complying with section 195.446(h)(6). 2. § 195.446 - Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to 2#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 3carry out the roles and responsibilities the operator has defined by performing each of the following: (1) … (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays; Third Coast did not provide adequate information to its controllers necessary for the controllers to carry out their roles and responsibilities. Specifically, Third Coast did not conduct a point-to- point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays, as required by their procedures. Records fail to document all the guidelines required by the Point to Point Verification Procedure, CRM-APP-309, rev. 2, dated 8/13/2019, section 309.3.1 - General Instrument Point to Point Guidelines. Bullet three of that procedure states, “In general, a point to point check of all indicating and control instruments shall be made at the minimum of three points 0%, 50%, and 100% of range.” Third Coast did not provide documentation showing the operator conducted point to point verification in accordance with its procedure. 3. § 195.446 - Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) … (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months. Third Coast did not provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out their roles and responsibilities. Specifically, Third Coast did not test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months. Records provided for testing of the internal communication plan indicate that the operator exceeded the interval for testing by approximately two months, from May 23, 2017 to November 1, 2018. Additionally, the documentation in the test records is sparse and fails to demonstrate that test and verification processes confirmed that the operator has adequate personnel, procedures, processes, communications infrastructure, and manual command-and-control capabilities to assure safe, reliable operations and pipeline integrity when operating manually. 3#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 4Records also illustrated that issues were identified during the testing, but no follow up actions were taken and/or documented. 4. § 195.446 - Control room management. (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) … (4) Test any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months; Third Coast did not provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out their roles and responsibilities. Specifically, Third Coast did not test any backup SCADA systems at least once each calendar year, but at intervals not to exceed 15 months. Records for the SCADA test with a date of “April 6” did not include a year on document and signature approvals were missing. Third Coast stated the forms were not signed due to the COVID pandemic, however, it remains unclear why the full date was not documented. Third Coast reported that they assume that the SCADA test occurred in 2020, but the test could not be verified. Further, records for the SCADA test from November, 2019 failed to include approval signatures, which are required by the control room procedures. Records for the SCADA test from October 18, 2018 also failed to include approval signatures. Only typed comments were noted in the approval boxes. Finally, records for the SCADA test from November 9, 2017 failed to include approval signatures. 5. § 195.446 - Control room management. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (1) … (2) Educate controllers and supervisors in fatigue mitigation strategies and how off- duty activities contribute to fatigue; Third Coast failed to implement all methods to reduce the risk associated with controller fatigue. Specifically, Third Coast failed to educate controllers and supervisors in fatigue mitigation 4#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 5strategies and how off-duty activities contribute to fatigue. High Island Pipeline System (HIPS)1 training records (circadian online training) for 2017 and 2020 were reviewed, however, Third Coast could not provide training records regarding fatigue mitigation strategies for 2018 and 2019. HIPS personnel confirmed operator personnel did not provide training or education for controllers and supervisors in fatigue mitigation strategies and how off-duty activities contribute to fatigue in 2018 and 2019. 6. § 195.446 - Control room management. (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller's ability to carry out the roles and responsibilities the operator has defined: (1) … (3) Train controllers and supervisors to recognize the effects of fatigue; Third Coast failed to implement all methods to reduce the risk associated with controller fatigue. Specifically, Third Coast failed to train controllers and supervisors to recognize the effects of fatigue. HIPS Training records (circadian online training) for 2017 and 2020 were reviewed, however, Third Coast could not provide training records regarding fatigue mitigation strategies for 2018 and 2019. HIPS personnel confirmed that operator personnel did not provide training for controllers and supervisors to recognize the effects of fatigue in 2018 and 2019. 7. § 195.446 - Control room management. (g) Operating experience. Each operator must assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures by performing each of the following: (1) Review accidents that must be reported pursuant to § 195.50 and 195.52 to determine if control room actions contributed to the event and, if so, correct, where necessary, deficiencies related to: (i) Controller fatigue; (ii) Field equipment; (iii) The operation of any relief device; (iv) Procedures; (v) SCADA system configuration; and (vi) SCADA system performance. Third Coast failed to assure that lessons learned from its operating experience are incorporated, as appropriate, into its control room management procedures. Specifically, Third Coast did not review accidents that must be reported pursuant to § 195.50 and 195.52 to determine if control 1 Third Coast has a control room located in Texas City that controls only the HIPS system. Third Coast was in the process of moving the HIPS assets to the control room in Houston, but had not completed the transfer at the time of the inspection. The HIPS records were separate from the Houston control room records. This alleged violation is specific to the controllers on the HIPS system not receiving training in 2018 and 2019. 5#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 6room actions contributed to the event(s) and, if so, correct, where necessary, deficiencies related to SCADA system configuration and SCADA system performance as required per the regulations. The operator presented its Comprehensive List of Causes Checklist as the record Third Coast uses to determine contribution factors and/or root causes after an accident. While this checklist shows Third Coast has a process for reviewing accidents, the review does not include whether there were deficiencies related to SCADA system configuration and SCADA system performance. 8. § 195.446 - Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1) Responding to abnormal operating conditions likely to occur simultaneously or in sequence; (2) Use of a computerized simulator or non-computerized (tabletop) method for training controllers to recognize abnormal operating conditions; (3) Training controllers on their responsibilities for communication under the operator's emergency response procedures; (4) Training that will provide a controller a working knowledge of the pipeline system, especially during the development of abnormal operating conditions; (5) For pipeline operating setups that are periodically, but infrequently used, providing an opportunity for controllers to review relevant procedures in advance of their application; and (6) Control room team training and exercises that include both controllers and other individuals, defined by the operator, who would reasonably be expected to operationally collaborate with controllers (control room personnel) during normal, abnormal or emergency situations. Operators must comply with the team training requirements under this paragraph no later than January 23, 2018. Third Coast failed to provide for training each controller to carry out the roles and responsibilities defined by the operator, including all the elements required by §195.446(h). Third Coast training final evaluation records for an employee, dated September 5, 2018, failed to include what tasks he was trained and tested on. These records did not document which elements of §195.446(h)(1) through (h)(6) to show the controller received training on all the required elements. Further, training records provided for an employee, dated September 11, 2018, stated that more training was needed for this controller, but the training checklist indicated he passed the training without indication that additional training was conducted. 6#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 79. § 195.446 - Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. Third Coast failed to review the controller training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. Third Coast could not provide records demonstrating that a review of the controller training program occurred in 2017. Further, the review records from 2018 and 2019 indicate a review occurred, however, the records for 2018 and 2019 fail to provide a description of the program content and effectiveness review. Additionally, the review dated December 18, 2018 failed to provide any information or documentation that the operator reviewed any of their third-party vendor information to ensure training content was effective or to determine whether the training required updating or improvements based on the third-party vendor information. 10. § 195.446 - Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1) … (5) For pipeline operating setups that are periodically, but infrequently used, providing an opportunity for controllers to review relevant procedures in advance of their application; Third Coast failed to establish a controller training program that including providing an opportunity for controllers to review relevant procedures in advance of their application for pipeline operating setups that are periodically, but infrequently used. Third Coast reported that they do have flow reversals, which is an infrequently used setup. The operator verbally stated there was no list developed for periodic, but infrequently used operating setups, that would provide the controller an opportunity to review prior to application. Third Coast’s controller training program, therefore, does not include an opportunity for controllers to review relevant procedures for pipeline operating setups that are periodically, but infrequently used, like follow reversals, in advance of their application. 11. § 195.446 - Control room management. (h) Training. Each operator must establish a controller training program and review the training program content to identify potential improvements at least once each 7#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 8calendar year, but at intervals not to exceed 15 months. An operator's program must provide for training each controller to carry out the roles and responsibilities defined by the operator. In addition, the training program must include the following elements: (1) … (6) Control room team training and exercises that include both controllers and other individuals, defined by the operator, who would reasonably be expected to operationally collaborate with controllers (control room personnel) during normal, abnormal or emergency situations. Operators must comply with the team training requirements under this paragraph no later than January 23, 2018. Third Coast could not show that its controller training program included team training and exercises in 2019. The records provided for team training that occurred on January 17, 2019, were vague and failed to identify positions and/or titles showing that team training included personnel who would reasonably be expected to operationally collaborate with controllers. Third Coast’s control room training documentation from 2019 did not show compliance with the team training requirement. 12. § 195.446 - Control room management. (j) Compliance and deviations. An operator must maintain for review during inspection: (2) Documentation to demonstrate that any deviation from the procedures required by this section was necessary for the safe operation of the pipeline facility. null Third Coast failed to maintain documentation to demonstrate that any deviation from the procedures required by §195.446 was necessary for the safe operation of the pipeline facility. Third Coast’s records indicated deviations from the normal schedule occurred during the month of June 2017, including the days of June 3rd and June 17th for several controllers. Additionally, a lead controller deviated from the normal schedule during the weeks of June 10 through 14, and June 17 through 21. No records of deviations during this time frame could be provided by Third Coast. The operator reported that they believed they did not have to document a deviation from their procedure for "normal schedule" if they met the Hours of Service requirements, however, this practice is not consistent with the regulations. Under 49 U.S.C. § 60122 and 49 CFR § 190.223, you are subject to a civil penalty not to exceed $222,504 per violation per day the violation persists, up to a maximum of $2,225,034 for a related series of violations. For violation occurring on or after July 31, 2019 and before January 11, 2021, the maximum penalty may not exceed $218,647 per violation per day the violation persists, up to a maximum of $2,186,465 for a related series of violations. For violation occurring on or after November 27, 2018 and before July 31, 2019, the maximum penalty may not exceed $213,268 per violation per day, with a maximum penalty not to exceed $2,132,679. 8#

52021004WL_Warning Letter_03242021_(20-172190)_text.pdf, page 9For violation occurring on or after November 2, 2015 and before November 27, 2018, the maximum penalty may not exceed $209,002 per violation per day, with a maximum penalty not to exceed $2,090,022. We have reviewed the circumstances and supporting documents involved in this case, and have decided not to conduct additional enforcement action or penalty assessment proceedings at this time. We advise you to correct the items identified in this letter. Failure to do so will result in Third Coast Midstream, LLC being subject to additional enforcement action. No reply to this letter is required. If you choose to reply, in your correspondence please refer to CPF 5-2021-004-WL. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Sincerely, Dustin Hubbard Director, Western Region Pipeline and Hazardous Materials Safety Administration cc: PHP-60 Compliance Registry PHP-500 D. Fehling (#20-172190) 9#