Hazardous Liquid Integrity Management Enforcement Guidance

Portal detail 1Hazardous Liquid Integrity Management Enforcement Guidance Hazardous_Liquid_IM_Enforcement_Guidance_12_7_2015.pdf (865.65 KB) The materials in this document are explanatory in nature and reflect PHMSA's current application of the regulations in effect at the time of the issuance of the guidance. In preparing an enforcement action alleging a probable violation, an allegation must always be based on the failure to take a required action (or taking a prohibited action) that is set forth directly in the language of the regulation. Issued Date: Monday, December 7, 2015#

Attachment 1, passage 1Hazardous Liquid Integrity Management Enforcement Guidance Sections 195.450 and 452 Introduction The materials contained in this document consist of guidance, techniques, procedures and other information for internal use by the PHMSA pipeline safety enforcement staff. This guidance document describes the practices used by PHMSA pipeline safety investigators and other enforcement personnel in undertaking their compliance, inspection, and enforcement activities. This document is U.S. Government property and is to be used in conjunction with official duties. The Federal pipeline safety regulations (49 CFR Parts 190-199) discussed in this guidance document contains legally binding requirements. This document is not a regulation and creates no new legal obligations. The regulation is controlling. The materials in this document are explanatory in nature and reflect PHMSA’s current application of the regulations in effect at the time of the issuance of the guidance. In preparing an enforcement action alleging a probable violation, an allegation must always be based on the failure to take a required action (or taking a prohibited action) that is set forth directly in the language of the regulation. An allegation should never be drafted in a manner that says the operator “violated the guidance.” Nothing in this guidance document is intended to diminish or otherwise affect the authority of PHMSA to carry out its statutory, regulatory or other official functions or to commit PHMSA to taking any action that is subject to its discretion. Nothing in this document is intended to and does not create any legal or equitable right or benefit, substantive or procedural, enforceable at law by any person or organization against PHMSA, its personnel, State agencies or officers carrying out programs authorized under Federal law. Decisions about specific investigations and enforcement cases are made according to the specific facts and circumstances at hand. Investigations and compliance determinations often require careful legal and technical analysis of complicated issues. Although this guidance document serves as a reference for the staff responsible for investigations and enforcement, no set of procedures or policies can replace the need for active and ongoing consultation with supervisors, colleagues, and the Office of Chief Counsel in enforcement matters. Comments and suggestions for future changes and additions to this guidance document are invited and should be forwarded to your supervisor. The materials in this guidance document may be modified or revoked without prior notice by PHMSA management. i#

Attachment 1, passage 2Table of Contents Introduction .................................................................................... Error! Bookmark not defined. Glossary .......................................................................................................................................... 3 §195.12(a) and (b) ........................................................................................................................... 4 §195.12(c) ....................................................................................................................................... 7 §195.12(d) ..................................................................................................................................... 11 §195.12(e) ..................................................................................................................................... 13 §195.12(f)...................................................................................................................................... 15 §195.450........................................................................................................................................ 17 §195.452(a) ................................................................................................................................... 20 §195.452(b) ................................................................................................................................... 23 §195.452(c) ................................................................................................................................... 28 §195.452(d)(1) .............................................................................................................................. 35 §195.452(d)(2) .............................................................................................................................. 38 §195.452(d)(3) .............................................................................................................................. 40 §195.452(e) ................................................................................................................................... 44 §195.452(f)(1) ............................................................................................................................... 49 §195.452(f)(2) ............................................................................................................................... 56 §195.452(f)(3) ............................................................................................................................... 58 §195.452(f)(4) ............................................................................................................................... 62 §195.452(f)(5) ............................................................................................................................... 65 §195.452(f)(6) ............................................................................................................................... 68 §195.452(f)(7) ............................................................................................................................... 71 §195.452(f)(8) ............................................................................................................................... 75 §195.452(g) ................................................................................................................................... 78 §195.452(h)(1) .............................................................................................................................. 88 §195.452(h)(2) .............................................................................................................................. 93 §195.452(h)(3) .............................................................................................................................. 99 §195.452(h)(4) ............................................................................................................................ 102 §195.452(i)(1) ............................................................................................................................. 108 §195.452(i)(2) ............................................................................................................................. 113 §195.452(i)(3) ............................................................................................................................. 118 §195.452(i)(4) ............................................................................................................................. 122#

Attachment 1, passage 3§195.452(j)(1) and (j)(2) ............................................................................................................. 125 §195.452(j)(3) ............................................................................................................................. 130 §195.452(j)(4) ............................................................................................................................. 135 §195.452(j)(5) ............................................................................................................................. 140 §195.452(k) ................................................................................................................................. 145 §195.452(l) .................................................................................................................................. 149 §195.452(m) ................................................................................................................................ 152#

Attachment 1, passage 4Glossary For a complete “Glossary of Terms” please refer to the following link: http://www.phmsa.dot.gov/staticfiles/PHMSA/Pipeline/TQGlossary/Glossary.html 3#

Attachment 1, passage 5Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Hazardous Liquid Integrity Management 49 CFR Part 195 12/7/2015 §195.12(a) and (b) What requirements apply to low-stress pipelines in rural areas? (a) General. This Section sets forth the requirements for each category of low- stress pipeline in a rural area set forth in paragraph (b) of this Section. This Section does not apply to a rural low-stress pipeline regulated under this Part as a low-stress pipeline that crosses a waterway currently used for commercial navigation; these pipelines are regulated pursuant to §195.1(a)(2). (b) Categories. An operator of a rural low-stress pipeline must meet the applicable requirements and compliance deadlines for the category of pipeline set forth in paragraph (c) of this Section. For purposes of this Section, a rural low-stress pipeline is a Category 1, 2, or 3 pipeline based on the following criteria: (1) A Category 1 rural low-stress pipeline: (i) Has a nominal diameter of 8 5/8 inches (219.1 mm) or more; (ii) Is located in or within one-half mile (.80 km) of an unusually sensitive area (USA) as defined in §195.6; and (iii) Operates at a maximum pressure established under §195.406 corresponding to: (A) A stress level equal to or less than 20-percent of the specified minimum yield strength of the line pipe; or (B) If the stress level is unknown or the pipeline is not constructed with steel pipe, a pressure equal to or less than 125 psi (861 kPa) gauge. (2) A Category 2 rural pipeline: (i) Has a nominal diameter of less than 8 5/8 inches (219.1mm); (ii) Is located in or within one-half mile (.80 km) of an unusually sensitive area (USA) as defined in §195.6; and (iii) Operates at a maximum pressure established under §195.406 corresponding to: (A) A stress level equal to or less than 20-percent of the specified minimum yield strength of the line pipe; or (B) If the stress level is unknown or the pipeline is not constructed with steel pipe, a pressure equal to or less than 125 psi (861 kPa) gauge. §195.12(a) & (b) 4#

Attachment 1, passage 6Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information (3) A Category 3 rural low-stress pipeline: (i) Has a nominal diameter of any size and is not located in or within one-half mile (.80 km) of an unusually sensitive area (USA) as defined in §195.6; and (ii) Operates at a maximum pressure established under §195.406 corresponding to a stress level equal to or less than 20-percent of the specified minimum yield strength of the line pipe; or (iii) If the stress level is unknown or the pipeline is not constructed with steel pipe, a pressure equal to or less than 125 psi (861 kPa) gage. Amdt. 195-89, 73 FR 31634, 6-3-2008 Amdt. 195-96, 76 FR 25576, 5-5-2011 Federal Register/Volume 76/Issue 87/Thursday, May 5, 2011/Page 25579 Some commenters “suggested that PHMSA exclude low-stress carbon dioxide (CO2) pipelines involved in enhanced oil recovery and/or carbon capture and storage. The associations noted that these pipelines pose different risks from petroleum pipelines, that releases from low-stress CO2 pipelines would not require the cleanup that would be associated with releases from crude oil or refined petroleum product pipelines, and that new requirements on CO2 lines could have a chilling effect on future investment in such pipelines. PHMSA notes that these factors were not raised in comments on the phase one rule even though the phase one rule applies to rural low-stress CO2 pipelines. PHMSA never proposed such an exclusion and also considers it inappropriate to exclude some rural low-stress CO2 pipelines from safety regulation while regulating others (i.e., those subject to the phase one final rule), and has not incorporated the suggested exclusion in this final rule.” 1. All rural low-stress pipelines meeting the criteria of §195.12(b) must fall into one of three Categories. 2. Operators should maintain a list of all Category 1, 2, and 3 rural low-stress pipeline segments. 3. Generally, an operator would not be cited for failure to categorize its rural low- stress lines. Instead the operator would generally be cited for failing to perform the activities required for the pipe segment’s Category. §195.12(a) & (b) 5#

Attachment 1, passage 7Examples of a Probable 1. Failure to correctly categorize all rural low-stress pipeline meeting the criteria of §195.12(b). Violation or Inadequate Procedures Examples of Evidence 1. Documentation of the operator's rural low-stress pipelines including the data relevant to establishing each line segment’s category (e.g., pipe diameter, operating pressure, etc.). 2. Maps of the operator's rural low-stress pipelines. 3. A listing of the Category assigned to each rural low-stress pipeline or pipeline segment. Other Special Notations §195.12(a) & (b) 6#

Attachment 1, passage 8Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Hazardous Liquid Integrity Management 49 CFR Part 195 12 7 2015 §195.12(c) What requirements apply to low-stress pipelines in rural areas? (c) Applicable requirements and deadlines for compliance. An operator must comply with the following compliance dates depending on the category of pipeline determined by the criteria in paragraph (b): (1) An operator of a Category 1 pipeline must: (i) Identify all segments of pipeline meeting the criteria in paragraph (b)(1) of this Section before April 3, 2009. (ii) Beginning no later than January 3, 2009, comply with the reporting requirements of Subpart B for the identified segments. (iii) IM requirements - (A) Establish a written program that complies with §195.452 before July 3, 2009, to assure the integrity of the pipeline segments. Continue to carry out such program in compliance with §195.452. (B) An operator may conduct a determination per §195.452(a) in lieu of the one- half mile buffer. (C) Complete the baseline assessment of all segments in accordance with §195.452(c) before July 3, 2015, and complete at least 50- percent of the assessments, beginning with the highest risk pipe, before January 3, 2012. (iv) Comply with all other safety requirements of this Part, except Subpart H, before July 3, 2009. Comply with the requirements of Subpart H before July 3, 2011. (2) An operator of a Category 2 pipeline must: (i) Identify all segments of pipeline meeting the criteria in paragraph (b)(2) of this Section before July 1, 2012. (ii) Beginning no later than January 3, 2009, comply with the reporting requirements of Subpart B for the identified segments. (iii) IM - (A) Establish a written IM program that complies with §195.452before October 1, 2012 to assure the integrity of the pipeline segments. Continue to carry out such §195.12(c) 7#

Attachment 1, passage 9Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information program in compliance with §195.452. (B) An operator may conduct a determination per §195.452(a)in lieu of the one- half mile buffer. (C) Complete the baseline assessment of all segments in accordance with §195.452(c) before October 1, 2016 and complete at least 50 percent of the assessments, beginning with the highest risk pipe, before April 1, 2014. (iv) Comply with all other safety requirements of this Part, except Subpart H, before October 1, 2012. Comply with Subpart H of this Part before October 1, 2014. Amdt. 195-89, 73 FR 31634, 6-3-2008 Amdt. 195-96, 76 FR 25576, 5-5-2011 Federal Register/Volume 73/Issue 107/Tuesday, June 3, 2008/Page 31638 “PHMSA also notes that this final rule allows operators to analyze their pipelines to determine which segments could affect USAs for purposes of application of integrity management requirements. This could-affect analysis could result in a larger or smaller area than the half mile buffer. As PHMSA has done with other integrity management inspections, these analyses will be scrutinized for adequate supporting technical justification and appropriate consideration of risk factors.” 1. All USAs defined in §195.6 must be considered in the segment identification process. 2. The sources used to identify the USAs defined in §195.6 must be documented. 3. NPMS should be used as a source for identifying potential USAs in the vicinity of rural low-stress pipelines. The operator will have to demonstrate whether these USAs are within .5 miles of the rural low-stress pipeline. 4. The operator must make a reasonable effort to assess the highest risk segments §195.12(c) 8#

Attachment 1, passage 10Examples of a Probable Violation or Inadequate Procedures first for the Category 1 and/or 2 rural low stress pipeline segments before the required dates for completing 50% of the assessments. Operators are allowed to take credit for low risk pipeline segment mileage assessed while assessing the highest risk segments. 5. If a pipeline segment lies within a USA boundary or within a ½ mile buffer zone around the USA, that pipeline is subject to the requirements in §195.12. There is no provision analogous to §195.452(a) whereby an operator can exclude a pipeline segment that is within the geographic boundaries of a USA from the IM requirements. 6. §195.12(c)(iii)(B) does allow the operator to perform a more detailed, engineering analysis of its pipeline segments that could affect USAs and use these results in lieu of the ½ mile buffer. 7. Failure to identify Category 1 and 2 rural low-stress pipeline segments by the required date should be enforced against §195.12(c)(1)(i) and §195.452(c)(2)(i) respectively. 8. Failure to have a written Integrity Management Plan for Category 1 and 2 rural low-stress pipeline segment by the required date should be enforced against §195.12(c)(1)(iii)(A) and §195.12(c)(2)(iii)(A) respectively. 9. Failure to have a written Integrity Management Plan for Category 1 and 2 rural low-stress pipeline segments that meets the requirements of §195.452 should be enforced against the applicable section of §195.452. 10. Failure to implement the written Integrity Management Plan in accordance with the requirements of §195.452 should be enforced against the applicable section of §195.452. 11. Failure to meet the schedule requirements for performing baseline assessments of Category 1 and 2 rural low-stress pipeline segments should be enforced against §195.12(c)(1)(iii)(C) and §195.12(c)(2)(iii)(C) respectively. 1. Failure to complete segment identification of Category 1 rural low-stress pipelines before April 3, 2009. 2. Failure to establish a written program for Category 1 rural low-stress pipeline segments, that complies with §195.452, before July 3, 2009. 3. Failure to complete the baseline assessments of at least 50% of the Category 1 rural low-stress pipeline segments before January 3, 2012. 4. Failure to complete the baseline assessments of all Category 1 rural low-stress pipeline segments before July 3, 2015. 5. Failure to complete segment identification of Category 2 rural low-stress pipelines before July 1, 2012. 6. Failure to establish a written program for Category 2 rural low-stress pipeline segments, that complies with §195.452, before October 1, 2012. 7. Failure to complete the baseline assessments of at least 50% of the Category 2 rural low-stress pipeline segments before April 1, 2014. 8. Failure to complete the baseline assessments of all Category 2 rural low-stress pipeline segments before October 1, 2016. 9. Baseline assessments of Category 1 or 2 rural low-stress pipelines did not begin with the highest risk pipe. §195.12(c) 9#

Attachment 1, passage 11Examples of Evidence 1. Portions of the written Integrity Management Plan which shows omissions or deficiencies. 2. Documentation that shows that the written Integrity Management Plan was not properly implemented. 3. A dated copy of the segment identification of Category 1 and 2 rural low-stress pipeline segments. 4. A dated copy of the written Integrity Management Program for Category 1 and 2 rural low-stress pipeline segments. 5. Baseline Assessment Plan. 6. Risk analysis of Category 1 and 2 rural low-stress pipeline segments with the risk ranking of each rural low-stress pipeline or pipeline segment. 7. Completion schedule of baseline assessments performed before January 3, 2012 for Category 1 rural low-stress pipeline segments. 8. Completion schedule for baseline assessments performed before July 3, 2015 for Category 1 rural low-stress pipeline segments. 9. Completion schedule for baseline assessments performed before April 1, 2014 for Category 2 rural low-stress pipeline segments. 10. Completion schedule for baseline assessments performed before October 1, 2016 for Category 2 rural low-stress pipeline segments. Other Special Notations §195.12(c) 10#

Attachment 1, passage 12Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Hazardous Liquid Integrity Management 49 CFR Part 195 12/7/2015 §195.12(d) What requirements apply to low-stress pipelines in rural areas? (d) Economic compliance burden. (1) An operator may notify PHMSA in accordance with §195.452(m) of a situation meeting the following criteria: (i) The pipeline is a Category 1 rural low-stress pipeline; (ii) The pipeline carries crude oil from a production facility; (iii) The pipeline, when in operation, operates at a flow rate less than or equal to 14,000 barrels per day; and (iv) The operator determines it would abandon or shut-down the pipeline as a result of the economic burden to comply with the assessment requirements in §195.452(d) or 195.452(j). (2) A notification submitted under this provision must include, at minimum, the following information about the pipeline: its operating, maintenance and leak history; the estimated cost to comply with the integrity assessment requirements (with a brief description of the basis for the estimate); the estimated amount of production from affected wells per year, whether wells will be shut in or alternate transportation used, and if alternate transportation will be used, the estimated cost to do so. (3) When an operator notifies PHMSA in accordance with paragraph (d)(1) of this Section, PHMSA will stay compliance with §§195.452(d) and 195.452(j)(3) until it has completed an analysis of the notification. PHMSA will consult the Department of Energy, as appropriate, to help analyze the potential energy impact of loss of the pipeline. Based on the analysis, PHMSA may grant the operator a special permit to allow continued operation of the pipeline subject to alternative safety requirements. Amdt. 195-89, 73 FR 31634, 6-3-2008 Amdt. 195-96, 76 FR 25576, 5-5-2011 §195.12(d) 11#

Attachment 1, passage 13Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information 1. This paragraph of the rule allows operators to notify PHMSA if they believe compliance with the assessment requirements in §195.452(d) or §195.452(j) for Category 1 low stress lines represents an excessive economic burden. Because this paragraph only informs operators how and under what circumstances, they may apply for relief, it is not expected that enforcement actions would be written against this paragraph. Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations §195.12(d) 12#

Attachment 1, passage 14Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management 49 CFR Part 195 12/7/2015 §195.12(e) What requirements apply to low-stress pipelines in rural areas? (e) Changes in unusually sensitive areas. (1) If, after June 3, 2008, for Category 1 rural low-stress pipelines or October 1, 2011 for Category 2 rural low-stress pipelines, an operator identifies a new USA that causes a segment of pipeline to meet the criteria in paragraph (b) of this Section as a Category 1 or Category 2 rural low-stress pipeline, the operator must: (i) Comply with the IM program requirement in paragraph (c)(1)(iii)(A) or (c)(2)(iii)(A) of this Section, as appropriate, within 12 months following the date the area is identified regardless of the prior categorization of the pipeline; and (ii) Complete the baseline assessment required by paragraph (c)(1)(iii)(C) or (c)(2)(iii)(C) of this Section, as appropriate, according to the schedule in §195.452(d)(3). (2) If a change to the boundaries of a USA causes a Category 1 or Category 2 pipeline segment to no longer be within one-half mile of a USA, an operator must continue to comply with paragraph (c)(1)(iii) or paragraph (c)(2)(iii) of this section, as applicable, with respect to that segment unless the operator determines that a release from the pipeline could not affect the USA. Amdt. 195-89, 73 FR 31634, 6-3-2008 Amdt. 195-96, 76 FR 25576, 5-5-2011 §195.12(e) 13#

Attachment 1, passage 15Other Reference Material & Source Guidance Information 1. A USA that previously existed and was missed during the initial segment identification period cannot be considered a newly identified USA. 2. Characterizing a USA that existed when initial segment identification was performed as a newly identified USA should be enforced against §195.12(c)(1)(i) or §195.12(c)(2)(i) respectively. 3. Failure to incorporate a newly identified USA into the Integrity Management Plan within 12 months and failure to perform a baseline assessment within 5 years should be enforced against §195.452(d)(3). 4. Failure to meet other §195.452 section requirements for inclusion of newly identified USAs should be enforced against the applicable section of §195.452. Examples of a Probable Violation or Inadequate Procedures 1. Failure to include a USA newly identified after June 3, 2008 in a Category 1 rural low-stress pipeline segment in the Integrity Management Program within 12 months following when the date the area is identified. 2. Failure to include a USA newly identified after October 1, 2011 in a Category 2 rural low-stress pipeline segment in the Integrity Management Program within 12 months following when the date the area is identified. 3. Failure to perform a baseline assessment of the newly identified Category 1 or 2 rural low-stress pipeline segment within 5 years of the date the area is identified. 4. Failure to comply with the requirements of §195.12(c)(1)(iii) and §195.12(c)(2)(iii) for a pipeline segment previously determined to affect a USA that is then determined that the boundary is more than .5 miles from the pipeline segment, without having demonstrated that a release from the pipeline segment could not affect the USA. (Note: refer to §195.12(c) for enforcement guidance). Examples of Evidence 1. Documentation or maps showing newly identified USAs. 2. Identification of the source of the newly identified USA. 3. Source documents used by the operator in the original segment identification process. 4. Applicable portions of the Integrity Management Plan showing omissions or deficiencies in incorporating newly identified USAs. 5. Documentation analyzing why a pipeline segment that is no longer within a ½ mile of a USA cannot affect that USA. Other Special Notations §195.12(e) 14#

Attachment 1, passage 16Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information Hazardous Liquid Integrity Management 49 CFR Part 195 12/7/2015 §195.12(f) What requirements apply to low-stress pipelines in rural areas? (f) Record Retention. An operator must maintain records demonstrating compliance with each requirement applicable to the category of pipeline according to the following schedule. (1) An operator must maintain the segment identification records required in paragraph (c)(1)(i), (c)(2)(i) or (c)(3)(i) of this Section for the life of the pipe. (2) Except for the segment identification records, an operator must maintain the records necessary to demonstrate compliance with each applicable requirement set forth in paragraph (c) of this Section according to the record retention requirements of the referenced Section or Subpart. Amdt. 195-89, 73 FR 31634, 6-3-2008 Amdt. 195-96, 76 FR 25576, 5-5-2011 1. Deficiencies or omissions in maintaining segment identification records should be enforced against §195.12(f)(1). 2. Deficiencies or omissions in maintaining a written integrity management plan or documentation supporting decisions and analyses made to implement and evaluate each element of the integrity management program should be enforced against §195.452(l). 3. Although Appendix C is guidance material, the example records in Appendix §195.12(f) 15#

Attachment 1, passage 17C VI must be maintained. Deficiencies in maintaining these records would be enforced against §195.452(l). Examples of a Probable Violation or Inadequate Procedures 1. Failure to maintain segment identification records. (Enforce against §195.12(f)(1)) 2. Failure to maintain a written integrity management plan. 3. Failure to maintain documentation supporting the decisions and analyses made to implement and evaluate each element of the integrity management program. 4. Failure to maintain the records identified in Appendix C VI. Examples of 1. Documentation showing the deficiencies or omissions in maintaining records required by §195.12(f), or §195.452(l) and Appendix C. Evidence Other Special Notations §195.12(f) 16#

Attachment 1, passage 18Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Hazardous Liquid Integrity Management 49 CFR Part 195 12/7/2015 §195.450 Definitions The following definitions apply to this section and §195.452: Emergency flow restricting device or EFRD means a check valve or remote control valve as follows: (1) Check valve means a valve that permits fluid to flow freely in one direction and contains a mechanism to automatically prevent flow in the other direction. (2) Remote control valve or RCV means any valve that is operated from a location remote from where the valve is installed. The RCV is usually operated by the supervisory control and data acquisition (SCADA) system. The linkage between the pipeline control center and the RCV may be by fiber optics, microwave, telephone lines, or satellite. High consequence area means: (1) A commercially navigable waterway, which means a waterway where a substantial likelihood of commercial navigation exists; (2) A high population area, which means an urbanized area, as defined and delineated by the Census Bureau, that contains 50,000 or more people and has a population density of at least 1,000 people per square mile; (3) An other populated area, which means a place, as defined and delineated by the Census Bureau, that contains a concentrated population, such as an incorporated or unincorporated city, town, village, or other designated residential or commercial area; (4) An unusually sensitive area, as defined in §195.6. 195-70, 65 FR 75378, December 1, 2000 §195.450 17#

Attachment 1, passage 19Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information Date: 1-22-2003 Advisory Bulletin ADB-03-01 Updates of Digital Mapping Data for Hazardous Liquid Pipeline High Consequence Areas (HCA) PHMSA provided notice of the updated and revised the High Consequence Area (HCA) digital mapping data sets based on revised U.S. Government data. The data sets are available for download for “High Population Areas”, “Other Populated Areas,” and “Commercially Navigable Waterways.” Operators were allowed one year from the date of this bulletin to incorporate these new high consequence areas into their baseline integrity management assessment plans Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75392. PHMSA Hazardous Liquid Integrity Management FAQs: 1.4 What is a high consequence area (HCA)? 1.4A What is an unusually sensitive area (USA)? 1. §195.450 provides a list of definitions that are used in the IM program requirements of §195.452. Other definitions in §§195.2 and 195.6 are also applicable. In and of themselves, these definitions do not impose any additional requirements on operators. For this reason, violations of §195.450 should not be expected. 2. These definitions are provided to establish what geographic locations are HCAs so that operators can identify which portions of their pipelines can impact these areas, and thus the portions of their pipelines for which §195.452 applies. Operators are free to identify additional HCAs outside of the areas specified by §195.450. However, their program must at least include all HCAs as defined by §195.450 unless they provide a technical justification why their pipeline cannot impact an HCA. 3. The preamble to the Final Rule also specifies that OPS will provide maps of the HCAs on the National Pipeline Mapping System. (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75392.) It also informs operators that some of the information that OPS is purchasing, such as discrete sets of ecological data from the Nature Conservancy and other sources, will not be publicly available. Operators may need to contact resource agencies to obtain additional information on a particular species or drinking water intake in an USA. 4. The preamble also tells operators that OPS used the National Waterways Network database to identify commercially navigable waterways. The commercially navigable waterways map and database will be available through the National Pipeline Mapping System. The Bureau of Transportation Statistics also has a database that includes commercially navigable waterways and non- commercially navigable waterways. The database can be downloaded from the BTS website: http://www.bts.gov/gis/ntatlas/ networks.html. 5. Low stress pipelines in rural areas that could affect USAs are also subject to §195.452 requirements. §195.12 defines the low stress lines subject to §195.450 18#

Attachment 1, passage 20§195.452 and the dates by which these pipelines must be included in an IM program. (See the portions of this guidance for §195.12.) 6. This section also defines EFRDs which are referred to in §195.452(i). Examples of a Probable Violation or Inadequate Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. Procedures Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the Plan or Program. 2. Records related to the deficiencies or omissions in the definitions of HCAs and EFRDs. 3. Documented conversations with operator or contractor personnel that identify inconsistencies regarding the definitions listed above. Other Special Notations At the present time, the IM regulations for assessments is limited to line pipe and remediation to all pipe, prompting the need for additional definitions of “non-line pipe” type and other facilities not covered under the assessment portion of the regulation. §195.450 19#

Attachment 1, passage 21Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(a) Pipeline integrity management in high consequence areas. (a) Which pipelines are covered by this section? This section applies to each hazardous liquid pipeline and carbon dioxide pipeline that could affect a high consequence area, including any pipeline located in a high consequence area unless the operator effectively demonstrates by risk assessment that the pipeline could not affect the area. (Appendix C of this part provides guidance on determining if a pipeline could affect a high consequence area.) Covered pipelines are categorized as follows: (1) Category 1 includes pipelines existing on May 29, 2001, that were owned or operated by an operator who owned or operated a total of 500 or more miles of pipeline subject to this part. (2) Category 2 includes pipelines existing on May 29, 2001, that were owned or operated by an operator who owned or operated less than 500 miles of pipeline subject to this part. (3) Category 3 includes pipelines constructed or converted after May 29, 2001. 195-70, 65 FR 75378, December 1, 2000 195-76A, 67 FR 46911, July 17, 2002 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Segment Identification. Part 195, Appendix C.I. Identifying a high consequence area and factors for §195.452(a) 20#

Attachment 1, passage 22Guidance Information considering a pipeline segment’s potential impact on a high consequence area. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75389. PHMSA Hazardous Liquid Integrity Management FAQs: 1.4 What is a high consequence area (HCA)? 1.7 What was DOT’s purpose for creating an Appendix C rather than placing this material in the regulation? 2.1 Does the rule apply to more than line pipe? 2.2A What are Category 1, 2, or 3 under the low-stress pipelines in rural areas, §195.12? 2.3 Do the requirements of the rule apply to “idle” pipe? 2.4 Does the rule apply to offshore pipelines? 2.5 What is meant by ‘operator who owns or operates a total of 500 or more miles of pipeline’ in 195.452 (a)? 2.6 If the operator of a small pipeline system is partially owned by another company, who is responsible for preparing the Baseline Assessment Plan and complying with the provisions of this rule - the operator, or the company that is part owner? 2.7 If a company acquires additional pipeline in late 2001 that increases its total mileage over 500, are they covered by the rule? Are the compliance deadlines the same? 2.9 If a pipeline subject to 195.452 is sold, does the new operator ‘inherit’ integrity management plans and deadlines from the original operator? 2.10 Who will be held accountable for implementing Integrity Management requirements in a case where an operator transfers ownership of pipeline assets to another company but retains responsibility, by contract, for maintenance and integrity management activities until some later date? 2.11 If a pipeline transports both gas and liquids (e.g., some off shore lines), does the hazardous liquid integrity management rule apply, or does the gas integrity management rule apply? 2.12 Does the rule apply to the operator of a marketing facility if that operator does not own or operate a pipeline but rather receives and delivers hazardous liquid from/to third-party pipelines? 1. §195.452(a) is primarily about the applicability of the IM requirements. This paragraph establishes that pipelines which could affect HCAs are subject to the requirements in the remaining paragraphs of §195.452; and it defines three categories of pipe for which different deadlines are established. Subsequent paragraphs in §195.452 identify the requirements and deadlines that apply to these categories of pipe. 2. §195.452(a) should generally not be cited for inadequacies or deficiencies in an operator’s approach to identify pipeline segments that could affect HCAs. §195.452(f)(1) specifies that an operator must have a process that identifies which pipeline segments could affect HCAs. Thus deficiencies in the process for identification of pipeline segments that could affect HCAs are generally cited under §195.452(f)(1). §195.452(a) 21#

Attachment 1, passage 23Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 3. If the operator does not identify segments that could affect HCAs, this should generally be cited under §195.452(b)(2). 4. §195.452 (a) does provide that an operator can exclude pipeline segments in HCAs from being subject to the IM program requirements if the operator can demonstrate by risk assessment that the pipeline could not affect the HCAs. In practice, this is normally done by an analysis that reasonably demonstrates that an HCA would not be affected by a pipeline release (e.g., a carbon dioxide release would not impact a nearby waterway). Selected Final Orders Referencing §195.452 (a). 1. Phillips 66 Transportation Company, [1-2002-5007, Item 1], June 23, 2003. The operator had HVL pipeline segments that intersected drinking water HCAs that were not identified as segments that could affect those HCAs. The operator asserted that these lines could not impact HCAs, but provided no technical justification to justify this determination. 2. Idaho Pipeline Corporation, [5-2008-5006, Item 2], December 5, 2008. The operator failed to identify if its pipeline could impact HCAs and did not demonstrate through risk assessment that its line could not affect HCAs. 1. Failure to effectively demonstrate through risk assessment or other technical justification that line segments intersecting HCAs could not affect those areas. 2. Failure to provide adequate justification for the categorical exclusion of the potential effect of HVL releases on drinking water or ecological USAs. 3. Failure to include idle pipe in the IM Program and not justifying why this pipe could not affect HCAs. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the Plan or Program. 2. Documented conversations with operator or contractor personnel identifying inconsistencies or problems regarding the assets included in its integrity management program, or the pipe category definitions. 3. Maps or other records depicting the assets included in the integrity management program. §195.452(a) 22#

Attachment 1, passage 24Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(b) Pipeline integrity management in high consequence areas. (b) What program and practices must operators use to manage pipeline integrity? Each operator of a pipeline covered by this section must: (1) Develop a written integrity management program that addresses the risks on each segment of pipeline in the first column of the following table not later than the dates in the second column: Pipeline Date Category 1 March 31, 2002 Category 2 February 18, 2003. Category 3 1 year after the date the pipeline begins operation. (2) Include in the program an identification of each pipeline or pipeline segment in the first column of the following table not later than the date in the second column: Pipeline Date Category 1 December 31, 2001. Category 2 November 18, 2002. Category 3 Date the pipeline begins operation. (3) Include in the program a plan to carry out baseline assessments of line pipe as required by paragraph (c) of this section. (4) Include in the program a framework that-- (i) Addresses each element of the integrity management program under paragraph (f) of this section, including continual integrity assessment and evaluation under paragraph (j) of this section; and (ii) Initially indicates how decisions will be made to implement each element. (5) Implement and follow the program. (6) Follow recognized industry practices in carrying out this section, unless-- (i) This section specifies otherwise; or (ii) The operator demonstrates that an alternative practice is supported by a reliable engineering evaluation and provides an equivalent level of public safety and environmental protection. §195.452(b) 23#

Attachment 1, passage 25Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines (latest edition). Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75383. PHMSA Hazardous Liquid Integrity Management FAQs: 1.5 What are recognized industry practices? 1.6 When can an operator use an alternative to a recognized industry practice? 2.1 Does the rule apply to more than line pipe? 3.1 When must pipeline segments subject to the rule be identified? 8.5 What is a framework? 8.6 What is an Integrity Management Program? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 8.17 Can pipeline integrity management programs required by 195.452 be part of broader corporate safety or integrity management systems (e.g., as described in API Publication 9100A, Model Environmental, Health and Safety (EHS) Management System)? 1. §195.452(b) establishes what an operator must do to implement an IM Program. It also provides deadlines for the different categories of hazardous liquid pipelines. These deadlines for currently operating pipelines have passed. Thus, all currently operating pipelines should either have an IM program in place for its line segments that could affect HCAs, are under orders from PHMSA or a state regulator to develop one, or are new pipelines in operation for less than one year. Practically, the requirements in §195.452(b) apply to newly constructed pipelines, or pipelines which formerly had no segments that could affect HCAs but now have such segments. An example of the latter would be population expansion encroaching upon the right-of-way. 2. The preamble to the Final Rule, clarifies that integrity management addresses more than material issues in line pipe, but other issues such as adequacy of §195.452(b) 24#

Attachment 1, passage 26procedures, operator training, and other issues related to the pipeline facilities. (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75389.) If an operator does not include pipeline facilities that could affect HCAs in its IM Program, generally §195.452(b)(2) should be cited. 3. Generally, the subparagraphs of §195.452(b) are cited only when an operator fails to do the specific action required by that subparagraph. For example, if an operator of a newly constructed pipeline (i.e., Category 3) does not develop a plan to conduct baseline assessments of the line pipe, §195.452(b)(3) would be cited. However, if an operator developed a baseline assessment plan for the new pipeline, but it was deficient or inadequate, the operator would be cited for the specific deficiency in the plan. For example, if the operator did not justify the assessment method(s) selected and did not provide an evaluation of the risk factors considered in establishing a schedule, §195.452(c)(1) (iii) should be cited. 4. The preamble to the Federal Register Notice for the Final Rule clarifies that operators may use alternative practices [§195.452(b)(6)]. However, the operator must document those practices and be able to provide the documentation to OPS inspection personnel for review during a field inspection. (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75383.) 5. In 2009, new requirements were issued for rural low stress pipelines that could affect USAs. §195.12(b) establishes categories of rural low stress pipe [analogous to §195.452(a)]. 195.12(c)(1)(i) and §195.12(c)(2)(i) provides the deadlines by which segments affecting USAs must be identified [analogous to §195.452(b)(2)]. Thus, if an operator fails to identify segments of a rural low stress line that affects USAs, it should be cited under the applicable subparagraph of §195.12(c) for the category of pipe that affects the USA. (See section of this guidance for §195.12.) Selected Final Orders Referencing §195.452(b)(1): 1. Cenex Harvest States Cooperative, Inc., [5-2004-5023, Item 1i] March 3, 2006. A newly-constructed pipeline that could affect an HCA must be identified in the IMP before being placed in service. 2. Bayou City Pipeline Inc, [4-2006-5004, Item 1], June 21, 2006. The pipeline segment in question was not covered under the parent company’s integrity management plan during a period before it was sold to CBG. 3. Golden Valley Electric Association, [5-2004-5035, Item 1b], July 07, 2009. At the time of the inspection, the operator had not developed an integrity management program by February 18, 2003. Selected Final Orders Referencing §195.452(b)(2): 1. Bayou City Pipeline Inc, [4-2006-5004, Item 2], June 12, 2006. The identification of segments that could affect HCAs was not completed until almost 3 years after the deadline. 2. Navajo Nation Oil and Gas Company, [4-2005-5009, Item 1], June 21, 2006. At time of the inspection, NNOG had not analyzed the potential effects of pipeline failures that could affect HCAs for pipeline segments other than those which directly intersect an HCA. §195.452(b) 25#

Attachment 1, passage 27Examples of a Probable Violation or Inadequate Procedures 3. Key Pipeline Limited, [5-2005-5016, Item 1] December 11, 2006. The operator was unable to present any documentation showing that it had completed segment identification for Category 2 pipeline, exceeding the mandated deadline by approximately 17 months. 4. Murphy Oil USA, [3-2005-5043, Item 1] December 1, 2005. The operator failed to include identification of Category 2 pipeline in the IMP that they failed to develop. Selected Final Orders Referencing §195.452(b)(3): 1. Aera Energy LLC, [5-2004-5016, Item 2], March 6, 2009. The operator’s integrity management program failed to include a baseline assessment plan by the required deadline in the regulation. Selected Final Orders Referencing §195.452(b)(4). 1. Link Energy, [4-2002-5011, Item 2], June 23, 2004. Operator failed to adequately address four elements required to be included in its written IM program. 2. Pipelines of Puerto Rico, [2-2005-6023, Item 4], April 13, 2006. Operator did not have a framework to address each element under paragraph (f) of the section. Selected Final Orders Referencing §195.452(b)(5). 1. Alon USA, LP, [5-2004-5021, Item 2], August 6, 2009. Operator failed to develop an adequate written integrity management program on or before March 31, 2002. They did not provide any documentation to show it had a written IM framework in place by the deadline or that it had implemented its IM program. 1. Failure to develop a written integrity management program by the dates prescribed in §195.452(b)(1). 2. An integrity management program was not in place for newly constructed or converted pipe within one year after the pipeline began operation. §195.452(b)(1). 3. Failure to identify and address the risks on each segment of pipeline that could affect HCAs within the dates prescribed in §195.452(b)(1). 4. Failure to complete the segment identification and include these segments in the IM program by the dates prescribed in §195.452(b)(2). 5. Failure to identify pipeline segments that could affect HCAs for newly constructed or converted pipe on the date the pipe began operation. §195.452(b)(2). 6. Failure to include pipeline facilities in the IM Program and not justifying why these facilities could not affect HCAs. 7. Failure to develop a baseline assessment plan. §195.452(b)(3). 8. Failure to develop a baseline assessment plan for a newly constructed or converted pipe within one year after the pipeline began operation. §195.452(b)(3). 9. Failure to develop an IM program framework that addresses all the required program elements. §195.452(b)(4). 10. Failure to implement and follow its integrity management program. §195.452(b) 26#

Attachment 1, passage 28§195.452(b)(5). 11. Failure to follow recognized industry practices in carrying out the requirements of §195.452 as required by §195.452(b)(6), unless the regulation specifies otherwise. 12. Failure to demonstrate using a reliable engineering evaluation that an alternative practice provides an equivalent level of public safety and environmental protection. §195.452(b)(6)(ii) Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the Plan or Program. 2. Integrity Management Framework 3. Baseline Assessment Plan 4. Records demonstrating the deficiency or inadequacy. 5. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the integrity management program. 6. Maps or other records showing the assets included in the integrity management program. Other Special Notations §195.452(b) 27#

Attachment 1, passage 29Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(c) Pipeline integrity management in high consequence areas. (c) What must be in the baseline assessment plan? (1) An operator must include each of the following elements in its written baseline assessment plan: (i) The methods selected to assess the integrity of the line pipe. An operator must assess the integrity of the line pipe by any of the following methods. The methods an operator selects to assess low frequency electric resistance welded pipe or lap welded pipe susceptible to longitudinal seam failure must be capable of assessing seam integrity and of detecting corrosion and deformation anomalies. (A) Internal inspection tool or tools capable of detecting corrosion and deformation anomalies including dents, gouges and grooves; (B) Pressure test conducted in accordance with subpart E of this part; (C) External corrosion direct assessment in accordance with §195.588; or (D) Other technology that the operator demonstrates can provide an equivalent understanding of the condition of the line pipe. An operator choosing this option must notify the Office of Pipeline Safety (OPS) 90 days before conducting the assessment, by sending a notice to the address or facsimile number specified in paragraph (m) of this section.; (ii) A schedule for completing the integrity assessment; (iii) An explanation of the assessment methods selected and evaluation of risk factors considered in establishing the assessment schedule. (2) An operator must document, prior to implementing any changes to the plan, any modification to the plan, and reasons for the modification. 195-70, 65 FR 75378, December 1, 2000 195-85, 70 FR 61576, October 25, 2005 §195.452(c) 28#

Attachment 1, passage 30Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Spike Hydrostatic Test Evaluation, Michael Baker Jr., July 2004. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics, June 2002. Overview of Integrity Assessment Methods, Robert J. Eiber Consultants, Inc., November 2003. (http://www.mrsc.org/artdocmisc/eiberoverview.pdf) Low Frequency and Lap Welded Longitudinal Seam Evaluation, Section 5.0, Michael Baker and Associates, April 2004. Pipe Wrinkle Study, Section 3.0, Michael Baker and Associates, October 2004. Dent Study, Section 4.0, Michael Baker and Associates, November 2004. Stress Corrosion Cracking Study, Section 6.0, Michael Baker and Associates, January 2005. Inspection Guideline for Timely Response to Geometry Defects, Sections 3 & 4, Michael Baker and Associates, July 2004. Mechanical Damage, Section 6.2, Michael Baker Jr., April 2009. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics Corporation, June 2002. Part 195, Appendix C.IV. Types of Internal Inspection Tools to Use. PHMSA Liquid Integrity Management Supplemental Guidance Document, Baseline Assessment Plan. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75396. PHMSA Hazardous Liquid Integrity Management FAQs: 2.3 Do the requirements of the rule apply to “idle” pipe? 4.1 What is an assessment? 4.2 What must be in the Baseline Assessment Plan? 4.3 Under what conditions should the Baseline Assessment Plan be modified? 4.4 When must baseline assessments be completed? 4.5 How do the required dates for completing 50 percent and 100 percent of assessments apply to a category 2 pipeline that is acquired by an operator that had more than 500 miles of pipeline on May 29, 2001? 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? §195.452(c) 29#

Attachment 1, passage 314.9 Will operators need to seek waivers from PHMSA Pipeline Safety in order to change assessment schedules after the initial Baseline Assessment Plan has been developed? 4.11 Should operators archive previous versions of their assessment plans so PHMSA Pipeline Safety can track changes to these plans over time? 4.13 For purposes of meeting the deadlines for completing baseline assessments, is the date of the assessment considered to be the day when the tool run is complete, when the preliminary data is received, or when the evaluation of the in-line inspection results is complete? 4.15 If an operator develops a single Baseline Assessment Plan that covers both intra- and interstate pipelines, does the need to complete assessments on 50% of the pipeline mileage that can affect HCAs apply to both intra- and interstate line segments, or just interstate line segment mileage? Should the company’s Plan identify whether line segments are intra- or interstate? 4.16 What specific information from the company’s baseline assessment plan does PHMSA Pipeline Safety expect to retain in its inspection files? For example, will PHMSA Pipeline Safety retain the boundaries of segments that could affect HCAs, the assessment methods for these segments, the dates on which these segments will be assessed, etc.? 4.17 If an operator has multiple pipeline systems and/or multiple business units, does PHMSA Pipeline Safety require the operator to produce a single Baseline Assessment Plan for the entire company, or can an operator create multiple plans to align with its operating units and internal management practices? 4.18 What specificity does PHMSA Pipeline Safety expect for schedules in baseline assessment plans? 6.1 What are acceptable integrity assessment methods? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 6.3 Are there different requirements for inspection of overhead suspension pipeline bridges? 6.4 What kind of tool can an operator use to conduct integrity assessments by internal inspection? 6.5 What type of pressure test can be used to assess pipeline integrity? 6.7 Can internal inspection be performed using only a deformation tool if the analysis of the pipeline demonstrates that corrosion is not a primary integrity threat for a specific pipeline segment? 6.8 Will PHMSA Pipeline Safety establish criteria for minimum acceptable in-line inspection tool capability? (E.g., are low resolution magnetic flux leakage tools acceptable or must high resolution tools be used?) 6.9 For operators having line pipe in states that have a pressure testing requirement, will satisfying the state requirement also suffice for satisfying the integrity assessment requirement of the integrity management rule? 6.10 What are the acceptable integrity assessment methods for ERW pipe or §195.452(c) 30#

Attachment 1, passage 32lap welded pipe susceptible to seam failure? 6.11a Is the evaluation of seam 'susceptibility' a one-time determination? 6.15 A reduction in operating pressure can provide an equivalent level of safety as that provided by a Subpart E hydrostatic test. Is a pressure reduction an acceptable integrity assessment method? 6.16 Will PHMSA Pipeline Safety allow liquid operators to use the Direct Assessment process allowed in the gas transmission integrity management rule as an acceptable “other technology” for integrity assessment [see 195.452 (c) (i) (C)]? 6.17 Can I perform an assessment using an MFL tool without also running a deformation tool? 6.18 If an operator chooses to assess its pipeline using external corrosion direct assessment (ECDA), does it have to use another assessment method to assess for deformation anomalies such as dents, gouges, and grooves? 6.19 Are the direct assessment requirements contained in ASME B31.8S-2001 standard applicable to hazardous liquid pipelines? 6.20 Does the new rule, §195.588, permit operators to use direct assessment to address the threat of stress corrosion cracking? 6.21 Can an operator use an indirect assessment tool for ECDA that is not listed in Table 2 of NACE RP-0502-2008? 6.22 If you learn something in the post assessment step that may change the results in another ECDA, is there a time limit when you have to reassess that covered segment? 6.23 If Guided Wave UT is used as part of the ECDA process, is it considered ‘other technology’ requiring notification?6.24 6.25 Does close interval survey/over-line survey qualify for ‘other technology’? 6.28 What is the definition of complementary technologies for selection of ECDA indirect inspection tools? 6.29 Can operators aggregate ECDA regions after the process is started and they determine that some regions have common features? 6.30 What does PHMSA expect to see in an ECDA feasibility study? 6.31 How can I demonstrate that I have applied more restrictive criteria the first time I used ECDA (required by 195.588(b)(2)-(4) and NACE-0502- 2002)? 6.32 Can the ‘ECDA’ assessment option be applied to significant portions of above ground portions of pipelines that cannot be assessed with ILI tools or hydrostatic testing? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 12.6 Will PHMSA Pipeline Safety review operator notifications and formally respond to the operator? Will PHMSA Pipeline Safety communicate responses to specific company notifications to the broader industry? 12.7 How will an operator know if PHMSA Pipeline Safety objects to its notification? §195.452(c) 31#

Attachment 1, passage 33Guidance Information 1. The rule requires the operator to have a written baseline assessment plan for line pipe which includes the method selected, schedule for completion, explanation of the assessment method and evaluation of risk factors considered in establishing the schedule. It also requires documentation of the basis for any changes to the plan prior to implementation. 2. The deadlines for completing baseline assessments for Category 1 and Category 2 pipe as defined in §195.452(a) have passed. Thus practically speaking, the requirements to perform a baseline assessment should apply only to Category 3 pipe – i.e., newly constructed or converted pipe, or to rural, low stress pipelines that can affect USAs. Category 1 and 2 pipe should already have received a baseline assessment, but if they have not, §195.452(c) would still apply. 3. The requirements for on-going evaluation and assessments (not baseline assessments) are covered under §195.452(j). Thus issues with assessment method selection and assessment intervals for reassessments should be cited under §195.452(j) and not §195.452(c). 4. The preamble to the Final Rule provides one important piece of clarifying guidance for operators selecting pressure testing as a method of integrity assessment. “OPS expects that an operator choosing this method of integrity assessment for a pipeline segment will review its corrosion control monitoring program for that segment. OPS inspectors will review these documents when evaluating an operator’s choice of pressure test as an assessment method.” (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75396.) 5. §195.12(c)(1)(iii)(C) and §195.12(c)(2)(iii)(C) specify that baseline assessments must be conducted on rural low stress lines that could affect USAs and provides deadlines for when these assessments must be complete [analogous to §195.452(b)(3) and §195.452(d)(1), respectively]. Thus if an operator fails to develop a baseline assessment plan or complete the baseline assessments for rural, low stress lines that can affect USAs within the deadlines, it would be cited under the applicable §195.12(c) subparagraph. However if an operator of a rural low stress pipeline had a baseline assessment plan, but it was not in compliance with §195.452(c), then the applicable paragraph of §195.452(c) should be cited. (See enforcement guidance for §195.12(c)(1)(iii)(C) and §195.12(c)(2)(iii)(C).) Selected Final Orders Referencing §195.452(c)(1)(i) 1. ExxonMobil Production Company, [5-2005-5015, Item 11], June 11, 2009. The operator failed to use a geometry tool capable of detecting and identifying deformation anomalies. 2. Chevron Pipe Line Co., [5-2003-5032, Item 4], June 8, 2009). An MFL tool in combination with a geometry tool is not adequate to assess seam integrity of pre- 1970 low frequency ERW line pipe. 3. Link Energy, [4-2002-5011, Item 3], October 18, 2006. Operator failed to §195.452(c) 32#

Attachment 1, passage 34document the capability of its assessment methods to assess seam integrity on its pre-1970 ERW pipe or lap welded pipe susceptible to longitudinal seam failures. 4. Navajo Refining Co., [5-2003-5030, Item 1], July 28, 2004. Operator used tools that are not capable of assessing seam integrity. They must assess segments containing LFERW pipe with a methodology capable of assessing seam integrity or provide an engineering analysis indicating that the pipeline is not susceptible to seam failure. 5. Tesoro-High Plains Pipeline Co, [5-2007-5027, Item 1A and 1B], June 17, 2010. Operator identified pipeline segments with LFERW line pipe, but it had not completed a long-seam evaluation process of that line pipe in certain cases. Also, the respondent failed to perform a stress corrosion cracking examination of its pipelines. 6. Arguello, Inc.[5-2004-7003, Item 1], January 30, 2009. Operator failed to use an adequate pipeline integrity assessment method in its baseline assessment plan. Geometry tools were not used in conjunction with MFL tools 7. QEP Field Services Company, [5-2008-5019, Item 1], March 4, 2010. Operator failed to perform an 8-hour pressure test of its buried propane pipeline as part of the company’s’ baseline assessment. Instead, they only performed a 4- hour test, an inadequate length of time for a pipeline that cannot be visually inspected. Selected Final Orders Referencing §195.452(c)(1)(ii) As of October, 2012, no final orders have been issued citing this paragraph. One NOA was issued and is summarized below. 1. Penn Octane Corporation, [4-2004-5021M, Item 2], May 19, 2004. The operator failed to identify whether a planned hydrostatic test or the initial construction hydrotest is the baseline assessment. Selected Final Order Referencing §195.452(c)(1)(iii) 1. Key Pipelines LTD, [5-2005-5016, Item 2b], December 11, 2006. The IM program did not contain an evaluation of risk factors for establishing the time interval between assessments. Selected Final Orders Referencing §195.452(c)(2) 1. Key Pipeline, [5-2005-5016, Item 3], December 11, 2006. The operator’s IMP did not contain any guidance directing personnel to document supporting justifications for revision to their IMP. Operator must amend their IMP to ensure that supporting justifications for revision to the IMP are documented. 2. ExxonMobil, [5-2005-5015, Item 10], June 11, 2009. The operator’s IMP lacks a process for adding or removing pipelines and/or pipeline segments from its asset inventory. ExxonMobil must amend its procedures to include a process for adding and removing such assets from its IMP. 3. Belle Fourche Pipeline, [5-2004-5030, Item 2c and 2d], July 10, 2006. The operator must amend its IM program BAP so it consolidates all portions of its system, and the operator must also amend its BAP to include a process for revising the BAP and appropriately documenting those revisions. §195.452(c) 33#

Attachment 1, passage 35Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 1. Failure to develop a Baseline Assessment Plan (BAP). 2. Failure to include the required elements in the BAP. 3. Failure to include all segments that could affect HCAs in the BAP. 4. Assessment methods in the BAP were not appropriate for the pipeline specific conditions and risk factors identified for each segment. 5. Failure to select an adequate method to assess low frequency electric resistance welded (LF ERW) pipe or lap welded pipe susceptible to longitudinal seam failure. 6. Failure to provide adequate technical justification that LF ERW or lap-welded pipe is not susceptible to seam integrity issues. 7. Failure to adequately specify the assessment method(s) for all segments in the BAP. 8. Failure to adequately justify the assessment method(s) in the BAP. 9. Failure to provide for the use of a deformation tool where applicable, and not requiring the excavation of all dent indications for MFL tool runs. 10. Failure to require notification to PHMSA when using “other technology.” 11. Failure to adequately document changes to the BAP. 12. Reasons for modifications to the BAP were inadequate or missing. 13. Assessment schedule does not begin with the highest risk pipe. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the BAP. 2. Integrity Management Framework 3. Baseline Assessment Plan 4. Records demonstrating the deficiency or inadequacy in the BAP. 5. Risk analysis results or other information used to determine risks associated with individual segments and to justify the selection of assessment methods. 6. Risk analysis results, segment risk rankings, or other information used to establish the risk-based schedule for conducting baseline assessments. 7. Criteria used to select assessment methods for different integrity threats. 8. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the BAP. 9. Maps or other records showing the assets included in the BAP. §195.452(c) 34#

Attachment 1, passage 36Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(d)(1) Pipeline integrity management in high consequence areas. (d) When must operators complete baseline assessments? Operators must complete baseline assessments as follows: (1) Time periods. Complete assessments before the following deadlines: If the pipeline is: Then complete baseline And assess at least 50 percent assessments not later than the of the line pipe on an following date according to a expedited basis, beginning schedule that prioritizes with the highest risk assessments: pipe, not later than: Category 1 March 31, 2008 September 30, 2004 Category 2 February 17, 2009 August 16, 2005 Category 3 Date the pipeline begins operation Not applicable. 195-70, 65 FR 75378, December 1, 2000 196-76A, 67 FR 46911, July 17, 2002 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance Document, Baseline Assessment Plan PHMSA Hazardous Liquid Integrity Management FAQs: 1.4 When must baseline assessments be completed? 1.5 How do the required dates for completing 50 percent and 100 percent of assessments apply to a category 2 pipeline that is acquired by an operator that had more than 500 miles of pipeline on May 29, 2001? §195.452(d)(1) 35#

Attachment 1, passage 37Guidance Information Examples of a Probable Violation or Inadequate Procedures 4.13 For purposes of meeting the deadlines for completing baseline assessments, is the date of the assessment considered to be the day when the tool run is complete, when the preliminary data is received, or when the evaluation of the in-line inspection results is complete? 4.15 If an operator develops a single Baseline Assessment Plan that covers both intra- and interstate pipelines, does the need to complete assessments on 50% of the pipeline mileage that can affect HCAs apply to both intra- and interstate line segments, or just interstate line segment mileage? Should the company’s Plan identify whether line segments are intra- or interstate? 4.18 What specificity does PHMSA Pipeline Safety expect for schedules in baseline assessment plans? 1. §195.452(d)(1) identifies the deadlines by which baseline assessments must be completed for each category of pipe. These deadlines have long passed for Category 1 and 2 operating pipelines. Thus future probable violations of this paragraph are likely to involve only Category 3 pipe – i.e., newly constructed or converted pipelines. All newly constructed or converted pipelines must have a baseline assessment completed by the date the pipe begins operation. Selected Final Order Referencing §195.452(d)(1) 1. Kiantone Pipeline Corp., [1-2005-5016, Item 3], October 13, 2006. The operator did not complete baseline assessment on time because it used a gauging plate to detect deformation anomalies. Gauging plates only detect gross deformations and do not detect the 2% and 3% deformations which are required to be detected under §195.452(h)(4)(ii) and (iii). [§195.452(c)(1)(i)(A) could also have been cited for this case.] 2. Belle Fourch, [5-2004-5030, Item 3b], July 10, 2006. The operator needs to amend its IM program baseline assessment schedule to ensure that 50% of Category 2 pipe will be assessed by August 16, 2005. 3. Bayou City Pipeline Inc., [4-2006-5004, Item 3], June 21, 2006. The operator did not complete 50% of its mileage that could affect HCAs by August 16, 2005. 1. Baseline assessments were not completed in the prescribed time frames. 2. Baseline assessments were not completed for at least 50% of the mileage that could affect HCAs by the required date. 3. Baseline assessments did not begin with the highest risk pipe. 4. Baseline assessments were not performed for newly constructed or converted pipe prior to operation. §195.452(d)(1) 36#

Attachment 1, passage 38Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the Baseline Assessment plan schedule. 2. Integrity Management Framework 3. Baseline Assessment Plan 4. Records demonstrating the failure to complete assessments by the required deadlines. 5. Risk analysis results, segment risk rankings, or other information used to establish the risk-based schedule for conducting baseline assessments. 6. Documented conversations with operator or contractor personnel that identify deficiencies, or inadequacies in the BAP and the completion of scheduled assessments. Other Special Notations §195.452(d)(1) 37#

Attachment 1, passage 39Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(d)(2) Pipeline integrity management in high consequence areas. (d) When must operators complete baseline assessments? Operators must complete baseline assessments as follows: (2) Prior assessment. To satisfy the requirements of paragraph (c)(1)(i) of this section for pipelines in the first column of the following table, operators may use integrity assessments conducted after the date in the second column, if the integrity assessment method complies with this section. However, if an operator uses this prior assessment as its baseline assessment, the operator must reassess the line pipe according to paragraph (j)(3) of this section. The table follows: Pipeline Date Category 1 January 1, 1996. Category 2 February 15, 1997. 195-70, 65 FR 75378, December 1, 2000 196-76A, 67 FR 46911, July 17, 2002 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance Document, Baseline Assessment Plan 1. §195.452(d)(2) establishes that operators may use an assessment performed before the rule was issued as a baseline assessment. It provides dates for category 1 and 2 pipe before which assessments may not be used as baseline assessments. Since the baseline assessment deadlines for category 1 and 2 pipe §195.452(d)(2) 38#

Attachment 1, passage 40have passed, all operators should have completed these initial assessments. Thus it is unlikely that §195.452(d)(2) should be cited in a future enforcement case. 2. As of October 2012, no final orders had been issued citing §195.452(d)(2). Examples of a Probable Violation or Inadequate Procedures 1. Failure to adequately address the use of prior assessments in the baseline assessment plan. 2. Failure to follow the baseline assessment plan in using prior assessments. 3. Prior assessments conducted before the dates in §195.452(d)(2) were included in the baseline assessment plan. 4. A prior assessment was included in the baseline assessment plan, but the method(s) used did not comply with §195.452(c)(1)(i). Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the BAP. 2. Integrity Management Framework 3. Baseline Assessment Plan 4. Records demonstrating the deficiency or inadequacy in the use of prior assessments in the BAP. 5. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the use of prior assessments in the BAP. 6. Operator maps showing segments assessed using a prior assessment. Other Special Notations §195.452(d)(2) 39#

Attachment 1, passage 41Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(d)(3) Pipeline integrity management in high consequence areas. (d) When must operators complete baseline assessments? Operators must complete baseline assessments as follows: (3) Newly-identified areas. (i) When information is available from the information analysis (see paragraph (g) of this section), or from Census Bureau maps, that the population density around a pipeline segment has changed so as to fall within the definition in §195.450 of a high population area or other populated area, the operator must incorporate the area into its baseline assessment plan as a high consequence area within one year from the date the area is identified. An operator must complete the baseline assessment of any line pipe that could affect the newly-identified high consequence area within five years from the date the area is identified. (ii) An operator must incorporate a new unusually sensitive area into its baseline assessment plan within one year from the date the area is identified. An operator must complete the baseline assessment of any line pipe that could affect the newly-identified high consequence area within five years from the date the area is identified. 195-70, 65 FR 75378, December 1, 2000 196-76A, 67 FR 46911, July 17, 2002 §195.452(d)(3) 40#

Attachment 1, passage 42Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Hazardous Liquid Integrity Management FAQs: 1.9 When must newly-identified HCAs be included in the program? 1.10 On what frequency or schedule will changes to the HCA maps on the National Pipeline Mapping System be made? Will PHMSA Pipeline Safety announce or provide public notice of changes? 1.11 How will PHMSA Pipeline Safety track changes to HCA information over time? When data fields are changed, will operators be able to clearly distinguish the new information from the old in NPMS? 4.3 Under what conditions should the Baseline Assessment Plan be modified? Guidance Information 1. Newly identified areas are those that were created since the last update of the operator’s identification of segments that could affect an HCAs. An example would be expansions of High Population or Other Populated Areas identified by a new census. However, new population HCAs are not just restricted to those officially identified by the Census Bureau. An operator is responsible for monitoring conditions along its pipeline. If population encroaches upon the right-of-way such that it meets the §195.450 population-related HCA definitions (e.g., a new subdivision in a formerly low population area), PHMSA expects that the operator will identify this as a new HCA and include the pipe that could affect this new area in its IM program. 2. The operator’s information/risk analysis may be used to identify population encroachment upon the pipeline or perhaps other HCAs. If the application of the information/risk analysis for the purposes of identification of new HCAs is deficient or inadequate, generally §195.452(d)(3) should be cited and not §195.452(g). 3. §195.452(d)(3) should be cited if an operator fails to identify a new HCA, fails to incorporate pipe segments that could affect newly identified HCAs in its IM Program, fails to schedule a baseline assessment of pipe affecting a newly identified area within one year, or fails to conduct a baseline assessment of pipe affecting a newly identified area within five years. 4. Segments that should have been identified by an operator, but were previously missed, are not considered to be “newly identified.” 5. Despite the fact that its Baseline Assessment Plan has been completed, an operator is still responsible for scheduling a baseline assessment of pipe affecting a newly identified HCA (be it population or USA) within one year, and for completing that baseline assessment within five years after the new area is identified. Selected Final Order Referencing §195.452(d)(1) 1. Belle Fourch, [5-2004-5030, Item 4], July 10, 2006. The operator must amend its IM program to include a process for the incorporation of changes that may cause new segments of their pipeline to affect an HCA. 2. Kinder Morgan, [1-2004-5004, Item 7], June 26, 2006. Local field knowledge §195.452(d)(3) 41#

Attachment 1, passage 43has been collected, but more than one year has passed without the information being applied to the HCA changes. Records show that KM had interviewed multiple field personnel, but the results of all those interviews was not used to help identify new HCAs or update information about existing HCAs. Examples of a Probable Violation or Inadequate Procedures 1. Failure to adequately provide for the identification of new HCAs (both population and USAs) in accordance with this section in the operator’s IM Program and Baseline Assessment Plan. 2. Failure to adequately follow procedures in the IM Program to identify new HCAs. 3. Failure to adequately conduct a periodic re-examination and update of the list and boundaries of HCAs. 4. Failure to perform an adequate analysis of updated HCA location information to determine if changes to the segment identification results are necessary. 5. Failure to adequately use of local knowledge, field personnel input, and other sources to update HCA location information. 6. Failure to identify new pipeline segments that could affect newly identified HCAs. 7. Failure to incorporate a newly identified HCA and the pipeline segments that can affect it into the baseline assessment plan within one year from the date the area is identified. 8. Failure to complete all baseline assessments of any line pipe that could affect the newly identified HCAs within five years from the date the area is identified. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. §195.452(d)(3) 42#

Attachment 1, passage 44Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the approach for identifying new HCAs, identifying pipeline segments that can affect newly identified HCAs, and scheduling assessments for these pipe segments. 2. Integrity Management Framework 3. Baseline Assessment Plan 4. Assessment schedule depicting when pipe affecting newly identified HCAs will be assessed. 5. Records demonstrating a deficiency or inadequacy in the BAP or assessment schedules for pipeline segments affecting newly identified HCAs. 6. Risk analysis results or other information used to determine risks associated with individual segments and to justify the selection of assessment methods for pipe segments affecting newly identified areas. 7. Risk analysis results, segment risk rankings, or other information used to establish the risk-based schedule for conducting baseline assessments for pipe segments newly identified areas. 8. Criteria used to select assessment methods for different integrity threats. 9. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the identification of newly identified HCAs, the identification of pipeline segments that could affect newly identified HCAs, or the assessment method and schedule for these segments. Other Special Notations §195.452(d)(3) 43#

Attachment 1, passage 45Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(e) Pipeline integrity management in high consequence areas. (e) What are the risk factors for establishing an assessment schedule (for both the baseline and continual integrity assessments)? (1) An operator must establish an integrity assessment schedule that prioritizes pipeline segments for assessment (see paragraphs (d)(1) and (j)(3) of this section). An operator must base the assessment schedule on all risk factors that reflect the risk conditions on the pipeline segment. The factors an operator must consider include, but are not limited to: (i) Results of the previous integrity assessment, defect type and size that the assessment method can detect, and defect growth rate; (ii) Pipe size, material, manufacturing information, coating type and condition, and seam type; (iii) Leak history, repair history and cathodic protection history; (iv) Product transported; (v) Operating stress level; (vi) Existing or projected activities in the area; (vii) Local environmental factors that could affect the pipeline (e.g., corrosivity of soil, subsidence, climatic); (viii) geo-technical hazards; and (ix) Physical support of the segment such as by a cable suspension bridge. (2) Appendix C of this part provides further guidance on risk factors. 195-70, 65 FR 75378, December 1, 2000 §195.452(e) 44#

Attachment 1, passage 46Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Part 195, Appendix C.II “Risk Factors for establishing frequency of assessment,” and C.III “Safety risk indicator tables for leak history, volume or line size, age of pipeline, and product transported.” PHMSA Liquid Integrity Management Supplemental Guidance Documents: Baseline Assessment Plan and Risk Analysis Letter Rick Kowalewski to The Honorable Mark Rosenker, October 2, 2008. (PHMSA’s commitments to address NTSB Recommendation P-07-9) PHMSA Hazardous Liquid Integrity Management FAQs: 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 6.3 Are there different requirements for inspection of overhead suspension pipeline bridges? 8.11 What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? 8.14 Will operators be expected to consider external conditions such as earthquake fault lines or mining subsidence in their integrity management program? Will these be classified as HCAs or require special repair provisions? 8.18 Can operators include potential business consequences (e.g., curtailments, plant shutdown) in its risk determinations? 1. §195.452(e) establishes the minimum set of risk factors that an operator must consider in determining its risk-based assessment schedule. These requirements apply to both the original baseline assessment and subsequent reassessments. In practice, operators typically should include factors in addition to those listed in this section to adequately characterize the risks associated with segments that can affect HCAs. 2. If an operator fails to consider one of the required risk factors listed in §195.452(e), and does not provide adequate technical justification for not considering a given factor, then a probable violation of this paragraph is likely. 3. If one or more of the probable violations or inadequate procedures deals with the incomplete consideration of risk factors, then the proposed compliance order or NOA must explicitly direct the operator to consider all risk factors in revising its information/risk analysis, periodic evaluation, assessment plans, §195.452(e) 45#

Attachment 1, passage 47and determining necessary preventive and mitigative measures. (PHMSA’s response to NTSB Recommendation P-07-009) 4. In general, §195.452(e) addresses the risk factors used in determining an assessment schedule or the frequency with which reassessments are performed. 5. With regard to the requirement in §195.452 (j)(3) to establish reassessment intervals, operators must use the risk factors in §195.452 (e). §195.452(j)(3) states: An operator must establish the assessment intervals based on the factors specified in paragraph (e) of this section, the analysis of the results from the last integrity assessment, and the information analysis required by paragraph (g) of this section. If the operator has a risk-based reassessment schedule, but omits or inappropriately uses some risk factors listed in §195.452(e) in the methodology, then §195.452(e) should generally be cited. But if the operator fails to develop a risk-based reassessment schedule (or does not base the reassessment intervals on risk), §195.452(j)(3) should generally be cited and not §195.452(e). 6. §195.452(e) deals only with the risk factors used to establish assessment schedules – not the use of risk analysis (also referred to as information analysis), which is required under §195.452(g) to support other IM program decisions. Inadequacies, omissions, or other issues with the operator’s risk analysis should generally be cited under §195.452(g) and not §195.452(e). 7. §195.452(e)(1) and §195.452(j)(3) both require consideration of the results of the most recent integrity assessment in establishing an assessment schedule. Thus either code citation could be used in cases where an operator did not consider the results of the most recent integrity assessment in establishing a reassessment schedule. However if the operator does not consider the results of the most recent assessment for a newly converted pipeline (Category 3) in developing its baseline assessment schedule, then §195.452(e)(1) should be cited. (This assumes of course that the newly converted pipeline had a previous integrity assessment.) 8. The unique risk factors posed by the transportation of ethanol and biofuels must be considered by operators transporting these commodities. Selected Final Orders Referencing §195.452(e) 1. Sunoco Pipeline L.P., [1-2005-5005. Item 2a] July 27, 2009 (Decision on Reconsideration). An operator must consider data from the actual HCAs that could be affected by its pipeline segments when establishing an assessment schedule that prioritizes segments for assessment. An operator may not employ a generic risk model that is not directly correlated to actual HCA locations. 2. Sunoco Pipeline L.P., [1-2005-5005, Item 2c], June 10, 2008. An operator must consider the potential risks attributable to depth of cover, internal corrosion, and operational factors, among other things, when establishing an §195.452(e) 46#

Attachment 1, passage 48integrity assessment schedule based on all the risk conditions on the pipeline segment. 3. ConocoPhillips Pipelines and Terminals, [3-2004-5013, Item 3a] August 29, 2005). An operator's integrity assessment schedule must include sufficient information about the ranking process and consideration of risk factors to prove that the results are prioritized as required by the rule. 4. Kinder Morgan, [1-2004-5004, Item 2a], June 26, 2006. The operator failed to consider the results of previous integrity assessments including previously identified defect type and predicted growth rate in establishing an integrity assessment schedule prioritizing its pipeline segments by risk. 5. Kinder Morgan, [1-2004-5004, Item 2c], June 26, 2006. The operator failed to consider local environmental factors, including soil corrosivity, subsidence, climactic conditions and geo-technical hazards, in establishing an integrity assessment schedule prioritizing its pipeline segments by risk. Examples of a Probable Violation or Inadequate Procedures 1. Failure to adequately consider all required risk factors in §195.452(e) when establishing an assessment schedule. 2. Failure to adequately consider all relevant risk factors that reflect the risk conditions on pipeline segments in establishing an assessment schedule. 3. Failure to adequately consider the susceptibility to failure of low-frequency ERW piping. 4. Failure to adequately consider all relevant threats to pipeline integrity in establishing a risk-based assessment schedule, such as: external and internal corrosion, stress corrosion cracking, materials problems, third party damage, operator or procedures errors, equipment failures, natural forces damage, and construction errors. 5. Failure to adequately include the results of the most recently completed integrity assessment in determining re-assessment intervals. (§195.452(j)(3) could also be cited.) 6. Failure to adequately consider the impacts on risk when different commodities are transported. 7. Failure to adequately address the unique risks associated with ethanol or biofuels in pipelines transporting these commodities. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. §195.452(e) 47#

Attachment 1, passage 49Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the risk factors used to establish a risk-based assessment schedule. 2. Baseline Assessment Plan, or on-going reassessment plan. 3. Risk analysis description or risk model documentation including the risk factors considered. 4. Records or documentation demonstrating the deficiency or inadequacy in the consideration of risk factors used to establish the risk-based assessment schedule. 5. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the risk factors used in establishing the risk-based assessment schedule. Other Special Notations §195.452(e) 48#

Attachment 1, passage 50Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(1) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (1) A process for identifying which pipeline segments could affect a high consequence area; 195-70, 65 FR 75378, December 1, 2000 Surface Hydrology Analysis, Michael Baker Jr., March 2003. Consequences of HVL Releases, Michael Baker Jr., December 2002. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Segment Identification. Part 195, Appendix C.I. Identifying a high consequence area and factors for considering a pipeline segment’s potential impact on a high consequence area. PHMSA Hazardous Liquid Integrity Management FAQs: §195.452(f)(1) 49#

Attachment 1, passage 513.2 Many operators have pre-defined segments on their pipeline (e.g., the length of pipe between two pump stations is considered a segment). When PHMSA Pipeline Safety refers to segments that can impact an HCA in the rule, in what context is the term segment used? 3.3 How will an operator determine if a pipeline can affect an HCA? 3.4 What is acceptable methodology and criteria for determining whether a segment could affect an HCA? (For example what spill volume should be considered - Worst-case discharge? Most likely discharge? Most likely worst-case discharge?) Can an arbitrary safe distance be applied or must location specific dispersion analyses be performed? Is air dispersion modeling expected or is spill trajectory adequate? 3.5 Do operators need to perform detailed consequence analysis to determine the specific impacts on population or USAs? 3.6 Can the identification of segments that “can affect” HCAs be refined after the December 31, 2001, (or November 18, 2002, as appropriate) deadline? 3.7 How will HCAs be identified and communicated to the industry? 3.8 What are PHMSA Pipeline Safety expectations for operators to determine new or changed HCAs? 3.10 On what frequency or schedule will changes to the HCA maps on the National Pipeline Mapping System be made? Will PHMSA Pipeline Safety announce or provide public notice of changes? 3.11 How will PHMSA Pipeline Safety track changes to HCA information over time? When data fields are changed, will operators be able to clearly distinguish the new information from the old in NPMS? 3.14 If an operator desires location and other information on a specific ecological or drinking water USA to use in risk analysis and determination of potential pipeline release impacts, how can this information be obtained? 3.15 Since the USA data in the National Pipeline Mapping System (NPMS) contains buffer zones around the actual drinking water or ecological resource, is it possible that an operator’s evaluation to determine whether a spill could impact an HCA might show a release reaching a USA depicted on the NPMS map when in reality such a release might not actually reach the sensitive area? 3.16 What mechanism is available for questioning or challenging HCA and USA identification once such identification has been posted on the National Pipeline Mapping System? 3.17 Must non-pipe elements of a pipeline system that can affect HCAs (e.g., stations and facilities) have been identified? 3.19 What types of considerations would PHMSA Pipeline Safety consider reasonable for determining whether pipelines can affect commercially navigable waterways in open water? 3.20 What assumptions would PHMSA Pipeline Safety find acceptable for analysis of spilled product transport by waterway or topographical features? §195.452(f)(1) 50#

Attachment 1, passage 523.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 3.22 The National Pipeline Mapping System (NPMS) does not contain maps for ecological USAs in Pennsylvania. Are operators responsible for identifying USAs in Pennsylvania? 3.23 Must concentrations of an operator’s own personnel, e.g., a work camp, be considered high consequence areas? 3.24 Can operators exclude pipeline from consideration under the integrity management rule on the basis that any effect it could have on a high consequence area is small? 3.25 Must I assume that a leak from a propane pipeline can affect drinking water USAs? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? Guidance Information 1. §195.452(f) establishes the required program elements of an integrity management program. The separate subparagraphs of §195.452(f) address each required element. §195.452(f)(1) requires that an operator have a process to identify portions of its pipeline that could affect HCAs. 2. The results of the operator’s “segment identification” process determine what portions of the pipeline system are subject to the remaining requirements of the operator’s IM program. 3. §195.452(f)(1) should generally be cited if there are omissions or deficiencies in an operator’s methodology for identifying pipeline segments that can affect HCAs. 4. Failure to identify pipeline segments that could affect an HCA should generally be cited as a probable violation of §195.452(b)(2), not §195.452(f)(1). 5. For existing pipelines, the deadlines to identify segments that could affect HCAs were December 31, 2001 for category 1 pipe and November 18, 2002 for category 2 pipe. Thus, except for newly constructed or converted pipe, the segments that could affect HCAs have been identified for most pipelines. However, operators are still responsible for monitoring conditions along their lines per §195.452(d)(3) and identifying any new segments that could impact HCAs due to changing population density along the pipeline or the identification of new USAs. Operators must use the same process required by §195.452(f)(1) to determine the pipeline segments that could impact a newly identified HCA. 6. In general, if an operator of a low stress pipeline fails to identify segments that could affect USAs, §195.12 would be cited. (See guidance for §195.12.) Selected Final Orders Referencing §195.452(f)(1) 1. Cenex Pipeline [5-2004-5023, Item 1a], March 3, 2006. Operator must conduct a quantitative analysis of the overland spread and water transport differences (including differences in spill volume) between line pipe and other §195.452(f)(1) 51#

Attachment 1, passage 53pipeline facilities, which usually have a greater potential release volume. This analysis is required to identify if pipeline facilities could affect HCAs. 2. Cenex Harvest States Cooperative, Inc., [5-2004-5023, Item 1i] March 3, 2006. A newly-constructed pipeline that could affect an HCA must be identified in the IMP before being placed in service. 3. Kiantone Pipeline [1-2005-5016, Item 1a], October 13, 2006. An operator is not necessarily required to use NPMS data to locate HCAs, but failure to use NPMS data calls into question the accuracy of the operator's process for identifying which pipeline segments could affect an HCA. If an operator fails to use NPMS data to identify HCAs, it is not a violation so long as the operator has accurately determined the location of HCAs through other means. 4. ExxonMobil, [5-2005-5015, Item 1c], June 11, 2009. The process for performing pipeline segment identification was not sufficient to ensure that all “could affect” segments would be covered in the ExxonMobil IM program. 5. Rocky Mountain Pipeline System, LLC, [5-2004-5001, Item 1b] December 11, 2006. An operator’s process for identifying pipeline segments must provide for the identification of not just line pipe, but also non-linear pipeline facilities that could affect HCAs, such as pump stations and breakout tanks. 6. Aera Energy LLC, [5-2004-5016, Item 1b] March 6, 2009). It is not sufficient under the regulation to include a generic list all HCA types. An operator must identify the actual HCAs that could be affected by its pipeline. The operator did not have a process for identifying which portions of its HVL line could affect HCAs. 7. Cook Inlet Pipe Line Co., [5-2004-5025, Item 1f] April 17, 2009. For pipelines near shore, the process to identify segments must account for the full range of relevant factors, such as tidal, weather, and other conditions necessary to understand where spilled oil could go. This includes, among other things, oil dispersion characteristics in various conditions; near-shore oil migration and open-water oil migration in outgoing tides during adverse weather conditions; oil dispersion patterns; and worst-case conditions in the model input parameters. It is not sufficient for the operator to merely include subjective assumptions for tidal influence, average flow speed, wind conditions, and direction of net circulation. 8. Magellan Midstream Partners, L.P., [4-2006-5020, Item 1] December 23, 2009 (Amended Final Order). An operator's process for identifying segments that could affect an HCA must be based on the unique characteristics of its particular system, and it must be technically defensible. An operator may not simply employ a drain-down factor taken from another source that is not based on the operator's own system. The operator’s previous experience showed a spill volume 300% greater than the volume used to determine segments that could affect HCAs. §195.452(f)(1) 52#

Attachment 1, passage 54General Examples of a Probable Violation or Inadequate Procedures 1. Failure to develop an adequate process to identify pipeline assets that could affect HCAs. This includes both segments of line pipe as well as pipeline facilities (e.g., pump stations, terminals). 2. Failure to adequately identify and locate all HCAs that could affect the pipeline – including segments that do not intersect, but could still affect HCAs. 3. Failure to consider all of the HCAs defined in §195.450 in identify segments that could impact HCAs. 4. Failure to adequately identify and maintain up-to-date location information for pipeline segments that could affect HCAs. 5. Failure to use NPMS or other appropriate information sources for identifying HCAs. 6. Failure to adequately consider how pipeline segments located outside of the geographic boundaries of HCAs could impact those HCAs. 7. Use of an analytical method or software for segment identification whose algorithm does not correctly identify the boundaries of segments that are within, or could affect, HCAs. 8. Revision of the segment identification analysis following the receipt of integrity assessment results in order to avoid remediation of anomalies. Note: The identification of pipeline segments that could impact HCAs generally requires detailed analysis including calculations of the volume released and its transport over land, by water, and through the air to HCAs. The items listed below are examples of deficiencies or inadequacies that could occur as part of these analyses. Release Volume Determination 9. Failure to adequately consider potential release locations and potential volume releases in the methodology to identify segments that could affect HCAs. 10. Failure to adequately justify the use of release volume assumptions that are less than historical release volumes. 11. Failure to adequately analyze facilities for potential impact to HCAs (includes spill volume for releases at facilities as well as facility contribution to drain down volume, e.g., tank volume). 12. Failure to adequately consider possible leak sizes that could result in a larger release than assumed in release volume calculations. For example, slow leaks below SCADA detection thresholds that leak for long time periods of time. 13. Failure to technically justify assumptions used in release volume calculations, including hole size, pressure, equipment and operator response times, and drain down volume. §195.452(f)(1) 53#

Attachment 1, passage 55Overland Transport 14. Failure to adequately consider topography for overland spread analysis. 15. Failure to adequately consider overland transport of liquids and liquid pool fires for HVL lines. 16. Use of non-conservative inputs or assumptions in overland transport analysis. Water Transport 17. Failure to adequately include an analysis of water transport of liquids to determine the extent of commodity spread and its effects on HCAs. 18. Failure to adequately consider the stream flow characteristics including potential flow velocity. 19. Use of invalid or non-conservative assumptions in water transport analysis. 20. Failure to adequately consider potential spills occurring at waterway crossings in segment identification. Air Dispersion Analysis 21. Failure to perform or document an adequate air dispersion analysis of hazardous vapors resulting from the release. 22. Use of non-conservative inputs or assumptions in the air dispersion analysis. Buffer Zone Methods 23. Failure to identify all segments that could affect HCAs in the buffer zone intersection analysis methodology. 24. Use of an incorrect or deficient algorithm in a buffer zone analysis. 25. Failure to identify segments by specific and unique endpoints in buffer analysis. 26. Failure to adequately include facilities that could affect HCAs in the buffer analysis. 27. Failure to technically justify the buffer size used to identify segments or facilities that could affect HCAs. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. §195.452(f)(1) 54#

Attachment 1, passage 56Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in processes for identifying pipeline segments that could affect HCAs 2. Integrity Management Framework 3. Records demonstrating a deficiency or inadequacy in the segment identification process or results. 4. Operator maps depicting the segments that could affect HCAs. 5. Documentation of the technical assumptions, justifications, and criteria used in the segment identification process. 6. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the identification of pipeline segments that could affect HCAs. 7. Documentation describing the segment identification algorithm or methodology. 8. Software documentation and output used for segment identification. 9. Engineering analyses to evaluate the transport of commodities released from the pipeline including overland transport, water transport, and air dispersion. Other Special Notations §195.452(f)(1) 55#

Attachment 1, passage 57Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(2) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: ….. (2) A baseline assessment plan meeting the requirements of paragraph (c) of this section; 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Baseline Assessment Plan. PHMSA Hazardous Liquid Integrity Management FAQs: 2.12 Does the rule apply to the operator of a marketing facility if that operator does not own or operate a pipeline but rather receives and delivers hazardous liquid from/to third-party pipelines? §195.452(f)(2) 56#

Attachment 1, passage 58Guidance Information Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 4.2 What must be in the Baseline Assessment Plan? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 8.5 What is a framework? 8.6 What is an Integrity Management Program? 8.15. The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 1. §195.452(f)(2) and §195.452(b)(3) are the same requirement. §195.452(b)(3) states that a plan to carry out baseline assessments is an IM program requirement. §195.452(f)(2) states that a required element of an IM program is a baseline assessment plan. Both of these code sections reference §195.452(c) for specific requirements of baseline assessment plans. 2. If an operator failed to develop a baseline assessment plan, citing either §195.452(f)(2) or §195.452(b)(3) is acceptable. If an operator developed a baseline assessment plan, but it had deficiencies or inadequacies, the appropriate paragraph in §195.452(c) should generally be cited. 3. Because the deadlines for completing baseline assessments for category 1 and category 2 pipe have passed, this requirement is likely applicable only to newly constructed or converted pipe. Selected Final Order Referencing §195.452(f)(1): 1. The Pipelines of Puerto Rico, Inc., [2-2011-6007, Item 3], February 8, 2012. The operator failed to develop a Baseline Assessment Plan as part of its IM program and failed to perform a baseline assessment on its 9.5 mile jet fuel line. 1. Failure to develop a Baseline Assessment Plan. 1. Integrity Management Plan or Program, or applicable portion that shows an omission of a Baseline Assessment Plan. 2. Integrity Management Framework 3. Records demonstrating the absence of a Baseline Assessment Plan. 4. Documented conversations with operator or contractor personnel that verify that a Baseline Assessment Plan was not prepared. §195.452(f)(2) 57#

Attachment 1, passage 59Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(3) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: …. (3) An analysis that integrates all available information about the integrity of the entire pipeline and the consequences of a failure (see paragraph (g) of this section); 195-70, 65 FR 75378, December 1, 2000 Advisory Bulletin ADB-12-06 Verification of Records PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities to verify their records relating to operating specifications for maximum allowable operating pressure (MAOP) required by 49 CFR 192.517 and maximum operating pressure (MOP) required by 49 CFR 195.310. This Advisory Bulletin informs gas operators of anticipated changes in annual reporting requirements to document the confirmation of MAOP, how they will be required to report total mileage and mileage with adequate records, when they must report, and what PHMSA considers an adequate record. In addition, this Advisory Bulletin informs hazardous liquid operators of adequate records for the confirmation of MOP. §195.452(f)(3) 58#

Attachment 1, passage 60Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Part 195 Appendix C. II Risk factors for establishing frequency of assessment. Part 195 Appendix C. III Safety risk indicator tables for leak history, volume or line size, age of pipeline, and product transported. PHMSA Liquid Integrity Management Supplemental Guidance, Risk Analysis. PHMSA Hazardous Liquid Integrity Management FAQs: 3.5 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 3.14 If an operator desires location and other information on a specific ecological or drinking water USA to use in risk analysis and determination of potential pipeline release impacts, how can this information be obtained? 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 8.6 What is an Integrity Management Program? 8.11 What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? 8.14 Will operators be expected to consider external conditions such as earthquake fault lines or mining subsidence in their integrity management program? Will these be classified as HCAs or require special repair provisions? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 8.16 The rule requires that the review of integrity assessment results and information analysis (i.e., risk analysis) be performed by a person qualified to evaluate the results and information. Are these covered tasks under Operator Qualification requirements? If not, how are operators expected to demonstrate that they have satisfied this requirement? 8.18 Can operators include potential business consequences (e.g., curtailments, plant shutdown) in its risk determinations? 8.19 What type of risk analysis process would PHMSA Pipeline Safety prefer, quantitative or qualitative? 9.8 What factors must be considered in risk analyses conducted to determine if additional preventive or mitigative actions are needed? 9.9 How long after completing the baseline assessment for a segment does an operator have to conduct a risk analysis and determine whether additional §195.452(f)(3) 59#

Attachment 1, passage 61preventive or mitigative actions are needed (including the need for EFRDs and leak detection system enhancements)? If an operator determines that additional actions are warranted, how long does it have to implement them? 9.10. How do operators assess and control risk caused by third-parties over which they have no direct control? Guidance Information 1. Operators are required to perform an analysis that integrates all available information about the integrity of the entire pipeline and the consequences of failure. This analysis is typically referred to as a risk analysis or an information analysis. §195.452(g) specifies the minimum information that must be considered in the risk analysis. 2. Generally if an operator does not have an analysis that integrates all information about pipeline integrity and the consequences of failure (i.e., a risk analysis), then §195.452(f)(3) should be cited. 3. However, if an operator has a risk analysis, but it does not consider the information listed in §195.452(g), then §195.452(g) should be cited. Note that §195.452(g) requires that an operator must “analyze all available information about the integrity of the entire pipeline.” Thus if an operator fails to consider some available information relevant to pipeline integrity or the consequences of failure in its risk analysis, §195.452(g) should generally be cited. 4. §195.452(g) should also be cited for deficiencies or inadequacies in the risk analysis itself. For example, if PHMSA determined that an operator used a risk model that relied upon industry average weighting factors and did not customize the model for its own pipeline systems, the inadequacy or deficiency should be cited as §195.452(g). 5. §195.452(i) also requires a risk analysis in determining additional preventive and mitigative measures. Although §195.452(i) does not explicitly refer to §195.452(f)(3) or §195.452(g), it states that the “operator must evaluate the likelihood of a pipeline release occurring and how a release could affect a high consequence area.” This is essentially the same language as used in §195.452(f)(3). Practically most operators have one risk analysis methodology that is applied to all risk-related requirements in the rule including the preventive and mitigative measures requirements, and the continual evaluation and assessment requirements. 6. As noted in item 3 above, the rule requires the operator to have an analysis that integrates all available information about the integrity of the entire pipeline (not just the segments that can affect HCAs). This includes applying data from other inspections, tests, surveillance and patrols required by Part 195, including, corrosion control monitoring and cathodic protection surveys. Selected Final Order Referencing §195.452(f)(3) 1. Aircraft Service International Group, [5-2007-5012, Item 1] April 22, 2010) The operator did not perform an analysis that integrated all available information about the integrity of its entire pipeline, including valves and other appurtenances connected to line pipe, pumping units and associated §195.452(f)(3) 60#

Attachment 1, passage 62Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations fabricated assemblies, metering and delivery stations and associated fabricated assemblies, and breakout tanks, and the consequences of a failure as required by 195.452(f)(3). 1. Failure to develop an analysis that integrates all available information about the integrity of the entire pipeline and the consequences of a failure. This analysis is typically referred to as a risk analysis or information analysis. 2. Failure to use of the most accurate available data to represent pipeline characteristics in the analysis of different segments, including the results of integrity assessments. 3. Failure to require controls to provide assurance of the completeness and quality of input information. 4. Failure to provide guidance to minimize the use of input information that is unnecessarily or excessively conservative (to avoid masking best-estimate risk insights). 5. Failure to require that the sources used to provide any subjective information are the most accurate available (e.g., from operator personnel, including field units). 6. Failure to require the use of a sufficiently structured process for obtaining subjective information (e.g., using forms, surveys, interviews, quality checks, etc.) to ensure that consistent information is captured. 7. Failure to require the use of the operator's or industry's collective operating experience data where applicable. 8. Failure to require a plan to address data gaps resulting from missing, unknown or poor quality data. 1. Integrity Management Plan or Program, or applicable portion that shows an information or risk analysis was not developed. 2. Integrity Management Framework. 3. Documented conversations with operator or contractor personnel that identify the absence of an information or risk analysis. §195.452(f)(3) 61#

Attachment 1, passage 63Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(4) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: …. (4) Criteria for remedial actions to address integrity issues raised by the assessment methods and information analysis (see paragraph (h) of this section); 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 ASME B31.4-2006, Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids, October 20, 2006. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review and Remedial Action PHMSA Hazardous Liquid Integrity Management FAQs: 4.13 For purposes of meeting the deadlines for completing baseline assessments, is the date of the assessment considered to be the day when the tool run is §195.452(f)(4) 62#

Attachment 1, passage 64Guidance Information complete, when the preliminary data is received, or when the evaluation of the in-line inspection results is complete? 6.17 Can I perform an assessment using an MFL tool without also running a deformation tool? 7.1 Do the anomaly repair schedule requirements in 195.452 (h) apply to ALL previous internal inspection runs performed by the operator, or just the integrity assessments required by 195.452 (i.e., the baseline assessment and subsequent integrity assessments)? 7.2 How soon must the results of pipeline integrity assessment be evaluated?7.3 7.4 What is an 'immediate repair condition?' 7.5 What is a '60-day condition'? 7.6 What is a '180-day condition'? 7.7 Are there other anomalies that an operator is required to address? 7.10 What is the minimum deformation that constitutes a “dent”? 7.14 If a segment that can affect an HCA is relatively short (e.g., only 2 miles in length), yet the operator internally inspects a longer portion around this segment (e.g., 50 miles from pig launcher to receiver), do the repair schedules in 195.452 (h) apply to the segment that can affect the HCA or the entire distance over which the pig is run? 7.18 How do the "burst pressure" that defines an immediate repair condition {452(h)(4)(i)(B)} and the "operating pressure" that defines a 180-day repair condition {452(h)(4)(iii)(D)} differ? 7.19 Should tool tolerances be considered when determining if a detected anomaly meets repair criteria? 7.20 Is a 20 percent reduction in pressure an adequate interim measure for immediate repair conditions?7.21 7.22 Must anomalies identified during pig runs not considered "baseline" or "re- assessments" under the rule be repaired in accordance with the rule's repair criteria? 7.23 Must pipe for which the maximum operating pressure has previously been reduced (e.g., to preclude the need for pressure testing in accordance with 195.302(b)(1)) be repaired or retested to restore its original, higher maximum operating pressure? 8.6 What is an Integrity Management Program? 1. §195.452(f)(4) states that operators must develop criteria for remedial actions to address integrity issues. This is a required IM Program element. §195.452(h) provides more specifics about what should be included in these criteria. 2. Generally, if an operator failed to establish criteria to address integrity issues, §195.452(f)(4) should be cited. If an operator has established remedial action criteria, but they don’t meet the conditions in §195.452(h), then the appropriate subparagraph of §195.452(h) should be cited. Selected Final Order Referencing §195.452(f)(4) 1. Tesoro, [5-2004-5033, Item 4], July 9, 2009. The operator failed to have §195.452(f)(4) 63#

Attachment 1, passage 65sufficiently detailed criteria for taking remedial action to address issues raised by the assessment methods and information analysis used in its IMP. Examples of a 1. Failure to include criteria for remedial action to address integrity issues in the IM Program. Probable Violation or Inadequate Procedures Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows criteria for remedial action were not developed. 2. Integrity Management Framework. 3. Documented conversations with operator or contractor personnel that identify the absence of remedial action criteria. 4. Operator’s pipeline repair procedure(s). Other Special Notations §195.452(f)(4) 64#

Attachment 1, passage 66Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(5) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: ….. (5) A continual process of assessment and evaluation to maintain a pipeline's integrity (see paragraph (j) of this section); 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, A Continual Process of Evaluation and Assessment. PHMSA Hazardous Liquid Integrity Management FAQs: 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? 5.1 How often must periodic integrity assessments be performed on pipeline segments that can affect an HCA after the baseline assessment is completed? 5.2 Does the requirement that an operator establish inspection intervals not to §195.452(f)(5) 65#

Attachment 1, passage 67Guidance Information exceed five (5) years mean 5 calendar years (i.e., pipe assessed in 2003 must be re-assessed in 2008) or 5 actual years? 5.3 Must operators conduct re-assessments before they have completed all baseline assessments? 5.4 Can a re-assessment interval be scheduled beyond 5 years? 5.6 Can the operator use risk assessment data to defend longer intervals between integrity assessments? 5.8 The gas transmission integrity management rule includes a provision for waiver of reassessment intervals if necessary to maintain product supply. Is PHMSA Pipeline Safety considering/willing to extend the same or similar provisions to hazardous liquids operators? How would such considerations be handled? 5.9 Once baseline assessments are complete, will operators be able to use their continuing evaluation process to identify primary threats and schedule assessments accordingly, even if this means conducting metal loss and deformation inspections on different intervals? 5.10 What is the difference between the ‘periodic evaluation’ required by 195.452 (j) (2) and the process for determining reassessment intervals required by 195.452 (j) (3)? 5.11 How does the 'not to exceed 68 month' assessment interval provision of the revised continual assessment interval requirement of 195.452 (j) (3) differ from the maximum 'five-year interval' for assessments? 8.6 What is an Integrity Management Program? 8.11 What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 1. §195.452(f)(5) requires that operators develop a process to continually assess and evaluate a pipeline’s integrity. §195.452(j) describes what should be in this continual evaluation process. 2. Generally, if an operator does not have a continual evaluation process, §195.452(f)(5) should be cited. If an operator has such a process, but it fails to comply with the requirements specified in §195.452(j), then the operator should be cited under the appropriate paragraph of §195.452(j). Final Orders Referencing §195.452(f)(5) 1. TE Products Pipeline Co., [4-2006-5049, Items 2A and 2B] April 28, 2008. The operator failed to develop a process to conduct periodic evaluations and determine assessment intervals. An operator must calculate reassessment intervals based on the process set forth in 195.452(j)(3). It is not sufficient for an operator to simply utilize its baseline assessment sequence on a 5-year continuing rotation for reassessment. §195.452(f)(5) 66#

Attachment 1, passage 68Examples of a 1. Failure to include a continual process of assessment and evaluation in the operator’s integrity management program. Probable Violation or Inadequate Procedures Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an absence of a process for continual assessment and evaluation. 2. Integrity Management Framework 3. Documented conversations with operator or contractor personnel that verify that a process for continual assessment and evaluation was not developed. Other Special Notations §195.452(f)(5) 67#

Attachment 1, passage 69Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(6) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: …... (6) Identification of preventive and mitigative measures to protect the high consequence area (see paragraph (i) of this section); 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Preventive and Mitigative Measures. PHMSA Hazardous Liquid Integrity Management FAQs: 3.5 Do operators need to perform detailed consequence analysis to determine the specific impacts on population or USAs? §195.452(f)(6) 68#

Attachment 1, passage 70Guidance Information Examples of a Probable Violation or Inadequate Procedures 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 8.18 Can operators include potential business consequences (e.g., curtailments, plant shutdown) in its risk determinations? 8.19 What type of risk analysis process would PHMSA Pipeline Safety prefer, quantitative or qualitative? 9.7 What preventive and mitigative actions must be taken to protect HCAs? 9.8 What factors must be considered in risk analyses conducted to determine if additional preventive or mitigative actions are needed? 9.9 How long after completing the baseline assessment for a segment does an operator have to conduct a risk analysis and determine whether additional preventive or mitigative actions are needed (including the need for EFRDs and leak detection system enhancements)? If an operator determines that additional actions are warranted, how long does it have to implement them? 9.10 How do operators assess and control risk caused by third-parties over which they have no direct control? 9.13 Can the evaluation of additional preventive and mitigative (P&M) measures be excluded for portions of HCA-affecting lines determined to be sufficiently “low” in risk by an operator’s risk analysis process? 1. §195.452(f)(6) requires operators to identify preventive and mitigative measures to protect high consequence areas. These preventive and mitigative measures go beyond the assessment and repair provisions of the rule. These preventive and mitigative measures help assure protection from threats that are not addressed by the assessment and repair provisions of the rule. §195.452(i) provides more specifics on what should be considered in identifying these additional measures. 2. Generally, if an operator had no process for identifying these measures, §195.452(f)(6) should be cited. If an operator had a process for identifying preventive and mitigative measures, but its approach had deficiencies or inadequacies, the appropriate paragraph in §195.452(i) should be cited. Selected Final Order Referencing §195.452(f)(6): 1. Buckeye Partners, [1-2009-5002, Item 17], May 30, 2012. The operator failed to include in its IMP a process for identifying (P&M) measures to protect HCAs. 1. Failure to develop an adequate process to identify preventive and mitigative measures to protect HCAs. This includes measures for line pipe as well as measures for other pipeline facilities (e.g., pump stations, breakout tanks, etc.). §195.452(f)(6) 69#

Attachment 1, passage 71Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an absence of a process for identifying preventive and mitigative measures. 2. Integrity Management Framework 3. Documented conversations with operator or contractor personnel that verify that a process for identifying preventive and mitigative measures was not developed. Other Special Notations §195.452(f)(6) 70#

Attachment 1, passage 72Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(7) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: (7) Methods to measure the program's effectiveness (see paragraph (k) of this section); 195-70, 65 FR 75378, December 1, 2000 Date: 12-5-2012 Advisory Bulletin ADB-2012-10, Using Meaningful Metrics in Conducting Integrity Management Program Evaluations PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipelines of their responsibilities, under Federal integrity management regulations, to perform evaluations of their integrity management programs using meaningful metrics. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Program Evaluation. Part 195 Appendix C. V. Methods to measure performance PHMSA Hazardous Liquid Integrity Management FAQs: 5.6 Can the operator use risk assessment data to defend longer intervals between integrity assessments? 8.13 How is an operator to monitor the effectiveness of its integrity management §195.452(f)(7) 71#

Attachment 1, passage 73Guidance Information Examples of a Probable Violation or program? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 1. The individual paragraphs in §195.452(f) identify the program elements that must be included in an operator’s IM program. 2. §195.452(f)(7) states that operators are required to identify methods to measure program effectiveness. This paragraph also references §195.452(k) for more specific requirements for the program evaluation element. Thus, generally, if an operator fails to develop a process to evaluate its IM program effectiveness, the operator should be cited under §195.452(f)(7). If an operator has developed a program to evaluate the effectiveness of its IM Program, but it has omissions, deficiencies, or other problematic features, these should generally be cited under §195.452(k). 3. §195.452(k) doesn’t provide much additional guidance. However, it refers to Appendix C which discusses the need to develop performance measures and provides some guidance to follow in selecting performance measures. Much of this portion of Appendix C is adapted or taken directly from API- 1160. If there are inadequacies or deficiencies in the operator’s selection and use of performance measures, these should generally be cited under §195.452(k) since this code section is more directly linked to the performance measures topic. Appendix C should not be identified as a primary citation in enforcement letters because it is considered to be guidance as opposed to a formal requirement. Selected Final Orders Referencing §195.452(f)(7): 1. Tesoro, [5-2004-5033, Item 7], July 9. 2009. The operator had neither a clearly defined process for applying performance metrics to evaluate the effectiveness of its IMP, nor a process for distribution and review of its evaluation results. 2. Rocky Mountain Pipeline, [5-2004-5001, Item 8], December 11, 2006. The operator did not define the process of applying performance metrics to evaluate program effectiveness of its IM Program. 3. Cenex Pipeline LLC, [5-2004-5023, Item 8], March 3, 2006. The operator failed to adequately describe its process for applying performance metrics in its IM Program to evaluate program effectiveness, as it relates to identifying the type and frequency of audits to be performed, developing a process for communicating goals and results of the IM Program to managers and others in the organization, and developing a process for analyzing actual events, (e.g., near misses) as well as incorporating lessons learned. 1. Failure to include a process to measure the program’s effectiveness in the IM Program. 2. Failure to include the use of periodic self-assessments, internal and/or external §195.452(f)(7) 72#

Attachment 1, passage 74Inadequate Procedures Examples of Evidence audits, management reviews, or other evaluations to measure program effectiveness. 3. Failure to include a clear description of the scope, objectives, and frequency of the program effectiveness evaluations. 4. Failure to specify assignment of responsibility for implementation of the required actions. 5. Failure to provide feedback to corrective action programs, preventive and mitigative measures decisions and the threat and risk analysis processes. 6. Failure to assure management awareness of IM Program effectiveness. 7. Failure to include provision for review and follow-up of program effectiveness evaluation results, findings and recommendations by appropriate company management 8. Failure to specify metrics that evaluate IM Program effectiveness. This includes overall performance metrics such as the number of failures, volume spilled, etc.; metrics that reflect accomplishments of the program’s objectives such as number of miles assessed, number of repairs, etc.; and threat-specific metrics. 9. Failure to specify the collection of performance metric data at a frequency that will provide timely information. 10. Process did not include activity, deterioration, or failure metrics as described in Part 195 Appendix C. 11. Process did not require trending of equipment or material failures. 12. Process did not require periodic review and updating of performance metrics as systems or environmental conditions change. 13. Failure to include performance goals, including segment-specific issues, in the process. 14. Failure to specify performance metrics for segment-specific issues or problems. 15. Failure to include provisions for periodic review and revision (if needed) of performance goals. 16. Failure to include provisions to compare the leak, failure, and incident data to the operator’s risk model results and use these comparisons to modify the risk model (if necessary). 1. Operator’s Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the program evaluation process. 2. Internal or external IM program audit reports. 3. Documented conversations with operator or contractor personnel that identify inconsistencies or deficiencies regarding the program evaluation process. 4. Operator records. §195.452(f)(7) 73#

Attachment 1, passage 75Other Special Notations §195.452(f)(7) 74 Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(f)(8) Pipeline integrity management in high consequence areas. (f) What are the elements of an integrity management program? An integrity management program begins with the initial framework. An operator must continually change the program to reflect operating experience, conclusions drawn from results of the integrity assessments, and other maintenance and surveillance data, and evaluation of consequences of a failure on the high consequence area. An operator must include, at minimum, each of the following elements in its written integrity management program: ……. (8) A process for review of integrity assessment results and information analysis by a person qualified to evaluate the results and information (see paragraph (h)(2) of this section). 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review. PHMSA Hazardous Liquid Integrity Management FAQs: 7.1 Do the anomaly repair schedule requirements in 195.452 (h) apply to ALL previous internal inspection runs performed by the operator, or just the integrity assessments required by 195.452 (i.e., the baseline assessment and subsequent integrity assessments)? 7.2 How soon must the results of pipeline integrity assessment be evaluated? §195.452(f)(8) 75#

Attachment 1, passage 767.3 What constitutes 'discovery of a condition'? 7.17 What does "general corrosion" mean in the context of the 180-day repair criterion in 195.452(h)(4)(iii)(E)? 7.18 How do the "burst pressure" that defines an immediate repair condition {452(h)(4)(i)(B)} and the "operating pressure" that defines a 180-day repair condition {452(h)(4)(iii)(D)} differ? 7.19 Should tool tolerances be considered when determining if a detected anomaly meets repair criteria? 7.21 Must anomalies identified during pig runs not considered "baseline" or "re- assessments" under the rule be repaired in accordance with the rule's repair criteria? 8.6 What is an Integrity Management Program? 8.16 The rule requires that the review of integrity assessment results and information analysis (i.e., risk analysis) be performed by a person qualified to evaluate the results and information. Are these covered tasks under Operator Qualification requirements? If not, how are operators expected to demonstrate that they have satisfied this requirement? Guidance Information 1. §195.452(f)(8) requires that operators have a process for the review of integrity assessment results and information analysis by person(s) qualified to evaluate the results and information. §195.452(h)(2) is referenced as providing more specifics on the review of integrity assessment results. 2. In general, if an operator does not have a process for the review of integrity assessment results (e.g., SMART pig runs), §195.452(f)(8) should be cited. If an operator has a process for review of integrity assessment results, but it has deficiencies or inadequacies, §195.452(h)(2) should be cited. Examples of deficiencies falling under §195.452(h)(2) might be failing to integrate other information about the integrity of the line in reviewing in-line inspection results, or not considering tool tolerances in identifying anomalies for remedial action. 3. PHMSA has not established requirements for the individuals who review integrity assessment or information (risk) analysis results. These activities are not covered tasks as defined by the Operator Qualification requirements. As set out in FAQ 8.16, PHMSA expects operators to describe the relevant experience, training, and other qualifications of the personnel performing this work. As part of their IM Program, operators should also describe their provisions for assuring that individuals performing this work have the necessary technical expertise and experience. 4. Although reviewing integrity assessment results and information analysis is not covered by the Operator Qualification requirements, PHMSA expects an operator to use a similar means to assure individuals performing these activities are qualified, such as: a. Job descriptions, task analyses, or other means to identify the qualification requirements for performing reviews of assessment results and information analysis, that address education, experience, skills, and training requirements, as appropriate. §195.452(f)(8) 76#

Attachment 1, passage 77Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations b. Documentation of existing personnel skills, education, training, and experience that (1) demonstrates the individual's qualification and proficiency, and (2) identifies additional qualification needs for those individuals that do not meet all qualification requirements. c. Plan and schedule to provide additional training or skills acquisition to achieve and maintain qualification requirements, as applicable. Selected Final Orders Referencing §195.452(f)(8): 1. Cenex Pipeline [5-2004-5023, Item 3a], March 3, 2006. The IM program does not contain any process description, nor reference any procedures, for performing reviews of integrity assessment results. 2. Rocky Mountain Pipeline, [5-2004-5001, Item 3a], December 11, 2006. The IM Program does not contain any process description, nor reference any procedures for performing reviews of integrity assessment results. 1. Failure to develop a process for the review of integrity assessment results and information (risk) analysis results. 2. Failure to adequately specify the qualification requirements for operator and vendor personnel who review and evaluate in-line inspection results 3. Failure to conduct reviews of integrity assessment results and information/risk analysis by a person qualified to do so. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an absence of a process for reviewing integrity assessment and information analysis results by a qualified person. 2. Integrity Management Framework 3. Documented conversations with operator or contractor personnel that verify that a process for reviewing integrity assessment and/or information analysis results was not developed. 4. Personnel training and other qualification documentation. §195.452(f)(8) 77#

Attachment 1, passage 78Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(g) Pipeline integrity management in high consequence areas. (g) What is an information analysis? In periodically evaluating the integrity of each pipeline segment (paragraph (j) of this section), an operator must analyze all available information about the integrity of the entire pipeline and the consequences of a failure. This information includes: (1) Information critical to determining the potential for, and preventing, damage due to excavation, including current and planned damage prevention activities, and development or planned development along the pipeline segment; (2) Data gathered through the integrity assessment required under this section; (3) Data gathered in conjunction with other inspections, tests, surveillance and patrols required by this Part, including, corrosion control monitoring and cathodic protection surveys; and (4) Information about how a failure would affect the high consequence area, such as location of the water intake. 195-70, 65 FR 75378, December 1, 2000 Date: 5-7-2012 Advisory Bulletin ADB-2012-06, Verification of Records PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities to verify their records relating to operating specifications for maximum allowable operating pressure (MAOP) required by 49 CFR 192.517 and maximum operating pressure (MOP) required by 49 CFR 195.310. This Advisory Bulletin informs gas operators of anticipated changes in annual reporting requirements to document the confirmation of MAOP, how they will be required to report total mileage and mileage with adequate records, when they must report, and what PHMSA considers an adequate record. In addition, this Advisory Bulletin informs hazardous liquid operators of adequate records for the confirmation of MOP. Date: 9-1-2011 §195.452(g) 78#

Attachment 1, passage 79Advisory Bulletin ADB-11-05, Potential for Damage to Pipeline Facilities Caused by the Passage of Hurricanes. PHMSA is issuing this advisory bulletin to remind owners and operators of gas and hazardous liquid pipelines of the potential for damage to pipeline facilities caused by the passage of Hurricanes. Date: 7-27-2011 Advisory Bulletin ADB-11-04, Potential for Damage to Pipeline Facilities Caused by Flooding. PHMSA is issuing this advisory bulletin to all owners and operators of gas and hazardous liquid pipelines to communicate the potential for damage to pipeline facilities caused by severe flooding. This advisory includes actions that operators should consider taking to ensure the integrity of pipelines in case of flooding. Date: 1-6-2011 Advisory Bulletin ADB-11-01, Establishing Maximum Allowable Operating Pressure or Maximum Operating Pressure Using Record Evidence, and Integrity Management Risk Identification, Assessment, Prevention, and Mitigation. PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities of their responsibilities, under Federal integrity management (IM) regulations, to perform detailed threat and risk analyses that integrate accurate data and information from their entire pipeline system, especially when calculating Maximum Allowable Operating Pressure (MAOP) or Maximum Operating Pressure (MOP), and to utilize these risk analyses in the identification of appropriate assessment methods, and preventive and mitigative measures. Date: 3-24-2010 Advisory Bulletin ADB-10-03, Girth Weld Quality Issues Due to Improper Transitioning, Misalignment, and Welding Practices of Large Diameter Line Pipe. PHMSA is issuing an advisory bulletin to notify owners and operators of recently constructed large diameter natural gas pipeline and hazardous liquid pipeline systems of the potential for girth weld failures due to welding quality issues. Misalignment during welding of large diameter line pipe may cause in-service leaks and ruptures at pressures well below 72 percent specified minimum yield strength (SMYS). PHMSA has reviewed several recent projects constructed in 2008 and 2009 with 20-inch or greater diameter, grade X70 and higher line pipe. Metallurgical testing results of failed girth welds in pipe wall thickness transitions have found pipe segments with line pipe weld misalignment, improper bevel and wall thickness transitions, and other improper welding practices that occurred during construction. A number of the failures were located in pipeline segments with concentrated external loading due to support and backfill issues. Owners and operators of recently constructed large diameter pipelines should evaluate these lines for potential girth weld failures due to misalignment and other issues by reviewing construction and operating records and conducting engineering reviews as necessary. §195.452(g) 79#

Attachment 1, passage 80Date: 9-30-2009 Advisory Bulletin ADB-09-02, Weldable Compression Coupling Installation. The Pipeline and Hazardous Materials Safety Administration (PHMSA) reminds pipeline owners and operators of the importance of installing weldable compression couplings in accordance with manufacturer procedures and following appropriate safety and start-up procedures. The failure to install weldable compression couplings correctly, or the failure to implement and follow appropriate safety and start-up procedures, could result in a catastrophic pipeline failure. PHMSA strongly urges operators to review, and incorporate where appropriate into operators' written procedures, the manufacturer's installation procedures and take any other necessary safety measures for safe and reliable operation of pipeline systems. Date: 5-21-2009 Advisory Bulletin ADB-09-01, Potential Low and Variable Yield and Tensile Strength and Chemical Composition Properties in High Strength Line Pipe. PHMSA is issuing an advisory bulletin to owners and operators of natural gas pipeline and hazardous liquid pipeline systems. This bulletin advises pipeline system owners and operators of the potential for high grade line pipe installed on projects to exhibit inconsistent chemical and mechanical properties. Yield strength and tensile strength properties that do not meet the line pipe specification minimums have been reported. This advisory bulletin pertains to microalloyed high strength line pipe grades, generally Grade X-70 and above. PHMSA recently reviewed metallurgical testing results from several recent projects indicating pipe joints produced from plate or coil from the same heat may exhibit variable chemical and mechanical properties by as much as 15% lower than the strength values specified by the pipe manufacturer. Date: 11-24-2008 Advisory Bulletin ADB-08-08, Proper Identification of Internal Corrosion Risk. This advisory bulletin reminds operators of their responsibilities under 49 CFR 195.579(a) and 49 CFR 195.589(c) with respect to the identification of circumstances under which the potential for internal corrosion must be investigated. Date: 11-05-2003 Advisory Bulletin ADB-03-06, Corrosion Threat to Newly Constructed Gas Transmission and Hazardous Liquid Pipelines. RSPA's Office of Pipeline Safety (OPS) is issuing this advisory bulletin to owners and operators of natural gas and hazardous liquid pipelines to consider the threat from external corrosion during and immediately after construction of new steel pipelines or pipeline segments. Operators are strongly encouraged to determine whether new pipelines are susceptible to interference and damage from stray electrical currents. Operators should carefully monitor and take action to mitigate any detrimental effects. Date: 10-01-2003 Advisory Bulletin ADB-03-05, Stress Corrosion Cracking (SCC) Threat to Gas and Hazardous Liquid Pipelines. §195.452(g) 80#

Attachment 1, passage 81RSPA's Office of Pipeline Safety (OPS) is issuing this advisory notice to owners and operators of gas and hazardous liquid pipelines to consider the threat from stress corrosion cracking (SCC) when developing and implementing Integrity Management Plans. Operators should determine whether their pipelines are susceptible to SCC and assess the impact of SCC on pipeline integrity. Based on this evaluation, an operator should prioritize application of additional in-line inspection and hydrostatic testing and take actions to remediate problem areas. Date: 11-12-1997 Advisory Bulletin ADB-97-05, Potential Failure of Check Valves Following Remanufacturing. RSPA is issuing an advisory bulletin to owners and operators of Hazardous Liquid and Natural Gas Pipelines. The bulletin advises the industry about potential failure of check valves following remanufacture. Date: 3-04-1997 Advisory Bulletin ADB-97-03, Potential Soil Subsidence on Pipeline Facilities. Heavy rainfall and flooding have increased the potential for damage to pipeline facilities. Several accidents have occurred on natural gas transmission facilities that appear to be related to the stress of soil movement on the facilities. Accordingly, the Department of Transportation's Pipeline and Hazardous Materials Safety Administration (PHMSA) is advising operators of pipeline facilities, regardless whether those facilities are regulated by PHMSA, of the need for caution associated with excessive flooding and soil movement. In particular, pipeline operators should conduct training, and patrol their rights-of-way to identify areas of potential soil subsidence that could adversely affect the safe operation of their pipelines. Additionally, emergency plans should be reviewed to assure they adequately address conditions possible in areas of soil subsidence. Date: 3/8/1989 Alert Notice ALN-89-01, Recent findings relative to factors contributing to operational failures of pipelines constructed with ERW prior to 1970. On January 28, 1988, OPS issued an Alert Notice advising pipeline operators who have pipe manufactured by ERW process of the occurrence of 12 hazardous liquid pipeline failures and of actions which operators may take to reduce the risks of similar failures. The continuing failure of ERW seams remains a matter of concern to RSPA. Since the issuance of that Alert Notice, RSPA has data on 8 additional hazardous liquid pipeline failures and 1 on a gas transmission pipeline involving pie seams manufactured prior to 1970 by the ERW process. Of the 8 additional hazardous liquid pipeline failures, 2 appear to be due to selective corrosion of the ERW seam. As stated in the 1988 Alert Notice (ALN-88-01), seams with selective corrosion occurring in an area of manufacturing defects may be particularly vulnerable to failure. However, the other failures appear to have resulted from flat growth of manufacturing defects in the ERW seam. Two of these failures resulted in some of the most significant spills (more than 20,000 bbls.) in recent years. Both of these failure involved pipelines which had not §195.452(g) 81#

Attachment 1, passage 82Other Reference Material & Source been hydrostatically tested in accordance with current standards. One of the failures occurred after the long-standing operating pressure had been increased a relatively short period of time before the failure. This increase in pressure clearly decreased the margin of safety between the operating pressure and highest pressure ever experienced during the life of the pipeline and contributed to the acceleration of the growth of a defect to failure. Date: 1-28-1988 Alert Notice ALN-88-01, Recent findings relative to factors contributing to operational failures of pipelines constructed with ERW prior to 1970. OPS has data on 12 hazardous liquid pipeline failures that occurred during 1986 and 1987 involving pipe seams manufactured prior to 1970 by the ERW process. The purpose of this notice is to advise pipeline operators who have such pipe in their systems of the data currently available to OPS and of actions which the operator may take to reduce the risk of failure. These recent failures have caused OPS to reevaluate the safety of continued operation of all pre-1970 ERW pipelines. This reevaluation has included more definitive metallurgical examinations of failed ERW seams. Of particular significance to the OPS evaluation of ERW pipe is the failure of an 8-inch diameter pipeline in Mounds View, Minnesota. The Mounds View pipeline carrying gasoline which failed at 1434 psig had been hydrostatically pressure tested to 1900 psig just 2 years prior to this accident. An independent failure analysis conducted by Battelle Columbus Laboratories concluded that the cause of the Mounds View failure was selective corrosion in the ERW seam in an area of inadequate cathodic protection. Similar metallurgical tests have identified at least 2 other recent failures where selective corrosion of the ERW seam in an area characterized by coating disbondment and inadequate cathodic protection contributed to the cause of the failure. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Risk Analysis. Part 195, Appendix C.I. Identifying a high consequence area and factors for considering a pipeline segment’s potential impact on a high consequence area. Part 195, Appendix C.II. Risk factors for establishing frequency of assessment. Part 195, Appendix C.III. Safety risk indicator tables for leak history, volume or line size, age of pipeline, and product transported. Stress Corrosion Cracking Study, Michael Baker Jr., January 2005. Dent Study, Michael Baker Jr., November 2004. Pipe Wrinkle Study, Michael Baker Jr., October 2004. Low Frequency ERW and Lap Welded Longitudinal Seam Evaluation, Michael Baker Jr., April 2004, Rev. 3. Pipe Wrinkle Integrity Determination, Michael Baker Jr., May 2003. §195.452(g) 82#

Attachment 1, passage 83Oil Pipeline Characteristics and Risk Factors: Illustrations from the Decade of Construction, Kiefner and Trench, December 2001. PHMSA Hazardous Liquid Integrity Management FAQs: 2.1 Does the rule apply to more than line pipe? 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? 4.9 Will operators need to seek waivers from PHMSA Pipeline Safety in order to change assessment schedules after the initial Baseline Assessment Plan has been developed? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 6.3 Are there different requirements for inspection of overhead suspension pipeline bridges? 8.5 What is a framework 8.6 What is an Integrity Management Program? 8.11 What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? 8.14 Will operators be expected to consider external conditions such as earthquake fault lines or mining subsidence in their integrity management program? Will these be classified as HCAs or require special repair provisions? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 8.16 The rule requires that the review of integrity assessment results and information analysis (i.e., risk analysis) be performed by a person qualified to evaluate the results and information. Are these covered tasks under Operator Qualification requirements? If not, how are operators expected to demonstrate that they have satisfied this requirement? 8.18 Can operators include potential business consequences (e.g., curtailments, plant shutdown) in its risk determinations? 8.19 What type of risk analysis process would PHMSA Pipeline Safety prefer, quantitative or qualitative? 9.9 How long after completing the baseline assessment for a segment does an operator have to conduct a risk analysis and determine whether additional preventive or mitigative actions are needed (including the need for EFRDs and leak detection system enhancements)? If an operator determines that additional actions are warranted, how long does it have to implement them? 9.10 How do operators assess and control risk caused by third-parties over which they have no direct control? §195.452(g) 83#

Attachment 1, passage 84Guidance Information 1. Operators are required to develop an analysis that integrates all available information about the integrity of the entire pipeline and the consequences of failure. This analysis is typically referred to as a risk analysis or an information analysis. §195.452(f)(3) establishes that this analysis is a required IM Program element. §195.452(g) specifies the minimum information that must be considered in the information/risk analysis. 2. Generally if an operator does not have an analysis that integrates all information about pipeline integrity and the consequences of failure (i.e., a risk analysis), then §195.452(f)(3) should be cited. 3. However, if an operator has an information/risk analysis, but it does not consider the information listed in §195.452(g), or has other deficiencies or inadequacies, then §195.452(g) should be cited. 4. §195.452(g) requires that an operator must “analyze all available information about the integrity of the entire pipeline.” Thus if an operator fails to consider some available information relevant to pipeline integrity or the consequences of failure in its information/risk analysis, §195.452(g) should generally be cited. The rule also requires the consideration of all available information about the integrity of the entire pipeline (not just the segments that can affect HCAs). This includes applying data from other inspections, tests, surveillance and patrols required by Part 195, including, corrosion control monitoring and cathodic protection surveys for portions of the pipeline that cannot affect HCAs. 5. §195.452(g) should be cited for deficiencies or inadequacies in the information/risk analysis methodology itself. For example, an operator used a risk model that relied upon industry average weighting factors and did not customize the model for its own pipeline systems, the inadequacy or deficiency should be cited as §195.452(g). 6. §195.452(j)(2) and §195.452(j)(3) both require the use of the information analysis in the periodic evaluation of integrity and the determination of reassessment intervals, respectively. If there are deficiencies or inadequacies in the application of the information/risk analysis to the periodic evaluation and/or the assessment interval determination, then §195.452(j)(2) and/or §195.452(j)(3) should be cited and not §195.452(g). 7. §195.452(i) also requires a risk analysis in determining additional preventive and mitigative measures. Although §195.452(i) does not explicitly refer to §195.452(f)(3) or §195.452(g), it states that the “operator must evaluate the likelihood of a pipeline release occurring and how a release could affect a high consequence area.” This is essentially the same language as used in §195.452(f)(3). Practically most operators have one risk analysis approach that is applied to all risk-related requirements in the rule including the preventive and mitigative measures requirements, and the continual evaluation and assessment requirements. Selected Final Orders Referencing §195.452(g): 1. Kinder Morgan, [1-2004-5004, Item 5], June 26, 2006. Operator failed to use available pipeline data as inputs in its information analysis including basic information on seam design, block valve rating, maximum expected discharge §195.452(g) 84#

Attachment 1, passage 85Examples of a Probable Violation or Inadequate Procedures pressure and internal corrosion inhibitor. 2. ConocoPhilips, [3-2004-5013, Items 5A – 5C], August 29, 2005. The information analysis process needs to be expanded to provide for the timely use of the Assessment Plan History and Planning Document. This document has been developed to capture data from the information analysis; however, the rate at which these documents were being generated, lagged the rate at which actual assessments were being completed. There was no formal approach to assure input information is current prior to running the risk analysis. The previous data obtained from prior ILI tools was not being used as required for input to the risk model or as validation of the risk results. A formal, documented methodology should be developed that provides a logical structure for conducting Subject Matter Expert evaluations. 3. Alon, USA, [5-2004-5021, Item 4a], August 6, 2009. Alon failed to establish an integrity assessment schedule that prioritized its pipeline segments for assessment on the basis of all risk factors and by failing to analyze all available information about the integrity of its entire pipeline system and the consequences of a failure. Specifically, the operator presented the OPS inspection team with a draft risk assessment method that had been copied verbatim from a textbook. The notice also alleged that the company provided the inspection team with a risk-factor form (a document that it planned to use to collect information on its pipeline system) that was inconsistent with its draft risk assessment methodology. Finally, the operator could not demonstrate how it planned to use any of the data gathered from the risk factor form in its IMP. 4. Chevron USA, Inc., [4-2006-7005, Item 2], February 6, 2007. The operator has not documented in sufficient detail the data integration and information analysis processes performed by the Facility Engineer to support evaluation of the condition of the pipeline, or to make decisions related to the repair or remediation of pipeline defects. 1. Failure to adequately consider the information identified in paragraphs §195.452(g)(1) through §195.452(g)(4) in the information/risk analysis. 2. Failure to include integrity information about the entire pipeline in analyzing the risks of segments that could affect HCAs, including information on inspections, surveillance, and patrols. 3. Failure to adequately consider all relevant threats to pipeline integrity in the risk analysis, such as: external and internal corrosion, stress corrosion cracking, materials problems, third party damage, operator or procedures errors, equipment failures, natural forces damage, and construction errors. 4. Failure to adequately consider the likelihood and/or consequences of pipeline failures in the information/risk analysis. 5. Local knowledge and field input was not incorporated in the information/risk analysis 6. Failure to demonstrate that the most accurate available data was used to represent pipeline characteristics in the analysis of different segments, including the results of integrity assessments. §195.452(g) 85#

Attachment 1, passage 867. Failure to demonstrate that the sources used to provide any subjective information are the best available (e.g., from operator personnel, including field units). 8. Failure to demonstrate utilization of a sufficiently structured process for obtaining subjective information (e.g., using forms, surveys, interviews, quality checks, etc.) to ensure that consistent information is provided for different segments. 9. Failure to demonstrate that guidance to minimize the use of input information that is unnecessarily or excessively conservative (to avoid masking best- estimate risk insights) was applied. 10. Failure to demonstrate that controls to provide assurance of the completeness and accuracy of input information were applied. 11. Records demonstrate that general or default values were inappropriately used where data was not collected. 12. Failure to demonstrate that documented plan was implemented to acquire unknown data, or improve the quality of its data. 13. Use of poor quality data in the information/risk analysis due to inadequate recordkeeping or inadequate data collection. (e.g., a disproportionate amount of risk analysis data is described as unknown.) 14. Inadequate collection or use of operating experience data (leak history and other operator-specific experience relating to specific risk factors; relevant industry experience) in the information/risk analysis. 15. The anticipated effect(s) of existing mitigative measures were overestimated, exaggerated, or otherwise evaluated improperly. 16. For operators using Subject Matter Expert-based approaches, failure to establish explicit guidelines and formality to support the use of SMEs in the information/risk analysis. 17. Failure to adequately consider segment-specific, unique risk factors when using a "standard" risk model. 18. Failure to adequately consider the consequences to multiple HCAs when a pipeline segment could affect more than one HCA. 19. Failure to adequately validate or justify the risk weighting factors used in the risk model or analysis. 20. Failure to adequately weight health and safety factors relative to other consequence factors in the information/risk analysis. 21. Use of an information/risk analysis method that produces inappropriately skewed results. 22. Failure to adequately consider the risks due to low-frequency ERW pipe. 23. Failure to adequately integrate the results from the analysis of how pipeline failures could affect high-consequence areas from the segment identification. 24. Failure to adequately consider the risks associated with alternate modes of pipeline operation that could be expected (e.g., startup, shutdown, shut-in, slack line, pressure cycling, etc.). 25. Information/risk analysis results are averaged over many segments such that segment-specific risks are obscured. 26. Failure to appropriately consider uncertainties in the information/risk analysis. 27. Failure to adequately address risks of pipeline facilities (e.g., pump stations, §195.452(g) 86#

Attachment 1, passage 87Examples of Evidence Other Special Notations tanks). 28. Failure to follow the operator’s own documented information/risk analysis methodology. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the information used in the information/risk analysis, or in the information/risk analysis methodology. 2. Baseline Assessment Plan, or on-going reassessment plan that shows omissions or deficiencies in the information used in the information/risk analysis, or in the information/risk analysis methodology. 3. Documentation of the Continual Evaluation Process that shows omissions or deficiencies in the information used in the information/risk analysis, or in the information/risk analysis methodology. 4. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used in the information/risk analysis, the risk model, or in the information/risk analysis methodology. This applies to the information/risk analysis used for line pipe as well as the approach used for pipeline facilities. 5. Information/risk analysis description or risk model documentation including the risk factors and information considered, the risk algorithm, and their weighting factors (if appropriate). This applies to the information/risk analysis used for line pipe as well as the approach used for pipeline facilities. 6. Records indicating that the information/risk analysis procedures were not followed. 7. Records demonstrating a deficiency or inadequacy in the risk analysis, risk model, and/or the information used in the information/risk analysis. §195.452(g) 87#

Attachment 1, passage 88Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(h)(1) Pipeline integrity management in high consequence areas. (h) What actions must an operator take to address integrity issues? (1) General requirements. An operator must take prompt action to address all anomalous conditions the operator discovers through the integrity assessment or information analysis. In addressing all conditions, an operator must evaluate all anomalous conditions and remediate those that could reduce a pipeline's integrity. An operator must be able to demonstrate that the remediation of the condition will ensure the condition is unlikely to pose a threat to the long-term integrity of the pipeline. An operator must comply with §195.422 when making a repair. (i) Temporary pressure reduction. An operator must notify PHMSA, in accordance with paragraph (m) of this section, if the operator cannot meet the schedule for evaluation and remediation required under paragraph (h)(3) of this section and cannot provide safety through a temporary reduction in operating pressure. (ii) Long-term pressure reduction. When a pressure reduction exceeds 365 days, the operator must notify PHMSA in accordance with paragraph (m) of this section and explain the reasons for the delay. An operator must also take further remedial action to ensure the safety of the pipeline. 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 §195.452(h)(1) 88#

Attachment 1, passage 89Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review and Remedial Action Part 195 Appendix C.VII. Conditions that may impair a pipeline’s integrity. PHMSA Hazardous Liquid Integrity Management FAQs: 7.1 Do the anomaly repair schedule requirements in 195.452 (h) apply to ALL previous internal inspection runs performed by the operator, or just the integrity assessments required by 195.452 (i.e., the baseline assessment and subsequent integrity assessments)? 7.2 How soon must the results of pipeline integrity assessment be evaluated? 7.7 Are there other anomalies that an operator is required to address? 7.14 If a segment that can affect an HCA is relatively short (e.g., only 2 miles in length), yet the operator internally inspects a longer portion around this segment (e.g., 50 miles from pig launcher to receiver), do the repair schedules in 195.452 (h) apply to the segment that can affect the HCA or the entire distance over which the pig is run? 7.15 The rule requires that an operator temporarily reduce pressure if an immediate repair condition is discovered (195.452(h)(4)(i)). With respect to this requirement: a. Can the temporary reduction in operating pressure be based upon previous maximum operating pressures? b. Can the temporary reduction in operating pressure be based on calculations other than those defined in section 451.6.2.2 (b) of ASME/ANSI B31.4? c. Is section 451.6.2.2 (b) of ASME/ANSI B31.4 applicable for calculating the temporary pressure reduction required for top-side dents with metal loss (195.452(h)(4)(i)(C)) and dents greater than 6% of the pipe diameter (195.452(h)(4)(i)(D))? 7.20 Is a 20 percent reduction in pressure an adequate interim measure for immediate repair conditions? 7.21 Must anomalies identified during pig runs not considered "baseline" or "re- assessments" under the rule be repaired in accordance with the rule's repair criteria? 7.22 Section 195.452(h)(4)(i) requires that I temporarily reduce pressure in response to an immediate repair condition. The same paragraph also requires that I must calculate the reduction using the formula in section 451.6.2.2 (b) of ASME/ANSI B31.4. If using that formula results in a calculated safe pressure that is higher than my original operating pressure, must I still reduce pressure? To what? 7.23 Must pipe for which the maximum operating pressure has previously been reduced (e.g., to preclude the need for pressure testing in accordance with 195.302(b)(1)) be repaired or retested to restore its original, higher maximum operating pressure? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 12.6 Will PHMSA Pipeline Safety review operator notifications and formally §195.452(h)(1) 89 respond to the operator? Will PHMSA Pipeline Safety communicate responses to specific company notifications to the broader industry? 12.7 How will an operator know if PHMSA Pipeline Safety objects to its#

Attachment 1, passage 90Guidance Information 1. Operators are required to develop criteria for remedial actions to address integrity issues under §195.452(f)(4). For more information on this required element, see the enforcement guidance material associated with §195.452(f)(4). 2. §195.452(f)(4) also refers to §195.452(h) which provides more specific requirements for this program element. §195.452(h)(1) provides general statements that an operator must take prompt action to address anomalous conditions identified through integrity assessments or the information/risk analysis. It also requires that an operator must evaluate all anomalous conditions and remediate those that could reduce pipeline integrity. 3. In addition, §195.452(h)(1)states that an operator must be able to demonstrate that the remediation of the condition will ensure that the condition does not pose a threat to the long-term integrity of the pipeline. This requires that the operator use industry-accepted repair methods for the condition being remediated. 4. §195.452(h)(1) also contains two subparagraphs related to pressure reduction notification. §195.452(h)(1)(i) requires operators to notify PHMSA if the operator cannot meet the repair schedule and cannot provide safety through a temporary pressure reduction. §195.452(h)(1)(ii) requires operators to notify PHMSA if a pressure reduction exceeds 365 days, explain the reason for the delay, and take further action to ensure the safety of the pipeline. 5. In general, if an operator fails to properly identify and repair specific anomalies within the time frames established for those anomalies, §195.452(h)(3) or perhaps one of the subparagraphs of §195.452(h)(4) should be cited rather than §195.452(h)(1). 6. Section §195.452(h)(1) should be cited for: (a) not taking prompt action to address all anomalous conditions found by integrity assessments or information analysis that could be detrimental to the integrity of the pipeline. This applies to more than just the anomalies that meet the immediate, 60 day, and 180 day repair criteria of §195.452(h)(4), (b) not taking a temporary pressure reduction when schedules cannot be met, (c) not notifying PHMSA when schedules cannot be met and a temporary pressure reduction cannot be taken, (d) not notifying PHMSA when a pressure reduction exceeds 365 days, (e) not taking additional remedial actions when a pressure reduction exceeds 365 days, and (f) using a repair method that the operator could not demonstrate would ensure the condition is unlikely to threaten long-term integrity. 7. An operator may have to submit a Safety Related Condition Report under §195.55(a). §195.55(a)(6) requires an SRCR when: "Any safety-related condition that could lead to an imminent hazard and causes (either directly or indirectly by remedial action of the operator), for purposes other than abandonment, a 20 percent or more reduction in operating pressure or shutdown of operation of the pipeline". This requirement applies both to anomalies in segments that could affect HCAs as well as anomalies outside these areas that are discovered by integrity assessments. Anomalies in areas §195.452(h)(1) 90#

Attachment 1, passage 91Examples of a Probable Violation or Inadequate Procedures that could not affect HCAs may still require a pressure reduction per §195.585. Selected Final Orders Referencing §195.452(h)(1). 1. Tesoro – High Plains Pipeline Company, [5-2007-5027, Item 2a], June 17, 2010. The operator failed to take prompt action to address all anomalous conditions discovered through its integrity assessment or information analysis. In particular, the Notice alleges that Tesoro did not include some of the repair records from the inline inspection (ILI) assessment of its 1.5 mile pipeline between Sand Island and the Shell Terminal in the documentation provided to the inspection team. The operator had to reevaluate all of the undocumented repair anomalies on that particular pipeline segment. 2. Tesoro – High Plains Pipeline Company, [5-2007-5027, Item 2b], June 17, 2010. Operator failed to take prompt action to address another anomalous condition discovered through its integrity assessment or information analysis. In particular, a dig site repair report indicated that SCC was present near a girth weld and the operator failed to perform further evaluations and remediation at the dig site. The operator also had failed to implement a SCC susceptibility program. 3. Tesoro Refining and Marketing, [5-2007-5031, Item 3a], December 28, 2009. The operator failed to temporarily reduce pressure or notify PHMSA when a scheduled 60 day repair was not completed on time. 1. Failure to take prompt action to address all of the anomalous conditions found through the integrity assessment or information analysis. 2. Failure to take a temporary pressure reduction when a schedule for evaluation and remediation could not be met. 3. Failure to take additional remedial actions when an evaluation and remediation schedule could not be met and a temporary pressure reduction could not be taken. 4. Failure to notify PHMSA when an evaluation and remediation schedule could not be met and a temporary pressure reduction could not be taken. 5. Failure to take additional remedial actions when a pressure reduction exceeded 365 days. 6. Failure to notify PHMSA when a pressure reduction exceeded 365 days. 7. Failure to use an appropriate repair method when remediating a condition. §195.452(h)(1) 91#

Attachment 1, passage 92Examples of Evidence 1. Documentation that shows the anomalous conditions identified by the operator for remediation, the repair methods used, and the repair schedule/completion dates. (e.g., pipeline excavation reports) 2. Documentation that shows operating pressure history of the affected pipeline segment. 3. Documentation that shows omissions or deficiencies in the information used in making decisions in regards to anomalous conditions that require remediation. 4. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used to make decisions regarding anomalous conditions that require remediation, or the actions taken to remediate anomalies. 5. Documentation that shows deficiencies in the additional remedial action taken by the operator when a schedule could not be met and a temporary pressure reduction could not be taken. 6. Documentation that shows deficiencies in the additional remedial action taken by the operator when a pressure reduction exceeds 365 days. 7. Documentation that shows PHMSA was not notified when schedules could not be met and temporary pressure reductions could not be made or pressure reductions exceeded 365 days. 8. Repair records that do not demonstrate the repair method to remediate a condition would ensure long-term integrity. Other Special Notations §195.452(h)(1) 92#

Attachment 1, passage 93Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(h)(2) Pipeline integrity management in high consequence areas. (h) What actions must an operator take to address integrity issues? (2) Discovery of condition. Discovery of a condition occurs when an operator has adequate information about the condition to determine that the condition presents a potential threat to the integrity of the pipeline. An operator must promptly, but no later than 180 days after an integrity assessment, obtain sufficient information about a condition to make that determination, unless the operator can demonstrate that the 180-day period is impracticable. 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review. Part 195 Appendix C.VII. Conditions that may impair a pipeline’s integrity. Federal Register / Vol. 67, No. 9 / Monday, January 14, 2002 / Rules and Regulations at Page 1653. Final Order, CPF 3-2005-5030, Amoco Oil Co, 4-26-2006. PHMSA Hazardous Liquids FAQs: 4.13 For purposes of meeting the deadlines for completing baseline assessments, is the date of the assessment considered to be the day when the tool run is §195.452(h)(2) 93#

Attachment 1, passage 94complete, when the preliminary data is received, or when the evaluation of the in-line inspection results is complete? 6.6 If an operator elects to use in-line inspection for satisfying its baseline assessment requirements, must a metal loss “smart” pig and a deformation tool both be run? If so, must these both be run at the same time, or can these runs be made at significantly different times? 6.27 What timeframes apply to "discovery" of conditions presenting a potential threat to the integrity of a pipeline when using Direct Assessment? 7.3 What constitutes "discovery of a condition'? 7.10 What is the minimum deformation that constitutes a “dent”? 7.19 Should tool tolerances be considered when determining if a detected anomaly meets repair criteria? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? Guidance Information 1. §195.452(f)(4) states that an operator must develop criteria for remedial actions to address integrity issues. This is one of the required IM Program elements. §195.452(h) provides more specific requirements for this program element. 2. §195.452(f)(8) requires that an operator have a process for the review of integrity assessment results and references §195.452(h)(2). 3. §195.452(h)(2) requires that an operator promptly, but no later than 180 days after completion of an assessment, obtain sufficient information about a condition to categorize the condition. Discovery is defined as when an operator has sufficient information about a condition to determine it is detrimental to the integrity of the pipeline. Sufficient information about a condition can be obtained: (1) when the vendor notifies the operator of a condition detrimental to the integrity of the pipeline; (2) when the operator receives a preliminary report from the vendor; (3) when the operator receives the final report from the vendor; or (4) when the operator performs a validation dig. Discovery of a condition should occur at the earliest opportunity. (See FAQ 7.3 and Federal Register/Vol. 67, No. 9/Monday, January 14, 2002/Rules and Regulations at Page 1653) 4. In general, if the operator’s process for review of assessment results has inadequacies or deficiencies, §195.452(f)(8) should be cited. If the operator’s use of their process for reviewing integrity assessment results is problematic, and anomalies that require remediation are not identified (or it is likely that such anomalies might not be identified), then §195.452(h)(2) should generally be cited. Examples of such issues might include: a. Failure to adequately consider ILI tool tolerances b. Inadequate or deficient ILI vendor specifications c. Inadequate or deficient methods to characterize anomalies from ILI data d. Failure to adequately integrate information from other sources (e.g., corrosion records) in reviewing ILI vendor reports. If one or more of the above programmatic deficiencies results in the failure to §195.452(h)(2) 94#

Attachment 1, passage 95classify an identified condition as a specific type of anomaly (e.g., an identified condition is not classified as an immediate repair condition because of failure to consider tool tolerances), then the operator should be cited under the specific sub-paragraph of §195.452(h)(4) appropriate for that type of condition(s). 5. Operators should require that vendors provide prompt (i.e., immediate) notification of all immediate repair conditions. 6. Discovery must occur within 180 days of completion of an assessment even when multiple ILI tool runs are made. For example, if geometry and MFL tools are run with considerable time spacing between tools, discovery of the conditions identified by the first tool must be within 180 days of the completion of the tool run. A lengthy time period between tool runs could result in a violation if, for example, a dent with metal loss is identified when the results of a geometry and MFL tool are overlaid and the discovery is in excess of 180 days from the completion of the first inspection. 7. FAQ 6.6 contains PHMSA's expectations on the time interval between successive ILI tool runs. It states " running the tools in close proximity allows the operator to readily identify potentially serious anomalies such as dents with metal loss". 8. The Final Order for CPF 3-2005-5030, Amoco Oil Co, April 26, 2006 stated that "Although PHMSA's predecessor agency, the Research and Special Programs Administration, stated in the preamble of the rule (Federal Register, Vol. 67, No. 9, January 14, 2002, Page 1653) that discovery is flexible and varies depending on circumstances, RSPA also stated that there is "an upper limit on the length of the discovery process. An operator must promptly obtain the information from an assessment to ensure that remediation of a condition which could threaten a pipeline's integrity occurs soon after an integrity assessment." Since identification of a dent with metal loss can be an immediate or 60 day repair condition, significant time between running deformation and geometry tools could be considered as exceeding the "upper limit on the length of the discovery process" for a dent with metal loss. Circumstances must be taken into consideration when determining if enforcement action needs to be taken. 9. If deformation tool results do not include orientation, then all dents in excess of 6% must be categorized (discovered) as top side dents and categorized as an immediate repair condition; all dents greater than 3% must be categorized as 60 day repair conditions; and all dents greater than 2% must be categorized as 180 day repair conditions. §195.452(h)(2) states that discovery of a condition occurs when an operator has adequate information to determine that a condition presents a potential threat to the integrity of the pipeline. Conditions determined to present an integrity threat to the pipeline are the immediate, 60 day, and 180 day repair conditions of §195.452(h)(4). To determine if a defect identified by a geometry tool meets any of the repair criteria, two pieces of data is needed. First, the depth of the anomaly, and second, the orientation of the anomaly. For example, if a dent is identified greater than 6% in depth without §195.452(h)(2) 95#

Attachment 1, passage 96orientation, it could be either an immediate repair condition, if located on the top of the pipe, or a 180 day repair condition, if located on the bottom of the pipe. Since orientation information is unavailable to accurately categorize the defect, the most conservative assumption must be made i.e., the defect is on the top of the pipe and is, therefore, an immediate repair condition 10. If deformation tool results do not include orientation, then all top side metal loss indications at the same axial position as a dent indication must be categorized (discovered) as an immediate repair condition regardless of depth. If the metal loss indication is on the bottom of the pipe with a dent at the same axial position, the indication must be categorized as a 60-day condition. Dents with metal loss, cracking, or stress risers can be either immediate repair conditions, if located on the top of the pipe, or 60 day repair conditions, if located on the bottom of the pipe. Metal loss would typically be identified by and MFL tool. Orientation of the metal loss would be provided by the tool. If a geometry tool provides depth but not orientation, than the most conservative assumption must be made for dents and metal loss defects at the same location i.e., they are immediate repair conditions for metal loss on the top of pipe and 60 day repair conditions for metal loss on the bottom of pipe. 11. There is no minimum depth of dent when categorizing a dent with metal loss. Any dent with metal loss must be treated as an immediate repair or 60 day condition. FAQ 7.10 states that a top side dent, regardless of depth, with metal loss, cracking, or a stress riser must be treated as an Immediate Repair condition. Likewise, any dent on the bottom of the pipe, regardless of depth, must be treated as a 60 day repair condition. 12. Tool tolerance should be considered when evaluating a condition. FAQ 7.19 states that an operator must take tool tolerance into consideration when categorizing defects. Selected Final Orders Referencing §195.452(h)(2): 1. Tesoro Refining and Marketing, [5-2007-5031, Item 2a], December 28, 2009. The operator failed to identify the correct date that it “discovered” an anomalous condition on its pipeline; even though the company had adequate information about the condition to determine that it presented a potential threat to the integrity of the pipeline. The operator should have deemed “discovery” of the conditions to have taken place upon receipt of the ILI vendor’s final reports for such pipelines. The operator’s IM Program procedure provided that discovery of a condition took place on the date company received the ILI vendor’s final report. Instead, the operator declared that it had discovered the conditions 30 or more days after delivery of the vendor’s final reports. 2. ConocoPhillips, [4-2005-5037, Item 2], January 9, 2007. The operator failed to discover anomalous conditions promptly and no later than 180 days after an integrity assessment. The Notice listed 23 specific ILI tool assessments where the operator declared discovery close to or after the 180 day period despite having sufficient information from ILI final reports several months prior. Failure to promptly discover and categorize conditions §195.452(h)(2) 96#

Attachment 1, passage 97identified by integrity assessment deferred the regulatory deadlines which posed a potential threat to the integrity of pipelines that could affect an HCA. Although respondent correctly stated that discovery sometimes requires the gathering and integration of information from other sources, Respondent did not specifically claim that it needed to gather and integrate information from sources other than the ILI reports listed in the Notice. Respondent did not provide any evidence that contradicted the allegation in the Notice that Respondent had sufficient information from the ILI reports to enable earlier discovery of the conditions. 3. Buckeye Partners, [3-2007-5026, Item 6], December 30, 2010. The operator failed to promptly determine that a condition presenting a potential integrity threat was present on its pipeline. The operator’s ILI vendor reported sufficient information about the dent and metal loss condition for the operator to make a determination that an immediate repair condition was present, but the operator did not make the required determination for over a month. 4. Kinder Morgan, LLC, [2-2011-5002, Item 1a], June 9, 2011. The operator failed to obtain and use information from an assessment to make a determination that a condition presented a potential threat to the integrity of the pipeline, within 180 days of completion of the assessment. Specifically, the operator completed an integrity assessment on May 9, 2008, but did not obtain sufficient information to make a determination of discovery that a 60- day condition existed until March 30, 2009, or 325 days following the completion of the assessment and 180 days past the regulatory deadline. The operator also failed to show that the 180-day period was impracticable in this case. 5. Enbridge Energy, [3-2012-5013, Item 1], September 7, 2012. The operator failed to promptly obtain sufficient information about anomalous conditions to make a determination that the conditions presented a potential threat to the integrity of the pipeline. The operator failed, within 180 days after receiving a contractor’s report on a high-resolution MFL integrity assessment that had been conducted on line 6B, to obtain sufficient information about the anomalies noted in the report to determine whether they posed a potential threat to the integrity of the pipeline. The operator failed to implement pressure restrictions until 462 days after the 180-day deadline. 6. BP Pipeline (North America) Inc., [3-2005-5030, Item 1], April 26, 2006. If an operator performs multiple tool runs at different times (e.g., geometry tool run and then, six months later, metal loss tool run), the operator must promptly, but no later than 180 days after the first tool run, obtain the assessment data to determine whether conditions present a threat to the pipeline. The operator may not wait until 180 days after the second tool run to discover all conditions from both assessments. 7. Alyeska Pipeline Service Co., [5-2006-5018, Item 1], November 16, 2011. An operator is not necessarily required to receive a "final" vendor report within 180 days, but the operator is required to obtain sufficient information to accurately and reliably identify, locate, validate, and evaluate pipeline anomalies detected by the integrity assessment and to properly classify them §195.452(h)(2) 97#

Attachment 1, passage 98Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations for repair. If the vendor report does not by itself contain sufficient information due to missing or inaccurate data, the operator must complete or correct the data so that it has sufficient information to discover conditions within the 180-day timeframe. 8. BP Pipelines, [5-2003-5031, Item 3a], May 16, 2005. On the operator's Colon Junction to River Rouge Segment, the period between the assessment and the discovery of three immediate repair anomalies was 71 days. 9. BP Pipelines, [5-2003-5031, Item 3b], May 16, 2005. On the Respondent's Toledo to West Toledo Segment, the period between the assessment and the discovery of four immediate repair conditions, eight 60 day repair conditions, and five 180 day repair conditions exceeded the 180 day deadline by 84 days. 1. Failure to declare discovery of a condition when sufficient information was available to determine that the condition was detrimental to the integrity of a pipeline. 2. Failure to declare discovery of a condition within 180 days of a completed assessment. 3. Failure to provide adequate justification that discovery within 180 days was impracticable when the 180 day time frame was missed. 4. Failure to categorize (discover) dents greater than 6% depth as immediate repair conditions when no orientation data is provided. 5. Failure to categorize (discover) dents greater than 3% as 60 day repair conditions when no orientation data is provided. 6. Failure to categorize (discover) dents greater than 2% as 180 day repair conditions when no orientation data is provided. 7. Failure to categorize (discover) dents with metal loss as immediate repair conditions when no orientation data is provided and corrosion is reported at the same location on the pipeline as the dent. 8. Failure to properly categorize a condition that meets the repair criteria of §195.452(h)(4). 9. Failure to account for tool tolerance in discovery. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the approach for reviewing integrity assessment results to identify anomalies in need of remediation. 2. Documentation that shows the dates when assessments were completed, vendor reports received, and the discovery dates for anomalous conditions. 3. Records showing the outcome of the operator’s integrity assessment results review including the identification of anomalies requiring remediation. 4. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used in making decisions in regards to categorizing anomalous conditions. §195.452(h)(2) 98#

Attachment 1, passage 99Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(h)(3) Pipeline integrity management in high consequence areas. (h) What actions must an operator take to address integrity issues (3) Schedule for evaluation and remediation. An operator must complete remediation of a condition according to a schedule prioritizing the conditions for evaluation and remediation. If an operator cannot meet the schedule for any condition, the operator must explain the reasons why it cannot meet the schedule and how the changed schedule will not jeopardize public safety or environmental protection. 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 195-87, 72 FR 39012, July 17, 2002 [195.452(h)(1),(3),&(4)] WINDOT Interpretation 195.452 1 Date: June 10, 2003 Pipeline Safety: Alternative Mitigation Measures for Required Repairs Delayed by a Need to Obtain Permits (Note: §195.452(h)(3) allows operator's to miss schedule if they can explain the reason why the schedule cannot be met and take measures to ensure safety.) Congress directed the Research and Special Programs Administration’s (RSPA) Office of Pipeline Safety (OPS) to revise its pipeline safety regulations, if necessary, to allow operators to take alternative mitigation measure while seeking governmental permits required for repairs. As RSPA/OPS interprets the pipeline safety regulations, they already allow such measures. Revising the regulations is not necessary. §195.452(h)(3) 99#

Attachment 1, passage 100Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review. Part 195 Appendix C.VII. Conditions that may impair a pipeline’s integrity. Federal Register / Vol. 67, No. 9 / Monday, January 14, 2002 / Rules and Regulations at Page 1654. PHMSA Hazardous Liquids FAQs: 7.1 Do the anomaly repair schedule requirements in 195.452 (h) apply to ALL previous internal inspection runs performed by the operator, or just the integrity assessments required by 195.452 (i.e., the baseline assessment and subsequent integrity assessments)? 7.21 Must anomalies identified during pig runs not considered "baseline" or "re- assessments" under the rule be repaired in accordance with the rule's repair criteria? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? Guidance Information 1. §195.452(f)(4) states that an operator must develop criteria for remedial actions to address integrity issues. This is one of the required IM Program elements. §195.452(h) provides more specific requirements for this program element. 2. §195.452(h)(3) requires that an operator have a prioritized schedule for remediating anomalous conditions. If the schedule cannot be met, the operator must explain the reasons for not meeting the schedule and ensure safety through additional measures. 3. In addition to the explanation if the schedule cannot be met, §195.452(h)(1)(i) requires that a temporary pressure reduction be taken if the schedule cannot be met. 4. Priorities for remediating conditions are set through the repair criteria for anomalies in §195.452(h)(4); however, an operator should remediate as many conditions as possible through a single excavation. For example, if an immediate repair condition is near other 60 or 180 day repair conditions, those conditions should be remediated at the same time. In addition, the operator should evaluate defects on the exposed pipe that are just below the thresholds of the repair criteria. For example, top side dents just below the 2% threshold and deep corrosion defects. 5. The preamble to the Final Rule also states that: an operator must document the basis for how it prioritizes conditions in its [evaluation and remediation] schedule. (Federal Register / Vol. 67, No. 9 / Monday, January 14, 2002 / Rules and Regulations at Page 1654.) §195.452(h)(3) 100#

Attachment 1, passage 101Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations Final Order Referencing §195.452(h)(3): 1. ConocoPhillips, [5-2009-5015, Item 1], July 22, 2011. The operator failed to remediate a condition on its pipeline system according to a prioritized schedule meeting deadlines specified in the regulations and failing to explain the reasons why it could not meet this schedule. The operator should have notified OPS of the reasons why it could not meet the original repair deadlines and more importantly, explain how the modified schedule would not jeopardize public or environmental safety. 1. Failure to establish a schedule for evaluation and remediation of anomalies. 2. Failure to properly prioritize the remediation of conditions. 3. Failure to adequately explain the reasons why a schedule could not be met. 4. Failure to adequately explain why the change in schedule would not jeopardize public safety or environmental protection. 1. Documentation that shows the operator's prioritized schedule for completing remediation. 2. Documentation that shows the dates remediation actions were completed. 3. Documentation that shows the operator's explanation for missing a scheduled remediation. 4. Documentation that shows the operator's explanation for why the schedule change would not jeopardize public safety or environmental protection. 5. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding establishing a schedule for evaluation and remediation, and decisions made to change schedules. §195.452(h)(3) 101#

Attachment 1, passage 102Enforcement Guidance Hazardous Liquid Integrity Management Part 195 Revision Date 12/7/2015 Code Section §195.452(h)(4) Section Title Pipeline integrity management in high consequence areas. Existing Code Language (h) What actions must an operator take to address integrity issues? (4) Special requirements for scheduling remediation (i) Immediate repair conditions. An operator's evaluation and remediation schedule must provide for immediate repair conditions. To maintain safety, an operator must temporarily reduce operating pressure or shut down the pipeline until the operator completes the repair of these conditions. An operator must calculate the temporary reduction in operating pressure using the formula in Section 451.6.2.2 (b) of ANSI/ ASME B31.4 (incorporated by reference, see §195.3). An operator must treat the following conditions as immediate repair conditions: (A) Metal loss greater than 80% of nominal wall regardless of dimensions. (B) A calculation of the remaining strength of the pipe shows a predicted burst pressure less than the established maximum operating pressure at the location of the anomaly. Suitable remaining strength calculation methods include, but are not limited to, ASME/ANSI B31G (``Manual for Determining the Remaining Strength of Corroded Pipelines'' (1991) or AGA Pipeline Research Committee Project PR-3-805 (``A Modified Criterion for Evaluating the Remaining Strength of Corroded Pipe'' (December 1989)). These documents are incorporated by reference and are available at the addresses listed in Sec. 195.3. (C) A dent located on the top of the pipeline (above the 4 and 8 o'clock positions) that has any indication of metal loss, cracking or a stress riser. (D) A dent located on the top of the pipeline (above the 4 and 8 o'clock positions) with a depth greater than 6% of the nominal pipe diameter. (E) An anomaly that in the judgment of the person designated by the operator to evaluate the assessment results requires immediate action. (ii) 60-day conditions. Except for conditions listed in paragraph (h)(4)(i) of this section, an operator must schedule evaluation and remediation of the following conditions within 60 days of discovery of condition. (A) A dent located on the top of the pipeline (above the 4 and 8 o'clock positions) with a depth greater than 3% of the pipeline diameter (greater than §195.452(h)(4) 102#

Attachment 1, passage 1030.250 inches in depth for a pipeline diameter less than Nominal Pipe Size (NPS) 12). (B) A dent located on the bottom of the pipeline that has any indication of metal loss, cracking or a stress riser. (iii) 180-day conditions. Except for conditions listed in paragraph (h)(4)(i) or (ii) of this section, an operator must schedule evaluation and remediation of the following within 180 days of discovery of the condition: (A) A dent with a depth greater than 2% of the pipeline's diameter (0.250 inches in depth for a pipeline diameter less than NPS 12) that affects pipe curvature at a girth weld or a longitudinal seam weld. (B) A dent located on the top of the pipeline (above 4 and 8 o'clock position) with a depth greater than 2% of the pipeline's diameter (0.250 inches in depth for a pipeline diameter less than NPS 12). (C) A dent located on the bottom of the pipeline with a depth greater than 6% of the pipeline's diameter. (D) A calculation of the remaining strength of the pipe shows an operating pressure that is less than the current established maximum operating pressure at the location of the anomaly. Suitable remaining strength calculation methods include, but are not limited to, ASME/ANSI B31G (``Manual for Determining the Remaining Strength of Corroded Pipelines'' (1991)) or AGA Pipeline Research Committee Project PR-3-805 (``A Modified Criterion for Evaluating the Remaining Strength of Corroded Pipe'' (December 1989)). These documents are incorporated by reference and are available at the addresses listed in Sec. 195.3. (E) An area of general corrosion with a predicted metal loss greater than 50% of nominal wall. (F) Predicted metal loss greater than 50% of nominal wall that is located at a crossing of another pipeline, or is in an area with widespread circumferential corrosion, or is in an area that could affect a girth weld. (G) A potential crack indication that when excavated is determined to be a crack. (H) Corrosion of or along a longitudinal seam weld. (I) A gouge or groove greater than 12.5% of nominal wall. (iv) Other conditions. In addition to the conditions listed in paragraphs (h)(4)(i) through (iii) of this section, an operator must evaluate any condition identified by an integrity assessment or information analysis that could impair the integrity of the pipeline, and as appropriate, schedule the condition for remediation. Appendix C of this part contains guidance concerning other conditions that an operator should evaluate. Origin of Code 195-70, 65 FR 75378, December 1, 2000 §195.452(h)(4) 103#

Attachment 1, passage 104Last Amendment 195-74, 67 FR 1650, January 14, 2002 195-87, 72 FR 39012, July 17, 2002 [195.452(h)(1),(3),&(4)] 195-94, 75 FR 48593, August 11, 2010 [195.452(h)(4)] Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplemental Guidance, Integrity Assessment Results Review, and Remedial Action Part 195 Appendix C.VII. Conditions that may impair a pipeline’s integrity. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75398. Federal Register / Vol. 67, No. 9 / Monday, January 14, 2002 / Rules and Regulations at Page 1657. PHMSA Hazardous Liquids FAQs: 7.1 Do the anomaly repair schedule requirements in 195.452 (h) apply to ALL previous internal inspection runs performed by the operator, or just the integrity assessments required by 195.452 (i.e., the baseline assessment and subsequent integrity assessments)? 7.4 What is an 'immediate repair condition'? 7.5 What is a '60 day condition'? 7.6 What is a '180 day condition'? 7.7 Are there other anomalies that an operator is required to address? 7.10 What is the minimum deformation that constitutes a 'dent'? 7.15 The rule requires that an operator temporarily reduce pressure if an immediate repair condition is discovered (195.452(h)(4)(i)). With respect to this requirement: a. Can the temporary reduction in operating pressure be based upon previous maximum operating pressures? b. Can the temporary reduction in operating pressure be based on calculations other than those defined in section 451.6.2.2 (b) of ASME/ANSI B31.4? c. Is section 451.6.2.2 (b) of ASME/ANSI B31.4 applicable for calculating the temporary pressure reduction required for top-side dents with metal loss (195.452(h)(4)(i)(C)) and dents greater than 6% of the pipe diameter (195.452(h)(4)(i)(D))? 7.17 What does "general corrosion" mean in the context of the 180-day repair criterion in 195.452(h)(4)(iii)(E)? §195.452(h)(4) 104#

Attachment 1, passage 105Guidance Information 7.18 How do the "burst pressure" that defines an immediate repair condition {452(h)(4)(i)(B)} and the "operating pressure" that defines a 180-day repair condition {452(h)(4)(iii)(D)} differ? 7.20 Should tool tolerances be considered when determining if a detected anomaly meets repair criteria? 7.22 Section 195.452(h)(4)(i) requires that I temporarily reduce pressure in response to an immediate repair condition. The same paragraph also requires that I must calculate the reduction using the formula in section 451.6.2.2 (b) of ASME/ANSI B31.4. If using that formula results in a calculated safe pressure that is higher than my original operating pressure, must I still reduce pressure? To what? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 12.13 Are Safety-Related Condition Reports required to be filed when an operator implements a pressure reduction for an immediate repair per §195.452(h)(4)(i)? 1. §195.452(f)(4) states that an operator must develop criteria for remedial actions to address integrity issues. This is one of the required IM Program elements. §195.452(h) provides more specific requirements for this program element. §195.452(h)(4) specifies the requirements for categorizing defects and remediation time frames. It also requires the operator to temporarily reduce operating pressure or shutdown the pipeline when an immediate repair condition is identified. 2. The preambles to the Federal Register Notices make it clear that the list of specific conditions identified in §195.452(h)(4) is not the complete and only set of anomalies an operator must consider in evaluation and remediation. We want to emphasize that the conditions listed as immediate repair, 60 day, and 180-day are not an exclusive list of conditions an operator will be required to evaluate and remediate. These are simply some of the conditions that may show up. The argument that because a condition was not listed in paragraph (h) or in the Appendix C guidance and so an operator did not know it was required to evaluate and remediate the condition, will never be accepted. (Federal Register / Vol. 67, No. 9 / Monday, January 14, 2002 / Rules and Regulations at Page 1657.) 3. An operator may have to submit a Safety Related Condition Report in accordance with §195.55(a). §195.55(a)(1) requires an SRCR when: "General corrosion that has reduced the wall thickness to less than that required for the maximum operating pressure, and localized corrosion pitting to a degree where leakage might result". §195.55(a)(3) requires an SRCR when: "Any material defect or physical damage that impairs the serviceability of a pipeline". 4. An operator’s program must have criteria for comparing vendor and field definitions of anomaly categories to IM rule definitions (e.g., ovalities, flat §195.452(h)(4) 105#

Attachment 1, passage 106spots). 5. When measuring the depth of a dent some operators include only the "sharp" portion of the dent and don't include the "flat" portion. The rule has no provisions that allow the "flat" portion to be ignored. Selected Final Orders Referencing §195.452(h)(4): 1. Magellan Pipeline Company, [4-2004-5006, Item 1], August 18, 2005. The operator failed to temporarily reduce operating pressure or shut down its Tulsa to Shelton pipeline immediately following its identification of numerous anomalies meeting the criteria for “immediate repair conditions” until repairs of these conditions could be completed. The operator failed to respond until approximately one month after the integrity assessment in which they were identified was conducted. 2. Kinder Morgan, LLC, [2-2011-5002, Item 1b], June 9, 2011. The operator failed to schedule evaluation and remediation within 60 days of conducting a March 30, 2009 assessment that identified a dent on the bottom of a pipeline segment. Specifically, the operator discovered a dent that indicated metal loss on a portion of a pipeline located in an HCA. 3. Enbridge Energy, L.P., [3-2012-5013, Item 2], September 7, 2012. The operator failed to properly schedule the evaluation and remediation within 180 days of their discovery. Specifically, following a 2004 Ultra-Sonic Wall Measurements in-line inspection, the operator did not schedule remediation of corrosion anomalies involving the longitudinal weld seam of pipe joint #217720 within 180 days of discovery. Additionally, Enbridge did not remediate other crack-like anomalies on the same pipe joint. Assessments of this pipe joint had revealed corrosion or crack-like anomalies that were longitudinal in orientation but the operator had failed to select the joint for excavation. The same joint ultimately ruptured on July 25, 2012. 4. Tesoro Refining and Marketing, [5-2007-5031, Item 1a], December 28, 2009. The operator failed to act immediately to investigate and repair an “immediate repair condition’ under its IM Program. Specifically, the operator failed to properly identify and repair an anomaly that had been discovered on one of its pipelines. The operator incorrectly identified the item as a bottom-side dent with metal loss, rather than a top-side dent with metal loss. Bottom-side dents must be investigated and repaired within 60 days, as opposed to top-side dents, which are more serious and must be investigated and repaired immediately. 5. Buckeye Partners, [3-2007-5026, Item 7], December 30, 2010.The operator failed to reduce the pressure or shut down the pipeline following discovery of a dent with metal loss which is an immediate repair. The operator did not reduce pressure until the date the date the anomaly was repaired which was 45 days after the operator had sufficient information to categorize the anomaly as an immediate repair condition. 6. BP Pipelines, [5-2003-5031, Item 3a], May 16, 2005. On the operator's Colon Junction to River Rouge Segment, a pressure reduction was taken 60 days after discovery of three immediate repair conditions and the repairs were not completed until 66 days after discovery. §195.452(h)(4) 106#

Attachment 1, passage 107Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 7. BP Pipelines, [5-2003-5031, Item 3c], May 16, 2005. On the operator’s 8 inch Xylene line, 17 of 19 180 day conditions still had not been remediated 312 days after discovery. 1. Failure to take a temporary pressure reduction when an immediate repair condition has been identified. 2. Failure to use the methods allowed by 451.6.2.2(b) of B31.4 to calculate the temporary pressure reduction where that method is required (e.g., corrosion). 3. Failure to take a pressure reduction even though the methods of 451.6.2.2(b) result in a pressure greater than the pressure the pipeline was operating at the time the defect was discovered. 4. Failure to take a 20% pressure reduction from the highest operating pressure experienced at the location of the defect within the previous two months where that method is appropriate (e.g., dents, gouges, dents with metal loss). 5. Failure to meet the special requirements for remediation listed in the subparagraphs of §195.452(h)(4). This includes immediate repair, 60-day, 180-day, and other conditions 1. Documentation that shows a temporary pressure reduction was not taken promptly. 2. Documentation to show a 20% pressure reduction was not taken from the highest operating pressure within the previous two months. 3. Documentation to show that a pressure reduction was calculated improperly. 4. Documentation to show that no pressure reduction was taken when a pressure higher than the operating pressure of the pipeline was calculated by the methods of 451.6.2.2(b). 5. Records showing an anomaly was not remediated in the required timeframes established in §195.452(h)(4). §195.452(h)(4) 107#

Attachment 1, passage 108Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(i)(1) Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (1) General requirements. An operator must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection. Such actions may include, but are not limited to, implementing damage prevention best practices, better monitoring of cathodic protection where corrosion is a concern, establishing shorter inspection intervals, installing EFRDs on the pipeline segment, modifying the systems that monitor pressure and detect leaks, providing additional training to personnel on response procedures, conducting drills with local emergency responders and adopting other management controls. 195-70, 65 FR 75378, December 1, 2000 Date: 11-22-2006 Advisory Bulletin ADB 06-03, Notice to Operators of Natural Gas and Hazardous Liquid Pipelines To Accurately Locate and Mark Underground Pipelines Before Construction-Related Excavation Activities Commence Near the Pipelines This advisory reminds and reinforces the importance of safe locating excavation practices near underground pipelines. PHMSA¿s pipeline safety regulations require pipeline operators to implement damage prevention programs to protect underground pipelines during construction related excavation. In addition, PHMSA recommends pipeline operators excavating in areas populated with other pipelines and utilities follow all consensus best practices and guidelines developed by the Common Ground Alliance. Recent serious incidents especially reinforce the importance of accurately locating and marking pipelines and highlight an urgent need for pipeline operators to review how they implement their damage prevention programs to prevent further accidents caused by construction related damage. This Advisory Bulletin provides guidance on how to do this. §195.452(i)(1) 108#

Attachment 1, passage 109Other Reference Material & Source Date: 5-24-2002 Advisory Bulletin ADB-0201, Protecting buried pipelines by using safe excavation practices. RSPA is issuing this advisory notice to operators of natural gas and hazardous liquid pipelines to remind them of the importance of safe excavation practices. We have also asked our partners in the Common Ground Alliance, a new national non-profit damage prevention organization, and the Associated General Contractors of America and the National Utility Contractors Association, to help distribute this advisory. Date: 7-29-93 Advisory Bulletin, ADB 93-03, Advisory to Owners and Operators of Hazardous Liquid and Natural Gas Pipeline Facilities in Areas of Flooding Extended periods of rain and flooding in Midwestern states have resulted in the potential for conditions that threaten the safety of pipelines. The Office of Pipeline Safety (OPS), RSPA, has issued this advisory bulletin to pipeline operators in those flood areas to advise them of measures they should consider to assure the safety of those pipelines. In particular, pipeline operators should review emergency plans to assure they adequately cover conditions possible in the current severe flooding. Date: 4-13-1989 Alert Notice, ALN 89-02, Results of OPS-conducted investigation of San Bernardino, CA, 05/12/89 train derailment; each gas/liquid operator should test check valves. The purpose of this Alert Notice is to advise you of the results of an investigation conducted by OPS of a recent pipeline accident and the relevance of that investigation to the safe operation of check valves. With this notice, OPS is alerting each gas transmission operator and hazardous liquid pipeline operator of the need to test check valves located in critical areas to assure that they close properly. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Measures. PHMSA Liquid Integrity Management Guidance, Preventive and Mitigative PHMSA Hazardous Liquid Integrity Management FAQs: 2.12 Does the rule apply to the operator of a marketing facility if that operator does not own or operate a pipeline but rather receives and delivers hazardous liquid from/to third-party pipelines? 3.5 Do operators need to perform detailed consequence analysis to determine the specific impacts on population or USAs? 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 8.10 What integrity management program documentation should be available for §195.452(i)(1) 109#

Attachment 1, passage 110Guidance Information PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 9.1 What is an emergency flow restricting device (EFRD)? 9.7 What preventive and mitigative actions must be taken to protect HCAs? 9.9 How long after completing the baseline assessment for a segment does an operator have to conduct a risk analysis and determine whether additional preventive or mitigative actions are needed (including the need for EFRDs and leak detection system enhancements)? If an operator determines that additional actions are warranted, how long does it have to implement them? 9.10 How do operators assess and control risk caused by third-parties over which they have no direct control? 9.13. Can the evaluation of additional preventive and mitigative (P&M) measures be excluded for portions of HCA-affecting lines determined to be sufficiently “low” in risk by an operator’s risk analysis process? 1. §195.452(i) contains four major sub-paragraphs. §195.452(i)(1) deals with the general requirement to identify and implement additional preventive and mitigative measures. §195.452(i)(2) addresses the risk analysis that must be performed to identify these additional preventive and mitigative measures. §195.452(i)(3) and §195.452(i)(4) provide specific guidance for enhancing leak detection capability and for installing EFRDs, respectively. 2. §195.452(i)(1) requires operators to implement additional measure to prevent accidents and mitigate their consequences. These measures go beyond the anomaly repair and remediation efforts that are performed following integrity assessments required by the rule. §195.452(i)(1) lists some possible measures that might be considered. However, each operator must determine the measures that best address the unique risks on its pipeline system(s). The operator must use the risk analysis required by §195.452(i)(2) to identify the nature and location of the most significant risks – and to determine the risk reduction benefits of various preventive and mitigative measures to address these risks. 3. An operator’s preventive and mitigative measures program should not be restricted to just line pipe. It should include facilities such as valves and other appurtenances connected to line pipe, metering and delivery stations, pump stations, and breakout tanks. 4. Generally, if an operator had no process for identifying preventive and mitigative measures, §195.452(f)(6) should be cited. If an operator had a process for identifying preventive and mitigative measures, but it had deficiencies or inadequacies in the implementation of the process, the appropriate paragraph in §195.452(i) should be cited. For example, if the risk analysis used in determining the need for preventive and mitigative measures was deficient, §195.452(i)(2) should be cited. §195.452(i)(1) 110#

Attachment 1, passage 111Examples of a Probable Violation or Inadequate Procedures 5. If the operator’s process is acceptable, but its implementation was flawed, then the appropriate paragraph in §195.452(i) should be cited. For example, suppose an operator’s risk analysis required the use of the most recent integrity assessment results, but in practice those results were not used. In this example, the operator would be cited under §195.452(i)(2). 6. If an operator’s process did not result in the implementation of any preventive or mitigative measures, and that process was not implemented appropriately, §195.452(i)(1) should be cited. Selected Final Orders Referencing §195.452(i)(1): 1. Enbridge Energy, [3-2012-5013, Item 3], September 7, 2012. Operator failed to perform a proper risk analysis to identify the need for additional preventive and mitigative measures to protect HCAs. In preparing its risk analysis, Enbridge failed to consider all relevant risk factors associated with the determination of the amount of product that could potentially be released from a rupture on one of its pipelines. 2. ConocoPhillips, [3-2004-5013, Item 7a], August 29, 2005. The operator’s preventive and mitigative process needs to be expanded to identify HCA specific risk drivers. They indicated that they had P&M measures in place prior to the integrity management rule; but did not evaluate these in terms of specific threats that exist in each HCA. 3. Hawaii Electric Company, [5-2004-5022, Item 5a], September 20, 2006. HECO’s IM program did not contain a preventive and mitigative measures process to evaluate the need for any additional enhancements to their IM program. 4. Nuevo Energy Co, [5-2004-7002, Item 8], May 22, 2007. Nuevo did not implement preventive or mitigative measures as a part of its IM program, and there was no documented process for the evaluation of additional preventive and mitigative measures. 1. Failure to technically justify the decision not to implement any preventive and mitigative measures. (i.e., failure to justify that existing pipeline controls provide adequate protection of HCAs.) 2. Failure to adequately consider additional measures for significant integrity threats. 3. Failure to consider adequate alternatives for prospective preventive and mitigative measures to enhance public safety or environmental protection. 4. Insufficient preventive or mitigative measures were actually implemented. 5. Failed to implement preventive or mitigative measures that have a significant reduction in risk. 6. Failure to consider preventive and mitigative measures for non-pipe facilities that could impact HCAs. 7. Failure to perform a preventive and mitigative measures evaluation in a timely manner. 8. Failure to implement approved preventive and mitigative measures. Depending on the circumstances, some of the examples listed in this section may be §195.452(i)(1) 111#

Attachment 1, passage 112Examples of Evidence Other Special Notations inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the approach to identify preventive and mitigative measures. 2. Integrity Management Framework 3. Records demonstrating the deficiency or inadequacy in the determination of preventive and mitigative measures, or the failure to implement preventive and mitigative measures. 4. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the determination of preventive and mitigative measures and/or the implementation of preventive and mitigative measures. 5. Records indicating that the operator’s preventive and mitigative procedures were not followed. 6. Photographs documenting the implementation of preventive and mitigative measures, or concerns with those measures. 7. Engineering assessments or technical studies used to support decision-making on preventive and mitigative measures. 8. Records or other documentation demonstrating the operator wrongly concluded that existing measures to protect HCAs are adequate. 9. Records demonstrating that timely evaluation of preventive and mitigative measures was not performed. 10. Records demonstrating that approved preventive and mitigative measures were not adequately implemented. §195.452(i)(1) 112#

Attachment 1, passage 113Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(i)(2) Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (2) Risk analysis criteria. In identifying the need for additional preventive and mitigative measures, an operator must evaluate the likelihood of a pipeline release occurring and how a release could affect the high consequence area. This determination must consider all relevant risk factors, including, but not limited to: (i) Terrain surrounding the pipeline segment, including drainage systems such as small streams and other smaller waterways that could act as a conduit to the high consequence area; (ii) Elevation profile; (iii) Characteristics of the product transported; (iv) Amount of product that could be released; (v) Possibility of a spillage in a farm field following the drain tile into a waterway; (vi) Ditches alongside a roadway the pipeline crosses; (vii) Physical support of the pipeline segment such as by a cable suspension bridge; (viii) Exposure of the pipeline to operating pressure exceeding established maximum operating pressure. 195-70, 65 FR 75378, December 1, 2000 §195.452(i)(2) 113#

Attachment 1, passage 114Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Measures. PHMSA Liquid Integrity Management Guidance, Preventive and Mitigative PHMSA Hazardous Liquid Integrity Management FAQs: 2.12 Does the rule apply to the operator of a marketing facility if that operator does not own or operate a pipeline but rather receives and delivers hazardous liquid from/to third-party pipelines? 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 8.14 Will operators be expected to consider external conditions such as earthquake fault lines or mining subsidence in their integrity management program? Will these be classified as HCAs or require special repair provisions? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? 8.18 Can operators include potential business consequences (e.g., curtailments, plant shutdown) in its risk determinations? 9.4 What criteria must an operator consider in determining whether enhancements to leak detection are required? 9.8 What factors must be considered in risk analyses conducted to determine if additional preventive or mitigative actions are needed? 9.9 How long after completing the baseline assessment for a segment does an operator have to conduct a risk analysis and determine whether additional preventive or mitigative actions are needed (including the need for EFRDs and leak detection system enhancements)? If an operator determines that additional actions are warranted, how long does it have to implement them? 9.10 How do operators assess and control risk caused by third-parties over which they have no direct control? 9.12 Can I take credit for existing automatic valves in my analysis considering the need for Emergency Flow Restriction Devices (EFRD)? 9.13 Can the evaluation of additional preventive and mitigative (P&M) measures be excluded for portions of HCA-affecting lines determined to be sufficiently “low” in risk by an operator’s risk analysis process? Guidance Information 1. §195.452(i) contains four major sub-paragraphs. §195.452(i)(1) deals with the general requirement to identify and implement additional preventive and mitigative measures. §195.452(i)(2) addresses the risk analysis that must be performed to identify these additional preventive and mitigative measures. §195.452(i)(2) 114#

Attachment 1, passage 115§195.452(i)(3) and §195.452(i)(4) provide specific guidance for enhancing leak detection capability and for installing EFRDs, respectively. 2. §195.452(i)(2) requires that an operator perform a risk analysis to identify the need for preventive and mitigative measures. This risk analysis should identify the nature (e.g., internal corrosion, outside force damage, etc.) and location of the most significant risks. This identifies where additional measures might be needed and it identifies the specific threats or risks for which measures should be developed. The risk analysis should also be used to demonstrate the risk reduction benefits to be realized when preventive and mitigative measures are implemented. 3. §195.452(i)(2) states that all relevant risk factors must be included in this analysis and identifies several specific risk factors that must be considered. These specific items are listed in subparagraphs (i) through (viii). 4. However, there are other paragraphs in the IM rule that address risk analysis. §195.452(f)(3) requires an information/risk analysis which is described in §195.452(g). This information/risk analysis is used to support the periodic evaluation process described in §195.452(j)(2) and the assessment interval determination in §195.452(j)(3). Although §195.452(i) does not explicitly refer to §195.452(f)(3) or §195.452(g), it states that the “operator must evaluate the likelihood of a pipeline release occurring and how a release could affect a high consequence area.” This is essentially the same language as used in §195.452(f)(3). 5. Practically most operators have one risk analysis methodology for line pipe that is applied to all risk-related requirements in the rule, including the preventive and mitigative measures requirements and the continual evaluation and assessment requirements. This can make it difficult to select the best code citation for inadequacies or deficiencies in risk analysis. The following general guidance and examples may be helpful. If the operator’s risk analysis is inadequate or deficient and that same risk analysis is applied to multiple rule requirements, then it is generally preferable to cite §195.452(g). However, if the application of the risk analysis to the determination of preventive and mitigative measures is inadequate or deficient, then it is generally preferable to cite §195.452(i)(2). a. For example, if the operator’s risk model used a generic set of weighting factors based on industry-average data instead of data for its particular assets, and this same risk model was used for preventive and mitigative measures evaluation as well as performing periodic evaluations and assessment interval determinations, then it should be cited under §195.452(g). However, if the operator is using its risk model to evaluate the risk reduction benefits of preventive and mitigative measures and makes unjustified assertions about the risk impact of a particular safety improvement, then it should be cited under §195.452(i)(2). b. As a second example, if the operator failed to consider all relevant risk §195.452(i)(2) 115#

Attachment 1, passage 116factors in its risk analysis and that same risk analysis is applied to multiple rule requirements, then it is generally preferable to cite §195.452(g). If the risk analysis is only performed for the purpose of identifying and evaluating preventive and mitigative measures, then §195.452(i)(2) should be cited. 6. If an operator’s risk analysis does not consider one of the specifically required preventive and mitigative measure risk factors and does not provide a technical justification for this decision, then the appropriate subparagraph of §195.452(i)(2) should be cited. For example, if an operator’s risk analysis failed to consider ditches along a roadway that the pipeline crosses, then §195.452(i)(2)(vi) should be cited. 7. An operator’s preventive and mitigative measures program should not be restricted to just line pipe. It should include facilities such as valves and other appurtenances connected to line pipe, metering and delivery stations, pump stations, and breakout tanks. It is possible that the operator may use one risk analysis methodology for line pipe and another approach for facilities. Selected Final Order Referencing §195.452(i)(2) 1. Kinder Morgan Energy Partners, [1-2004-5004, Item 3a], June 26, 2006. The operator did not document the basis for some decisions on risk factor weighting and scoring. The operator had populated the IAP risk model database with algorithm weighting factors to integrate the risk information for ranking BAP sections. 2. Kinder Morgan Energy Partners, [1-2004-5004, Item 3c], June 26, 2006. The operator did not base its weighting factors on the relative risk relationship between the HCA risk factors. This was largely due to the selection of arbitrary weighting factors using a binary code (i.e., 1,2,4,8,16) selected for the convenience of the application in the risk model. When evaluating the likelihood of a pipeline release occurring and how a release could affect an HCA for purposes of identifying the need for additional preventative and mitigative measures, an operator must base the weights assigned to the HCA risk factors on the relative risk relationships among those factors. 3. Arguello, Inc., [5-2004-7004, Item 6b], July 10, 2005. The operator did not conduct a risk analysis for its IM program. The risk analysis will identify the need for additional EFRDs and other preventive and mitigative actions that may be necessary. 4. Chevron, [4-2006-7005, Item 3], February 6, 2007. Operator failed to develop a process for identification of preventive and mitigative measures for pipeline segments that can affect an HCA based on the analysis of the risk. §195.452(i)(2) 116#

Attachment 1, passage 117Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 1. Failure to adequately consider all relevant risk factors in the risk analysis to identify additional preventive and mitigative measures. 2. Failure to adequately consider all required risk factors specified in §195.452(i)(2)(i) through §195.452(i)(2)(viii). 3. Failure to adequately consider applicable operational and maintenance data into the risk analysis and the preventive and mitigative measure determination. 4. Risk analysis results did not adequately identify dominant risk drivers. (i.e., areas where additional preventive and mitigative measures should be considered). 5. Risk analysis results were aggregated such that HCA-affecting segment- specific risks measures were obscured or could not be identified. 6. Risk analysis results were not adequately considered in making preventive and mitigative decisions. 7. Failure to determine the risk reduction impacts of potential preventive and mitigative measures. 8. Failure to adequately consider facility risk as part of the preventive and mitigative measures determination. 9. Facilities risk analysis was not technically adequate or complete. 10. Failure to consider all operating modes (e.g., startup, shutdown, pressure cycling) in the risk analysis. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the risk analysis to support preventive and mitigative measures decision-making. 2. Integrity Management Framework 3. Records demonstrating the deficiency or inadequacy in the risk analysis. 4. Records demonstrating the failure to consider all required and relevant risk factors in the risk analysis. 5. Risk model documentation and procedures. 6. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the risk analysis and/or the risk factors considered. 7. Records indicating that the operator’s risk analysis methodology and procedures were not followed. 8. Engineering assessments or technical studies used to support the risk analysis. 9. Documentation of engineering assessments and analysis. §195.452(i)(2) 117#

Attachment 1, passage 118Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(i)(3) Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (3) Leak detection. An operator must have a means to detect leaks on its pipeline system. An operator must evaluate the capability of its leak detection means and modify, as necessary, to protect the high consequence area. An operator's evaluation must, at least, consider, the following factors–length and size of the pipeline, type of product carried, the pipeline's proximity to the high consequence area, the swiftness of leak detection, location of nearest response personnel, leak history, and risk assessment results. 195-70, 65 FR 75378, December 1, 2000 Date: 1-26-2010 Advisory Bulletin ADB-10-01, Leak Detection on Hazardous Liquid Pipelines. The Pipeline and Hazardous Materials Safety Administration (PHMSA) is issuing this Advisory Bulletin to advise and remind hazardous liquid pipeline operators of the importance of prompt and effective leak detection capability in protecting public safety and the environment. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). API 1130, Computational Pipeline Monitoring for Liquids Pipelines (latest edition) Hazardous Liquid Leak Detection Techniques and Processes, General Physics, April 2003. PHMSA Liquid Integrity Management Guidance, Preventive and Mitigative Measures. PHMSA Hazardous Liquid Integrity Management FAQs: 3.5 Do operators need to perform detailed consequence analysis to determine §195.452(i)(3) 118#

Attachment 1, passage 119Guidance Information the specific impacts on population or USAs? 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 9.1 What is an emergency flow restricting device (EFRD)? 9.4 What criteria must an operator consider in determining whether enhancements to leak detection are required? 9.5 What is the minimum acceptable leak detection system in order to comply with 195.452 (i) (3), which states "an operator must have a means to detect leaks on its pipeline system."? 9.6 49 CFR 195.134 and 195.444 require that computational pipeline monitoring (CPM) leak-detection systems on hazardous liquid pipelines must comply with API Standard 1130 for design and operations/maintenance respectively. Paragraph (i) (3) of the integrity management rule requires that operators must have a means to detect leaks on pipelines that can affect HCAs. Must leak detection means used to satisfy 49 CFR 195.452 (i) (3) meet API-1130? 9.11 Leak detection is applied to an entire system, which generally contains both HCA and non-HCA segments. Therefore, how do you compare leak detection between the HCA and non-HCA segments? 1. §195.452(i) contains four major sub-paragraphs. §195.452(i)(1) deals with the general requirement to identify and implement additional preventive and mitigative measures. §195.452(i)(2) addresses the risk analysis that must be performed to identify these additional preventive and mitigative measures. §195.452(i)(3) and §195.452(i)(4) provide specific guidance for enhancing leak detection capability and for installing EFRDs, respectively. 2. §195.452(i)(3) requires that an operator must have a means to detect leaks. It also requires that the operator evaluate the capability of its leak detection system and modify, as necessary, to protect HCAs. 3. §195.452(i)(3) also identifies a minimum set of factors that must be considered in performing this evaluation. 4. If an operator had no means to detect leaks, then §195.452(i)(3) shall be cited. 5. If an operator did not perform an adequate evaluation of its leak detection system capability, then §195.452(i)(3) would be cited. Similarly if the operator’s leak detection system capability evaluation did not address any of the required factors, §195.452(i)(3) would also be cited. 6. Although leak detection system enhancements are one of the example measures identified in §195.452(i)(1), if there are issues with the capability evaluation and the decisions to improve (or not) the leak detection system, §195.452(i)(3) should generally be cited. Selected Final Order Referencing §195.452(i)(3): 1. TE Products, [4-2006-5049, Item 1], April 28, 2008. The operator did not follow IM procedures regarding leak detection capability evaluation. Completed §195.452(i)(3) 119#

Attachment 1, passage 120preventive and mitigative measures evaluation folders contained no discussion or implementation details for a leak detection evaluation process. 2. Chevron, [4-2006-7005, Item 4], February 6, 2007. The operator has not developed and documented the process for the evaluation of leak detection capabilities. They have not performed the evaluation of leak detection capabilities and modified those capabilities, as necessary to protect HCA areas. 3. Williams Field Services, [4-2006-5027, Item 1], January 9, 2007. The operator has not performed evaluations of leak detection capabilities and modified this capability, as necessary, to protect the HCA on the pipeline assets currently in the IM Program. 4. Chevron, [5-2010-5028, Item 3], February 17, 2011. Operator failed to have an adequate means for detecting leaks on its pipeline system. The operator did not detect a failure on one of its lines for more than 10 hours, and only became aware of the release when it received a phone call from the local fire department. Further, the failure occurred in an HCA and resulted in approximately 800 barrels of crude oil into the Red Butte Creek and surrounding soils. Examples of a Probable Violation or Inadequate Procedures 1. Pipeline system does not have a means to detect leaks. 2. Failure to perform an adequate evaluation of leak detection system capability. 3. Failure to consider the required evaluation factors in the leak detection capability evaluation. 4. Failure to provide an adequate justification for assumed control center operator actions/reactions in evaluating leak detection capability. 5. Failure to provide an adequate technical basis for not making improvements to a leak detection system. (Or alternatively, failure to provide a technical basis for proposed improvements.) 6. Failure to adequately consider the impact of facilities in the leak detection system capability evaluation. 7. Failure to address all operating modes (e.g., startup, shutdown, pressure cycling) in the evaluation of leak detection system capability. 8. Failure to implement identified improvements to leak detection capabilities in a timely manner. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. §195.452(i)(3) 120#

Attachment 1, passage 121Examples of Evidence 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the leak detection capability evaluation. 2. Integrity Management Framework 3. Leak detection system capability evaluation documentation. 4. Records or accident history demonstrating the deficiency or inadequacy in the leak detection capability. 5. Records demonstrating the failure to consider all required risk factors in the leak detection capability analysis. 6. Risk model documentation and procedures used to support the leak detection capability evaluation. 7. Engineering assessments or technical studies used to support the leak detection capability evaluation. 8. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the leak detection capability evaluation. 9. Records or other information that the operator used to wrongly conclude that the existing leak detection means are adequate. 10. Records demonstrating that approved leak detection system improvements were not adequately implemented in a timely manner. Other Special Notations §195.452(i)(3) 121#

Attachment 1, passage 122Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(i)(4) Pipeline integrity management in high consequence areas. (i) What preventive and mitigative measures must an operator take to protect the high consequence area? (4) Emergency Flow Restricting Devices (EFRD). If an operator determines that an EFRD is needed on a pipeline segment to protect a high consequence area in the event of a hazardous liquid pipeline release, an operator must install the EFRD. In making this determination, an operator must, at least, consider the following factors–the swiftness of leak detection and pipeline shutdown capabilities, the type of commodity carried, the rate of potential leakage, the volume that can be released, topography or pipeline profile, the potential for ignition, proximity to power sources, location of nearest response personnel, specific terrain between the pipeline segment and the high consequence area, and benefits expected by reducing the spill size. 195-70, 65 FR 75378, December 1, 2000 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Measures. PHMSA Liquid Integrity Management Guidance, Preventive and Mitigative PHMSA Hazardous Liquid Integrity Management FAQs: 2.3 Do the requirements of the rule apply to “idle” pipe? 3.21 Why is it important that operators know the specific characteristics of high consequence areas their pipelines can affect? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity §195.452(i)(4) 122#

Attachment 1, passage 123management-related documentation be retained? 9.1 What is an emergency flow restricting device (EFRD)? 9.2 What criteria must an operator use in determining whether emergency flow restricting devices are required to protect HCAs? 9.12 Can I take credit for existing automatic valves in my analysis considering the need for Emergency Flow Restriction Devices (EFRD)? Guidance Information 1. §195.452(i) contains four major sub-paragraphs. §195.452(i)(1) deals with the general requirement to identify and implement additional preventive and mitigative measures. §195.452(i)(2) addresses the risk analysis that must be performed to identify these additional preventive and mitigative measures. §195.452(i)(3) and §195.452(i)(4) provide specific guidance for enhancing leak detection capability and for installing EFRDs, respectively. 2. §195.452(i)(4) requires that an operator must install an EFRD if one is necessary to protect an HCA. This paragraph goes on to describe specific factors that must be considered in the determination of whether or not an EFRD is needed. 3. If an operator performs no evaluation of the need for additional EFRDs, or the evaluation has some inadequacies or deficiencies, §195.452(i)(4) should be cited. 4. If an operator’s EFRD evaluation does not include the required factors, §195.452(i)(4) should be cited. 5. If an operator determines that EFRDs are not needed, documentation justifying this decision must be provided. 6. Since the impact of EFRDs is location-specific, the EFRD analysis must address all HCA-affecting pipeline segments – either individually or in a bounding-type calculation. 7. Although EFRDs are one of the example measures identified in §195.452(i)(1), if there are issues with the EFRD needs analysis and the decision to implement or not implement EFRDs, §195.452(i)(4) should generally be cited. Selected Final Order Referencing §195.452(i)(4): 1. Williams Field Services, [4-2006-5027, Item 1], January 9, 2007. The operator has not performed determinations of EFRD needs on the assets currently in the IM Program. 2. Cenex Pipeline, [5-2007-5015, Item 1c], August 26, 2008. Respondent failed to complete an evaluation to determine if there were a need to additional EFRDs on any segment of its pipeline system in order to protect a high consequence area in the event of a release. 3. Buckeye Partners, LP, [1-2009-5002, Item 19], May 30, 2012. The operator failed to determine whether EFRDs were needed to protect against failures that could affect HCAs along its pipeline, and, if so, to install them. Since 2005, the operator had failed to conduct annual EFRD analyses of pipeline segments scheduled for integrity re-assessment, as required by the company’s IM manual. The operator also failed to install certain EFRDs that had been recommended as a result of a 2002 evaluation. §195.452(i)(4) 123#

Attachment 1, passage 124Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 4. Nuevo Energy Co., [5-2004-7002, Item 9], May 22, 2007. Respondent failed to implement a proper process for determining placement of EFRDs. Respondent relied solely on the original construction design to determine EFRD placement. 1. Failure to perform an adequate evaluation of the need for additional EFRDs without adequate justification for any omissions. Failure to consider the required evaluation factors in the EFRD needs evaluation. 2. Failure to consider the unique location-specific conditions for HCA-affecting segments in the EFRD needs analysis. 3. Failure to provide an adequate justification for assumed control center operator actions/reactions in evaluating the need for EFRDs. 4. Failure to provide an adequate technical basis for not installing additional EFRDS. 5. Failure to adequately consider the impact of facilities in the EFRD needs evaluation. 6. Failure to address all operating modes (e.g., startup, shutdown, transients, pressure cycling) in the EFRD needs analysis. 7. Failure to install additional EFRDs in a timely manner. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the EFRD needs evaluation. 2. Integrity Management Framework 3. EFRD needs analysis documentation. 4. Records or accident history demonstrating the deficiency or inadequacy in the EFRD needs evaluation. 5. Records demonstrating the failure to consider all required risk factors in the EFRD needs analysis. 6. Risk model documentation and procedures used to support the EFRD needs evaluation. 7. Engineering assessments or technical studies used to support the EFRD needs evaluation. 8. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the EFRD needs evaluation. 9. Records or other information that the operator used to wrongly conclude that no additional EFRDs are needed. 10. Records demonstrating that approved EFRDs were not installed in a timely manner §195.452(i)(4) 124#

Attachment 1, passage 125Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(j)(1) and (j)(2) Pipeline integrity management in high consequence areas. (j) What is a continual process of evaluation and assessment to maintain a pipeline’s integrity? (1) General. After completing the baseline integrity assessment, an operator must continue to assess the line pipe at specified intervals and periodically evaluate the integrity of each pipeline segment that could affect a high consequence area. (2) Evaluation. An operator must conduct a periodic evaluation as frequently as needed to assure pipeline integrity. An operator must base the frequency of evaluation on risk factors specific to its pipeline, including the factors specified in paragraph (e) of this section. The evaluation must consider the results of the baseline and periodic integrity assessments, information analysis (paragraph (g) of this section), and decisions about remediation, and preventive and mitigative actions (paragraphs (h) and (i) of this section). 195-70, 65 FR 75378, December 1, 2000 195-87, 72 FR 39012, July 17, 2007 Date: 1-06-2011 Advisory Bulletin ADB-11-01, Establishing Maximum Allowable Operating Pressure or Maximum Operating Pressure Using Record Evidence, and Integrity Management Risk Identification, Assessment, Prevention, and Mitigation. PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities of their responsibilities, under Federal integrity management (IM) regulations, to perform detailed threat and risk analyses that integrate accurate data and information from their entire pipeline system, especially when calculating Maximum Allowable Operating Pressure (MAOP) or Maximum Operating Pressure (MOP), and to utilize these risk analyses in the identification of appropriate assessment methods, and preventive and mitigative measures. Date: 6-25-2008 §195.452(j)(1) and §195.452(j)(2) 125#

Attachment 1, passage 126Advisory Bulletin ADB-08-05, Notice to Hazardous Liquid Pipeline Operators of Request for Voluntary Advance Notification of Intent To Transport Biofuels. PHMSA is requesting that any hazardous liquid pipeline operator intending to transport ethanol, ethanol-gasoline blends, or other biofuels by pipeline voluntarily provide us with advance notice of their intent to transport these fuels to facilitate cooperation in achieving safety. We request that any operator intending to field test transportation of biofuels by pipeline notify PHMSA of such testing in advance so that PHMSA can work with the operator to address any safety concerns that arise. PHMSA will be interested in discussing the steps the operator will take to ensure safety during the test and informing the local emergency response officials about the product being transported. Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Spike Hydrostatic Test Evaluation, Michael Baker Jr., July 2004. Low Frequency and Lap Welded Longitudinal Seam Evaluation, Section 5.0, Michael Baker and Associates, April 2004. Pipe Wrinkle Study, Section 3.0, Michael Baker and Associates, October 2004. Dent Study, Section 4.0, Michael Baker and Associates, November 2004. Stress Corrosion Cracking Study, Section 6.0, Michael Baker and Associates, January 2005. Mechanical Damage, Section 6.2, Michael Baker Jr., April 2009. PHMSA Liquid Integrity Management Supplementary Guidance, Continual Process of Evaluation and Assessment. Part 195, Appendix C.IV. Types of internal inspection tools to use. PHMSA Hazardous Liquid Integrity Management FAQs: 5.6 Can the operator use risk assessment data to defend longer intervals between integrity assessments? 5.9 Once baseline assessments are complete, will operators be able to use their continuing evaluation process to identify primary threats and schedule assessments accordingly, even if this means conducting metal loss and deformation inspections on different intervals? 6.2 Are there different requirements for inspection of pipelines carrying highly volatile liquids? 6.3 Are there different requirements for inspection of overhead suspension pipeline bridges? 6.11a What types of other technology can be used for integrity assessments other than internal inspection or pressure tests? 8.11. What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? §195.452(j)(1) and §195.452(j)(2) 126#

Attachment 1, passage 127Guidance Information 1. §195.452(f)(5) requires that operators develop a process to periodically assess and evaluate a pipeline’s integrity. It refers to §195.452(j) as providing more specific requirements. 2. §195.452(j)(1) is a general statement of the need for an ongoing process of evaluating the integrity of pipeline segments that can affect HCAs, and conducting periodic assessments on those segments. It is essentially the same requirement as stated in §195.452(f)(5). In general if an operator has no periodic evaluation and assessment process at all, §195.452(f)(5), or §195.452(j)(1) should be cited. 3. §195.452(j) has five subparagraphs. §195.452(j)(2) describes what is required for periodic evaluation of pipeline integrity and §195.452(j)(3) describes the requirements for assessment intervals. §195.452(j)(4) identifies situations where a variance from the 5 year assessment interval may be allowed. §195.452(j)(5) describes the methods that can be used for periodic assessments. 4. If there are deficiencies or inadequacies in the periodic evaluation, the assessment interval determination, or the assessment method(s) selected, these should be cited under §195.452(j)(2), §195.452(j)(3), or §195.452(j)(5), respectively. 5. §195.452(j)(2) requires that an operator periodically evaluate the integrity of segments that can affect HCA. The frequency with which this evaluation must be performed is based on the risk factors specific to its pipeline, including those in §195.452(e). Thus, if an operator fails to perform a periodic evaluation, then §195.452(j)(2) should be cited. Likewise, if there are inadequacies or deficiencies associated with the frequency with which periodic evaluations are performed, these too would be cited under §195.452(j)(2 6. §195.452(j)(2) also prescribes the information that must be considered in conducting a periodic evaluation including the requirements of paragraph §195.452(e). These are the results of integrity assessments, the information/risk analysis (required by §195.452(g)), and decisions about remediation and preventive and mitigative actions (§195.452(h) and §195.452(i), respectively). Thus, if the operator fails to consider any of these information sources in its periodic evaluation, §195.452(j)(2) should be cited. Similarly, if there are inadequacies or deficiencies in the periodic evaluation or its results, §195.452(j)(2) should be cited. 7. The information/risk analysis described in §195.452(g) is an important part of the continual evaluation. If the application of the risk analysis to the periodic evaluation of integrity is deficient or inadequate, then the citation should generally be §195.452(j)(2). However, if the information/risk analysis has inadequacies or deficiencies, and that same information/risk analysis process is used for preventive and mitigative measures and other IM program determinations and decisions, it is generally preferable to cite §195.452(g). Selected Final Orders Referencing §195.452(j)(2): 1. Cenex Pipeline, [5-2007-5015, Item 2a], August 26, 2008. The operator failed to conduct an annual evaluation of its pipeline system as specified in its §195.452(j)(1) and §195.452(j)(2) 127#

Attachment 1, passage 128procedures. 2. Chevron USA, [4-2006-7005, Item 6] September 19, 2006. The operator failed to develop a continual process for evaluation and assessment, and it failed to establish the frequency for evaluation based on the applicable risk factors, including those factors specified in §195.452(j)(3). 3. TE Products, [4-2006-5049, Item 2a], April 28, 2008. The operator’s IM program contained no process documentation for periodic evaluations of pipeline integrity. No evidence of the performance of any periodic evaluations was observed. 4. Chevron Pipeline, [4-2006-5038, Item 1], February 6, 2007. Chevron did not document in sufficient detail the process for the evaluation of pipeline integrity to ensure that all of the required factors are accounted for in the evaluation. The IM program lacks sufficient detail to demonstrate that the requirements of §195.452(j)(2) are being met. Examples of a Probable Violation or Inadequate Procedures §195.452(j)(1) 1. Failure to implement a process for assessment at specified intervals and periodically evaluating the integrity of pipeline segments that could affect HCAs. §195.452(j)(2) 2. Failure to implement a process for periodically evaluating the integrity of pipeline segments that could affect HCAs. 3. Failure to establish a frequency with which to evaluate the integrity of segments that could affect HCAs. 4. Failure to adequately consider the required risk factors in establishing a frequency for evaluating integrity of segments that could affect HCAs. [This includes the risk factors in §195.452(e)]. 5. Failure to perform a periodic evaluation of integrity at the frequency established by the operator’s procedures. 6. Failure to perform a periodic evaluation of integrity when risk information is available indicating such an evaluation should be performed. 7. Failure to consider the results of previous integrity assessments (including the baseline or the most recently completed integrity assessment) in the periodic evaluation of pipeline integrity. 8. Failure to consider the information/risk analysis required by §195.452(g) in the periodic evaluation process. 9. Failure to consider the decisions and actions on pipeline remediation required by §195.452(h) in the periodic evaluation process. 10. Failure to consider the results and actions taken as a result of the preventive and mitigative measures process required by §195.452(i) in the periodic evaluation process. 11. Failure to allow for non-routine evaluations when pipeline risk information (e.g., degrading performance) is available that indicates an integrity evaluation should be performed. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the §195.452(j)(1) and §195.452(j)(2) 128#

Attachment 1, passage 129Examples of Evidence Other Special Notations enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the process for periodically evaluating pipeline integrity of segments that could affect HCAs. 2. Procedures or other documentation describing the periodic process for integrity evaluation. 3. Engineering analysis used to determine the frequency for periodic integrity evaluations, including the factors considered in making these determinations. 4. Documentation of the periodic evaluation process that shows omissions or deficiencies in the information used in the information/risk analysis, or in the information/risk analysis process. 5. Records demonstrating a deficiency or inadequacy in the periodic integrity evaluation process, and/or the information used in the evaluation process, including: a. Records indicating that previous integrity assessment results were not adequately considered in the periodic integrity evaluation process. b. Records indicating that previous decisions on remediation were not adequately considered in the periodic integrity evaluation process. c. Records indicating that the information/risk analysis results were not adequately considered in the periodic integrity evaluation process. d. Records indicating that the results of the preventive and mitigative measures process were not adequately considered in the periodic integrity evaluation process. 6. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used in the periodic evaluation process or in the process methodology. 7. Records indicating that the procedures for periodic integrity evaluations were not followed. §195.452(j)(1) and §195.452(j)(2) 129#

Attachment 1, passage 130Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(j)(3) Pipeline integrity management in high consequence areas. (j) What is a continual process of evaluation and assessment to maintain a pipeline’s integrity? (3) Assessment intervals. An operator must establish five-year intervals, not to exceed 68 months, for continually assessing the line pipe's integrity. An operator must base the assessment intervals on the risk the line pipe poses to the high consequence area to determine the priority for assessing the pipeline segments. An operator must establish the assessment intervals based on the factors specified in paragraph (e) of this section, the analysis of the results from the last integrity assessment, and the information analysis required by paragraph (g) of this section. 195-70, 65 FR 75378, December 1, 2000 195-87, 72 FR 39012, July 17, 2007 Date: 1-06-2011 Advisory Bulletin ADB-11-01, Establishing Maximum Allowable Operating Pressure or Maximum Operating Pressure Using Record Evidence, and Integrity Management Risk Identification, Assessment, Prevention, and Mitigation. PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities of their responsibilities, under Federal integrity management (IM) regulations, to perform detailed threat and risk analyses that integrate accurate data and information from their entire pipeline system, especially when calculating Maximum Allowable Operating Pressure (MAOP) or Maximum Operating Pressure (MOP), and to utilize these risk analyses in the identification of appropriate assessment methods, and preventive and mitigative measures. Date: 6-25-2008 Advisory Bulletin ADB-08-05, Notice to Hazardous Liquid Pipeline Operators of Request for Voluntary Advance Notification of Intent To Transport Biofuels. §195.452(j)(3) 130#

Attachment 1, passage 131PHMSA is requesting that any hazardous liquid pipeline operator intending to transport ethanol, ethanol-gasoline blends, or other biofuels by pipeline voluntarily provide us with advance notice of their intent to transport these fuels to facilitate cooperation in achieving safety. We request that any operator intending to field test transportation of biofuels by pipeline notify PHMSA of such testing in advance so that PHMSA can work with the operator to address any safety concerns that arise. PHMSA will be interested in discussing the steps the operator will take to ensure safety during the test and informing the local emergency response officials about the product being transported. Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Spike Hydrostatic Test Evaluation, Michael Baker Jr., July 2004. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics, June 2002. Overview of Integrity Assessment Methods, Robert J. Eiber Consultants, Inc., November 2003. (http://www.mrsc.org/artdocmisc/eiberoverview.pdf) Low Frequency and Lap Welded Longitudinal Seam Evaluation, Section 5.0, Michael Baker and Associates, April 2004. Pipe Wrinkle Study, Section 3.0, Michael Baker and Associates, October 2004. Dent Study, Section 4.0, Michael Baker and Associates, November 2004. Stress Corrosion Cracking Study, Section 6.0, Michael Baker and Associates, January 2005. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics Corporation, June 2002. Mechanical Damage, Section 6.2, Michael Baker Jr., April 2009. PHMSA Liquid Integrity Management Supplementary Guidance, Continual Process of Evaluation and Assessment. Part 195, Appendix C.IV. Types of internal inspection tools to use. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Pages 75387 and 75388. PHMSA Hazardous Liquid Integrity Management FAQs: 4.7 What must an operator consider in prioritizing pipe segments for assessment and re-assessment? 5.1 How often must periodic integrity assessments be performed on pipeline segments that can affect an HCA after the baseline assessment is completed? 5.2 Does the requirement that an operator establish inspection intervals not to exceed five (5) years mean 5 calendar years (i.e., pipe assessed in 2003 must be re-assessed in 2008) or 5 actual years? 5.3 Must operators conduct re-assessments before they have completed all baseline assessments? §195.452(j)(3) 131#

Attachment 1, passage 132Guidance Information 5.4 Can a re-assessment interval be scheduled beyond 5 years? 5.8 The gas transmission integrity management rule includes a provision for waiver of reassessment intervals if necessary to maintain product supply. Is PHMSA Pipeline Safety considering/willing to extend the same or similar provisions to hazardous liquids operators? How would such considerations be handled? 5.9 Once baseline assessments are complete, will operators be able to use their continuing evaluation process to identify primary threats and schedule assessments accordingly, even if this means conducting metal loss and deformation inspections on different intervals? 5.10 What is the difference between the ‘periodic evaluation’ required by 195.452 (j) (2) and the process for determining reassessment intervals required by 195.452 (j) (3)? 5.11 How does the 'not to exceed 68 month' assessment interval provision of the revised continual assessment interval requirement of 195.452 (j) (3) differ from the maximum 'five-year interval' for assessments? 6.3 How does the 'not to exceed 68 month' assessment interval provision of the revised continual assessment interval requirement of 195.452 (j) (3) differ from the maximum 'five-year interval' for assessments?6.22 8.11 What kinds of information must be integrated in performing periodic evaluations and reassessment interval determinations? 1. §195.452(j)(3) requires the operator to establish intervals for conducting integrity assessments. The paragraph requires that the basis for these intervals be risk based with the operator using the risk factors in §195.452(e) and the information/risk analysis required by §195.452(g) to determine the intervals. The operator is also required to use the results from the last integrity assessment (which should be a part of a complete and correctly performed information/risk analysis). 2. §195.452(j)(3) also establishes a maximum interval of 5 years (not to exceed 68 months) for conducting integrity assessments. 3. If an operator fails to establish integrity assessment intervals, then §195.452(j)(3) should be cited. 4. If the operator establishes assessment intervals but does not base these decisions on risk, §195.452(j)(3) should be cited. For instance, if an operator establishes all of its assessment intervals at the maximum allowable 5 years, but provides not risk basis for this decision, §195.452(j)(3) should be cited. 5. If the operator establishes assessment intervals based on risk but does not include all of the required risk factors identified in §195.452(e), and does not justify the exclusion of a required risk factor, then §195.452(e) should be cited. 6. If the operator establishes assessment intervals but does not consider the results of all previous assessments, §195.452(j)(3) should be cited. 7. The information/risk analysis described in §195.452(g) is an important part of assessment interval determination. If the application of the risk analysis to the assessment interval determination is deficient or inadequate, then the citation should generally be §195.452(j)(3). §195.452(j)(3) 132#

Attachment 1, passage 1338. Operators may determine that an assessment interval greater than 5 years is appropriate for some line segments. However, if an interval exceeds 5 years additional requirements are imposed as described in §195.452(j)(4). Generally, if there are issues related to inspection intervals greater than 5 years, §195.452(j)(4) should be cited. 9. §195.452(j)(3) does not address the methods used for integrity assessment. Issues related to the selection of integrity assessment methods should generally be cited under §195.452(j)(5). 10. The assessment interval determination and the assessment method selection are often determined by the periodic evaluation required by §195.452(j)(2). Selected Final Orders Referencing §195.452(j)(3): 1. TE Products, [4-2006-5049, Item 2b], April 28, 2008. Operator’s IM program contained no process documentation regarding assessment interval determination as required, other than noting that the initial reassessment schedule follows the same sequence of testing conducted under the BAP. No re-assessment schedule interval determinations had been conducted at the time of the inspection; instead, the operator “defaulted” to a five-year rotation for re-assessments. 2. Chevron Pipeline, [4-2006-5038, Item 2], February 6, 2007. The operator did not document the process for determination of reassessment intervals in sufficient detail to ensure that the required factors are accounted for in the determination and that the process can be consistently applied across all segments in the IM Program. The operator has identified the “default” reassessment interval to be 5 years. In some instances a reassessment interval less than 5 years has been chosen. Although the IM rule sets the maximum reassessment interval at 5 years without an engineering justification and notification to PHMSA, it is expected that an operator provide sufficient justification that the pipeline integrity will not be jeopardized if the 5-year reassessment interval is selected. 3. BP Pipeline, [4-2005-5045, Item 1], April 26, 2006. The operator has not documented the process to establish the integrity assessment intervals as described in the rule. The operator’s procedures require that the ILI Specialist provide a recommendation for reassessment when, based on a comparison of corrosion anomaly data and ILII data, the anticipated 5 year reassessment interval needed to be modified. The procedures did not include a process for determining integrity assessment intervals in accordance with the specified factors in §195.452(j)(3), including the risk the line pipe poses to the HCA, the factors specified in paragraph §195.452(e), the analysis of the results from the last integrity assessment, and the information analysis required by paragraph §195.452(g). 4. Chevron USA, [4-2006-7005, Item 7] September 19, 2006. The operator failed to develop a process to establish intervals and priorities for continually assessing integrity that are based on applicable risk factors, including those factors required by §195.452(j)(3). §195.452(j)(3) 133#

Attachment 1, passage 134Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations 1. Failure to establish intervals for future integrity assessments. 2. Failure to perform integrity assessments at the prescribed intervals. 3. Failure to adequately consider risk in determination of assessment intervals. 4. Failure to adequately consider all required risk factors in §195.452(e) in determining assessment intervals. 5. Failure to adequately consider the results of the most recent integrity assessment or the information/risk analysis in determining assessment intervals. 6. Defaulting to the 5 year maximum assessment interval without technical justification that such an interval will not jeopardize integrity. 7. Failure to adequately consider the risks of each segment that could affect an HCA in establishing assessment intervals. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the determination of assessment intervals. 2. Procedures or other documentation describing the approach for assessment interval determination. 3. Assessment schedule. 4. Engineering or risk analysis used to determine the frequency for integrity assessments, including the factors considered in making these determinations. 5. Records of the assessment interval determination showing the required risk factors, the results of the last integrity assessment, or the results of the information/risk analysis were not adequately considered. 6. Records demonstrating a deficiency or inadequacy in the assessment interval determination. 7. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used in the assessment interval determination. 8. Records indicating that the procedures for determining assessment intervals were not followed. §195.452(j)(3) 134#

Attachment 1, passage 135Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(j)(4) Pipeline integrity management in high consequence areas. (j) What is a continual process of evaluation and assessment to maintain a pipeline’s integrity? (4) Variance from the 5-year intervals in limited situations- (i) Engineering basis. An operator may be able to justify an engineering basis for a longer assessment interval on a segment of line pipe. The justification must be supported by a reliable engineering evaluation combined with the use of other technology, such as external monitoring technology, that provides an understanding of the condition of the line pipe equivalent to that which can be obtained from the assessment methods allowed in paragraph (j)(5) of this section. An operator must notify OPS 270 days before the end of the five-year (or less) interval of the justification for a longer interval, and propose an alternative interval. An operator must send the notice to the address specified in paragraph (m) of this section. (ii) Unavailable technology. An operator may require a longer assessment period for a segment of line pipe (for example, because sophisticated internal inspection technology is not available). An operator must justify the reasons why it cannot comply with the required assessment period and must also demonstrate the actions it is taking to evaluate the integrity of the pipeline segment in the interim. An operator must notify OPS 180 days before the end of the five-year (or less) interval that the operator may require a longer assessment interval, and provide an estimate of when the assessment can be completed. An operator must send a notice to the address specified in paragraph (m) of this section. 195-70, 65 FR 75378, December 1, 2000 195-87, 72 FR 39012, July 17, 2007 §195.452(j)(4) 135#

Attachment 1, passage 136Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Date: 1-06-2011 Advisory Bulletin ADB-11-01, Establishing Maximum Allowable Operating Pressure or Maximum Operating Pressure Using Record Evidence, and Integrity Management Risk Identification, Assessment, Prevention, and Mitigation. PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities of their responsibilities, under Federal integrity management (IM) regulations, to perform detailed threat and risk analyses that integrate accurate data and information from their entire pipeline system, especially when calculating Maximum Allowable Operating Pressure (MAOP) or Maximum Operating Pressure (MOP), and to utilize these risk analyses in the identification of appropriate assessment methods, and preventive and mitigative measures. Date: 6-25-2008 Advisory Bulletin ADB-08-05, Notice to Hazardous Liquid Pipeline Operators of Request for Voluntary Advance Notification of Intent To Transport Biofuels. PHMSA is requesting that any hazardous liquid pipeline operator intending to transport ethanol, ethanol-gasoline blends, or other biofuels by pipeline voluntarily provide us with advance notice of their intent to transport these fuels to facilitate cooperation in achieving safety. We request that any operator intending to field test transportation of biofuels by pipeline notify PHMSA of such testing in advance so that PHMSA can work with the operator to address any safety concerns that arise. PHMSA will be interested in discussing the steps the operator will take to ensure safety during the test and informing the local emergency response officials about the product being transported. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). PHMSA Liquid Integrity Management Supplementary Guidance, Continual Process of Evaluation and Assessment. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75399. PHMSA Hazardous Liquid Integrity Management FAQs: 6.20 Does the new rule, §195.588, permit operators to use direct assessment to address the threat of stress corrosion cracking? 6.23 If Guided Wave UT is used as part of the ECDA process, is it considered ‘other technology’ requiring notification? 6.25 Does close interval survey/overline survey qualify for ‘other technology’? 12.6 Will PHMSA Pipeline Safety review operator notifications and formally respond to the operator? Will PHMSA Pipeline Safety communicate responses to specific company notifications to the broader industry? 12.7 How will an operator know if PHMSA Pipeline Safety objects to its notification? §195.452(j)(4) 136#

Attachment 1, passage 137Guidance Information Examples of a Probable Violation or Inadequate Procedures 1. §195.452(j)(4) identifies two situations in which the maximum assessment interval of 5 years can be exceeded. Subparagraph §195.452(j)(4)(i) addresses the use of engineering analysis to extend the interval. The technical justification for extending the interval must be supported by a “reliable engineering evaluation.” Furthermore, the operator must use some other technology, such as external monitoring that provides an understanding of the condition of the pipe equivalent to that which can be obtained from the approved assessment methods in §195.452(j)(5). Finally the operator must notify PHMSA 270 days before the end of the 5 year (or less) interval of the justification for a longer interval and propose an alternate interval. 2. The preamble to the final rule states that the engineering-based exception was included in the rule to encourage the use of advanced alternative technologies. It is intended for use in those instances where an operator is employing an advanced alternative technology and should therefore be dictated by the use of such technology. It is intended to be a limited exception to the interval of five years or less, and not to exceed an additional two years whenever possible. (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75399.) 3. §195.452(j)(4)(ii) allows the operator to exceed the 5 year maximum interval if the technology being used to conduct the assessment is unavailable. The operator must justify the reasons why it cannot comply with the required assessment period and must demonstrate the actions it is taking to evaluate and assure integrity in the interim. In these situations, the operator must notify PHMSA 180 days prior to the end of the 5 year (or less) interval. This notification must provide an estimate of when the assessment can be completed. As of September 2012, there have been no Final Orders citing §195.452(j)(4) and only one Order Directing Amendment which is summarized below. Key Pipelines LTD, [5-2005-5016, Items 12a and 12b], December 11, 2006. The operator must amend its procedures to state that if it is going to use an engineering justification to exceed an assessment interval, it must notify PHMSA 270 days before the end of the five year (or less) interval and propose an alternative interval. The operator must also amend its procedures to state that if it plans to have a longer assessment interval because of the unavailability of technology, it must notify PHMSA 180 days before the end of the five year (or less) interval that a longer interval will be required and provide an estimate of when the assessment can be completed. 1. If an operator intends to extend assessment intervals beyond the 5 year maximum, failure to include provisions in its IM program for (1) developing an engineering basis for longer assessment intervals and (2) notifying PHMSA 270 days before the end of the current assessment interval. 2. Failure to include provisions for (1) unavailable technology requiring a longer assessment interval and (2) notifying PHMSA 180 days before the end of the current assessment interval in the IM program. 3. Failure to notify PHMSA at least 270 days prior to the end of the 5 year (or less) interval when an assessment interval exceeds the 5 year limit. §195.452(j)(4) 137#

Attachment 1, passage 138Examples of Evidence 4. Failure to provide a reliable engineering evaluation justifying the extension of an assessment interval beyond 5 years when an assessment interval exceeds the 5 year limit. 5. When extending an assessment interval on an engineering basis, failure to describe other technologies or actions the operator is taking to provide an understanding of the pipe condition equivalent to that which can be obtained from the methods in §195.452(j)(5). 6. Failure to provide an alternate assessment interval as part of the notification to PHMSA (applies to both the engineering and unavailable technology variances). 7. Failure to notify PHMSA at least 180 days prior to the end of the 5 year (or less) interval when assessment interval will be exceeded because of unavailable technology. 8. When extending an assessment interval because of unavailable technology, failure to justify why the proposed assessment technology is unavailable and to describe the actions the operator is taking in the interim to assure integrity. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the approach for determining variances in the 5 year assessment interval limitation. 2. Procedures or other documentation describing the approach for variances from the 5 year assessment interval. 3. Assessment schedule. 4. Notifications and accompanying documentation provided to PHMSA informing PHMSA of variances in the 5 year interval. 5. Engineering or risk analysis used to determine the frequency for integrity assessments, including the factors considered in making these determinations. 6. Records demonstrating a deficiency or inadequacy in assessment interval determination. (For engineering basis variances.) 7. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the information used in determining the variance from the 5 year assessment interval. (For engineering basis variances.) 8. Documentation of the actions taken to evaluate and assure integrity until the “unavailable” technology can be implemented. (For unavailable technology variances.) 9. Descriptions of the measures taken that provide an understanding of the pipe condition that is equivalent to that which can be obtained from the assessment methods in §195.452(j)(5), and the technical justification for determining the equivalent understanding of pipe condition. (For engineering basis variances.) §195.452(j)(4) 138#

Attachment 1, passage 13910. Documentation from vendors or other suppliers of technology justifying why a specific technology is not available. 11. Records indicating that the procedures for establishing variances from the 5 year assessment intervals were not followed. Other Special Notations §195.452(j)(4) 139#

Attachment 1, passage 140Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(j)(5) Pipeline integrity management in high consequence areas. (j) What is a continual process of evaluation and assessment to maintain a pipeline’s integrity? (5) Assessment methods. An operator must assess the integrity of the line pipe by any of the following methods. The methods an operator selects to assess low frequency electric resistance welded pipe or lap welded pipe susceptible to longitudinal seam failure must be capable of assessing seam integrity and of detecting corrosion and deformation anomalies. (i) Internal inspection tool or tools capable of detecting corrosion and deformation anomalies including dents, gouges and grooves; (ii) Pressure test conducted in accordance with subpart E of this part; (iii) External corrosion direct assessment in accordance with §195.588; or (iv) Other technology that the operator demonstrates can provide an equivalent understanding of the condition of the line pipe. An operator choosing this option must notify OPS 90 days before conducting the assessment, by sending a notice to the address or facsimile number specified in paragraph (m) of this section. 195-70, 65 FR 75378, December 1, 2000 195-87, 72 FR 39012, July 17, 2007 Date: 1-06-2011 Advisory Bulletin ADB-11-01, Establishing Maximum Allowable Operating Pressure or Maximum Operating Pressure Using Record Evidence, and Integrity Management Risk Identification, Assessment, Prevention, and Mitigation. PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipeline facilities of their responsibilities, under Federal integrity management (IM) regulations, to perform detailed threat and risk analyses that integrate accurate data and information from their entire pipeline system, especially when calculating Maximum Allowable Operating Pressure (MAOP) or Maximum Operating Pressure (MOP), and to utilize these risk analyses in the identification of appropriate §195.452(j)(5) 140#

Attachment 1, passage 141assessment methods, and preventive and mitigative measures. Date: 6-25-2008 Advisory Bulletin ADB-08-05, Notice to Hazardous Liquid Pipeline Operators of Request for Voluntary Advance Notification of Intent To Transport Biofuels. PHMSA is requesting that any hazardous liquid pipeline operator intending to transport ethanol, ethanol-gasoline blends, or other biofuels by pipeline voluntarily provide us with advance notice of their intent to transport these fuels to facilitate cooperation in achieving safety. We request that any operator intending to field test transportation of biofuels by pipeline notify PHMSA of such testing in advance so that PHMSA can work with the operator to address any safety concerns that arise. PHMSA will be interested in discussing the steps the operator will take to ensure safety during the test and informing the local emergency response officials about the product being transported. Other Reference Material & Source API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Spike Hydrostatic Test Evaluation, Michael Baker Jr., July 2004. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics, June 2002. Overview of Integrity Assessment Methods, Robert J. Eiber Consultants, Inc., November 2003. (http://www.mrsc.org/artdocmisc/eiberoverview.pdf) Low Frequency and Lap Welded Longitudinal Seam Evaluation, Section 5.0, Michael Baker and Associates, April 2004. Pipe Wrinkle Study, Section 3.0, Michael Baker and Associates, October 2004. Dent Study, Section 4.0, Michael Baker and Associates, November 2004. Stress Corrosion Cracking Study, Section 6.0, Michael Baker and Associates, January 2005. Report on the Use of In-Line Inspection Tools for the Assessment of Pipeline Integrity, General Physics Corporation, June 2002. Mechanical Damage, Section 6.2, Michael Baker Jr., April 2009. PHMSA Liquid Integrity Management Supplementary Guidance, Continual Process of Evaluation and Assessment. Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75396. PHMSA Hazardous Liquid Integrity Management FAQs: 6.1 What are acceptable integrity assessment methods? 6.3 Are there different requirements for inspection of overhead suspension pipeline bridges? 6.4 What kind of tool can an operator use to conduct integrity assessments by internal inspection? 6.5 What type of pressure test can be used to assess pipeline integrity? §195.452(j)(5) 141#

Attachment 1, passage 1426.7 Can internal inspection be performed using only a deformation tool if the analysis of the pipeline demonstrates that corrosion is not a primary integrity threat for a specific pipeline segment? 6.8 Will PHMSA Pipeline Safety establish criteria for minimum acceptable in- line inspection tool capability? (E.g., are low resolution magnetic flux leakage tools acceptable or must high resolution tools be used?) 6.9 For operators having line pipe in states that have a pressure testing requirement, will satisfying the state requirement also suffice for satisfying the integrity assessment requirement of the integrity management rule? 6.10 What are the acceptable integrity assessment methods for ERW pipe or lap welded pipe susceptible to seam failure? 6.15 A reduction in operating pressure can provide an equivalent level of safety as that provided by a Subpart E hydrostatic test. Is a pressure reduction an acceptable integrity assessment method? 6.16 Will PHMSA Pipeline Safety allow liquid operators to use the Direct Assessment process allowed in the gas transmission integrity management rule as an acceptable “other technology” for integrity assessment [see 195.452 (c) (i) (C)]?6.17 6.18 If an operator chooses to assess its pipeline using external corrosion direct assessment (ECDA), does it have to use another assessment method to assess for deformation anomalies such as dents, gouges, and grooves? 6.19 Are the direct assessment requirements contained in ASME B31.8S-2001 standard applicable to hazardous liquid pipelines? 6.20 Does the new rule, §195.588, permit operators to use direct assessment to address the threat of stress corrosion cracking? 6.21 Can an operator use an indirect assessment tool for ECDA that is not listed in Table 2 of NACE RP-0502-2008? 6.23 If Guided Wave UT is used as part of the ECDA process, is it considered ‘other technology’ requiring notification? 6.24 For the first time using ECDA you are required to do an extra direct examination. Does this mean the "first time" on each covered segment, or the first time you do ECDA (ever)? 6.25 Does close interval survey/overline survey qualify for ‘other technology’? 6.26 At what point during ECDA does one move from severe, moderate, minor to immediate, scheduled, and monitored? 6.27 What timeframes apply to "discovery" of conditions presenting a potential threat to the integrity of a pipeline when using Direct Assessment?6.28 6.29 Can operators aggregate ECDA regions after the process is started and they determine that some regions have common features? 6.30 What does PHMSA expect to see in an ECDA feasibility study? 6.31 How can I demonstrate that I have applied more restrictive criteria the first time I used ECDA (required by 195.588(b)(2)-(4) and NACE-0502-2002)? 6.32 Can the ‘ECDA’ assessment option be applied to significant portions of above ground portions of pipelines that cannot be assessed with ILI tools or hydrostatic testing? §195.452(j)(5) 142#

Attachment 1, passage 143Guidance Information Examples of a Probable Violation or Inadequate Procedures 12.6 Will PHMSA Pipeline Safety review operator notifications and formally respond to the operator? Will PHMSA Pipeline Safety communicate responses to specific company notifications to the broader industry? 12.7 How will an operator know if PHMSA Pipeline Safety objects to its notification? 1. §195.452(j)(5) identifies methods that can be used for integrity assessment. The list in §195.452(j)(5) is identical to that in §195.452(c)(1)(i) for baseline assessment methods. This section also imposes specific requirements on low frequency ERW pipe and on lap welded pipe susceptible to seam failure. 2. The preamble to the final rule also states that PHMSA expects an operator choosing hydrostatic pressure testing as the method of integrity assessment for a pipeline segment will review its corrosion control monitoring program for that segment. PHMSA inspectors will review these documents when evaluating an operator’s choice of pressure test as an assessment method. (Federal Register / Vol. 65, No. 232 / Friday, December 1, 2000 / Rules and Regulations at Page 75396.) Selected Final Order Referencing §195.452(j)(5): 1. Tesoro Refining, [5-2007-5027, Item 3], June 17, 2010. The operator failed to use an adequate method for assessing the integrity of its line pipe. The operator’s ILI results and a dig report showed visual evidence of SCC on its pipeline. The operator should have reviewed its dig reports to determine if other areas exhibited those same characteristics. If such areas did exist, then the operator had an obligation to reevaluate its method for assessing the integrity of its line pipe. Selected Orders Directing Amendment Referencing §195.452(j)(5): 2. Chevron Pipe Line Company, [5-2003-5032, Item7], June 8, 2009. The IM program procedures did not reflect the 90 day notification process for use of other assessment technologies. 3. Belle Fourche [5-2004-5030, Item 10b], July 10, 2006. The operator must amend its IM Program to include provisions to notify PHMSA in the event an “other” assessment technology is used. 4. Plains Exploration and Production Energy [5-2004-7002, Item 4], May 22, 2007. The operator used pressure testing as a method of assessment, but did not specify in its IM Program that evaluation/root cause analysis of hydrostatic testing failures should be performed. 1. Assessment method(s) selected for reassessment were not appropriate for the pipeline specific conditions and risk factors identified for each segment. 2. Failure to adequately justify the basis for selection of assessment methods. 3. Failure to consider the results of previous integrity assessments in selecting assessment method(s) for future assessments. 4. Failure to select an adequate method to assess low frequency electric resistance welded (LF ERW) pipe or lap welded pipe susceptible to longitudinal seam failure. (i.e., a method that assesses seam integrity and is capable of detecting corrosion and deformation anomalies) §195.452(j)(5) 143#

Attachment 1, passage 144Examples of Evidence Other Special Notations 5. Failure to provide adequate technical justification that LF ERW or lap-welded pipe is not susceptible to seam integrity issues. 6. Failure to select an appropriate assessment method(s) for pipe segments that are susceptible to cracks or have exhibited crack-like features. 7. Failure to adequately specify the assessment method(s) for all segments that could affect HCAs. 8. Failure to adequately justify the assessment method(s) used for reassessment. 9. Failure to provide for the use of a deformation tool where applicable, and not requiring the excavation of all dent indications for MFL tool runs. 10. Failure to perform a comprehensive review of the corrosion control program effectiveness when using hydrostatic testing as an assessment technique. 11. Hydrostatic pressure tests do not meet the requirements of Subpart E of Part 195. 12. ECDA methodology used does not meet the requirements of §195.588. 13. IM Program documentation does not require notification to PHMSA when using “other technology.” 14. Failure to notify PHMSA when using an “other technology” 90 days before conducting the assessment. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the determination of assessment methods. 2. Procedures or other documentation describing the assessment method selection. 3. Assessment schedule. 4. Engineering or risk analysis used to determine the most significant integrity threats for the purposes of selecting an assessment method(s). 5. Records of assessment method determination showing the risk factors considered, the results of the last integrity assessment, and the results of the information/risk analysis. 6. Records demonstrating a deficiency or inadequacy in the assessment method determination. 7. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the assessment method determination. 8. Records indicating that the procedures for determining assessment methods were not followed. §195.452(j)(5) 144#

Attachment 1, passage 145Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(k) Pipeline integrity management in high consequence areas. (k) What methods to measure program effectiveness must be used? An operator's program must include methods to measure whether the program is effective in assessing and evaluating the integrity of each pipeline segment and in protecting the high consequence areas. See Appendix C of this part for guidance on methods that can be used to evaluate a program's effectiveness. 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 Date: 12-5-2012 Advisory Bulletin ADB-2012-10, Using Meaningful Metrics in Conducting Integrity Management Program Evaluations PHMSA is issuing an Advisory Bulletin to remind operators of gas and hazardous liquid pipelines of their responsibilities, under Federal integrity management regulations, to perform evaluations of their integrity management programs using meaningful metrics. API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Part 195, Appendix C.V. PHMSA Liquid Integrity Management Supplementary Guidance, Program Evaluation. PHMSA Hazardous Liquid Integrity Management FAQs: 8.13 How is an operator to monitor the effectiveness of its integrity management program? 8.15 The Integrity Management Program portion of the rule [195.452 (f)] applies to all portions of a pipeline system that can impact HCAs, including pump stations, terminals, and other equipment. What must an operator do to comply with the rule for these facilities? §195.452(k) 145#

Attachment 1, passage 146Guidance Information Examples of a Probable Violation or Inadequate Procedures 1. Operators are required to develop methods to measure the program’s effectiveness. As discussed in the guidance for §195.452(f)(7), if an operator fails to have methods to measure program effectiveness in its IM Program, then it would generally be cited under §195.452(f)(7). However, if the operator made some progress toward developing program evaluation methods, but its program had omissions or inadequacies, those specific issues should generally be cited under §195.452(k). The probable violation examples below provide areas where operator programs may have issues. 2. Although the language in §195.452(k) does not explicitly state that the program effectiveness evaluation methods must be implemented, it is understood that these program effectiveness evaluations must be performed. §195.452(b)(5) requires an operator implement all elements of its IM Program. Selected Final Orders Referencing §195.452(k). 1. Chevron USA, Inc, [4-2006-7005, Item 8], February 6, 2007. The operator has not documented the process to measure the effectiveness of the IM Program in sufficient detail to ensure consistent application and results. It is expected at this time that the required processes would be mature and documented in sufficient specificity to ensure consistent application and repeatability. 2. TEPPCO, [4-2006-5049, Item 3], April 28. 2008. The operator’s program evaluation process has not yet been fully implemented. At the time of the inspection, no internal audits had been completed and the performance measures process had not been fully implemented. 3. Cenex Pipeline, [5-2007-5015, Item 3a], August 26, 2008. The operator failed to have conducted periodic evaluations of the effectiveness of its IM Program in assessing and evaluating the integrity of each pipeline segment and in protecting HCAs. 4. Norfolk Southern Railway, [2-2011-6005, Item 4], July 22, 2011. The operator failed to perform a review of its IM Program to measure its effectiveness in assessing and evaluating the integrity of each segment and in protecting HCAs. Specifically, the operator failed to provide documentation that it had ever performed an IM program review. 5. Tampa Bay Pipeline, [2-2012-6008, Item 4], September 14, 2012. The operator failed to include methods to measure whether the program was effective in assessing and evaluating the integrity of each pipeline segment and in protecting HCAs. 1. Failure to perform and/or document an adequate IM program effectiveness evaluation. 2. Failure to develop adequate procedures for conducting IM program effectiveness evaluations. 3. Failure to demonstrate that periodic self-assessments, internal and or/external audits, management reviews, or other evaluations to measure program effectiveness were performed. 4. Failure to establish performance measures to be used in the IM program §195.452(k) 146#

Attachment 1, passage 147documentation 5. Failure to implement a program to assure the completeness and accuracy of the data used to measure performance. 6. Failure to select performance measures that provide meaningful insight into integrity-related performance. 7. Failure to establish and document the frequency with which performance measure data would be collected, and the frequency of program evaluations using these measures. 8. The metrics in the IM program did not consider factors such as: (a) overall measures of program effectiveness such as number of releases affecting HCAs – in total and by threat, the total volume released, and the percent of spilled volume that is recovered. (b) measures that reflect the accomplishment of the program's objectives such as number of miles of pipeline assessed; number of anomalies found requiring repair or mitigation; number of right-of-way encroachments. (c) Measures that reflect the effectiveness of existing preventive and mitigative efforts. 9. Failure to report complete and accurate performance metric data to PHMSA. 10. Failure to include threat-specific metrics, such as: number of leaks caused by internal/external corrosion; anomalies from manufacturing defects; third party damage; operator error; over-fill/over-pressure (tanks); equipment or non-pipe problems in the IM program. 11. Failure to compare leak, failure, and incident metrics with the risk model and make changes where necessary. 12. Failure to include performance goals in the IM program effectiveness evaluation. 13. Failure to consider segment-specific issues related to the operator's unique operating environment such as an increase in the number, and depth of corrosion related anomalies, an increase in the threat of mechanical damage due to an increase in one calls, a change in operations resulting in an increase in pressure cycles, an increase in the number of crack anomalies, etc. in the operator’s performance goals. 14. Failure to consider trending of equipment or material failures as a means to evaluate pipeline deterioration and provide insights into the end of useful life for materials and components in performance measure determination. 15. Failure to consider trending of leading indicators such as inadvertent over- pressurization, right-of-way encroachments without one-call notification, SCADA outages, operation of overpressure or other safety devices, etc. in the IM program. 16. Failure to consider Part 195 Appendix C guidelines when developing performance metrics. 17. Failure to periodically review and update the performance measures to assure they are providing useful information about the effectiveness of IM Program activities. 18. Failure to consider measures related to the transportation of ethanol and bio- §195.452(k) 147#

Attachment 1, passage 148Examples of Evidence Other Special Notations fuels, as applicable. 19. Failure to adequately consider internal reviews or audits of the IM Program in the IM program effectiveness evaluation. 20. Failure to adequately respond to negative performance indicators or trends. 21. Failure to implement program improvements identified by the IM program effectiveness evaluation. 22. Failure to adequately delineate responsibilities for the IM program effectiveness evaluation. 23. Failure to involve management in the program evaluation implementation. 24. Failure to provide evidence of management awareness of the program effectiveness evaluation results. 25. Failure to identify deficiencies that were indicative of programmatic breakdowns in the IM program. 26. Failure to identify adequate actions to improve the IM program. 27. Failure to provide evidence of feedback to corrective action programs, preventive and mitigative measure decision, and the threat and risk analysis process. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Operator’s Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the Plan or Program. 2. Procedures describing the program effectiveness evaluation and internal audits. 3. Internal or external IM program audit reports. 4. Documented conversations with operator or contractor personnel that identify inconsistencies or deficiencies regarding the program evaluation and performance measurement functions. 5. Operator records indicating the program evaluation approach was not followed, or the records are incomplete. 6. Operator performance metrics data, trends, and other performance analysis. §195.452(k) 148#

Attachment 1, passage 149Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(l) Pipeline integrity management in high consequence areas. (l) What records must be kept? (1) An operator must maintain for review during an inspection: this section. (i) A written integrity management program in accordance with paragraph (b) of (ii) Documents to support the decisions and analyses, including any modifications, justifications, variances, deviations and determinations made, and actions taken, to implement and evaluate each element of the integrity management program listed in paragraph (f) of this section. (2) See Appendix C of this part for examples of records an operator would be required to keep. 195-70, 65 FR 75378, December 1, 2000 195-74, 67 FR 1650, January 14, 2002 API 1160, Managing System Integrity for Hazardous Liquid Pipelines, (latest edition). Part 195, Appendix C.VI. Examples of types of records an operator must maintain. Pipeline Safety Enforcement Procedures, Section 4.1.3.1, “Prepare Draft Notice Letter and Violation Report,” March 17, 2011. PHMSA Hazardous Liquid Integrity Management FAQs: 4.16 What specific information from the company’s baseline assessment plan does PHMSA Pipeline Safety expect to retain in its inspection files? For example, will PHMSA Pipeline Safety retain the boundaries of segments §195.452(l) 149#

Attachment 1, passage 150Guidance Information Examples of a Probable Violation or Inadequate Procedures that could affect HCAs, the assessment methods for these segments, the dates on which these segments will be assessed, etc.? 6.30 What does PHMSA expect to see in an ECDA feasibility study? 8.10 What integrity management program documentation should be available for PHMSA Pipeline Safety inspections and how long should that integrity management-related documentation be retained? 1. §195.452(l) summarizes the type of IM program documentation the operator must maintain. Appendix C.VI elaborates on this paragraph providing guidance as to the specific examples of documents and records an operator should maintain. 2. There are some instances where both recordkeeping and substantive violations arise out of the same conduct. In these situations, it is generally better to cite the substantive violation rather than the absence of records, provided there is evidence supporting the substantive violation. For example, §192.452(j)(3) requires operators establish assessment intervals using several information sources. If an operator fails to perform the required analysis to establish its assessment intervals, it will not have records of this analysis. In this situation, the operator should be cited under §192.452(j)(3) and not §195.452(l). A separate violation for §195.452(l) should not be issued. However, if it is only possible to obtain information that shows the records were not kept, it may be better to just pursue the recordkeeping violation. Selected Final Orders Referencing §195.452(l): 1. Cenex Pipeline, [5-2004-5023, Items 9a and 9b], March 3, 2006. The operator failed to have a written integrity management program at the time of the inspection. They also failed to develop two of the processes required to be in the initial framework. They also failed to have sufficient documentation to support the decisions and analyses, including any modifications, justification, variances, deviations and determinations made and actions taken, to implement and evaluate each element of the integrity management program. 2. Alon, [5-2004-5021, Item 5], August 8, 2009. The operator failed to maintain proper documentation of the decisions and analyses, including any modifications, justifications, variances, deviations and determinations made, and actions taken, to implement and evaluate each element of its IM Program. Specifically, Alon failed to properly document the modifications it had previously made to its IM Program, and lacked a procedure for tracking such changes. The written procedure submitted by Alon is dated less than one week prior to the OPS inspection, and no other evidence exists that contradicts the inspector’s allegation that an adequate procedure was not effect as the date required under the regulation. 1. Failure to have an adequate procedure for maintaining records applicable to the integrity management of their pipeline segments that could affect HCAs. 2. Inadequate documentation to support the decisions, analyses, and action taken to implement and evaluate each element of the integrity management program. (These would generally be cited under the requirements for the specific program elements that apply- e.g., the appropriate paragraph(s) under §195.452(l) 150#

Attachment 1, passage 151Examples of Evidence Other Special Notations §195.452(f). However, there may be some instance when this applies globally to the entire IM program.) 3. Adequate measures for controlling documents to ensure changes are tracked and that the latest revision is being used were not available. 4. A document retention policy that ensures all appropriate documents are retained for the life of the pipeline was not available. 5. The operator does not maintain the records identified in Part 195, Appendix C V.I. Depending on the circumstances, some of the examples listed in this section may be inadequate plans and procedures, and not probable violations. Thus, the enforcement tool to address these issues would be a Notice of Amendment and not a Notice of Probable Violation or a Warning Letter. Section 3 of the Enforcement Procedures provides guidance on selecting the appropriate enforcement action. 1. Integrity Management Plan or Program documentation including procedures, and records related to the development and implementation of each IM program element. 2. Documents to support the IM Program decisions and analyses. 3. Documents supporting modifications, justifications, variances, deviations and determinations for each IM program element. 4. Documents supporting notifications made to PHMSA. 5. Assessment schedule. 6. Documentation retention and control procedures. 7. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the operator’s IM record keeping procedures and practices. §195.452(l) 151#

Attachment 1, passage 152Enforcement Guidance Revision Date Code Section Section Title Existing Code Language Origin of Code Last Amendment Interpretation Summaries Advisory Bulletin/Alert Notice Summaries Other Reference Material & Source Guidance Information Hazardous Liquid Integrity Management Part 195 12/7/2015 §195.452(m) Pipeline integrity management in high consequence areas. (m) How does an operator notify PHMSA? An operator must provide any notification required by this section by: (1) Entering the information directly on the Integrity Management Database Web site at http://primis.phmsa.dot.gov/imdb/; (2) Sending the notification to the Information Resources Manager, Office of Pipeline Safety, Pipeline and Hazardous Materials Safety Administration, 1200 New Jersey Avenue, SE., Washington, DC 20590; or (3) Sending the notification to the Information Resources Manager by facsimile to (202) 366-7128. 195-70, 65 FR 75378, December 1, 2000 195-89, 73 FR 31634, June 3, 2008 PHMSA Hazardous Liquid Integrity Management FAQ: 12.5 How can notifications be submitted? 1. §195.452(m) provides the different mechanisms an operator can use to notify PHMSA in the event a notification is required by one of the other §195.452 paragraphs. 2. In general, if an operator fails to comply with the notification requirements of the IM rule, it should be cited under the specific notification requirement it failed to satisfy. For example, if an operator needs to extend its assessment interval because of unavailable technology and fails to notify PHMSA, §195.452(m) 152#

Attachment 1, passage 153Examples of a Probable Violation or Inadequate Procedures Examples of Evidence Other Special Notations §195.452(j)(4)(ii) should be cited and not §195.452(m). 3. Because §195.452(m) basically lists web address, mailing address, and a facsimile number, it is not likely that this code paragraph would be cited in an enforcement case. As of October 2012, this code paragraph has only been cited once – in a Notice of Amendment where the operator had the incorrect web address and an incorrect mailing address for submitting notifications in its procedures. 4. There may be some instances in which a Safety Related Condition Report may also be required for IM related events. In these instances, the SRC reporting process must be followed as well as any IM notification requirements. 1. Failure to communicate a notification to PHMSA using either the mailing address, internet address, or facsimile listed in §195.452(m). 2. Failure to specify the correct mailing address, internet address, or facsimile number for communicating notifications in the operator’s IM program documentation. 1. Integrity Management Plan or Program, or applicable portion that shows an omission or deficiency in the process for submitting notifications to PHMSA. 2. Records of notifications submitted to PHMSA. 3. Documented conversations with operator or contractor personnel that identify inconsistencies, deficiencies, or inadequacies regarding the options by which notifications are submitted to PHMSA. §195.452(m) 153#