Liquid Operator RM Guide

Portal detail 1Liquid Operator RM Guide Liquid-Operator-RM-Guide-Final-Nov2008.pdf (1.55 MB) First-generation "Liquid Pipeline Operator’s Control Room Human Factors Risk Assessment and Management Guide," resulting in a comprehensive methodology that could be applied by pipeline operators to assess and manage human factors risks in their operations. Effective Date: Thursday, July 12, 2012#

Attachment 1, passage 1Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page i LIQUID PIPELINE OPERATOR’S CONTROL ROOM HUMAN FACTORS RISK ASSESSMENT AND MANAGEMENT GUIDE Prepared by: Marvin McCallum and Christian Richard Prepared for: Pipeline and Hazardous Materials Administration and Pipeline Research Council International November 26, 2008#

Attachment 1, passage 2Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page i This research was co-funded by the Department of Transportation, Pipeline and Hazardous Materials Safety Administration (PHMSA) and by the Pipeline Research Council International, Inc. (PRCI). The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of PHMSA or the U.S. Government. This document is furnished to Pipeline Research Council International, Inc. (PRCI) under the terms of PRCI contract Project No. PR-003-03405, between PRCI and Battelle Memorial Institute, Battelle Columbus Operations. Publication and dissemination of this report by PRCI should not be considered an endorsement by PRCI or Battelle of the accuracy or validity of any opinions, findings, or conclusions expressed herein. In publishing this report, neither PRCI nor Battelle make any warranty or representation, expressed or implied, with respect to the accuracy, completeness, usefulness, or fitness for any particular purpose of the information contained herein, or that the use of any information, method, process, or apparatus disclosed in this report may not infringe on privately owned rights. Neither PRCI nor Battelle assume any liability for damages, including but not limited to any direct, special, punitive, incidental or consequential damages, resulting from the use or misuse of, any information, method, process, or apparatus disclosed in this report.#

Attachment 1, passage 3Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page iii ACKNOWLEDGEMENTS The Battelle researchers would like to acknowledge the Government agencies, industry associations, and the individuals who supported this project. This project was co-funded and ably co-managed by the Pipeline and Hazardous Materials Safety Administration (PHMSA) and Pipeline Research Council International (PRCI). Several past and present managers from seven separate pipeline operating companies actively supported this project through their participation in planning meetings, coordination of company resources, and their review and comment on numerous interim project products. Risk analysis professionals from two participating companies played a critical role in shaping the final risk assessment methodology. More than 200 individual pipeline Controllers and control room supervisors from participating companies provided the detailed operational information that allowed the resulting methodology to be tailored to the realities of pipeline monitoring and control operations through their interview participation, Controller Survey completion, and risk likelihood rating participation. Finally, the authors of this report relied heavily on the excellent database management and analysis support provided by Jim Brown of Battelle and the outstanding administrative support, data entry, and document preparation and management skills of Diane Williams of Battelle.#

Attachment 1, passage 4Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page v TABLE OF CONTENTS Acknowledgements ...................................................................................................................iii Glossary ............................................................................................................................vii Introduction ..............................................................................................................................1 Background.............................................................................................................................1 Human Factors Risks in the Control Room.............................................................................1 Mitigating Control Room Human Factors Risks ......................................................................3 Project Objectives, Activities, and Products............................................................................4 Organization of this Guide.......................................................................................................5 Methodology Overview...............................................................................................................7 Methodology Organization ......................................................................................................7 Step 1: Assemble the Human Factors Risk Management Team.............................................9 Step 2: Administer the Controller Survey...............................................................................10 Step 3: Administer the Risk Likelihood Rating Activity ..........................................................11 Step 4: Calculate Risk Levels and Rank-order Human Factors Topics for Operational Review...................................................................................................12 Step 5: Select Operational Review Topics ............................................................................14 Step 6: Conduct and Summarize Operational Reviews.........................................................15 Step 7: Develop a Risk Mitigation Strategy ...........................................................................16 Step 8: Develop and Implement Risk Mitigations ..................................................................17 General Issues in Applying this Guide ..................................................................................18 Risk Management Process Overview ...................................................................................21 Appendix A Step 1 Human Factors Risk Management Team Guidance .........................A-1 Step 1 Human Factors Risk Management Team Assembly Guidance ............................... A-3 Risk Management Team Guidance Handouts .................................................................... A-5 Appendix B Step 2 Controller Survey and Administration Instructions ......................... B-1 Step 2 Controller Survey Administration Instructions.......................................................... B-3 Liquid Pipeline Control Room Human Factors Taxonomy .................................................. B-7 Controller Survey .............................................................................................................. B-15 Appendix C Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance ...................................................................................................................C-1 Step 3 Risk Likelihood Rating Activity Administration Guidance......................................... C-3 Risk Likelihood Rating Activity Materials.............................................................................C-7 Appendix D Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets ...............................................................................................D-1 Step 4 Risk Level Calculation Instructions and Example.................................................... D-3 Risk Level Score Calculation Example ...............................................................................D-5 Preliminary Industry Risk Norm Data..................................................................................D-8 Risk Level Calculation Summary Sheets .......................................................................... D-17#

Attachment 1, passage 5Page vi Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Appendix E Step 5 Operational Review Topics Selection Guidance and Documentation Sheet............................................................................................... E-1 Step 5 Operational Review Topics Selection Guidance...................................................... E-3 Operational Review Topics Selection Documentation Sheet.............................................. E-7 Appendix F Step 6 Control Room Operational Review Guidance and Worksheets ...... F-1 Step 6 Operational Review Guidance................................................................................. F-3 Operational Review Worksheets....................................................................................... F-13 Detailed Operational Review Guidance ............................................................................ F-39 Appendix G Step 7 Risk Mitigation Strategy Development Guidance and Worksheets ...............................................................................................................G-1 Step 7 Risk Mitigation Strategy Development Guidance ....................................................G-3 Step 7 Mitigation Assessment Worksheet and Guidance ...................................................G-5 Risk Mitigation Descriptions................................................................................................G-9 Appendix H Step 8 Mitigation Development and Implementation Guidance and Worksheet .................................................................................................................H-1 Step 8 Risk Mitigation Development and Implementation Guidance .................................. H-3 Risk Mitigations Development and Implementation Planning Worksheet and Instructions. H-7 LIST OF FIGURES Figure 1. Sequence of Human Factors-Related Incident Investigation Causes .........................2 Figure 2. Incident Causes and Defenses (Adapted from Reason, 1990) ...................................3 Figure 3. Major Project Tasks and Products ..............................................................................4 Figure 4. Overall Control Room Risk Management Methodology Activities ...............................7 Figure 5. Graphic Depiction of Pipeline Operations Human Factors Taxonomy Organization...8 Figure 6. Step 1 Human Factors Risk Management Team Assembly Activities ........................9 Figure 7. Step 2 Controller Survey Administration Activities ....................................................10 Figure 8. Step 3 Risk Likelihood Rating Administration Activities ............................................12 Figure 9. Step 4 Risk Level Calculation Activities ....................................................................13 Figure 10. Step 5 Operational Review Topic Selection Activities...............................................14 Figure 11. Step 6 Operational Review Activities ........................................................................15 Figure 12. Step 7 Risk Mitigation Strategy Development Activities............................................16 Figure 13. Step 8 Risk Mitigation Development and Implementation Activities..........................17 Figure 14. Flow Diagram of Risk Management Steps and Primary Outcomes ..........................21#

Attachment 1, passage 6Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page vii GLOSSARY Following are definitions for a number of terms that are used in this document to refer to specific aspects of human factors and pipeline operations. Human Factors is the study of how the various aspects of personal characteristics and experience, job and task design, workspace design, tools and equipment design, and work environment affect both system operator and overall system performance. Human Factors Taxonomy is the hierarchically organized list of human factors incorporated in the current Guide that is comprised of 11 Human Factors Areas, 29 Human Factors Topics, and 138 Performance Factors. Human Factors Area is the highest level of organization in the Human Factors Taxonomy. There are 11 Human Factors Areas: 1) Task Complexity and Workload, 2) Displays and Controls, 3) Communications, 4) System Information Accuracy and Access, 5) Job Procedures, 6) Alarm Presentation and Management, 7) Controller Training, 8) Coping with Stress, 9) Controller Alertness, 10) Automation, and 11) Control Room Design and Staffing. Human Factors Topic is the intermediate level of organization in the Human Factors Taxonomy. Each of 29 Human Factors Topics is nested within one of the 11 Human Factors Areas, and is comprised of a group of related Performance Factors. Performance Factor is the most detailed level of organization in the Human Factors Taxonomy. Each of 138 Performance Factors represents specific human factors control room working conditions, including the characteristics of Controllers (e.g., experience, fatigue), workspaces (e.g., display monitors, lighting), job tools (e.g., batch tracking, SCADA), job design (e.g., control tasks and activities), and other factors that affect the Controller’s ability to effectively monitor and control pipeline operations. Controller Survey is a survey administered to Controllers that obtains both their ratings regarding the Prevalence with which they encounter each of 138 Performance Factors included in the Human Factors Taxonomy and their descriptions of working conditions associated with Performance Factors that may be adversely affecting their job performance. Working Conditions are the specific operating conditions or factors that Controllers encounter at their work site while conducting pipeline monitoring and control activities and other related tasks. Working Conditions are associated with specific Performance Factors (e.g., workload problems at a specific console, specific field technician communications problems, specific alarms that are a particular nuisance, etc.). Prevalence is the estimated level of Controllers’ exposure to working conditions associated with a Performance Factor in their control room. Prevalence is seen as influencing operational risk and efficiency by increasing Controllers’ exposure to conditions that may adversely affect their monitoring and control performance.#

Attachment 1, passage 7Page viii Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Likelihood is the rated likelihood that exposure to the working conditions associated with a Performance Factor will directly lead to sub-optimal Controller pipeline monitoring and control performance and thereby cause or contribute to the occurrence and/or increase in severity of an incident with an unacceptable consequence. Risk Level is the relative risk at a control room that working conditions associated with a Performance Factor or Human Factors Topic will be present, that those working conditions will adversely affect Controller pipeline monitoring and control performance, and that the degraded performance will result in the occurrence and/or increase in severity of an incident with an unacceptable consequence. Control Room Operational Reviews are activities conducted to supplement information obtained from the Controller Survey and Risk Likelihood rating activity that help in understanding the nature of specific operational risks and potential mitigations of those risks. Types of operational review information collection activities include: 1) accident, incident, and near-incident report review; 2) Controller interview; 3) observational review; and 4) materials review. Mitigations represent changes that can be made to working conditions, operating practices (e.g., workspace layout, training, software design, job requirements, procedures, etc.), and system design to improve overall system performance and reduce operational risk. Supervisory Control and Data Acquisition (SCADA) systems are computer based tools that provide an integrated summary of remote pipeline sensors and controls. Pipeline Controllers engaged in SCADA operations to monitor and control pipeline operations from a console in a pipeline control room, which is typically equipped with multiple SCADA consoles used to monitor and control separate sections of a larger pipeline system.#

Attachment 1, passage 8Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page ix ACRONYMS CBP......................................................................................................Computer-Based Procedures HF .............................................................................................................................Human Factors KSA................................................................................................ Knowledge, Skills and Abilities MOC ........................................................................................................... Management of Change MOP.................................................................................................. Maximum Operating Pressure NTSB .................................................................................... National Transportation Safety Board PBP .............................................................................................................Paper-Based Procedures PF .......................................................................................................................Performance Factor PHMSA...................................................Pipeline and Hazardous Materials Safety Administration PRCI...................................................................................Pipeline Research Council International RAS...................................................................................... Representation and Analysis Software SCADA..........................................................................Supervisory Control and Data Acquisition TLX........................................................................................................................ Task Load Index#

Attachment 1, passage 9Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 1 Introduction INTRODUCTION BACKGROUND The purpose of this guide is to document methodologies, tools, procedures, guidance, and instructions that have been developed to provide liquid pipeline operators with an efficient and effective means of managing the human factors risks in their control rooms. A companion technical report to this document has been prepared, which documents the technical basis for these methodologies, as well as the findings and recommendations resulting from this effort. Section 12 of the ‘‘Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006’’ provides general guidance regarding regulations that will require operators to manage the human factors risks in their control room. A partial quotation from Section 12 is provided below. § 60137. Pipeline control room management ‘‘(a) IN GENERAL.—Not later than June 1, 2008, the Secretary shall issue regulations requiring each operator of a gas or hazardous liquid pipeline to develop, implement, and submit” … “a human factors management plan designed to reduce risks associated with human factors, including fatigue, in each control center for the pipeline.” Battelle and industry participants proactively developed methodologies that can be used by liquid operators to assess and manage control room human factors risks. These methodologies were developed during a four-year Human Factors Analysis of Pipeline Monitoring and Control Operations project that was co-sponsored by the Pipeline and Hazardous Materials Safety Administration (PHMSA) and a group of liquid pipeline operators represented by the Pipeline Research Council International (PRCI). The methodologies were developed with the objective of providing liquid operators with tools and procedures that can be used to identify potential pipeline monitoring and control operational risks, prioritize those risks for further investigation, conduct operational reviews in their control room to fully understand the nature of the risks and potential mitigations, develop a feasible and appropriate mitigation strategy, and then implement and track the value of the implemented mitigations. HUMAN FACTORS RISKS IN THE CONTROL ROOM Human factors is the study of how the various aspects of personal characteristics and experience, job and task design, work space design, tools and equipment design, and work environment affect system operator performance and overall system performance. The current methodology addresses those human factors that affect liquid pipeline Controller’s performance in monitoring and controlling pipeline operations. These factors are, in turn, assumed to affect overall pipeline system safety and operational efficiency. Few pipeline incidents are typically attributed to human factors. Indeed, the most-frequently cited causes of oil pipeline incidents are third-party damage, corrosion, and equipment-related failure1. However, several recent investigations of severe pipeline incidents have determined that Controllers did not correctly identify and respond to abnormal situations in an effective and timely manner; thereby contributing to the severity of the accident2. In addition, a relatively small percentage of pipeline incidents have been directly attributed to Controller error3; where the initiating cause of the incident did not involve equipment failure or damage. Although#

Attachment 1, passage 10Page 2 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Introduction current industry-wide incident analysis and reporting systems do not support an accurate estimate of the extent that Controller ‘unsafe acts’ contribute to pipeline accidents, other industries with more mature human factors incident reporting programs indicate that human performance plays a significant role in incidents. For example, human performance has been judged to be the major contributor to loss of life, personnel injury, and property damage in the chemical process industry4. In the civil and military aviation industry, where human factors accident investigation and reporting procedures are relatively mature, estimates of human performance involvement in accidents range between 70% and 80%5 . The term unsafe act is used to characterize operator behavior in relation to a hazard. It implies that an operator’s action provided the opportunity for the occurrence or increased severity of an incident by exposing the system to a hazard or not actively defending the system from that hazard. Unsafe acts are often categorized as resulting from an operator error or from the intentional violation of rules and procedures. In investigating human factors-related accidents, an operator’s unsafe act is often identified as the proximal contributing factor to an incident. However, that should not necessarily lead to the conclusion that operator performance was the root cause of the incident. Figure 1 depicts the opposing sequences of critical incident investigation activities and causes. Starting from the investigation perspective, someone reviewing the events and conditions leading up to an incident with a human factors contribution will typically identify one or more unsafe acts (such as the misdiagnosis of an abnormal condition or an incorrect control action) as the proximal cause. The incident investigator may not continue the analysis to consider workplace factors (such as displays and control layouts) or operational factors (such as job design and abnormal event training) that may have also contributed to the occurrence of that unsafe act. Critical Incident Misdiagnosis, Incorrect Control Action SCADA Displays, Control Layout Job Design, Abnormal Event Training Unsafe Acts Causes Investigation Operational Factors Figure 1. Sequence of Human Factors-Related Incident Investigation Causes The current methodology is based on the fundamental assumption that the causes of unsafe acts represent the full range of human performance, local workplace, and operational factors. For example, if an inappropriate control response to an abnormal incident were identified as the unsafe act preceding a product leak, one contribution to that incident could be identified as the Controller misdiagnosing the nature of the abnormal condition. However, further analysis could reveal that a factor contributing to the Controller’s misdiagnosis was the layout of the physical#

Attachment 1, passage 11Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 3 Introduction pipeline on the SCADA display that made it difficult to determine the status of the affected portion of the pipeline system. Continuing the current example, further analysis of the Controller’s misdiagnosis could reveal that an additional factor contributing to this unsafe act was the limited ability of the Controller to mentally focus on the abnormal conditions; due to a job design that required concurrent monitoring and control of several ongoing pipeline activities. Thus, a very fundamental premise of this guide is that the full range of operator, local workplace, and operational factors can contribute to the occurrence of an incident. MITIGATING CONTROL ROOM HUMAN FACTORS RISKS The interpretation of incident causation depicted in Figure 1 suggests that there is a broad range of strategies that can be adopted to reduce the likelihood that an unsafe act will occur. Modification of the local workplace design can reduce the likelihood of unsafe acts by providing tools and equipment that better support correct diagnosis of abnormal conditions and the correct and timely selection of control actions. Additionally, operational factors can further reduce the likelihood of unsafe acts by tailoring the job to match to the human operators’ capabilities and/or by better equipping Controllers to effectively monitor and control operations through the development and implementation of more effective policies, procedures, and training. A second perspective on incident causation that suggests additional strategies for mitigating human factors risk is depicted in Figure 2. This figure, adapted from James Reason’s ‘Swiss Cheese’ model of accident causation6, depicts the trajectory of critical incident opportunities and the value of multiple, redundant system defenses or incident barriers. Figure 2 depicts the basic perspective that the trajectory of most potential incidents resulting from a hazardous situation can be avoided through the design and implementation of effective system defenses. Effective redundant defenses, such as redundant sensors that provide overlapping information regarding system status, automated alarm management that facilitates access to critical information, and relief valves that minimize the result of over-pressurization, reduce the likelihood that a hazardous situation will result in an actual incident. A combination of mitigations that are developed to augment Controllers capabilities and better match job requirements to Controllers’ capabilities (as depicted in Figure 1); and to provide additional system defenses (as depicted in Figure 2) can provide a broad range of effective strategies for reducing human factors risks in a control room. Critical Incident Relief Valves Automated Alarm Management Redundant Sensors Figure 2. Incident Causes and Defenses (Adapted from Reason, 1990)#

Attachment 1, passage 12Page 4 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Introduction PROJECT OBJECTIVES, ACTIVITIES, AND PRODUCTS The systems perspective towards human factors risks and their mitigation presented in the preceding discussion served as the basis for defining the objectives, activities, and products of the current project. The project was conducted to better understand the specific human factors risks and potential mitigations in pipeline control rooms and to translate that knowledge into methodologies, tools, and procedures that could be used by operators to manage their human factors risks. Figure 3 presents an overview of these project tasks and products, which are briefly discussed below. Project Tasks Project Products Task 1 Identify human factors contributing to monitoring and control safety and efficiency Human Factors Taxonomy Task 2 Conduct operational reviews at selected sites Controller Survey Operational Review Procedures Task 3 Identify the potential risk level of human factors Risk Likelihood Rating Activity Risk Level Calculation Procedure Task 4 Define cost-effective improvement strategies for reducing risks Mitigation Descriptions Task 5 Prepare a human factors risk management guide Mitigation Selection Procedure Final Risk Management Guide Figure 3. Major Project Tasks and Products#

Attachment 1, passage 13Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 5 Introduction Task 1 consisted of a series of information gathering and analysis activities, including National Transportation Safety Board (NTSB) accident investigation report analysis, human factors research review, and structured interviews with control room personnel, to identify the specific human factors that contribute to pipeline monitoring and control safety and efficiency. Task 1 provided the technical basis for the development of the Human Factors Taxonomy, which is a hierarchically organized list of human factors that affect liquid pipeline monitoring and control performance. This taxonomy is comprised of 11 Human Factors Areas, 29 Human Factors Topics, and 138 Performance Factors. Task 2 involved the development of operational review procedures and their trial application by a group of participating operators. Two basic tools were developed and implemented during this task. First, a Controller Survey was developed, which is a survey administered to Controllers to obtain both their estimates regarding the frequency with which they encounter each of the 138 Performance Factors included in the Human Factors Taxonomy and their descriptions of working conditions associated with Performance Factors that may be adversely affecting their job performance. Second, draft versions of operational review procedures were developed and applied on a trial basis by the participating operators. These procedures define activities conducted to supplement information obtained from the Controller Survey to aid in understanding the nature of specific operational risks and potential mitigation of those risks. Task 3 was conducted to establish a risk-based means of prioritizing potential human factors risks for mitigation management activities. This task resulted in the development and trial application of a Risk Likelihood Rating Activity and Risk Level calculation procedure. The Risk Likelihood Rating Activity provided a structured procedure to obtain ratings of the likelihood that exposure to the working conditions associated with each Performance Factor will result in degraded Controller performance and contribute to the occurrence and/or increase in severity of an incident with an unacceptable consequence. The Risk Level calculation procedure integrates Controller Survey and Risk Likelihood rating data to prioritize Human Factors Topics and Performance Factors on the basis of their relative Risk Level. Task 4 was conducted to identify potential mitigations that could be developed and implemented by an operator in order to reduce and manage human factors risks. Available theoretical, research, and applied operational literature, were integrated with operator input into a series of mitigation descriptions that can serve as a starting point for operators in developing a mitigation strategy. Task 5 involved the development of procedures and guidance for operators to use in selecting from the potential mitigations and developing a mitigation strategy that best meets their organization’s potential human factors risks and operational environment. The mitigation selection procedures, along with this guide, were the major product of Task 5. ORGANIZATION OF THIS GUIDE This guide is organized into ten sections. This Introduction is followed by a Methodology Overview, which provides a summary of the full set of human factors risk management procedures; and discusses some of the general issues regarding methodology limitations and implementation guidance. Following the Methodology Overview, eight separate appendices – one for each of the eight steps in the methodology – provide detailed instructions and guidance regarding the conduct of each step, along with specific materials designed to aid operators in#

Attachment 1, passage 14Page 6 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Introduction carrying out each step of the current human factors risk management methodology. Each of these eight appendices has been prepared as a stand-alone, inclusive document that provides the materials, procedures, instructions, and guidance required to support a pipeline operator in conducting each of the eight Human Factors risk management steps that comprise this methodology. 1 Trench, C. (2003). The U.S. Oil Pipeline Industry’s Safety Performance. New York, NY: Allegro Energy Consulting. Prepared for Association of Oil Pipelines. Available at http://www.aopl.org/posted/888/Safety_thru_2001.57651.pdf 2 National Transportation Safety Board. (2005). Supervisory Control of Data Acquisition (Safety Study NTSB/SS- 05/02). Washington DC: Author. Available at http://www.ntsb.gov/publictn/2005/SS0502.pdf 3 The PHMSA Fact Sheet Incorrect Operations, reports that “Operating Errors generally cause approximately 7% of total pipeline and non-pipeline incidents. Available at http://primis.phmsa.dot.gov/comm/FactSheets/FSIncorrectOperation.htm 4 Center for Chemical Process Safety of the American Institute of Chemical Engineers. (1994). Guidelines for Preventing Human Error in Process Safety. New York, NY: Author. 5 Wiegmann, D.& Shappell, S. (2001). A Human Error Analysis of Commercial Aviation Accidents Using the Human Factors Analysis and Classification System (HFACS) (Report No. DOT/FAA/AM-01/3). Oklahoma City, OK: FAA Civil Aeromedical Institute. Available at http://www.faa.gov/library/reports/medical/oamtechreports/2000s/media/0103.pdf 6 Reason, J. (1990). Human Error. Cambridge, UK: Cambridge University Press.#

Attachment 1, passage 15Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview Page 7 METHODOLOGY OVERVIEW METHODOLOGY ORGANIZATION Figure 4 provides an overview of the human factors risk assessment and management methodology that serves as the basis for this guide. The overall methodology consists of eight steps that are conducted by an operator to establish a human factors risk management team, identify and assess the human factors risks in their control room, develop a plan for mitigating the highest-priority risks, and developing and implementing the selected mitigations. This Guide provides detailed guidance, instructions, tools, and worksheets to support operators in their performance of each of these eight steps. Step 1: Assemble the Control Center Human Factors Risk Management Team Step 2: Administer Controller Survey Step 3: Administer Risk Likelihood Ranking Activity Step 4: Calculate Risk Levels and Rank-Order Human Factors Topics for Operational Review Risk Management Feedback Loop Step 5: Select Operational Review Topics Step 6: Conduct Operational Reviews and Summarize Findings Step 7: Develop a Risk Mitigation Strategy Step 8: Develop and Implement Risk Mitigations Figure 4. Overall Control Room Risk Management Methodology Activities#

Attachment 1, passage 16Page 8 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview The methodology includes a risk management feedback loop, depicted on the left-hand side of Figure 4. Human factors risk mitigations are implemented in an effort to reduce the risk levels associated with targeted human factors. The effectiveness of implemented mitigations can be evaluated through this feedback loop by periodically assessing control room human factors risk levels associated with the targeted human factors. Conducting a periodic human factors risk assessment will both provide evidence regarding the effectiveness of mitigations implemented in the past, and help in determining appropriate future steps to further reduce potential human factors risks. The technical reference used in identifying and organizing potential human factors risks and mitigations throughout this guide is the Pipeline Operations Human Factors Taxonomy. This taxonomy was developed during the current project, based on analyses of pipeline accident investigation reports, process control research literature reviews, an extensive series of structured interviews with liquid pipeline Controllers, and an iterative review and refinement of the content and wording of the human factors taxonomy by the project researchers, pipeline operations managers, and risk management experts. Figure 5 graphically depicts the basic organization of the Pipeline Operations Human Factors Taxonomy, omitting many of the details. The most general Human Factors Area level of the taxonomy consists of 11 areas: (1) Task Complexity and Workload, (2) Displays and Controls, (3) Communications, (4) System Information Accuracy and Access, (5) Job Procedures, (6) Alarm Presentation and Management, (7) Controller Training, (8) Coping with Stress, (9) Controller Alertness, (10) Automation, and (11) Control Room Design and Staffing. Human Factors Areas (11) 1. Task Complexity and Workload Human Factors Topics (29) Performance Factors (142) 1.1. Task Design 1.1.1. Execution of… 1.1.2. Routine activities… 1.2 Console Workload 1.1.1. Execution of… 1.1.2. Routine activities… 2. Displays and Controls 2.1. Equipment Layout 2.2. … 2.3. … 11. Control Room Design and Staffing 11.1. Control Room Design 11.2. Control Room Staffing 11.1.1. The location… 11.1.2. … 11.2.1. Another Contr… 11.2.2. … Figure 5. Graphic Depiction of Pipeline Operations Human Factors Taxonomy Organization#

Attachment 1, passage 17Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 9 Methodology Overview The intermediate Human Factors Topic level of the taxonomy includes 29 Human Factors Topics nested within the Human Factors Areas. For example, as depicted in the figure, there are two Human Factors Topics nested within Human Factors Area 1: 1.1.—Task Design and 1.2.— Console Workload. The most detailed Performance Factor level of the taxonomy includes 138 specific characteristics of the Controller (e.g., experience, fatigue), workspace (e.g., display monitors, lighting), job tools (e.g., batch tracking, SCADA), job design (e.g., control tasks and activities), and other factors that can affect a Controller’s ability to effectively monitor and control the pipeline. For example, there are five Performance Factors nested within Human Factors Topic 1.1, including: 1.1.1—Execution of a control action (e.g., open/close valve, start/stop pump, change set point) requires too many steps (e.g., more than three); and 1.1.2—Routine activities (e.g.., line start up, batch cutting, or manifold flushing) are too complex. Following is a brief overview of each of the eight steps in the risk assessment and management methodology, along with discussions regarding the applications of this taxonomy. STEP 1: ASSEMBLE THE HUMAN FACTORS RISK MANAGEMENT TEAM An operator commences their management of human factors risks with the assembly of a control room human factors risk management team. The organization’s management can review desirable team member characteristics and the general charter for the team, along with organizational priorities and objectives in establishing the risk management team. The risk management team may require ongoing management involvement to supplement the team with new and/or temporary members, to review and approve resource requirements, and to initiate new cycles of risk management activities. The two activities comprising this first risk management step are depicted in Figure 6 and briefly discussed below. Appendix A provides general guidance for assembling a risk management team, as well as a summary of team member qualifications and a sample risk management team charter. 1.1 Select the Team Members 1.2 Establish the Team’s Charter Figure 6. Step 1 Human Factors Risk Management Team Assembly Activities 1.1. Select the Team Members In general, the individuals comprising the risk management team must bring the appropriate skills, knowledge, and experience to this effort. Individual team members should bring both corporate operational and risk analysis expertise; as well as control room operational expertise. In addition, it is important that the risk management team maintain continuity throughout the various steps of the process; and management should try to select individuals who will be available for a minimum of one and preferably two years. An important consideration in selecting risk management team members will be each team member’s ability to critically review#

Attachment 1, passage 18Page 10 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview current working conditions and to consider a broad range of alternative mitigations in addressing identified risks. 1.2. Establish the Team’s Charter Assessing and managing the human factors risks within a control room requires a significant organizational commitment, both in terms of the resources expended and the timeframe of the effort. The level of resource investment will vary between organizations based on the risks identified, available resources, and other organizational priorities. However, it is critical that management demonstrate their commitment by assembling a qualified risk management team that is assigned the resources necessary to complete a full cycle of the risk management activities depicted in Figure 4. Once a risk management team is assembled, management must assign team responsibilities and authorities. It is recommended that a team leader be assigned who has experience successfully enabling operational change within the organization. The team leader should be responsible to management for ensuring the quality and completeness of individual activities, as well as communicating with management regarding emerging issues, including critical findings, schedule and budget deviations, and upcoming resource requirements. Individual team members can be assigned lead and/or support roles for the major functions of risk assessment, mitigation selection, mitigation development, and mitigation implementation. STEP 2: ADMINISTER THE CONTROLLER SURVEY The Controller Survey is used to obtain Controllers’ Prevalence ratings for individual Performance Factors and detailed descriptions of human factors that may be adversely affecting their monitoring and control performance. The bulk of the survey consists of a series of items corresponding to each of the 138 Performance Factors. The four activities involved in preparing for and administering the Controller Survey are depicted in Figure 7 and briefly discussed below. A copy of the Human Factors Taxonomy, which is the technical basis of the Controller Survey, a copy of the Controller Survey, and survey administration instructions are provided in Appendix B. 2.1 Define Controller Respondent Sample 2.2 Determine Method of Confidential Survey Administration 2.3 Determine Mode of Survey Administration 2.4 Administer Survey and Compile Responses Figure 7. Step 2 Controller Survey Administration Activities#

Attachment 1, passage 19Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 11 Methodology Overview 2.1. Define Controller Respondent Sample The Controller Survey should be administered to an adequate sample of Controllers to ensure that the obtained Prevalence ratings and working condition descriptions provide a representative sample of Controller judgments and descriptions. 2.2. Determine Method of Confidential Survey Administration Although it is not strictly required by the nature of the survey items, it is highly recommended that administration of the Controller Survey involve confidential survey administration. It is likely that some Controllers will feel more able to fully describe the nature of adverse working conditions if they are assured that their individual survey responses will be treated confidentially. The most straight-forward means of ensuring survey respondent confidentiality is through third- party administration. An alternative is to establish internal confidentiality controls. 2.3. Determine Mode of Survey Administration This guide provides a text version of the Controller Survey. The survey can be administered as a paper-and-pencil survey by printing copies of this text version. However there is a substantial advantage in efficiency if the survey is administered as a computer-based survey. An efficient computer-based administration approach is to administer the survey using one of several commercial survey administration vendors. These vendors provide adequate confidentiality if the survey is administered by a third party. An alternative computer-based administration approach would be to develop a stand-alone computer version that could be administered through a company’s internal computer network. This latter alternative would be costly if implemented by an individual operator; but could prove to be cost-effective if development costs were shared by a consortium of operators. 2.4. Administer the Survey and Compile Responses Survey administration takes approximately two hours and survey counterbalancing procedures are provided to avoid systematic differences in survey responses associated with the order of survey item administration (e.g., a Controller may put less effort into providing comments near the end). Computer-based survey administration allows the importation and concatenation of electronic files for subsequent review and analysis. If paper-and-pencil administration is employed, all survey responses must be manually entered into an electronic format prior to review and analysis. STEP 3: ADMINISTER THE RISK LIKELIHOOD RATING ACTIVITY Risk Likelihood ratings are obtained from control room operational experts to support estimates of the likelihood that exposure to the working conditions associated with each Performance Factor will directly lead to sub-optimal Controller job performance and thereby contribute to the occurrence and/or increase in severity of an unacceptable incident. Figure 8 depicts the two basic activities involved in preparing for and obtaining Risk Likelihood ratings. Considerations regarding each of these activities are discussed below. Risk Likelihood rating activity administration guidance and a copy of rating materials are provided in Appendix C.#

Attachment 1, passage 20Page 12 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview 3.1 Define Respondent Sample 3.2 Obtain and Compile Ratings Figure 8. Step 3 Risk Likelihood Rating Administration Activities 3.1. Define Respondent Sample The Risk Likelihood rating activity requires detailed knowledge of the operations and associated risks involved in a control room’s pipeline monitoring and control activities. This requires a sample of seasoned operational experts who have full knowledge of the physical characteristics of the pipeline, the operation of the control room’s SCADA system, all pertinent operational policies and procedures, and the organization’s criteria for an ‘unacceptable’ incident. Typically, this would mean that experienced and qualified Controllers and supervisors would provide the most valid Risk Likelihood ratings from a control room. It is recommended that an operator endeavor to obtain a complete sampling of the senior Controllers and their supervisors to ensure that a valid and reliable set of ratings is obtained. A target sample of between 20 and 25 respondents will help to ensure stable and representative results. 3.2. Obtain and Compile Ratings Risk Likelihood ratings are obtained from selected operational experts who provide their judgments regarding the Risk Likelihood level corresponding to each Performance Factor individually, so that valid and independent input on this important parameter can be obtained. Each identified operational expert is provided with a set of cards, each with the definition of one Performance Factor, and the experts are instructed to sort the cards into different groups representing each of the Risk Likelihood levels. The Risk Likelihood level ratings from individual experts can then be tabulated and Risk Likelihood scores computed that reflect the likelihood of risk associated with each Performance Factor in the control room. The resulting Risk Likelihood scores can then be incorporated into the Risk Level calculation procedures during Step 4. STEP 4: CALCULATE RISK LEVELS AND RANK-ORDER HUMAN FACTORS TOPICS FOR OPERATIONAL REVIEW Step 4 is conducted to analyze and integrate the individual Prevalence and Risk Likelihood data in order to provide a metric that can be used to prioritize potential control room human factors topics for further analysis and possible mitigation action. Figure 9 depicts the four activities that comprise this step. Each of these activities is briefly described below. Appendix D provides the materials used in this step, including: Risk Level calculation instructions, an example series of calculations, Risk Levels obtained from an initial trial application of these procedures by participating companies, a Performance Factor Risk Level calculation worksheet, and a Human Factors Topic Risk Level calculation worksheet.#

Attachment 1, passage 21Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview Page 13 4.1 4.1 Compute Compute Prevalence Prevalence Scores Scores 4.3 Calculate Risk Level Scores 4.4 Rank-Order Human Factors Topics 4.2 4.2 Compute Risk Compute Risk Likelihood Scores Likelihood Scores Figure 9. Step 4 Risk Level Calculation Activities 4.1. Compute Prevalence Scores A Prevalence score reflects how often a specific set of working conditions that may adversely affect Controller performance are present in a given control room. The Prevalence score for each individual Performance Factor is calculated to reflect the frequency with which it has been encountered by survey respondents during the past year. 4.2. Compute Risk Likelihood Scores The Risk Likelihood score for a Performance Factor is calculated to reflect a representative value of the respondents’ Risk Likelihood ratings for each Performance Factor. The Risk Likelihood score for each Performance Factor is calculated to reflect the likelihood that the presence of associated working conditions will adversely affect Controller performance and contribute to the occurrence or increased severity of an incident with an unacceptable consequence. 4.3. Calculate Risk Level Scores A Risk Level score reflects the level of risk associated with working conditions in a control room, as indicated by either individual Performance Factors or Human Factors Topics. A Risk Level score for each individual Performance Factor is calculated by multiplying the Prevalence Score and the Risk Likelihood Score for a given Performance Factor. 4.4. Rank-order Human Factors Topics With Risk Level scores calculated for individual Performance Factors, these scores can be used to prioritize topics for further analysis and potential mitigation development. Two sets of rank- ordered lists are prepared for this purpose. First, a Risk Level score for each Human Factors Topic is calculated to prioritize the 29 individual Human Factors Topics. Second, the Risk Level scores calculated for each individual Performance Factor are used to prepare a rank-ordered list of the 138 Performance Factors. This second list provides a check to ensure that any individual Performance Factors with high Risk Level scores that may be grouped in a Human Factors Topic comprised of Performance Factors with relatively low Risk Level scores do not get “lost” because the average Risk Level score for the Human Factors Topic is low.#

Attachment 1, passage 22Page 14 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview STEP 5: SELECT OPERATIONAL REVIEW TOPICS Step 5 is conducted to systematically review all information relevant to control room human factors risks and select a set of topics that will be further investigated through the conduct of operational reviews. Figure 10 depicts the three activities that comprise this step, as well as the review of other inputs during this step. Each of these activities is briefly described below. Operational review topic selection guidance and a worksheet to aid in structuring and documenting the topic selection process and outcome are provided in Appendix E. 5.1 Review Human Factors Topic Risk Level Rankings 5.2 Review High-Risk Performance Factors Review Other Inputs: • Incidents • Accidents • New Risks • Regulation 5.3 Select Operational Review Topics Figure 10. Step 5 Operational Review Topic Selection Activities 5.1. Review Human Factors Topic Risk Level Rankings The first source of information to consider in selecting operational review topics is the Human Factors Topic Risk Level rank-order list prepared during Step 4. This list ranks the 29 Human Factors Topics in their order of estimated relative risk to pipeline operations at a level that allows comprehensive and efficient consideration of the pertinent issues. In reviewing these topics, the team should develop a general understanding of the scope of the upcoming operational review, selecting those topics that can be thoroughly addressed with the resources available. 5.2 Review High-Risk Performance Factors Once a set of Human Factors Topics to be addressed in the operational review is selected, the team should review the rank-order list of individual Performance Factors. The objective of this review is to identify any individual Performance Factors that appear to represent a level of operational risk that indicates that their inclusion in the upcoming operational review would help to understand and/or manage potentially high-risk factors. 5.3. Select Operational Review Topics The final selection of operational review topics should take into account the results of activities 5.1 and 5.2, as well as any other pertinent information. It is recognized that the current methodology addresses a limited range of factors in the selection of operational review topics. Therefore, an additional set of risk management team inputs labeled ‘Other Inputs’ are identified#

Attachment 1, passage 23Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview in Figure 10 to guide the selection of operational review topics based on other operational objectives or in response to incidents, accidents, new risks, and regulations. In reviewing all available inputs, the risk management team should select and document a set of operational review topics that they think represent the greatest potential operational risk that can be comprehensively addressed in the upcoming operational review. Page 15 STEP 6: CONDUCT AND SUMMARIZE OPERATIONAL REVIEWS Step 6 involves planning, conducting, and summarizing the operational reviews. Figure 11 depicts the three major activities that comprise this step, along with the four information collection activities that comprise sub-step 6.2. Each of these activities is briefly described below. General operational review guidance, guidance specific to individual Human Factors Topics and Performance Factors, and operational review worksheets are provided in Appendix F. 6.1 6.1 Define Scope and Plan Define Scope and Plan for Operational Review for Operational Review 6.2 Conduct Information Collection Activities 6.2 Conduct Information Collection Activities Conduct Conduct Incident and Incident and Accident Accident Reviews Reviews Conduct Conduct Interviews Interviews Conduct Conduct Observations Observations Conduct Conduct Materials Materials Reviews Reviews 6. 3 6. 3 Summarize Summarize Operational Reviews Operational Reviews Figure 11. Step 6 Operational Review Activities 6.1. Define Scope and Plan for Operational Review The objective of an operational review is to take a closer look at those Human Factors Topics and individual Performance Factors that represent the greatest potential operational risk by obtaining specific information about the nature of the operational risks, the working conditions contributing to those risks, and potential mitigations that could be implemented to reduce current risk levels. The operational review process begins with the preparation of materials needed to support the subsequent activities. During this stage, the risk management team should look at the topics selected for operational review and identify which operational review activities are best suited for getting the needed information.#

Attachment 1, passage 24Page 16 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview 6.2. Conduct Information Collection Activities Four separate types of operational review information collection activities can be conducted in reviewing any specific topic, as depicted in Figure 11: incident and accident reviews; interviews; observations; and materials reviews. The specific type and focus of information collection activities conducted in addressing any individual topic will depend upon the relative level of operational risks associated with that topic, the availability of information to support each information collection activity, and the resources allocated to the operational review process. There is an advantage to conducting the information collection activities in the sequence shown in Figure 11, since information obtained in earlier activities helps focus the content of later activities. However, other sequences are acceptable if there are logical or practical reasons for doing so. 6.3. Summarize Operational Reviews At the conclusion of the individual information collection activities, the obtained information is integrated, summarized, and documented. For each review topic, the summary should include a description of the specific working conditions that are adversely affecting monitoring and control performance, the nature of potential operational risks associated with the topic under review, and currently-identified mitigations to address specific working conditions and risks. STEP 7: DEVELOP A RISK MITIGATION STRATEGY Step 7 is conducted to develop a risk mitigation strategy that identifies specific mitigations that are judged to provide a feasible approach for addressing the highest-priority human factors risks. Figure 12 depicts the two activities in this step. Each of these activities is described below. Appendix G provides more detailed guidance and worksheets that can be used to help in conducting and documenting this step. 7.1 Identify and Assess Alternative Mitigations for Each Human Factors Topic 7.2 Prioritize Mitigations for Development and Implementation Figure 12. Step 7 Risk Mitigation Strategy Development Activities 7.1. Identify and Assess Alternative Mitigations for each Human Factors Topic Potential mitigations can be identified through a review of the mitigation descriptions provided in Appendix G, through the operational review findings completed during Step 6, and through input by professional colleagues and consultants. After identifying potential mitigations, the risk management team assesses each potential mitigation. Three recommended assessment criteria are: (1) the relevance of a mitigation in directly addressing the work conditions and system operational risks previously identified; (2) the efficacy of a mitigation in reducing the prevalence of working conditions and level of operational risk; and (3) the compatibility of a mitigation with current or future organizational policies and procedures.#

Attachment 1, passage 25Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 17 Methodology Overview 7.2. Prioritize Mitigations for Development and Implementation During the second Step 7 sub-step, the final analysis of potential mitigations is conducted in two activities. First, mitigations are prioritized with respect to their relative value in addressing problematic working conditions and reducing risk levels identified during the earlier risk assessment steps. Then, the development and implementation issues that were identified by the risk management team during this assessment are summarized and documented. STEP 8: DEVELOP AND IMPLEMENT RISK MITIGATIONS Step 8 is conducted to develop and implement the selected risk mitigations. Figure 13 depicts the four activities that comprise this step. Each of these activities is briefly described below. Risk mitigation development and implementation planning guidance and a supporting worksheet are provided in Appendix H. 8.1 8.1 Establish a Establish a Mitigation Mitigation Development Plan Development Plan 8.2 8.2 Develop Develop and Refine and Refine Mitigations Mitigations 8.4 8.4 Implement Implement Mitigations Mitigations 8.3 8.3 Obtain User Feedback Obtain User Feedback Figure 13. Step 8 Risk Mitigation Development and Implementation Activities 8.1. Establish a Mitigation Development Plan In establishing a mitigation development plan, the set of mitigations selected during the preceding step are incorporated into an integrated mitigation development plan that identifies development objectives, resource requirements, schedules, and coordination activities. Importantly, development objectives should include a statement about changes targeted at working conditions and operational risks associated with the specific Performance Factors being addressed by the mitigations in addition to more global safety and efficiency objectives. 8.2. Develop and Refine Mitigations Mitigation development involves the execution of the development plan and coordination of the user feedback activities, as depicted in Figure 13. Mitigation development and refinement should be conducted as an iterative activity involving the periodic collection and review of user feedback to determine if development objectives are successfully addressing those working conditions and operational risks identified in the mitigation development plan.#

Attachment 1, passage 26Page 18 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview 8.3. Obtain User Feedback User feedback should be considered as one of the central components of all mitigation development and implementation efforts. Representatives of the user community whose inputs will be solicited should be identified in advance, making certain that input from a full range of users will be obtained, as appropriate for the specific mitigation characteristics and objectives. When applicable, feedback should be solicited using a structured question format that addresses the specific mitigation development objectives and the individual components and characteristics of the mitigation. 8.4. Implement Mitigations Mitigation implementation can proceed once a complete, first-generation mitigation has been developed. Depending upon the nature of the mitigation, implementation will involve some degree of an extended development activity. Critical components of implementation include user introduction, any required training and orientation, and the collection of user feedback using the structured question format employed during mitigation development and refinement, as appropriate. GENERAL ISSUES IN APPLYING THIS GUIDE The appendices of this guide provide detailed guidance and instructions for conducting each of the eight steps that comprise the current human factors risk assessment and management methodology. However, any operator who is considering using these procedures should be aware of a number of general issues that affect the validity and practicality of these procedures. The following discussions of limitations of the current methodology and general guidance in applying the guide address these issues. Limitations of the Current Methodology The current methodology was generally modeled after relatively mature programs in other process control industries, especially those of the nuclear power and aviation industries. However, it must be recognized that this guide presents a first-generation methodology that was developed with the support of a subset of pipeline operators with limited trial application. Therefore, the current methodology has a number of limitations, as discussed below. Large-scale operator involvement. The current methodology and associated procedures were developed and tested through the participation of relatively large-scale liquid operators. Most operators participating in the current project had control rooms with five or more separate consoles. However, two of these larger operators had smaller satellite operations that also participated in the trial implementation of the procedures. The project team suggests that it would be prudent to conduct a coordinated trial application of the current methodology and guide with smaller liquid pipeline operators to ensure applicability of the methodology and guide to those operators. Liquid product operations focus. This methodology and guide were developed primarily on the basis of the review of operations and participation by liquid pipeline operators. The project involved some exposure to gas pipeline operations, but those operations did not serve as the primary technical reference in defining human factors risks. Based on the project team’s experience with gas pipeline operations, it is our judgment that the current risk assessment and#

Attachment 1, passage 27Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 19 Methodology Overview mitigation materials should undergo a coordinated period of refinement and trial application with gas pipeline operators to ensure that the methodology and guide are tailored to those operations. No trial application of mitigation procedures. Trial application and refinement of the current procedures and tools were limited to the Human Factors Taxonomy, Controller Survey, Risk Likelihood Rating Activity, and Risk Level calculations. The Mitigation Descriptions and Mitigation Selection process underwent an iterative cycle of review and revision; but no actual trial applications. Therefore, these latter procedures would very likely benefit from coordinated trial applications and subsequent refinement. Limited empirical evidence supporting many of the mitigations. There is limited empirical evidence supporting the effectiveness of many of the mitigations identified in this guide. The project team has endeavored to identify the extent to which a mitigation is based upon empirical research, theory, or anecdotal evidence; and key references have been provided to assist operators in learning more about those mitigations with some empirical support. However, operators would certainly benefit from a more complete set of evidence regarding the outcome of developing and implementing many of these mitigations. Paper-based risk assessment and mitigation strategy development procedures and worksheets. The current first-generation procedures and guide are primarily a paper-based set of materials, tools, and procedures. Even with the Controller Survey being administered through a computer-based service and the use of word processing-based worksheets, application of these procedures requires a substantial level of manual data entry and file manipulation. It has been recognized from the start of this project that an integrated computer-based set of procedures would significantly reduce the resources required to apply this methodology. The methodology is not certified as conforming to PHMSA regulations. The current guide is intended to provide one alternative approach in meeting the nominal requirements of upcoming PHMSA human factors risk management regulations in response to Section 12 of the ‘‘Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006’’. However, to date, this guide has not been developed through close collaboration with PHMSA and the conformance of these procedures with PHMSA regulations has neither been assessed by the developers nor certified in any manner by PHMSA. General Guidance in Applying the Guide The underlying intent of this guide is to provide a comprehensive, defensible, and transparent process for assessing and managing human factors risks in the pipeline control room environment. The surveys and worksheets in this guide are intended to both standardize the analytical process, in terms of the parameters and criteria considered, and to provide a standard means of documenting that process. As discussed in the first section of this guide, the basic model and perspective of human factors risks reflected by this methodology assumes that a broad range of factors can potentially contribute to a single incident, including Controller skills and knowledge, workplace characteristics, console and SCADA design, additional automated tools, operational policies and procedures, job design, Controller training, control room staffing levels and assignments, and work scheduling. It is not consistent with the current methodology to single-out Controller performance as the primary cause of any incident without thoroughly analyzing how the full#

Attachment 1, passage 28Page 20 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Methodology Overview range of other factors included in the Human Factors Taxonomy may have contributed to an incident or operational risk. There are a number of management policies, practices, and procedures that can help to establish the foundation for many of the individual mitigations described in this guide. A number of these management activities, which are generally applicable to process control operations, are summarized below. Define corporate priorities and policies regarding appropriate responses to abnormal operating conditions. Alarm management philosophy development is discussed as an individual mitigation in the current guide. However, an even more general activity involves establishing and communicating corporate priorities regarding the relative importance and appropriate response to abnormal conditions that may affect one or some combination of safety, the environment, and profitability. Clear definition and communication of these priorities provides a valuable foundation upon which to establish more specific abnormal operating condition alarm levels and responses. Incorporate appropriate testing of candidate Controllers during the hiring process. Even though the current guide stresses the overlapping contribution of a wide range of human factors to operational risk, it must be recognized that Controller skills and capabilities are significant factors. The value of valid and reliable personnel testing procedures in reducing training costs, increasing retention rates, and managing operational risks is well documented. Tests that were developed for the chemical process control industry have been adapted and evaluated for their applicability to the pipeline Controller job; and at least one private vendor claims that their selection procedures provide a valid and cost-effective means of identifying qualified pipeline Controller job candidates. The implementation of such selection procedures would likely have the general effect of allowing operators to focus on the more fundamental factors that affect human factors risks in their operations. Establish a human factors incident reporting, investigation, analysis, and documentation program. Some industries – most notably nuclear power and aviation – have relatively mature incident human factors reporting, investigation, analysis, and documentation programs in place. These programs employ a standardized taxonomy of human factors, which establishes a basis for sharing knowledge and experience regarding the nature of specific human factors risks and the value of alternative mitigations. The pipeline industry has a stable and effective pipeline integrity management program in place; and individual companies have established more general incident analysis programs. However, neither of these two programs provide the necessary procedures to support an effective human factors incident reporting, investigation, analysis, and documentation program. It is suggested that the Pipeline Operations Human Factors Taxonomy could serve as a very useful starting point in developing such a program by providing the structure and organization that could be used in all phases of a human factors incident program. Implement the current methodology as an iterative ongoing process that takes advantage of the potential risk management feedback loop. After completing the eight steps that comprise this risk management methodology, operators will have the opportunity to assess the effectiveness of their risk mitigation efforts. As depicted in Figure 4 in the Methodology Overview of this guide, the current methodology provides the opportunity to implement a Risk Mitigation Feedback Loop and assess changes over time in the level of operational risks that are associated with specific Human Factors Topics and Performance Factors. By re-administering#

Attachment 1, passage 29Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page 21 Methodology Overview the Controller Survey and Risk Likelihood Ranking Activity after an appropriate period following the implementation of a series of mitigations, an operator will be able to assess the relative levels of various potential operational risks and identify changes in the nature and relative extent of those risks. Formally determining the effectiveness of mitigations in a complex organization is extremely difficult, due to the many uncontrolled events that tend to logically confound any clear-cut comparison. However, the relatively specific and detailed nature of the Performance Factors defined in this methodology should afford a reasonable opportunity for operators to gain some insights regarding the effectiveness of their risk management efforts. Appendix H provides some basic guidance regarding the implementation of this Risk Management Feedback Loop. RISK MANAGEMENT PROCESS OVERVIEW The preceding discussion identifies several inter-related risk management scores, worksheets, and reports that have been developed to support the implementation of this methodology. Figure 14 provides a summary of the Human Factors Risk Management steps identified in this guide; the primary risk management scores, worksheets, and reports associated with each step, and the data sharing paths among these scores, worksheets, and reports. Risk Management Step Step 1: Assemble the Control Risk Management Scores, Worksheets, and Reports Room Human Factors Risk Management Team Prevalence Prevalence Controller Controller Step 2: Administer Controller Prevalence Prevalence Score Score Comment Comment Survey Scores Scores Tables Tables Report Report Risk Risk Risk Risk Step 3: Administer Risk Likelihood Likelihood Likelihood Likelihood Likelihood Ranking Activity Scores Scores Tables Tables Step 4: Calculate Risk Levels Risk Level Risk Level Risk Level Risk Level and Rank-Order Topics for Operational Review Scores Scores Tables Tables Operational Step 5: Select Operational Review Topic Review Topics Summary Sheet Step 6: Conduct Operational Operational Operational Operational Operational Reviews and Summarize Review Review Review Review Findings Worksheets Worksheets Summary Sheets Summary Sheets Mitigation Step 7: Develop a Risk Assessment Mitigation Strategy Sheets Mitigation Step 8: Develop and Development Plan Implement Risk Mitigations Summary Sheets Figure 14. Flow Diagram of Risk Management Steps and Primary Outcomes#

Attachment 1, passage 30Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page A-1 APPENDIX A STEP 1 HUMAN FACTORS RISK MANAGEMENT TEAM GUIDANCE#

Attachment 1, passage 31Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page A-3 STEP 1 HUMAN FACTORS RISK MANAGEMENT TEAM ASSEMBLY GUIDANCE The control room human factors risk assessment and management process commences with the assembly of a human factors risk management team. The organization’s operations management can review desirable team member characteristics and the general charter for the team in establishing the risk management team and then tailor the team’s charter to best meet management objectives and constraints. The human factors risk management team’s activities may require ongoing management involvement to supplement the team, address schedule deviations, review and approve resources, and initiate new cycles of risk management activities. The two major activities comprising this first risk management step are depicted in Figure A-1. Major considerations regarding the conduct of these activities follow. Separate summaries of desirable risk management team member characteristics and a sample risk management team charter are provided at the end of this appendix. 1.1 Select the Team Members 1.2 Establish the Team’s Charter Figure A-1. Step 1 Human Factors Risk Management Team Assembly Activities 1.1 Select the Team Members The first risk management activity starts with the organization’s management selecting the risk management team members. In general, the individuals comprising the risk management team must bring the appropriate skills, knowledge, and experience to this effort. A risk management team should be led by a senior member of the control center staff. Individual team members should bring both corporate operational and risk analysis expertise; as well as control room operational expertise. Support activities, including product scheduling, Controller training and qualification, operational procedures development and documentation, and SCADA engineering should be represented by members of the team. Individual team members should have a demonstrated history of enabling positive operational change – or have a demonstrated aptitude to do so. In addition, it is important that the risk management team maintain continuity throughout the various steps of the process; and management should select individuals who will be available for a minimum of one and preferably two years. Team members should join the team willingly, and have a personal investment in helping to introduce improvements to control room operations. Therefore, candidate team members should be fully briefed on the scope of the activities – including having the opportunity to fully review this guide – and be asked to voluntarily commit to supporting the risk management team. An important consideration in selecting risk management team members is each team member’s ability to critically review current working conditions and be open to considering a broad range of alternative mitigations in addressing identified risks. This requires both the careful selection of flexible and creative individuals and also establishing a team charter and working environment#

Attachment 1, passage 32Page A-4 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance that supports the unbiased and independent review of the full range of working conditions that may be adversely affecting pipeline monitoring and control operations. 1.2. Establish the Team’s Charter Once a risk management team is assembled, management must assign team responsibilities and authorities. It is recommended that an overall team leader be assigned who has experience successfully enabling operational change within the organization. The team leader should be responsible to management for ensuring the quality and completeness of individual activities, as well as communicating with management regarding emerging issues, including critical findings, schedule and budget deviations, and upcoming resource requirements. Individual team members can be assigned lead and/or support roles for the major functions of risk assessment, mitigation selection, mitigation development, and mitigation implementation. Managing the human factors risks within a control room requires a significant organizational commitment, both in terms of the resources expended and the timeframe of the effort. The level of resource investment will vary between organizations based on the risks identified, available resources, and other competing organizational activities. However, it is critical that management demonstrate their commitment by assembling a qualified risk management team that is assigned the resources necessary to complete a full cycle of all eight steps that comprise this methodology (see Figure 4 in the Methodology Overview of this guide). The time frame for completing one cycle of all activities will vary between organizations, based on available resources and competing activities. However, a reasonable scope of effort could likely aim to complete one full cycle of activities within one year under an aggressive schedule (or an effort with limited mitigations developed and implemented) and two years under a more relaxed schedule (or an effort with a substantial number of mitigations developed and implemented).#

Attachment 1, passage 33Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page A-5 RISK MANAGEMENT TEAM GUIDANCE HANDOUTS Recommended Human Factors Team Member Characteristics Page 1 of 1 Team Leader Characteristics Control center mid-level manager or a senior Controller Highly experienced in control room operations Familiar with risk analysis activities Demonstrated capability to manage projects to schedule and budget Demonstrated capability to motivate and engage team members Demonstrated capability to lead group problem solving activities General Characteristics of Team Members Collectively, members of the team should provide expertise in:  Corporate operational and risk analysis expertise  Control room operational expertise  SCADA engineering  Field operations as they affect control room operations  Controller training and qualification  Operational procedures development and documentation  Product scheduling All team members should have a demonstrated history of enabling operational improvements – or have a demonstrated aptitude to do so, as evidenced by creative brain storming and problem solving skills, as well as good team membership and communications skills. All team members should be available to support the risk management team for a minimum of one year and preferably two years. All team members should read this guide and fully understand the described objectives and procedures, especially:  The model of incident causation (Figure 1);  The pipeline control room human factors taxonomy;  The operational review guidance; and  The detailed mitigation descriptions.#

Attachment 1, passage 34Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page A-7 Sample Human Factors Risk Management Team Charter Page 1 of 3 The following charter has been established for (operating company’s) Human Factors Risk Management Team. Date Team Charter Established:_______________________________ Risk Management Team Resources Team Staffing. The following personnel are assigned as members of the (operating company’s) Human Factors Risk Management Team. Team Leader: _________________________________ Alternate Leader: _________________________________ Members: _________________________________ _________________________________ (add lines as needed) Controller Survey Participation. The planned sample of Controllers to be administered the 2-hour Controller Survey is (check one):  Less than 80% of all active Controllers (not recommended)  A minimum of 80% of all active Controllers (recommended minimum)  95 - 100% of all active Controllers (preferred) Survey Administration Budget. The following budget has been set aside for the administration, data compilation, and analysis of the Controller Survey: $ ____________ Risk Likelihood Rating Activity Participation. The planned sample of Control Center personnel who will complete the Risk Likelihood Rating Activity are (check one):  Less than 50% of all senior Controllers, team leaders, and supervisors who are experienced in understanding the specific operational risks associated with pipeline monitoring and control operations (not recommended)  A minimum of 50 - 75% of all senior Controllers, team leaders, and supervisors (or 10 - 15 in total) who are experienced in understanding the specific operational risks associated with pipeline monitoring and control operations (recommended minimum)  100% of all senior Controllers, team leaders, and supervisors (or 20 - 25 in total) who are experienced in understanding the specific operational risks associated with pipeline monitoring and control operations (preferred)#

Attachment 1, passage 35Page A-8 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Sample Human Factors Risk Management Team Charter continued Page 2 of 3 Risk Management Team Resources, continued Operational Review Support. The following personnel categories will be made available to support the conduct of operational reviews (check all that apply):  Control Center Management  Control Room Supervisors  Controllers  Controller Training Developers  Controller Procedure and Manual Developers  SCADA Engineers  Control Center Human Resources  Company Risk Assessment Professionals  Company Health and Human Safety Professionals  Pipeline Schedulers  Other (specify): ___________________________________________ ___________________________________________ ___________________________________________ Mitigation Development Budget. The following budget has been set aside for the development of human factors risk mitigations: $ Risk Management Milestone Schedule The following schedule milestones are established for planning purposes. Milestone Planned Completion Date (Recommended month after start) Controller Survey Administration Month 2 Risk Likelihood Rating Activity Administration Month 3 Risk Level Calculation Month 4 Operational Review Plan Month 4 Operational Review Completion Month 6 Mitigation Strategy Plan Development Month 8 Mitigation Development and Implementation To Be Determined#

Attachment 1, passage 36Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page A-9 Sample Human Factors Risk Management Team Charter continued Page 3 of 3 Team Roles and Responsibilities Team Leader  Lead (or delegate and manage) all team meetings required to effectively complete a cycle of control room human factors risk assessment and management  Ensure that all risk assessment and management activities are conducted in accordance with company policy and/or the guidance provided in the Risk Management Guide  Ensure that all risk assessment and management activities are completed within the established budget and schedule  Maintain communications with Control Center management regarding critical findings, anticipated schedule and budget deviations, and projected resource requirements Alternate Team Leader  Fulfill the Team Leader responsibilities, as required, due to Team Leader unavailability Specific Team Member Assignments The following individual team member lead and support assignments have been established. Note that responsibility for the development of individual mitigations should be assigned after the mitigation strategy plan has been completed. Responsibility Assigned Team Member Controller Survey Administration and Scoring Lead: Support: Risk Likelihood Rating Activity Administration and Scoring Lead: Support: Human Factors Risk Level Assessment Lead: Support: Operational Review Coordination Lead: Support: Mitigation Strategy Plan Development Coordination Lead: Support: Risk Assessment Documentation Quality Control Lead: Support:#

Attachment 1, passage 37Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 1 Human Factors Risk Management Team Guidance Page B-1 APPENDIX B STEP 2 CONTROLLER SURVEY AND ADMINISTRATION INSTRUCTIONS#

Attachment 1, passage 38Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Page B-3 STEP 2 CONTROLLER SURVEY ADMINISTRATION INSTRUCTIONS The Controller Survey is used to obtain two types of information from Controllers. First, it is used to obtain ratings of how often Controllers encounter working conditions associated with individual Performance Factors. Second, the survey is used to obtain Controllers’ detailed descriptions of working conditions that may be adversely affecting their ability to effectively monitor and control pipeline operations. The survey consists of several Controller background questions, followed by a series of items corresponding to each of the 138 Performance Factors. The background questions provide a means of characterizing the sample of Controllers who complete the survey at a site. The responses to these questions are particularly useful in interpreting responses to survey questions that may be associated with Controller training or experience level. Figure B-1 depicts the four activities involved in preparing for and administering the Controller Survey. Instructions regarding each of these activities are provided below. The Liquid Pipeline Human Factors Taxonomy and a copy of the Controller Survey are provided in this appendix immediately following these instructions. 2.1 Define Controller Respondent Sample 2.2 Determine Method of Confidential Survey Administration 2.3 Determine Mode of Survey Administration 2.4 Administer Survey and Compile Responses Figure B-1. Step 2 Controller Survey Administration Activities. 2.1. Define Controller Respondent Sample The Controller Survey should be administered to an adequate sample of Controllers to ensure that the obtained Prevalence ratings and working condition descriptions accurately represent the current Controller workforce. The responses to the Controller Survey are intended to provide a valid and representative sample of Controllers’ first-hand reports of working conditions. Operators will want to be able to compare survey results across time, so a fully representative sample is important. It is recommended that a minimum of 80% of all active Controllers who are assigned to each console complete the survey – a sample of all Controllers (100%) is preferable. If a 100% sample of Controllers from each console cannot be obtained, then those Controllers who complete the survey should be selected randomly – basically, the names of Controllers assigned to each console should be drawn from a hat without any consideration for their expected survey responses. For those cross-trained Controllers who actively work on more than one console, each individual should be asked to complete the survey by considering their experience with one particular console. If there are multiple Controllers in this situation, the survey administrator should take#

Attachment 1, passage 39Page B-4 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions care to balance the number of Controllers who are completing the survey with a reference to different consoles, so that the total number of surveys completed by Controllers who are referring to one console is as equal as possible across consoles. When the Controller Survey sample has been defined, a table similar to Table B-1 could be prepared to summarize the sample of Controllers who will be providing responses with reference to each console. Cross-trained Controllers should be listed under the console they will use as their reference console. Table B-1. Example of a Controller Survey Sample Summary Table Controller Survey Sample Summary Console A Sample Console B Sample Console C Sample … Console N Sample 1. 2. 3. 4. 5. 6. 1. 2. 3. 4. 5. 6. 1. 2. 3. 4. 5. 6. 1. 2. 3. 4. 5. 6. 1. 2. 3. 4. 5. 6. 2.2. Determine Method of Confidential Survey Administration Although it is not strictly required by the nature of the survey items, it is highly recommended that administration of the Controller Survey employ a confidential means of survey administration. It is likely that some Controllers will feel more comfortable and willing to fully describe the nature of adverse working conditions if they are assured that their individual survey responses will be treated confidentially. The following statement is included in the introductory page of the Controller Survey to assure Controllers about the confidentiality of survey administration. If full confidentiality cannot be provided, then this portion of the survey introduction should be modified as appropriate. This survey is being confidentially administered to Controllers in your control room. Your individual input to this survey will not be disclosed to your management. No survey responses will be released that could be directly associated either with an individual Controller or with a small identifiable group of Controllers. The survey administrator will combine results across Controllers before submitting the survey results to your management team. The most straight-forward means of ensuring Controller confidentiality is through third-party administration. If your company has established procedures for administering fully confidential surveys, then these procedures might be used. Another alternative is to hire an outside consultant who can be fully trusted to maintain Controller confidentiality and administer and compile survey responses prior to providing the results to the risk management team.#

Attachment 1, passage 40Control Room Human Factors Risk Assessment and Management Guide Page B-5 Step 2 Controller Survey and Administration Instructions 2.3. Determine Mode of Survey Administration This guide provides a text version of the Controller Survey. The survey can be administered as a paper-and-pencil survey by directly copying this text version and handing it out to the Controllers who will be completing the survey. However, there is a substantial advantage in efficiency if the survey is administered as a computer-based survey. An efficient approach towards computer-based administration is to administer the survey using one of several commercial survey administration vendors who administer the survey via the world wide web. These vendors provide adequate confidentiality if the survey is administered by a third party. Using a web-based administration service, individual respondents are identified, sent an invitation to access a specific website to complete the survey, and the status of their survey completion is automatically monitored and available to the client. These vendors typically provide survey responses in various electronic file formats; and an operator should be able to identify a vendor who can provide a format that is compatible with the software application that is planned for use in compiling and analyzing survey responses. An alternative computer-based administration approach to that of using a web-based commercial service would be to develop a computer application that could be used to administer the survey through a company’s internal computer network. This latter alternative provides some additional security benefits, but it would require substantial software development resources and additional confidentiality safeguards. If such an application were developed by an individual operator; it could be cost-prohibitive. However, it could be cost-effective if development costs were shared among a consortium of operators. 2.4. Administer the Survey and Compile Responses Controllers should be assigned a period to complete the survey when they can work in a quiet environment where they will not be interrupted. Acceptable administration alternatives are: (1) to have Controllers report to their work setting for a 2-hour period when they are not responsible for console operations; and (2) to have Controllers complete the survey at their home during an extended period away from work. Controllers should not be given the option of completing the survey while they are concurrently responsible for console operations. It is preferable to have Controllers complete the survey during one extended two-hour session. In this way, Controllers’ responses are likely to be consistent between individual survey sections. However, because it takes approximately two hours to complete the Controller Survey, there is a legitimate concern that Controllers will not maintain an entirely consistent approach in completing items during that period. Specifically, Controllers could tend to be less careful and less detailed in their open-ended responses in later parts of the survey. To address this concern, the survey should be administered to equally-sized Controller subgroups in the three different orders summarized in Table B-2. Care should also be taken to have roughly equivalent subgroups representing each console.#

Attachment 1, passage 41Page B-6 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Table B-2. Recommended Controller Subgroups and Survey Section Completion Order Survey Section Subgroup 1 Subgroup 2 Subgroup 3 Completion Order (one-third) (one-third) (one-third) First Section B (Background) Section B (Background) Section B (Background) Second Sections 1-3 Sections 4-6 Sections 7-11 Third Sections 4-6 Sections 7-11 Sections 1-3 Fourth Sections 7-11 Sections 1-3 Sections 4-6 In completing the survey, it is advisable that Controllers have the opportunity to take brief breaks at appropriate points in the survey. Following the second and third portions of the survey, there are written suggestions in the survey indicating that Controllers are advised to take a brief break before proceeding with the next portion of the survey. In compiling survey responses, computer-based survey administration allows the importation and concatenation of electronic files for subsequent data grooming and analysis. As noted above, web-based services will typically provide electronic file formats compatible with common data analysis packages, such as spreadsheets or commercial statistical analysis packages. If the survey is administered in a paper-and-pencil mode, all survey responses will need to be input into an electronic format prior to review and analysis. Manual data entry errors can be minimized by implementing the common practice of entering all data in two separate files and comparing these files to identify and correct errors. Caution must be taken to ensure that Controller confidentiality is maintained during any manual data entry activity. During the trial administration and analysis of the Controller Survey, Microsoft Excel™ was used to compile the database and conduct the analyses. The basic file structure used was that of a row of data for each Controller who completed the survey. Individual fields were defined for each separate survey response in the spreadsheet.#

Attachment 1, passage 42Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Page B-7 LIQUID PIPELINE CONTROL ROOM HUMAN FACTORS TAXONOMY Following is the Liquid Pipeline Control Room Human Factors Taxonomy. The individual Human Factors Areas, Human Factors Topics, and Performance Factors are listed in a manner that makes the nesting of more detailed elements clear. The Performance Factor Identifying Number (PF ID) provided in the left-hand column corresponds directly to each Controller Survey item number that is based on one Performance Factor. In computing Human Factors Topic-level Risk Level scores, scores corresponding to individual Performance Factors are first computed (see Appendix C) and then combined in accordance with the Human Factors Topic identifier in the right-hand column of the taxonomy table. Human Factors Topic scores represent averages of all Performance Factors nested under that Human Factors Topic. HF Topic PF ID Performance Factor Risk Calculation Human Factors Area 1. Task Complexity and Workload Topic 1.1 Task Design 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three) 1.1 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex 1.1 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities 1.1 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations 1.1 1.1.5 Some operations have a very small margin for error 1.1 Topic 1.2 Console Workload 1.2.1 Two or more control operations (e.g., line switches) must be done at the same 1.2 time 1.2.2 Excessive telephone activity interferes with monitoring and control operations 1.2 1.2.3 Shift hand-off activities interfere with operations 1.2 1.2.4 Unusual work conditions (trainees, tours/visitors) interfere with operations 1.2 1.2.5 Unusual operational conditions (smart pigging, major repairs) interfere with operations 1.2 1.2.6 Controllers have to make important operational decisions without sufficient time to adequately consider alternatives 1.2 Human Factors Area 2. Displays and Controls Topic 2.1 Equipment Layout and Workstation Design 2.1.1 There are not enough display monitors to show all of the information that a Controller needs at one time during normal operations 2.1 2.1.2 There are not enough display monitors to show all of the information that a Controller needs at one time during abnormal situations 2.1#

Attachment 1, passage 43Page B-8 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions HF Topic PF ID Performance Factor Risk Calculation 2.1.3 Monitoring and control activities are disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare) 2.1 2.1.4 Monitoring and control activities are disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast) 2.1 Topic 2.2 SCADA Information Access and Layout 2.2.1 Inconsistencies in SCADA display design from screen to screen increase the difficulty of getting needed information 2.2 2.2.2 A cluttered, or complicated SCADA display increases the difficulty of finding needed information 2.2 2.2.3 The layout of information (e.g., lines, equipment, and data) on the SCADA display increases the difficulty of finding, identifying, and interpreting information 2.2 2.2.4 Needed information is not shown on the appropriate SCADA display 2.2 2.2.5 Controllers must navigate between more than two SCADA displays to view related information 2.2 * 2.2.6 Navigating between SCADA displays interferes with the flow of monitoring and control activities 2.2 2.2.7 The location or layout of SCADA control boxes/targets makes them difficult to use 2.2 Topic 2.3 SCADA Information Content, Coding, and Presentation 2.3.1 Information about which part of the pipeline system the current SCADA display represents is not adequately provided 2.3 2.3.2 Some colors on SCADA displays make data interpretation difficult 2.3 2.3.3 Some labels on SCADA displays make data interpretation difficult 2.3 2.3.4 Some symbols on SCADA displays make data interpretation difficult 2.3 2.3.5 Controllers must transform values from the measurement scale presented on the SCADA display to another scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task 2.3 2.3.6 SCADA displays do not provide adequate system overview information for keeping track of system status 2.3 2.3.7 There is inconsistent use of units of measure (e.g., gallons, barrels, cubic meters) on SCADA displays 2.3 Human Factors Area 3. Communications Topic 3.1 Shift Hand-off Procedures 3.1.1 Shift hand-off procedures or tools do not adequately identify, track, and record information required by the Controller coming on shift 3.1 3.1.2 Formal shift hand-off procedures are not adequately followed by Controllers 3.1 * Corresponds with final survey item.#

Attachment 1, passage 44Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions PF ID Performance Factor Topic 3.2 Control Center Communications 3.2.1 The exchange of required operations information between Controllers on different consoles is not adequate 3.2.2 Control center staff (not including field technicians) are not available to provide assistance with an operational issue when required 3.2.3 The lines of communication in the control room are not clearly defined or adhered to Topic 3.3 Schedule Communications 3.3.1 Product delivery schedules are inaccurate 3.3.2 Changes in product delivery schedules are not communicated to Controllers at all 3.3.3 Changes in product delivery schedules are communicated to Controllers without sufficient lead time Topic 3.4 Field Personnel Communications 3.4.1 Field technicians are not available to assist Controllers with an operational issue when required 3.4.2 Important field information (e.g., operational and maintenance activities) is not provided directly to Controllers in a timely manner 3.4.3 Field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to Controllers 3.4.4 Field personnel do not fully communicate important ongoing operational conditions (e.g., pigging or repairs) to Controllers 3.4.5 Controllers have difficulty communicating with field personnel due to a lack of available communications equipment Human Factors Area 4. System Information Accuracy and Access Topic 4.1 Operational Information Accuracy and Availability 4.1.1 SCADA data from field instruments (meters, gauges, etc.) are inaccurate 4.1.2 SCADA data are stale/out-of-date, or unavailable due to a communications problem (e.g., outage, time delay) 4.1.3 The SCADA display does not indicate that data are out-of-date or unavailable 4.1.4 Changes in field system operational status (e.g., equipment identity or operational activities) are not adequately indicated on SCADA displays 4.1.5 Displayed pipeline schematics or operational parameters (e.g., MOPs) are inaccurate 4.1.6 Manually entered batch, log, and/or summary information is not accurate 4.1.7 Required information is not available on the SCADA display Page B-9 HF Topic Risk Calculation 3.2 3.2 3.2 3.3 3.3 3.3 3.4 3.4 3.4 3.4 3.4 4.1 4.1 4.1 4.1 4.1 4.1 4.1#

Attachment 1, passage 45Page B-10 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions HF Topic PF ID Performance Factor Risk Calculation Human Factors Area 5. Job Procedures Topic 5.1 Job Procedure Design 5.1.1 When to use a procedure is not clearly defined 5.1 5.1.2 Required technical detail is not provided by a procedure 5.1 5.1.3 Procedures are difficult to read 5.1 5.1.4 Critical information is difficult to find in a procedure 5.1 5.1.5 Procedures do not meet the needs of both novice and experienced operators 5.1 5.1.6 Procedures and job aids used in responding to abnormal situations are difficult to follow 5.1 Topic 5.2 Job Procedure Availability 5.2.1 A specific required operations procedure is not available 5.2 5.2.2 Finding an individual procedure among the large overall number of procedures is difficult 5.2 5.2.3 Procedures and job aids required to identify and recover from abnormal situations are not readily available 5.2 Topic 5.3 Job Procedure Accuracy and Completeness 5.3.1 Procedures contain out-of-date or inaccurate information 5.3 5.3.2 Procedure update notifications are not adequately provided to Controllers 5.3 5.3.3 Controllers do not understand the documented procedure 5.3 5.3.4 Controllers execute actions in a manner that is not consistent with established and documented procedures because the procedure is incorrect or incomplete 5.3 Human Factors Area 6. Alarm Presentation and Management Topic 6.1 Alarm Availability and Accuracy 6.1.1 No alarm is available to notify the Controller about important current operational status information (e.g., pressure or batch interface at a specific point in the line) 6.1 6.1.2 Alarms do not provide the Controller with sufficient lead time to take corrective actions (i.e., because of sensor location) 6.1 6.1.3 Changes in operating conditions triggered by external events that are outside of Controllers’ influence (e.g., equipment failure or maintenance on a feeder system) are not displayed on the SCADA 6.1 Topic 6.2 Alarm Display and Presentation 6.2.1 Alarm displays become too cluttered making it difficult to identify Important 6.2 alarms 6.2.2 The alarm display shows alarms from another console and Controllers have difficulty finding the alarms for their console 6.2 6.2.3 High-priority alarms are ineffective in attracting a Controller’s attention when performing other activities 6.2 6.2.4 The sound or loudness of critical alarms startles Controllers unnecessarily 6.2#

Attachment 1, passage 46Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions PF ID Performance Factor 6.2.5 The sound of an alarm does not clearly indicate the intended alarm priority 6.2.6 The color of an alarm does not clearly indicate the intended alarm priority Topic 6.3 Alarm Interpretation 6.3.1 The displayed alarm description is difficult to interpret 6.3.2 There are multiple causes for some alarms, but insufficient information is provided to identify the actual cause 6.3.3 Alarm summary information does not provide adequate information about conditions at the time that the alarm was triggered 6.3.4 Alarms are not displayed in a consistent format, making their interpretation difficult 6.3.5 It is difficult to determine the intended priority of an alarm Topic 6.4 Alarm Access and Acknowledgement 6.4.1 The process of clearing alarms interferes with monitoring and control operations 6.4.2 Controllers unintentionally clear important alarms when there are too many alarms that need to be cleared 6.4.3 It is difficult to sort alarms by priority, time of occurrence, or other useful dimensions 6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screens, or keystrokes to access previously acknowledged alarms) 6.4.5 Controllers accidentally acknowledge or clear alarms for an adjacent console Topic 6.5 Nuisance Alarms 6.5.1 The number of nuisance alarms limits the ability to quickly identify potentially important alarms 6.5.2 Monitoring and control operations are disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up) 6.5.3 Monitoring and control activities are disrupted by unnecessary information, alarms, or notifications being displayed on the alarm screen (e.g., action started, action completed, etc.) 6.5.4 Too many nuisance alarms are caused by equipment that is waiting to be fixed 6.5.5 Some alarms classified as critical do not represent true critical situations Human Factors Area 7. Controller Training Topic 7.1 Pipeline Fundamentals Knowledge and Field Exposure 7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter 7.1.2 Controller on-the-job training does not provide the optimal assignment of mentor(s) to ensure exposure to a sufficient range of expertise and good operating practices 7.1.3 Controllers are not provided adequate training about hydraulics Page B-11 HF Topic Risk Calculation 6.2 6.2 6.3 6.3 6.3 6.3 6.3 6.4 6.4 6.4 6.4 6.4 6.5 6.5 6.5 6.5 6.5 7.1 7.1 7.1#

Attachment 1, passage 47Page B-12 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions HF Topic PF ID Performance Factor Risk Calculation 7.1.4 Controllers are not provided adequate training on field operations and field systems 7.1 7.1.5 Controllers are not adequately trained on specific console operations prior to working alone 7.1 7.1.6 Controllers are not provided refresher training frequently enough 7.1 7.1.7 Controllers are not provided adequate training before the introduction of a new 7.1 pipeline 7.1.8 Controllers are not provided adequate training on a specific operational procedure, product, or tool before it is introduced into operation 7.1 Topic 7.2 Emergency Response Training 7.2.1 Controllers are not adequately trained in emergency response 7.2 7.2.2 Controller are not adequately trained in handling abnormal situations 7.2 Human Factors Area 8. Coping with Stress Topic 8.1 Abnormal Situation Task Assignments 8.1.1 Controllers are distracted in their response to abnormal situations by non- critical, ongoing duties (e.g., responding to phone calls) 8.1 8.1.2 Controllers are distracted in their response to abnormal situations by the need to provide required notifications 8.1 8.1.3 Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations 8.1 8.1.4 Control room staff roles and responsibilities during abnormal situations are not well defined 8.1 Topic 8.2 Control Room Distractions 8.2.1 Controllers are distracted from monitoring and controlling operations by the need to complete operations reports (e.g., operating sheets, production summaries, line status summaries) 8.2 8.2.2 Controllers end up completing work that is assigned to schedulers 8.2 8.2.3 Field personnel do not provide adequate or timely support to Controllers 8.2 8.2.4 Stressful relations with control room management distracts Controllers from monitoring and control operations 8.2 8.2.5 Stress resulting from productivity goals, incentives, or penalties distracts Controllers from monitoring and control operations 8.2 Human Factors Area 9. Controller Alertness Topic 9.1 Controller Fatigue 9.1.1 A Controller feels particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm) 9.1 9.1.2 A Controller feels drowsy or tired throughout most of a shift 9.1 9.1.3 A Controller feels fatigued at the end of a shift 9.1#

Attachment 1, passage 48Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Page B-13 HF Topic PF ID Performance Factor Risk Calculation Topic 9.2 Controller Schedule and Rest 9.2.1 Controllers get insufficient sleep because of transitions in shift schedules from day to night or night to day 9.2 9.2.2 Controllers get insufficient sleep because of being called in to work a shift on short notice 9.2 9.2.3 Controllers get insufficient sleep because of overtime work 9.2 9.2.4 Controllers get insufficient sleep because of twelve hour shifts 9.2 9.2.5 Controllers get insufficient sleep because of ongoing understaffing 9.2 9.2.6 Controllers get insufficient sleep because of shift start times 9.2 Topic 9.3 Slow Work Periods 9.3.1 Controllers experience reduced alertness during slow work periods 9.3 9.3.2 Controllers experience difficulty regaining alertness to deal with a challenging situation following a slow work period 9.3 Topic 9.4 Alertness Management Practices 9.4.1 Controllers report to work tired enough that they are concerned about their ability to run the pipeline 9.4 9.4.2 Controllers do not notify management when they report to work without adequate rest 9.4 9.4.3 Controllers report for work tired because they have not been provided training on sleep basics, personal alertness practices, and effective fatigue-reduction practices 9.4 Human Factors Area 10. Automation Topic 10.1 Automated Operations 10.1.1 Automation of control actions makes the Controller job more difficult 10.1 10.1.2 Too many steps are required to set up an automated sequence of control 10.1 actions 10.1.3 Automated operation of some equipment conflicts or interferes with Controller 10.1 actions 10.1.4 Controllers can forget to perform a manual control action because the initial steps are automated 10.1 10.1.5 Automation is not consistent across similar stations/locations 10.1 10.1.6 Controllers do not understand how automation works at a station/location 10.1 10.1.7 Controllers do not sufficiently trust the reliability of control action automation 10.1 10.1.8 There are some steps in an automated sequence that are not displayed by SCADA 10.1 10.1.9 There are specific control actions (e.g., line ups, line shutdown, and manifold flushing) that would benefit from automation 10.1#

Attachment 1, passage 49Page B-14 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions HF Topic PF ID Performance Factor Risk Calculation Human Factors Area 11. Control Room Design and Staffing Topic 11.1 Control Room Design 11.1.1 The location of break facilities keeps Controllers away from their console too 11.1 long 11.1.2 The location of break facilities keeps Controllers from taking appropriate brief 11.1 breaks 11.1.3 The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.) 11.1 11.1.4 Controllers on break cannot be reached to address an immediate operational situation 11.1 Topic 11.2 Control Room Staffing 11.2.1 Another Controller’s long break times puts an excessive burden on the relieving Controller 11.2 11.2.2 Controller staffing is not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc.) 11.2 11.2.3 Controller staffing is not adequate to allow for vacation, sick leave, and/or regularly scheduled days off 11.2 11.2.4 Controllers work on their scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc.) 11.2 11.2.5 Controller staffing is not adequate to provide Controller assistance during busy normal operations 11.2 11.2.6 Controller staffing is not adequate to provide Controller assistance during abnormal situations 11.2#

Attachment 1, passage 50Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Page B-15 CONTROLLER SURVEY The remainder of this appendix consists of a complete copy of the Controller Survey. As discussed in the preceding instructions, this survey can be administered by either preparing and administering paper copies or by adapting the electronic file of this survey into a format that is compatible with the computer-based administration software application that is used.#

Attachment 1, passage 51Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 1 PIPELINE CONTROLLER SURVEY Introduction This survey is part of a broader activity being conducted by your company to identify, analyze, and manage the operational risks associated with human factors in your control room. The term human factors refers to a wide variety of factors that affect the performance of control room personnel. The primary focus of this effort is on the monitoring and control activities of Controllers who have the primary responsibility for operations safety and efficiency. This survey will provide your management team with an initial understanding of those human factors that should be looked at more closely to determine if there is an opportunity to reduce operational risks in your control room. This survey is being confidentially administered to Controllers in your control room. Your individual input to this survey will not be disclosed to your management. No survey responses will be released that could be directly associated either with an individual Controller or with a small identifiable group of Controllers. The survey administrator will combine results across Controllers before submitting the survey results to your management team. Please check the box below to acknowledge your understanding of the survey objectives, the confidential procedures being used in reporting survey results, and to proceed to the survey instructions. Yes Please Continue#

Attachment 1, passage 52Page 2 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Survey Items This survey asks you to report on specific conditions that affect your ability to safely and efficiently monitor and control pipeline operations at your primary desk or console. There are two types of questions: Frequency questions and Percentage questions. Descriptions of these are provided below. Frequency Questions Frequency questions ask you to estimate how often you encounter specific conditions at your primary desk/console and/or control center that affect your ability to safely and efficiently monitor and control pipeline operations. An example question and answer about a hypothetical respondent’s computer is shown below: How frequently do you have to reboot your computer? Never Once a Few year times a Once a month year If Once a week or more, please explain briefly: Computer locks up after running communications software Once a week Once a day More than once a day More than once an hour In the example above, the respondent estimates that the need to reboot occurs more frequently than “Once a month” but less frequently than “Once a day” so the box under “Once a Week” has been checked and the “Computer locks up after running communications software” explanation has been written in the space below the question. In responding to each Frequency question, you will be asked to check the one box that best reflects how many times you have personally experienced the identified condition during your past year working as a Controller for your current operating company. Note that if you have not worked as a Controller throughout the past 12 months, you will need to estimate the yearly rate if the condition is quite infrequent. If the frequency of a condition has changed over the course of the past year, please try to estimate the average frequency rather than the most recent frequency. For example, if you were asked about the frequency of thunder storms, your answer may depend on the current time of the year – with such storms occurring about once a week during half of the year and about once during the entire other half of the year. A reasonable average frequency in this case would be about 20 times per year, which would best be reflected as “Once a month”. Finally, while explanations are useful, it is more important to provide an accurate frequency estimate. Please do not answer a lower frequency just to avoid providing an explanation. It is acceptable to leave the explanation space blank if you can’t easily think of a brief explanation or if you do not wish to provide one. Please Continue#

Attachment 1, passage 53Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 3 Percentage Questions Percentage questions are the second part of two-part questions that deal with conditions associated with relatively infrequent abnormal conditions or emergency events. Two questions in this survey ask you to estimate the frequency that abnormal situations or emergency events occur. For the purposes of this questionnaire, please use the following definitions. Abnormal situations are ones in which a Controller must initiate control actions to address a condition that may: (a) indicate a condition exceeding an operating design limit; or (b) result in a hazard(s) to persons, property, or the environment. Emergency events are ones in which there is an apparent actual hazard to persons, property, or the environment. Percentage questions ask you to estimate the percentage of time during an abnormal situation or emergency event that you encounter specific conditions at your primary desk/console and/or control center that affect your ability to safely and efficiently monitor and control pipeline operations. An example question and answer about a hypothetical respondent’s computer is shown below: How frequently do you have to reboot your computer during an abnormal situation? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: Computer locks up sometimes during a flood of alarms. In the example above, the respondent estimates that the need to reboot occurs approximately 20% of the time during abnormal situations so the box under “20%” has been checked and the “Computer locks up sometimes during a flood of alarms” explanation has been written in the space below the question. In responding to each Percentage question, you will be asked to check the one box that best reflects the percentage of time you have personally experienced the identified condition during past abnormal situations or emergency events while you have been working as a Controller for your current operating company. Because abnormal situations or emergency events are relatively rare, you are asked to consider your recent experience, going back several years. However, if a condition has been addressed in the recent past, then you should not indicate that it occurs. As in the case with the Frequency questions, explanations are useful, but it is more important to provide an accurate percentage estimate. Please do not answer a lower percentage just to avoid providing an explanation. It is acceptable to leave the explanation space blank if you can’t easily think of a brief explanation or if you do not wish to provide one. Please check the box below to acknowledge your understanding of the survey items and to proceed to the next section. Yes Please Continue#

Attachment 1, passage 54Page 4 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Survey Organization and Completion This survey consists of an initial Background section followed by 11 separate Human Factor Area sections. Each of these two types of sections is described below. The Background section asks you to report some basic information about your experience and training, work schedule, and Control Room. Your answers to these questions will be useful in determining ways in which Control Center conditions can be improved for subsets of Controllers who may be experiencing specific difficulties in the control room. The 11 Human Factors Area sections include sets of Frequency and/or Percentage questions that ask about specific Control Room Human Factors. You are asked to answer each question in the order that it is presented, completing each section before going on to the next section. It will take approximately 2 hours to complete the entire survey. You will be given instructions from your management regarding local administration of the survey. In general, it will be best if you take some brief breaks between some of the sections to ensure that you are taking a “fresh look” at each item. Suggested points for breaks are identified as you complete the survey. When you have completed the survey, please follow the instructions for submitting it to the confidential survey administrator. Please check the box below to acknowledge your understanding of the survey organization and completion and to proceed to the next section. Yes Please Continue#

Attachment 1, passage 55More 15 years More 15 years Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 5 Section B. Background Information B.1 Experience and Training B.1.1 How many years have you worked in the pipeline industry? Less than 1 year Between 1 and 2 Between 2 and 3 Between 3 and 4 Between 4 and 5 Between 5 and 10 Between 10 and 15 B.1.2 How many years have you worked as a Controller in a pipeline Control Room? Less than 1 year Between 1 and 2 Between 2 and 3 Between 3 and 4 Between 4 and 5 Between 5 and 10 Between 10 and 15 B.1.3 How many separate pipeline Control Room consoles are you personally certified to operate at this time? None One Two Three Four or more B.1.4 How many years have you been certified to operate a specific console in your current Control Room? (If you are certified to operate more than one console, indicate the longest period. Include both internal company certification and DOT- approved Operator Qualifications certification in determining the period of certification.) Less than 1 year Between 1 and 2 Between 2 and 3 Between 3 and 4 Between 4 and 5 Between 5 and 10 Between 10 and 15 B.2 Work Schedule B.2.1 On average, how long is your commute from home to your Control Center? Less than 10 minutes Between 10 and 20 minutes Between 20 and 30 minutes Between 30 and 45 minutes Between 45 and 60 minutes Between 60 and 90 minutes Between 90 and 120 minutes B.2.2 Which of the following best describes your work shift schedule? Rotate regularly between 12-hour day and night shifts Work primarily 12-hour day shifts Work primarily 12-hour night shifts Rotate regularly between 8-hour day, swing, and graveyard shifts Work primarily 8-hour day shifts Work primarily 8-hour swing shifts More 15 years More two hours Work primarily 8-hour graveyard shifts#

Attachment 1, passage 56Page 6 Control Room Human Factors Risk Assessment and Management Guide Controller Survey B.2.3 Six or less shifts On average, how many shifts per 4-week month do you normally work at a console (including overtime)? (If your work rotation is not based on a 4-week period, please estimate an average for a 4-week period.) 7-8 shifts 9-10 shifts 11-12 shifts 13-14 shifts 15-16 shifts 17-18 shifts 19-20 shifts 21-22 shifts More than 22 shifts B.2.4 Describe your current shift rotation schedule in the space below. B.3 Control Room B.3.1 Less than four When your Control Room is fully staffed with Controllers, how many Controllers are assigned to your console? Four Four and one-half Five Five and one-half Six More than six B.3.2 Single console in isolated room Other Which of the following best describes your Controller console arrangement? Paired consoles in isolated room Individual consoles in a shared Control Room Paired consoles in a shared Control Room#

Attachment 1, passage 57Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 7 1. Task Complexity and Workload This topic refers to the specific activities that you perform while operating and monitoring your pipeline. 1.1 Task Design 1.1.1 How often do you need to perform more than three steps to execute a control (e.g., open/close valves, start/stop pumps, change set point)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour 1.1.2 How often do you perform routine activities (e.g., line start up, batch cutting, or manifold flushing) that are too complex? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 1.1.3 How often do you perform a manual calculation that is used directly as an input to operational activities? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 58Page 8 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 1.1.4 How often do you perform non-typical control actions (e.g., start/stop pump, open/close valve) that are different than control actions for similar equipment (e.g., pumps, valves, etc.) at the majority of locations? Never Once a year Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour 1.1.5 How often do you perform an operation that has a very small margin for error? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour 1.2 Console Workload The questions in this subsection ask about your activities while operating and monitoring your pipeline. Several questions ask about the degree to which activities “interfere with” or “disrupt” operating activities. The terms “interfere with” or “disrupt,” mean that the additional task(s) lead to one or all of the following: 1) you having to switch your attention between the primary operating tasks and other tasks, 2) the primary tasks take longer to complete, or you have less time to complete them, or 3) the primary tasks are conducted in a different way than usual. 1.2.1 How often do you have to perform two or more control operations (e.g., line switches) at the same time? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 59Control Room Human Factors Risk Assessment and Management Guide Controller Survey 1.2.2 How often does excessive telephone activity interfere with your monitoring and control operations? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Page 9 Once a week Once a day More than once a day More than once an hour 1.2.3 How often do shift hand-off activities interfere with operations? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day Once a week Once a day 1.2.4 How often do unusual work conditions (trainees, tours/visitors) interfere with operations? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 60Page 10 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a month Once a week Once a day 1.2.5 How often do unusual operational conditions (smart pigging, major repairs) interfere with operations? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 1.2.6 How often do you have to make important operational decisions without sufficient time to adequately consider alternatives? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 2. Displays and Controls This topic includes the workstation equipment, information display screens and controls associated with the monitoring and control system that you operate. 2.1 Equipment Layout and Workstation Design 2.1.1 How often are you unable to display all of the information that you need on the available monitors during normal operations? Never Once a year Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 61Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 11 2.1.2 In what percentage of the abnormal situations that you have faced were you unable to display all of the information that you need on the available monitors? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 2.1.3 How often are your monitoring and control activities disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare)? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour 2.1.4 How often are your monitoring and control activities disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a week or more, please explain briefly:#

Attachment 1, passage 62Page 12 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 2.2 SCADA Information Access and Layout 2.2.1 How often do you have difficulty finding information you need because of inconsistencies in the SCADA display design between screens? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour Once a week Once a day 2.2.2 How often do you have difficulty finding information you need because of cluttered or complicated SCADA displays? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: More than once a day More than once an hour 2.2.3 How often do you have difficulty finding, identifying, and interpreting information because of the layout of information (e.g., lines, equipment, and data) on the SCADA display? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 63Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 13 Once a month Once a week Once a day 2.2.4 How often is the information you need not shown on the appropriate SCADA display? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 2.2.5 How often do you have to navigate between more than two SCADA displays to view related information? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 2.2.6 How often do you find that navigating between SCADA displays interferes with the flow of monitoring and control activities? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 64Page 14 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 2.2.7 How often do you have difficulty using SCADA control boxes/targets because of their layout or location in the SCADA? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 2.3 SCADA Information Content, Coding, and Presentation 2.3.1 How often do you have difficulty determining which part of the pipeline system the SCADA display represents? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour Once a month Once a week Once a day 2.3.2 How often do you encounter colors on a SCADA display that make data interpretation difficult? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 65Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 15 Once a month Once a week Once a day 2.3.3 How often do you encounter labels on a SCADA display that make data interpretation difficult? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 2.3.4 How often do you encounter symbols on a SCADA display that make data interpretation difficult? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 2.3.5 How often do you need to transform values from the measurement scale presented on the SCADA display to a different scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 66Page 16 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a day 2.3.6 How often does the SCADA display not provide adequate system overview information for keeping track of system status? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week More than once a day More than once an hour 2.3.7 How often does the SCADA display different units for the same type of measurement (e.g., psi used on some displays and bar used on other similar displays)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour 3. Communications This topic covers communications that Controllers have with others (e.g., other Controllers, field technicians, schedulers, supervisors, etc.) as part of normal and abnormal pipeline operating and monitoring activities. 3.1 Shift Hand-off Procedures 3.1.1 How often are shift hand-off procedures or tools not adequate for identifying, tracking, and recording information needed as you come on shift? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day#

Attachment 1, passage 67Control Room Human Factors Risk Assessment and Management Guide Controller Survey 3.1.2 How often are formal shift hand-off procedures not adequately followed by Controllers? Never Once a year Few times a year Once a month Once a week If Once a week or more, please explain briefly: Page 17 Once a day More than once a day 3.2 Control Center Communications 3.2.1 How often is the exchange of required operations information between you and another Controller on a different console not adequate? Please check “Not Applicable” if Controllers on different consoles do not share information in your Control Room. Never Once a year Few times a year Once a month Once a week Once a day More than once a day Not Applicable More than once an hour If Once a week or more, please explain briefly: 3.2.2 How often are other control center staff not available to provide you with assistance on an operational issue when you need it? (Not including field technicians)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour#

Attachment 1, passage 68Page 18 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a month Once a week Once a day 3.2.3 How often do you find that the lines of communication in the control room are not clearly defined or adhered to? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 3.3 Schedule Communications 3.3.1 How often do you receive inaccurate product delivery schedules? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 3.3.2 all? Never Once a year Once a month Once a week Once a day How often are changes in product delivery schedules not communicated to you at Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 69Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 19 Once a month Once a week Once a day 3.3.3 How often are changes in product delivery schedules communicated to you without sufficient lead time? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 3.4 Field Personnel Communications 3.4.1 How often are field technicians not available to assist you with an operational issue when required? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour 3.4.2 How often is important field information (e.g., operational and maintenance activities) not provided directly to you in a timely manner? Never Once a year Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 70Page 20 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a day 3.4.3 How often do field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to you? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week More than once a day More than once an hour 3.4.4 How often do field personnel fail to fully communicate important ongoing operational conditions (e.g., pigging or repairs) to you? Never Once a year Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour Once a day 3.4.5 How often do you have difficulty communicating with field personnel due to a lack of available communications equipment? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week More than once a day More than once an hour This is a Good Point in the Survey for a Brief Break#

Attachment 1, passage 71Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 21 4. System Information Accuracy and Access This topic covers the accuracy and availability of information that you need to make decisions or take actions during your pipeline operating and monitoring activities. Note that the accuracy and availability of information that is not important for pipeline operating and monitoring should not be considered in your response. 4.1 Operational Information Accuracy and Availability Once a week Once a day 4.1.1 How often do you get inaccurate SCADA data because of faulty field instruments (e.g., meters, gauges, etc.)? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: More than once a day More than once an hour 4.1.2 How often does a communication problem (e.g., outage, time delay) result in SCADA data becoming stale, out-of-date, or unavailable? Never Once a year Few times a year Once a month Once a week More than once a day Once a day More than once an hour If Once a week or more, please explain briefly:#

Attachment 1, passage 72Page 22 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a month Once a week Once a day 4.1.3 How often does a SCADA display not correctly indicate that data are out-of-date or unavailable? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 4.1.4 How often do you encounter changes in field system operational status (e.g., equipment identity or operational activities) that are not adequately indicated in a SCADA display? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 4.1.5 How often do you encounter displayed pipeline schematics or operational parameters (e.g., MOPs) that are later found to be inaccurate? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour#

Attachment 1, passage 73Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 23 4.1.6 How often do you encounter manually entered batch, log, and/or summary information that is later found to be inaccurate? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a week or more, please explain briefly: 4.1.7 How often is information you require not available in the SCADA display? Never Once a year Once a month Once a week More than once a day Few times a year Once a day More than once an hour If Once a week or more, please explain briefly: Page 24 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 5. Job Procedures This topic covers the written procedures for normal and abnormal situations that are available for you to reference in either electronic or hardcopy format. These include procedures for conducting operational tasks and recovering from abnormal situations. 5.1 Job Procedure Design Please note that the criterion for adding comments varies in this section. Once a month Once a week Once a day 5.1.1 How often do you use a procedure that does not have clear instructions about when it should be used? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour 5.1.2 How often do you use a procedure that does not have adequate technical detail? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a month or more, please explain briefly:#

Attachment 1, passage 74Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 25 5.1.3 How often do you use a procedure that is difficult to read? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: More than once a day More than once an hour 5.1.4 How often do you have difficulty finding critical information in a procedure? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour Once a month Once a week Once a day 5.1.5 How often do you use a procedure that does not meet the needs of both novice and experienced operators? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 75Page 26 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 5.1.6 In what percentage of the abnormal situations that you have faced did you use a procedure or job aid that was difficult to follow? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 5.2 Job Procedure Availability 5.2.1 written? Never Once a year Few times a year If Once a month or more, please explain briefly: How often do you need a specific required operations procedure that has not been Once a month Once a week Once a day More than once a day More than once an hour Once a day 5.2.2 How often do you have difficulty finding a specific procedure because it is difficult to find among a large overall number of procedures? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week More than once a day More than once an hour#

Attachment 1, passage 76Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 27 5.2.3 In what percentage of the abnormal situations that you have faced did you need a procedure or job aid that was not readily available? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 5.3 Job Procedure Accuracy and Completeness 5.3.1 How often do you encounter a procedure that contains out-of-date or inaccurate information? Never Once a year Few times a year If Once a month or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour Once a month Once a day 5.3.2 How often are updated procedure notifications not adequately provided to Controllers? Never Once a year Few times a year Once a week If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 77Page 28 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 5.3.3 How often do you use a documented procedure that you do not fully understand? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a month or more, please explain briefly: 5.3.4 How often do you perform an operation different from an established and documented procedure because the procedure is incorrect or incomplete? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour 6. Alarm Presentation and Management This topic covers alarms presented on the SCADA or other alarm management system that occur during normal or abnormal situations, and that Controllers are responsible for monitoring and responding to. 6.1 Alarm Availability and Accuracy 6.1.1 How often is no alarm available to notify you about important current operational status information (e.g., pressure or batch interface at a specific point in the line)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour#

Attachment 1, passage 78Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 29 6.1.2 How often do you get an alarm that does not provide you with sufficient lead time to take corrective actions (i.e., because of sensor location)? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: More than once a day More than once an hour 6.1.3 How often are changes in operating conditions triggered by external events that are outside of your control (e.g., equipment failure or maintenance on a feeder system) not displayed on the SCADA? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 6.2 Alarm Display and Presentation 6.2.1 How often do you have difficulty identifying important alarms because the alarm display is too cluttered? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 79Page 30 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 6.2.2 Not Applicable How often do you have difficulty finding the alarms for your console because the alarm display shows alarms from another console? Please check “Not Applicable” if Controllers on different consoles do not receive alarms from different consoles in your Control Room. Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a month or more, please explain briefly: 6.2.3 How often do you get a high-priority alarm that is not effective in attracting your attention if you are performing other activities? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 6.2.4 How often are you unnecessarily startled by the sound or loudness of a critical alarm? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 80Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 31 Once a month Once a week Once a day 6.2.5 How often do you have difficulty determining the intended priority of an alarm based on its sound? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 6.2.6 How often do you have difficulty determining the intended priority of an alarm based on its color? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour 6.3 Alarm Interpretation 6.3.1 How often do you have difficulty interpreting an alarm description? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 81Page 32 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 6.3.2 How often do you have difficulty identifying the cause of an alarm that can have multiple causes because there is insufficient alarm information? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour 6.3.3 How often do you get alarm summary information that does not provide adequate information about conditions at the time the alarm was triggered? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour Once a month Once a week Once a day 6.3.4 How often do you have difficulty interpreting an alarm because it is displayed in an inconsistent format? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 82Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 33 6.3.5 How often do you have difficulty determining the intended priority of an alarm? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: More than once a day More than once an hour 6.4 Alarm Access and Acknowledgement Please note that the criterion for adding comments varies in this section. 6.4.1 How often does the process that you have to clear alarms interfere with your monitoring and control operations? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour Once a week Once a day 6.4.2 How often do you unintentionally clear an important alarm because there are too many alarms that need to be cleared? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 83Page 34 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a month Once a week Once a day 6.4.3 How often do you find that it is difficult to sort alarms by priority, time of occurrence, or other useful dimensions? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour 6.4.4 How often does it take two or more steps, screens, or keystrokes to access previously acknowledged alarms for review on the SCADA? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour 6.4.5 Not Applicable How often do you accidentally acknowledge or clear alarms for an adjacent console? Please check “Not Applicable” if Controllers on different consoles do not receive alarms from different consoles in your Control Room. Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a week or more, please explain briefly:#

Attachment 1, passage 84Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 35 6.5 Nuisance Alarms 6.5.1 How often are there so many nuisance alarms that you are unable to quickly identify potentially important alarms? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour 6.5.2 How often are monitoring and control operations disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour 6.5.3 How often are your monitoring and control activities disrupted by unnecessary information, alarms, or notifications being displayed on the alarm screen (e.g., action started, action completed, etc)? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 85Page 36 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 6.5.4 How often do you get nuisance alarms caused by equipment that is waiting to be fixed? Never Once a year Few times a year If Once a month or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour 6.5.5 How often do you get an alarm that is classified as critical when it does not actually represent a true critical situation? Never Once a year Few times a year Once a month More than once a day Once a week Once a day More than once an hour If Once a month or more, please explain briefly: Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 37 7. Controller Training This topic covers company practices that help to provide Controllers with a broad knowledge of the pipeline system and specific technical aspects of pipeline operations, including initial Controller training, and any other periodic refresher training. 7.1 Pipeline Fundamentals Knowledge and Field Exposure Once a month Once a week Once a day 7.1.1 How often do you encounter an operational situation that you are not adequately prepared to respond to? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour 7.1.2 How often do you face an operational situation that you are not adequately trained to respond to because your on-the-job training did not provide you with the best assignment of mentor(s) to ensure that you were exposed to an adequate range of expertise and good operating practices? Never Once a year Few times a year Once a month Once a week More than once a day More than once an hour Once a day If Once a month or more, please explain briefly:#

Attachment 1, passage 86Page 38 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 7.1.3 How often are you challenged by an incomplete understanding of hydraulics? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour Once a month Once a week Once a day 7.1.4 How often are you challenged by an incomplete understanding of a specific field operation or field system? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour Once a week Once a day 7.1.5 How often do you face an operational situation that you are not adequately trained to respond to before working alone? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 87Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 39 Once a week Once a day 7.1.6 How often are you challenged by an operation where more frequent refresher training would have helped you? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: More than once a day More than once an hour 7.1.7 When first taking control of a new pipeline or facility introduced on your console, how often did you have difficulties operating the line specifically because you did not have adequate training on the new line before you had to start running it? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a month or more, please explain briefly: Once a week Once a day 7.1.8 How often have new procedures, products, or tools been introduced without adequate training on how to use them? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 88Page 40 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 7.2 Emergency Response Training 7.2.1a How often do you face an emergency event? Never Once a year Few times a year Once a month Once a week No Comments Required for this question Once a day More than once a day More than once an hour 7.2.1 In what percentage of emergency events that you have faced were you not adequately trained to respond to the conditions? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 7.2.2a How often do you face an abnormal situation? Never Once a year Few times a year Once a month Once a week No Comments Required for this question Once a day More than once a day More than once an hour 7.2.2 In what percentage of abnormal situations that you have faced were you not adequately trained to respond to the conditions? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly:#

Attachment 1, passage 89Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 41 8. Coping with Stress This topic covers stress related to abnormal situations and other control room distractions, either of which have the potential to impact pipeline operating and monitoring activities. 8.1 Abnormal Situation Task Assignments 8.1.1 In what percentage of abnormal situations that you have faced were you required to perform non-critical activities (e.g., responding to phone calls) while responding to the abnormal situation? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 8.1.2 In what percentage of abnormal situations that you have faced were you distracted because you were required to perform notification activities while responding to the abnormal situation? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 8.1.3 In what percentage of abnormal situations that you have faced were you distracted because you were required to monitor and control unrelated ongoing operations while responding to the abnormal situation? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly:#

Attachment 1, passage 90Page 42 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 8.1.4 In what percentage of abnormal situations that you have faced were staff roles and responsibilities not well defined? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly: 8.2 Control Room Distractions 8.2.1 How often are you distracted from monitoring and controlling operations due to the preparation of operational reports (e.g., operating sheets, production summaries, line status summaries)? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week Once a day More than once a day More than once an hour Once a day 8.2.2 How often do you end up completing work that is assigned to schedulers? Never Once a year Few times a year Once a month If Once a week or more, please explain briefly: Once a week More than once a day More than once an hour#

Attachment 1, passage 91Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 43 8.2.3 Never Once a year How often do field personnel fail to provide you with adequate or timely support? Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour Once a day 8.2.4 How often are you distracted from monitoring and controlling operations due to stressful relations with control room management? Never Once a year Few times a year Once a month Once a week If Once a week or more, please explain briefly: More than once a day More than once an hour 8.2.5 How often are you distracted from monitoring and controlling operations due to stress resulting from productivity goals, incentives, or penalties? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour#

Attachment 1, passage 92Page 44 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 9. Controller Alertness This topic covers alertness and the factors that can lead to fatigue during a shift. When the questions refer to fatigue or drowsiness they mean: difficulty concentrating or focusing, difficulty staying awake, dozing off, having to recheck information more often than usual, etc. 9.1 Controller Fatigue 9.1.1 How often do you get particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm)? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.1.2 How often do you feel drowsy or tired throughout most of a shift? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.1.3 How often do you feel fatigued near the end of a shift? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly:#

Attachment 1, passage 93Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 45 9.2 Controller Schedule and Rest 9.2.1 How often do you get insufficient sleep because of transitions in shift schedules from day to night or night to day? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.2.2 How often do you get insufficient sleep because you were called in to work a shift on short notice? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.2.3 How often do you get insufficient sleep because of overtime work? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly:#

Attachment 1, passage 94Page 46 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 9.2.4 How often do you get insufficient sleep because of twelve hour shifts? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.2.5 How often do you get insufficient sleep because of ongoing understaffing? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: 9.2.6 How often do you get insufficient sleep because of shift start times? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 47 9.3 Slow Work Periods 9.3.1 How often do you experience reduced alertness during slow work periods? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour Once a day 9.3.2 How often do you have difficulty regaining alertness to deal with a challenging situation following a slow work period? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week More than once a day More than once an hour 9.4 Alertness Management Practices Please note that the criterion for adding comments varies in this section. 9.4.1 How often have you reported for work tired enough that you were concerned about your ability to run the pipeline? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly:#

Attachment 1, passage 95Page 48 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 9.4.2 How often have you reported for work tired enough that you were concerned about your ability to run the pipeline, but not notified management? Never Once a year Few times a year Once a month If Few times a year or more, please explain briefly: Once a week Once a day 9.4.3 How often have you reported for work tired enough that you were concerned about your ability to run the pipeline because of a lack of understanding of sleep basics, personal alertness practices, and effective fatigue-reduction practices? Never Once a year Few times a year Once a month Once a week Once a day If Few times a year or more, please explain briefly: 10. Automation This topic covers the ways in which certain aspects of your job may be automated, such as the implementation of preset control points or alarms and the various uses of PCL (Program Control Logic). It essentially involves activities that would probably be your responsibility to perform manually if they were not automated in some way. 10.1 Automated Operations Please note that the criterion for adding comments varies in this section. 10.1.1 How often is your job made more difficult due to the automation of control actions? Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a month or more, please explain briefly:#

Attachment 1, passage 96Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 49 10.1.2 How often does the set-up of an automated sequence of control actions require too many steps? Never Once a year Few times a year If Once a month or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour Once a month Once a week Once a day 10.1.3 How often does automated operation of some equipment conflict or interfere with your actions? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 10.1.4 How often do you forget to perform a manual control action because the initial steps of that action are automated? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 97Page 50 Control Room Human Factors Risk Assessment and Management Guide Controller Survey Once a day 10.1.5 How often do you encounter automation at one station/location that is not consistent with automation at other similar stations/locations? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week More than once a day More than once an hour Once a month Once a week Once a day 10.1.6 How often do you not fully understand how the automation you are using works at a station/location? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 10.1.7 How often do you not fully trust the reliability of control action automation that you are using? Never Once a year Few times a year If Once a month or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 98Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 51 Once a month Once a week Once a day 10.1.8 How often do you use automated sequences where not all the steps are displayed by the SCADA? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour 10.1.9 How often do you perform specific control actions manually (e.g., line ups, line shutdown, and manifold flushing) that could benefit from automation? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a week or more, please explain briefly: More than once an hour 11. Control Room Design and Staffing This topic covers the level of staffing at your primary console/workstation and how well control room facilities accommodate breaks. 11.1 Control Room Design 11.1.1 How often does the location of break facilities keep you away from your console too long? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 99Page 52 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 11.1.2 How often do you not take an appropriate brief break because break facilities are not conveniently located? Never Once a year Few times a year If Once a week or more, please explain briefly: Once a month Once a week Once a day More than once a day More than once an hour 11.1.3 How often do you have difficulty meeting basic personal needs (i.e., food, bathroom, illness, etc.) because of the lack of breaks during a shift? Never Once a year Few times a year Once a month Once a week Once a day If Once a week or more, please explain briefly: More than once a day More than once an hour Once a month Once a week Once a day 11.1.4 How often are you not able to reach a Controller on break to address an immediate operational situation? Never Once a year Few times a year If Once a week or more, please explain briefly: More than once a day More than once an hour#

Attachment 1, passage 100Control Room Human Factors Risk Assessment and Management Guide Controller Survey Page 53 11.2 Control Room Staffing Please note that the criterion for adding comments varies in this section. 11.2.1 How often do you feel excessively burdened because you are covering for a Controller that is taking a long break? Please check “Not Applicable” if Controllers at your control room do not cover for one another during their breaks. Never Once a year Few times a year Once a month Once a week Not Applicable Once a day More than once a day More than once an hour If Once a week or more, please explain briefly: 11.2.2 How often is Controller staffing not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc)? Never Once a year Few times a year Once a month Once a week Once a day If Once a month or more, please explain briefly: More than once a day More than once an hour 11.2.3 How often is Controller staffing not adequate to allow for your vacation, sick leave, and/or regularly scheduled days off? Never Once a year Few times a year Once a month If Once a month or more, please explain briefly: Once a week Once a day More than once a day More than once an hour#

Attachment 1, passage 101Page 54 Control Room Human Factors Risk Assessment and Management Guide Controller Survey 11.2.4 How often do you have to work on your scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc)? Never Once a year Few times a year Once a month Once a week Once a day More than once a day If Once a month or more, please explain briefly: More than once an hour 11.2.5 How often is Controller staffing not adequate to provide you with assistance during busy normal operations? Not Applicable Please check "Not Applicable" if Controllers at your control room do not get assistance from other control room staff during normal operations. Never Once a year Few times a year Once a month Once a week Once a day More than once a day More than once an hour If Once a week or more, please explain briefly: 11.2.6 In what percentage of abnormal situations that you have faced was Controller staffing not adequate to provide you with assistance? Never 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% If 10% or more, please explain briefly:#

Attachment 1, passage 102Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-1 APPENDIX C STEP 3 RISK LIKELIHOOD RATING ACTIVITY MATERIALS AND ADMINISTRATION GUIDANCE#

Attachment 1, passage 103Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-3 STEP 3 RISK LIKELIHOOD RATING ACTIVITY ADMINISTRATION GUIDANCE Risk Likelihood ratings are obtained from control room operational experts. These ratings are one of the data sources used in calculating Risk Levels. The Risk Likelihood ratings reflect experts’ judgments regarding the likelihood that exposure to the working conditions associated with a Performance Factor will directly lead to sub-optimal Controller job performance and thereby contribute to the occurrence and/or increase in severity of an unacceptable incident. Figure C-1 depicts the two basic activities involved in preparing for and obtaining Risk Likelihood ratings. Guidance regarding the conduct of each of these activities is provided below. Risk Likelihood rating activity materials are provided at the end of this appendix. 3.1 Define Respondent Sample 3.2 Obtain and Compile Ratings Figure C-1. Step 3 Risk Likelihood Rating Administration Activities 3.1. Define Respondent Sample Valid input to the Risk Likelihood rating activity requires detailed knowledge of the operations and associated risks involved in a control room’s pipeline monitoring and control activities. Therefore, these ratings should only be provided by seasoned operational experts who have full knowledge of the physical characteristics of the pipeline, the operation of the control room’s SCADA system, and all pertinent operational policies and procedures. Typically, this will mean that experienced and qualified Controllers and their supervisors would provide the most valid Risk Likelihood ratings from a control room. Limiting the sample to these individuals will help to ensure that the obtained results are valid – that is, that they reflect the actual operational risks in the control room. Obtaining ratings from all such individuals will help to ensure that the obtained results are reliable – that is, that comparable risk ratings would be obtained if the rating activity were to be repeated under the same operational conditions. It is highly recommended that an operator endeavor to obtain a complete sampling of all individuals who are qualified to provide ratings to ensure that a valid and reliable set of ratings are obtained. A general rule of thumb regarding a target sample size for this activity would be 20 - 25 individuals.#

Attachment 1, passage 104Page C-4 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions When the rating activity respondent sample has been defined, a table similar to Table C-1 could be prepared to summarize the sample of individuals who will be providing responses. Table C-1. Example of a Risk Likelihood Rating Sample Summary Table Controller Survey Sample Summary Senior Controllers Control Room Supervisors Other Operational Experts 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 3.2. Obtain and Compile Ratings The Risk Likelihood ratings are obtained by having the selected operations experts individually provide their judgments regarding the Risk Likelihood level corresponding to each Performance Factor individually, so that independent input can be obtained from each respondent on this important parameter. Specifically, each identified operational expert is provided with a set of cards, with the definition of one Performance Factor on each card, and the expert is provided written instructions to sort the cards into different groups representing each of the Risk Likelihood levels. This type of sorting task has an established record of providing an efficient and reliable method for evaluating multiple options based on pre-defined criteria. The Risk Likelihood level ratings from individual experts can then be tabulated and incorporated into the Risk Level calculation procedures in Step 4. Risk Likelihood is defined as the rated likelihood that exposure to the working conditions associated with a Performance Factor will directly lead to sub-optimal Controller job performance and thereby contribute to the occurrence and/or increase in severity of an incident with an unacceptable economic and/or safety consequence. Table C-2 applies this general#

Attachment 1, passage 105Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page C-5 Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance definition in specifying five levels of Risk Likelihood. It is important to note that these levels refer to various effects on Controller performance as the primary basis for differentiating between the levels. That is, the primary basis for assigning a Risk Likelihood level to a Performance Factor is the judged likelihood that exposure to specific working conditions will result in sub-optimal Controller performance which, in turn, could be reasonably expected to result in the occurrence and/or increase in severity of an incident with an unacceptable economic and/or safety consequence. Table C-2. Risk Likelihood Levels and Definitions Risk Likelihood Risk Likelihood Level Definition Level Not significant It is difficult to conceive how this could lead to sub-optimal Controller performance by a conscientious Controller. Includes: ■ Non-time dependent problems/deficiencies that Controllers can get clarification on by asking, etc, or that they can address during slow periods or when they are not operating a console. ■ Non-time critical activities that are not an important or regular part of normal operations Low Working conditions could plausibly lead to sub-optimal Controller performance, but otherwise this factor is mostly just an actual or potential inconvenience that most Controllers compensate for through training and/or practice. Includes: ■ General increase in workload from activities that are not time critical and for which Controllers have some control over when to conduct them (e.g., activities that can be easily postponed) ■ Controllers are aware of problem/deficiencies and have alternative methods for performing their tasks Medium Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc in a meaningful way. A non- alert Controller could perform sub-optimally, but an alert Controller would likely not be affected, although their activities may be more challenging. Includes: ■ Unavoidable increases in workload at the same time as important Controller-driven operational activities are ongoing ■ A novice Controller may be more likely to make errors under these conditions, but not a seasoned Controller High Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc, in a meaningful way, and even an alert/proactive Controller could plausibly perform sub-optimally. ■ Even seasoned Controllers would not be immune to making errors under these conditions Very High Baseline Working conditions are challenging and it is easy to see how a Controller could perform sub-optimally. Controllers must be highly focused on the tasks at hand to avoid performing in a sub-optimal manner. Includes: ■ Situations where it may be largely outside of the Controller’s ability to perform monitoring and control activities in an optimal manner (e.g., key information significantly misrepresents actual conditions in a way that is not apparent to the Controller)#

Attachment 1, passage 106Page C-6 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions It is also important to recognize that the Risk Likelihood definitions and instructions do not specify a level of incident consequence that should be considered as “unacceptable”. Rather, it instructs the respondent to assign Risk Likelihood Levels based on the very general referent of any incident that would be associated with economic and/or safety consequences that are judged to be unacceptable by their company. It is recommended that the management team responsible for control room operations review this rating activity and provide specific documented guidance to respondents regarding the types of incidents that they would like to be considered as “unacceptable.” Providing a documented reference will greatly facilitate current and future interpretation of the results. Note that if the management team’s definition of “unacceptable” economic and/or safety consequences shifts in the future, then the Risk Likelihood rating activity should be re-administered to provide an appropriate basis for calculating Risk Level scores.#

Attachment 1, passage 107Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-7 RISK LIKELIHOOD RATING ACTIVITY MATERIALS The remainder of this appendix consists of a complete copy of the Risk Likelihood respondent instructions, category labels, and Performance Factor card labels. The following materials should be prepared for each individual who will be providing ratings.  One large envelope (approximately 8 X 10 inches) with an attached form for the respondent to write his/her name, position, and control center  Five smaller envelopes (approximately 4 X 6 inches), each with one of the Risk Likelihood level titles and definitions printed on them  138 cards (approximately 2 X 3.5 inches), with a separate Performance Factor label and definition printed on each card. The set of cards should be organized into 11 separate bundles corresponding to each Human Factors Area, and placed inside the large envelope.  A copy of the rating activity instructions The rating activity takes about one hour. Respondents should be provided with a quiet room with a large (2.5’ X 4’ minimum) uncluttered desk and chair.#

Attachment 1, passage 108Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-9 Risk Likelihood Rating Materials Introduction You have been identified as an individual with expert knowledge about the operations at your control room. The present effort is aimed at collecting judgments from experts like you regarding how different working conditions affect the operational risk in your control room. Risk Likelihood Level Input Objectives You are being asked to provide your judgments regarding the Risk Likelihood (defined below) corresponding to a set of the Performance Factors. Your judgments will be compiled along with those of other operational experts to calculate Risk Likelihood levels for the Performance Factors. Following are some definitions of terms that are used. A Performance Factor is defined as the characteristics of 1) the Controller (e.g., experience, fatigue), 2) the Controller’s workspace (e.g., display monitors, lighting), 3) job tools (e.g., batch tracking, SCADA), 4) job design (e.g., control tasks and activities), and 5) other factors that affect the Controller’s ability to effectively monitor and control pipeline operations (individual characteristics or factors are referred to as working conditions). Working Conditions are the specific operating characteristics or factors that Controllers encounter at their work site while conducting pipeline monitoring and control activities and any other tasks associated with their job. Working Conditions are directly tied to specific Performance Factors (e.g., workload problems at a specific console, specific field technician communications problems, specific alarms that are a particular nuisance, etc.). Risk Likelihood is defined as the rated likelihood that exposure to the working conditions associated with a Performance Factor will directly lead to sub-optimal Controller job performance and thereby cause or contribute to the occurrence and/or increase in severity of an incident with an unacceptable economic and/or safety consequence. Five separate Risk Likelihood levels have been defined for the purpose of the present rating activity. The definitions of these areas rely primarily upon a consideration of the effect of the working conditions associated with a Performance Factor on Controller performance. Following are brief definitions of the Risk Likelihood levels (additional examples are provided with the instructions).#

Attachment 1, passage 109Page C-10 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Not significant It is difficult to conceive how this could lead to sub-optimal Controller performance by a conscientious Controller Low Working conditions could plausibly lead to sub-optimal Controller performance, but otherwise this factor is mostly just an actual or potential inconvenience that most Controllers compensate for through training and/or practice. Med Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc in a meaningful way. A non-alert Controller could perform sub-optimally, but an alert Controller would likely not be affected. High Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc, in a meaningful way, and even an alert/proactive Controller could plausibly perform sub-optimally. Very High Baseline Working conditions are challenging and it is easy to see how a Controller could perform sub-optimally. Controllers must be highly focused on the tasks at hand to avoid performing in a sub-optimal manner. Instructions Enclosed with this document are one large envelope and five smaller envelopes. The smaller envelopes are each labeled with one of the Risk Likelihood level definitions, along with additional explanatory information. Please set aside approximately one hour of uninterrupted time to complete the following steps: 1. Go to a quiet room with a large (2.5’ X 4’ minimum) uncluttered desk and chair. 2. Sit at the chair, take the five smaller envelopes with the Risk Likelihood level definitions, and arrange them in a row across the desk in front of you. Review each of the definitions on the cards. 3. Open the large envelope and take out the stack of individual cards. Each of these cards has the definition of one Performance Factor and the cards are ordered numerically by their identification number. 4. Take each Performance Factor card, in the provided order, and place it under one of the Risk Likelihood level envelopes. Try to place each card so that you can still read the definition. Continue until you have placed each Performance Factor Card under a Risk Likelihood level envelope. 5. IMPORTANT: Review each set of Performance Factors and rearrange groupings, as you think is most appropriate. Make sure that individual cards seem to have a similar Risk Likelihood level as the ones next to them. 6. Once you are satisfied with your groupings, take each group of Performance Factor cards, put it into the appropriate Risk Likelihood level envelope, and close the clasp on the envelope. 7. Once you have closed each smaller envelope, place them in the larger envelope and provide your identifying information on the outside of the larger envelope. 8. Put the larger envelope into the enclosed envelope and return it to the survey administrator.#

Attachment 1, passage 110Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-11 Risk Likelihood Level En velope Definitions Following are the definitions that should be provided on each of the Risk Likelihood level envelopes. Risk Likelihood Level Risk Likelihood Level Definition Not significant It is difficult to conceive how this could lead to sub-optimal Controller performance by a conscientious Controller. Includes:  Non-time dependent problems/deficiencies that Controllers can get clarification on by asking, etc, or that they can address during slow periods or when they are not operating a console.  Non-time critical activities that are not an important or regular part of normal operations Low Working conditions could plausibly lead to sub-optimal Controller performance, but otherwise this factor is mostly just an actual or potential inconvenience that most Controllers compensate for through training and/or practice. Includes:  General increase in workload from activities that are not time critical and for which Controllers have some control over when to conduct them (e.g., activities that can be easily postponed)  Controllers are aware of problem/deficiencies and have alternative methods for performing their tasks Med Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc in a meaningful way. A non-alert Controller could perform sub-optimally, but an alert Controller would likely not be affected, although their activities may be more challenging. Includes:  Unavoidable increases in workload at the same time as important Controller-driven operational activities are ongoing  A novice Controller may be more likely to make errors under these conditions, but not a seasoned Controller High Working conditions represent a situation in which the Controller receives clearly deficient information/support from tools, personnel, etc, in a meaningful way, and even an alert/proactive Controller could plausibly perform sub- optimally.  Even seasoned Controllers would not be immune to making errors under these conditions Very High Baseline Working conditions are challenging and it is easy to see how a Controller could perform sub-optimally. Controllers must be highly focused on the tasks at hand to avoid performing in a sub-optimal manner. Includes:  Situations where it may be largely outside of the Controller’s ability to perform monitoring and control activities in an optimal manner (e.g., key information significantly misrepresents actual conditions in a way that is not apparent to the Controller)#

Attachment 1, passage 111Page C-12 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Risk Likelihood Level Envelope Label Name Position Control Center Company Please Complete Information Before Returning Risk Likelihood Level Performance Factor Cards Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-13 1.1.1 Task Design Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three) 1.1.2 Task Design Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex Task Design 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities Task Design 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations 1.1.5 Task Design Some operations have a very small margin for error 1.2.1 Console Workload Two or more control operations (e.g., line switches) must be done at the same time Console Workload 1.2.2 Excessive telephone activity interferes with monitoring and control operations Console Workload 1.2.3 Shift hand-off activities interfere with operations Console Workload 1.2.4 Unusual work conditions (trainees, tours/visitors) interfere with operations Console Workload 1.2.5 Unusual operational conditions (smart pigging, major repairs) interfere with operations#

Attachment 1, passage 112Page C-14 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Console Workload 1.2.6 Controllers have to make important operational decisions without sufficient time to adequately consider alternatives 2.1.1 Equipment Layout and Workstation Design There are not enough display monitors to show all of the information that a Controller needs at one time during normal operations 2.1.2 Equipment Layout and Workstation Design There are not enough display monitors to show all of the information that a Controller needs at one time during abnormal situations Equipment Layout and Workstation Design 2.1.3 Monitoring and control activities are disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare) Equipment Layout and Workstation Design 2.1.4 Monitoring and control activities are disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast) SCADA Information Access and Layout 2.2.1 Inconsistencies in SCADA display design from screen to screen increase the difficulty of getting needed information SCADA Information Access and Layout 2.2.2 A cluttered, or complicated SCADA display increases the difficulty of finding needed information 2.2.3 SCADA Information Access and Layout The layout of information (e.g., lines, equipment, and data) on the SCADA display increases the difficulty of finding, identifying, and interpreting information 2.2.4 SCADA Information Access and Layout Needed information is not shown on the appropriate SCADA display SCADA Information Access and Layout 2.2.5 Controllers must navigate between more than two SCADA displays to view related information#

Attachment 1, passage 113Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-15 SCADA Information Access and Layout 2.2.6 Navigating between SCADA displays interferes with the flow of monitoring and control activities 2.2.7 SCADA Information Access and Layout The location or layout of SCADA control boxes/targets makes them difficult to use 2.3.1 SCADA Information Content, Coding, and Presentation Information about which part of the pipeline system the current SCADA display represents is not adequately provided 2.3.2 SCADA Information Content, Coding, and Presentation Some colors on SCADA displays make data interpretation difficult 2.3.3 SCADA Information Content, Coding, and Presentation Some labels on SCADA displays make data interpretation difficult SCADA Information Content, Coding, and Presentation 2.3.4 Some symbols on SCADA displays make data interpretation difficult SCADA Information Content, Coding, and Presentation 2.3.5 Controllers must transform values from the measurement scale presented on the SCADA display to another scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task SCADA Information Content, Coding, and Presentation 2.3.7 There is inconsistent use of units of measure (e.g., gallons, barrels, cubic meters) on SCADA displays 2.3.6 3.1.1 SCADA Information Content, Coding, and Presentation SCADA displays do not provide adequate system overview information for keeping track of system status Shift Hand-off Procedures Shift hand-off procedures or tools do not adequately identify, track, and record information required by the Controller coming on shift#

Attachment 1, passage 114Page C-16 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Shift Hand-off Procedures 3.1.2 Formal shift hand-off procedures are not adequately followed by Controllers Control Center Communications 3.2.1 The exchange of required operations information between Controllers on different consoles is not adequate 3.2.2 Control Center Communications Control center staff (not including field technicians) are not available to provide assistance with an operational issue when required 3.2.3 Control Center Communications The lines of communication in the control room are not clearly defined or adhered to Schedule Communications 3.3.1 Product delivery schedules are inaccurate Schedule Communications 3.3.2 Changes in product delivery schedules are not communicated to Controllers at all Schedule Communications 3.3.3 Changes in product delivery schedules are communicated to Controllers without sufficient lead time 3.4.1 Field Personnel Communications Field technicians are not available to assist Controllers with an operational issue when required Field Personnel Communications 3.4.2 Important field information (e.g., operational and maintenance activities) is not provided directly to Controllers in a timely manner Field Personnel Communications 3.4.3 Field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to Controllers#

Attachment 1, passage 115Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-17 3.4.4 Field Personnel Communications Field personnel do not fully communicate important ongoing operational conditions (e.g., pigging or repairs) to Controllers Field Personnel Communications 3.4.5 Controllers have difficulty communicating with field personnel due to a lack of available communications equipment Operational Information Accuracy and Availability 4.1.1 SCADA data from field instruments (meters, gauges, etc.) are inaccurate Operational Information Accuracy and Availability 4.1.2 SCADA data are stale/out-of- date, or unavailable due to a communications problem (e.g., outage, time delay) Operational Information Accuracy and Availability 4.1.3 The SCADA display does not indicate that data are out-of-date or unavailable Operational Information Accuracy and Availability 4.1.4 Changes in field system operational status (e.g., equipment identity or operational activities) are not adequately indicated in SCADA displays Operational Information Accuracy and Availability 4.1.5 Displayed pipeline schematics or operational parameters (e.g., MOPs) are inaccurate Operational Information Accuracy and Availability 4.1.6 Manually entered batch, log, and/or summary information is not accurate Operational Information Accuracy and Availability 4.1.7 Required information is not available in the SCADA display 5.1.1 Job Procedure Design When to use a procedure is not clearly defined#

Attachment 1, passage 116Page C-18 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions 5.1.2 Job Procedure Design Required technical detail is not provided by a procedure 5.1.3 Job Procedure Design Procedures are difficult to read 5.1.4 Job Procedure Design Critical information is difficult to find in a procedure 5.1.5 Job Procedure Design Procedures do not meet the needs of both novice and experienced operators 5.1.6 Job Procedure Design Procedures and job aids used in responding to abnormal situations are difficult to follow Job Procedure Availability 5.2.1 A specific required operations procedure is not available Job Procedure Availability 5.2.2 Finding an individual procedure among the large overall number of procedures is difficult 5.2.3 Job Procedure Availability Procedures and job aids required to identify and recover from abnormal situations are not readily available Job Procedure Accuracy and Completeness 5.3.1 Procedures contain out-of-date or inaccurate information Job Procedure Accuracy and Completeness 5.3.2 Procedure update notifications are not adequately provided to Controllers#

Attachment 1, passage 117Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-19 5.3.3 Job Procedure Accuracy and Completeness Controllers do not understand the documented procedure 5.3.4 Job Procedure Accuracy and Completeness Controllers execute actions in a manner that is not consistent with established and documented procedures because the precedure is incorrect or incomplete 6.1.1 Alarm Availability and Accuracy No alarm is available to notify the Controller about important current operational status information (e.g., pressure or batch interface at a specific point in the line) 6.1.2 Alarm Availability and Accuracy Alarms do not provide the Controller with sufficient lead time to take corrective actions (i.e., because of sensor location) Alarm Availability and Accuracy 6.1.3 Changes in operating conditions triggered by external events that are outside of Controllers’ influence (e.g., equipment failure or maintenance on a feeder system) are not displayed on the SCADA Alarm Displays and Presentation 6.2.1 Alarm displays become too cluttered making it difficult to identify important alarms 6.2.2 Alarm Displays and Presentation The alarm display shows alarms from another console and Controllers have difficulty finding the alarms for their console Alarm Displays and Presentation 6.2.3 High-priority alarms are ineffective in attracting a Controller’s attention when performing other activities 6.2.4 Alarm Displays and Presentation The sound or loudness of critical alarms startles Controllers unnecessarily 6.2.5 Alarm Displays and Presentation The sound of an alarm does not clearly indicate the intended alarm priority#

Attachment 1, passage 118Page C-20 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions 6.2.6 Alarm Displays and Presentation The color of an alarm does not clearly indicate the intended alarm priority 6.3.1 Alarm Interpretation The displayed alarm description is difficult to interpret 6.3.2 Alarm Interpretation There are multiple causes for some alarms, but insufficient information is provided to identify the actual cause Alarm Interpretation 6.3.3 Alarm summary information does not provide adequate information about conditions at the time that the alarm was triggered 6.3.4 Alarm Interpretation Alarms are not displayed in a consistent format, making their interpretation difficult 6.3.5 Alarm Interpretation It is difficult to determine the intended priority of an alarm 6.4.1 Alarm Access and Acknowledgement The process of clearing alarms interferes with monitoring and control operations Alarm Access and Acknowledgement 6.4.2 Controllers unintentionally clear important alarms when there are too many alarms that need to be cleared 6.4.3 Alarm Access and Acknowledgement It is difficult to sort alarms by priority, time of occurrence, or other useful dimensions Alarm Access and Acknowledgement 6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screens, or keystrokes to access previously acknowledged alarms)#

Attachment 1, passage 119Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-21 Alarm Access and Acknowledgement 6.4.5 Controllers accidentally acknowledge or clear alarms for an adjacent console 6.5.1 Nuisance Alarms The number of nuisance alarms limits the ability to quickly identify potentially important alarms Nuisance Alarms 6.5.2 Monitoring and control operations are disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up) Nuisance Alarms 6.5.3 Monitoring and control activities are disrupted by unnecessary information, alarms, or notifications being displayed on the alarm screen (e.g., action started, action completed, etc.) 6.5.4 Nuisance Alarms Too many nuisance alarms are caused by equipment that is waiting to be fixed 6.5.5 Nuisance Alarms Some alarms classified as critical do not represent true critical situations Pipeline Fundamentals Knowledge and Field Exposure 7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter Pipeline Fundamentals Knowledge and Field Exposure 7.1.3 Controllers are not provided adequate training about hydraulics Pipeline Fundamentals Knowledge and Field Exposure 7.1.2 Controller on-the-job training does not provide the optimal assignment of mentor(s) to ensure exposure to a sufficient range of expertise and good operating practices Pipeline Fundamentals Knowledge and Field Exposure 7.1.4 Controllers are not provided adequate training on field operations and field systems#

Attachment 1, passage 120Page C-22 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Pipeline Fundamentals Knowledge and Field Exposure 7.1.5 Controllers are not adequately trained on specific console operations prior to working alone Pipeline Fundamentals Knowledge and Field Exposure 7.1.6 Controllers are not provided refresher training frequently enough Pipeline Fundamentals Knowledge and Field Exposure 7.1.7 Controllers are not provided adequate training before the introduction of a new pipeline Emergency Response Training 7.1.8 Controllers are not provided adequate training on a specific operational procedure, product, or tool before it is introduced into operation Emergency Response Training 7.2.1 Controllers are not adequately trained in emergency response Abnormal Situation Task Assignments 7.2.2 Controller are not adequately trained in handling abnormal situations 8.1.1 Abnormal Situation Task Assignments Controllers are distracted in their response to abnormal situations by non-critical, ongoing duties (e.g., responding to phone calls) 8.1.2 Abnormal Situation Task Assignments Controllers are distracted in their response to abnormal situations by the need to provide required notifications 8.1.3 Abnormal Situation Task Assignments Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations 8.1.4 Abnormal Situation Task Assignments Control room staff roles and responsibilities during abnormal situations are not well defined#

Attachment 1, passage 121Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-23 Control Room Distractions 8.2.1 Controllers are distracted from monitoring and controlling operations by the need to complete operations reports (e.g., operating sheets, production summaries, line status summaries) Control Room Distractions 8.2.2 Controllers end up completing work that is assigned to schedulers 8.2.3 Control Room Distractions Field personnel do not provide adequate or timely support to Controllers Control Room Distractions 8.2.4 Stressful relations with control room management distracts Controllers from monitoring and control operations Control Room Distractions 8.2.5 Stress resulting from productivity goals, incentives, or penalties distracts Controllers from monitoring and control operations Controller Fatigue 9.1.1 A Controller feels particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm) 9.1.2 Controller Fatigue A Controller feels drowsy or tired throughout most of a shift 9.1.3 Controller Fatigue A Controller feels fatigued at the end of a shift Controller Schedule and Rest 9.2.1 Controllers get insufficient sleep because of transitions in shift schedules from day to night or night to day Controller Schedule and Rest 9.2.2 Controllers get insufficient sleep because of being called in to work a shift on short notice#

Attachment 1, passage 122Page C-24 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Controller Schedule and Rest 9.2.3 Controllers get insufficient sleep because of overtime work Controller Schedule and Rest 9.2.4 Controllers get insufficient sleep because of twelve hour shifts Controller Schedule and Rest 9.2.5 Controllers get insufficient sleep because of ongoing understaffing Controller Schedule and Rest 9.2.6 Controllers get insufficient sleep because of shift start times Slow Work Periods 9.3.1 Controllers experience reduced alertness during slow work periods Slow Work Periods 9.3.2 Controllers experience difficulty regaining alertness to deal with a challenging situation following a slow work period 9.4.1 Alertness Management Practices Controllers report to work tired enough that they are concerned about their ability to run the pipeline Alertness Management Practices 9.4.2 Controllers do not notify management when they report to work without adequate rest Alertness Management Practices 9.43 Controllers have not been provided training on sleep basics, personal alertness practices, and effective fatigue-reduction practices Automated Operations 10.1.1 Automation of control actions makes the Controller job more difficult#

Attachment 1, passage 123Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 3 Risk Likelihood Rating Activity Materials and Administration Guidance Page C-25 Automated Operations 10.1.2 Too many steps are required to set up an automated sequence of control actions Automated Operations 10.1.3 Automated operation of some equipment conflicts or interferes with Controller actions Automated Operations 10.1.4 Controllers can forget to perform a manual control action because the initial steps are automated Automated Operations 10.1.5 Automation is not consistent across similar stations/locations Automated Operations 10.1.6 Controllers do not understand how automation works at a station/location Automated Operations 10.1.7 Controllers do not sufficiently trust the reliability of control action automation Automated Operations 10.1.8 There are some steps in an automated sequence that are not displayed by SCADA Automated Operations 10.1.9 There are specific control actions (e.g., line ups, line shutdown, and manifold flushing) that would benefit from automation Control Room Design 11.1.1 The location of break facilities keeps Controllers away from their console too long Control Room Design 11.1.2 The location of break facilities keeps Controllers from taking appropriate brief breaks#

Attachment 1, passage 124Page C-26 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Control Room Design 11.1.3 The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.) Control Room Design 11.1.4 Controllers on break cannot be reached to address an immediate operational situation Control Room Staffing 11.2.1 Another Controller’s long break times puts an excessive burden on the relieving Controller Control Room Staffing 11.2.2 Controller staffing is not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc.) Control Room Staffing 11.2.3 Controller staffing is not adequate to allow for vacation, sick leave, and/or regularly scheduled days off Control Room Staffing 11.2.4 Controllers work on their scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc.) Control Room Staffing 11.2.5 Controller staffing is not adequate to provide Controller assistance during busy normal operations Control Room Staffing 11.2.6 Controller staffing is not adequate to to provide Controller assistance during abnormal situations#

Attachment 1, passage 125Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-1 APPENDIX D STEP 4 RISK LEVEL CALCULATION INSTRUCTIONS, SAMPLE RESULTS, AND SUMMARY SHEETS#

Attachment 1, passage 126Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-3 STEP 4 RISK LEVEL CALCULATION INSTRUCTIONS AND EXAMPLE Step 4 is conducted to analyze and integrate the individual Prevalence and Risk Likelihood data in order to provide a metric that can be used to prioritize potential control room human factors topics for further analysis and possible mitigation action. Risk Level scores are obtained by multiplying Prevalence scores (which represent how frequently Performance Factor working conditions occur) with Risk Likelihood scores (which represent the likelihood that exposure to those working conditions could lead to unacceptable risks). Figure D-1 depicts the four activities that comprise Step 4. Instructions for conducting each of these sub-steps are provided below. This appendix also provides a Risk Level calculation example, Risk Level results obtained from a trial application of these procedures, a Risk Level Calculation Worksheet, and a Human Factors Topic Risk Level calculation worksheet. 4.1 4.1 Compute Compute Prevalence Prevalence Scores Scores 4.3 Calculate Risk Level Scores 4.4 Rank-Order Human Factors Topics 4.2 4.2 Compute Risk Compute Risk Likelihood Scores Likelihood Scores Figure D-1. Step 4 Risk Level Calculation Activities 4.1. Compute Prevalence Scores A Prevalence score is intended to reflect how often specific working conditions that may adversely affect Controller performance are present in a given Control Room. The Prevalence score for an individual Performance Factor is calculated as the median value of Controller Survey respondents’ Prevalence responses for that Performance Factor. The median value reflects the 50th percentile rank-order score across a frequency distribution of responses. Note that Controller Survey items corresponding to individual Performance Factors are worded so that Controllers will provide an estimate of the frequency with which they have encountered working conditions corresponding to an individual Performance Factor during the past year. The individual Prevalence responses are scaled to approximate the underlying frequencies for the different Prevalence response categories, assuming Controllers are working approximately 2,000 hours per year, as summarized in Table D-1.1 1 It should be noted that a small subset of Controller Survey items are calculated on the basis of two questions. First, how frequently a specific operational condition occurs. Second, what percentage of time an individual Performance Factor is present during the specific operational condition. In such cases, a Prevalence score is calculated by multiplying the Prevalence response scale and the percentage value; then the median of these prevalence scores is determined#

Attachment 1, passage 127Page D-4 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Table D-1. Prevalence Response Categories and Scales Prevalence Response Category Prevalence Score Scale Never 0 Once a Year 1 Few Times a Year 2 Once a Month 10 Once a Week 50 Once a Day 200 More than Once a Day 500 More than Once an Hour 2,000 4.2. Compute Risk Likelihood Scores The Risk Likelihood response scales have been developed so that the Risk Likelihood scores both: (1) reflect an approximate logarithmic scale (which reflects the psychological scale used by individuals when estimating likelihood); and (2) have a comparable range to that of the Prevalence scores (so that Prevalence and Risk Likelihood are weighted equally in the final Risk Level score). Following response scaling, a Risk Likelihood score for each Performance Factor is calculated as the median value of the respondents’ Risk Likelihood rating score for that Performance Factor. The Risk Likelihood response categories and scales used to derive Risk Likelihood scores are summarized in Table D-2. Table D-2. Risk Likelihood Response Categories and Scales Risk Likelihood Response Category Risk Likelihood Score Scale Not significant: It is difficult to think of how working conditions such as these could lead to sub-optimal Controller performance by a conscientious Controller. 1 Low: Working conditions such as these could possibly lead to sub-optimal Controller performance, but this factor is mostly just an actual or potential 10 inconvenience that most Controllers compensate for through training and/or practice. Medium: Working conditions such as these could result in a situation where the Controller receives clearly deficient information and/or support from tools, personnel, etc. A non-alert Controller could perform sub-optimally, but an alert 200 Controller would likely not be affected, although their activities may be more challenging. High: Working conditions such as these could result in a situation in which the Controller receives clearly deficient information and/or support from tools, 500 personnel, etc., and even an alert/proactive Controller could perform sub- optimally. Very High: Working conditions such as these are challenging and it is easy to see how they could lead to a situation in which a Controller could perform sub- 2,000optimally.#

Attachment 1, passage 128Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-5 4.3. Calculate Risk Level Scores A Risk Level score is intended to reflect the level of risk associated with Control Room working conditions, as reflected by either individual Performance Factors or Human Factors Topics. A Risk Level score for an individual Performance Factor is calculated by multiplying the Prevalence Score and the Risk Likelihood Score for a given Performance Factor, as illustrated in the equation below. A Risk Level score for a Human Factors Topic is calculated by computing the arithmetic mean (average) across the individual Risk Level scores for all Performance Factors that are included under one Human Factors Topic in the Control Room Human Factors Taxonomy (see Appendix B, pages B-7 through B-14). Risk Level = Median Prevalence Scaled Frequency Response X Median Risk Likelihood Scaled Response 4.4. Rank-order Human Factors Topics With Risk Level scores calculated for individual Performance Factors, these scores can be used to prioritize topics for further analysis during operational reviews and potential mitigation development. Two sets of rank-ordered lists are prepared for this purpose. First, a Risk Level score for each Human Factors Topic is calculated by computing the arithmetic mean (average) across the individual Risk Level scores for all Performance Factors that are included under one Human Factors Topic in the Human Factors Taxonomy. The resulting Risk Level scores can be used to prioritize the 29 individual Human Factors Topics on the basis of their estimated Risk Level. Initial experience in applying this methodology suggests that further analysis at the Human Factors Topic level provides the most efficient and comprehensive approach towards understanding current risks and characterizing potential mitigations. Second, the Risk Level scores calculated for each individual Performance Factor can be used as the criterion for preparing a rank-ordered list of all 138 Performance Factors. This second list provides a check to ensure that isolated working conditions that represent significant potential operational risk are not ignored during the subsequent risk analysis and management steps. RISK LEVEL SCORE CALCULATION EXAMPLE Following are a series of tables and figures that illustrate a hypothetical set of Prevalence responses, Prevalence scores, Risk Likelihood responses, Risk Likelihood scores, and the corresponding Risk Level score calculations for Performance Factors and Human Factors Topics. Table D-3 presents a hypothetical set of scaled Prevalence ratings by 20 respondents for Performance Factors 6.1.1 through 6.3.2 along with the median responses (Prevalence score) for each Performance Factor.#

Attachment 1, passage 129Page D-6 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Table D-3. Hypothetical Prevalence Responses and Scaled Data Prevalence Respondents Score PF (Median 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Response) 6.1.1 0 1 2 10 50 2 10 10 200 10 50 2 50 0 2 10 50 10 2 10 10 6.1.2 0 0 1 2 10 1 2 2 1 50 10 1 200 0 1 2 2 10 1 1 1.5 6.1.3 1 2 10 50 50 10 50 10 200 50 10 10 50 2 50 50 50 200 50 50 50 6.1.4 0 0 1 2 1 1 2 2 1 2 2 1 1 0 1 2 10 2 1 2 1 6.2.1 1 2 50 10 50 10 50 10 50 50 10 10 50 2 10 50 50 200 200 50 50 6.2.2 50 200 10 50 200 10 50 10 200 50 10 50 50 2 10 50 50 200 50 50 50 6.3.1 0 1 2 10 50 2 10 10 200 10 50 2 50 0 2 10 50 10 2 10 10 6.3.2 0 0 1 2 10 1 2 2 50 2 10 1 10 0 1 2 10 2 1 2 2 The histograms in Figure D-2 show the distribution of Prevalence scores for the hypothetical data sets of the first two Performance Factors in Table D-3. The median score represents the middle value in the ordered set of scores. Note that with an even number of responses the median can occur at a point between two response options, as is the case for the 6.1.2 example. In this case the arithmetic mean between the two categories is taken as the median. Frequency Distribution for PF 6.1.1 Frequency Distribution for PF 6.1.2 Frequency Count 8 7 6 5 4 3 2 1 0 Median Value = 10 Frequency Count 8 7 6 5 4 3 2 1 0 Median Value = 1.5 (Average of 1 & 2) 0 1 2 10 50 200 Response Value 0 1 2 10 50 200 Response Value Figure D-2. Distribution of scaled prevalence responses for the hypothetical data sets of the first two Performance Factors in Table 4.#

Attachment 1, passage 130Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-7 Table D-4 presents a hypothetical set of scaled Risk Likelihood ratings by 20 respondents for Performance Factors 6.1.1 through 6.3.2 along with the median responses (Risk Likelihood score) for each Performance Factor. Table D-4. Hypothetical Risk Likelihood Responses (with Rank-order Scale Data) Respondents Risk Likelihood PF Score 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 (Median Response) 6.1.1 200 500 2000 2000 500 2000 2000 10 200 2000 2000 500 10 2000 1 2000 2000 2000 2000 500 2000 6.1.2 10 200 500 500 200 500 500 1 10 500 500 500 500 500 10 200 500 500 500 500 500 6.1.3 200 10 10 200 10 10 10 200 200 2000 500 500 10 200 1 500 500 10 200 500 200 6.1.4 200 500 200 200 500 2000 2000 10 200 200 2000 500 200 2000 1 200 500 2000 500 500 500 6.2.1 1 10 10 10 500 200 10 10 200 10 10 200 10 10 1 200 10 200 200 500 10 6.2.2 10 200 500 500 200 500 500 1 10 500 500 500 500 500 10 200 500 500 500 500 500 6.3.1 200 500 200 200 500 2000 200 10 200 2000 2000 500 10 2000 1 2000 2000 2000 2000 500 500 6.3.2 10 500 10 200 10 200 10 200 10 200 10 200 10 200 1 200 2000 200 10 200 200 Table D-5 presents the hypothetical Prevalence scores (from Table D-3) and Risk Likelihood scores (from Table D-4) for the example set of Performance Factors 6.1.1 through 6.3.2, the Risk Level score for each Performance Factor (PF) calculated by multiplying the Prevalence and Risk Likelihood scores for that Performance Factor, and the Human Factors (HF) Topic Risk Level score calculated as the mean (arithmetic average) of the set of Performance Factors nested within each Human Factors Topic. Table D-5. Risk Level Score Calculations for Performance Factors and Human Factors Topics based on Table 4 and 5 Data Risk HF Prevalence PF Likelihood Topic Risk PF Score Risk Level Score Level Score (Median) Score (Median) (Means) 6.1.1 10 2,000 20,000 6.1.2 1.5 500 750 6.1.3 50 200 10,000 6.1.4 1 500 500 7,813 6.2.1 50 10 500 6.2.2 50 500 25,000 12,750 6.3.1 10 500 5,000 6.3.2 2 200 400 2,700#

Attachment 1, passage 131Page D-8 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions PRELIMINARY INDUSTRY RISK NORM DATA Table D-6 provides the Human Factors Topic Risk Level scores and rankings obtained from the trial application of the Controller Survey and Risk Likelihood rating activity to members of participating companies during the development of this methodology. Note that Prevalence score values for Yes/No items were approximated based on a established algorithm in scoring the test version of the survey. Yes/No questions are called out because their Risk Level scores have a significant estimated component and review of Table D-6 suggests that this estimated component may have biased the scores upwards. This is not an issue during future implementation of this methodology because the final form of the Controller Survey no longer has any Yes/No items that are used in Risk Level calculations. Guidance in Appendix E discusses the use of results similar to these in selecting operational review topics. Table D-6. Risk Level Score and Ranking by Human Factors Topic obtained from the Trial Application of the Controller Survey and Risk Likelihood Rating Activity Risk Risk Level Level HF Topic # HF Topic Description Score Ranking ‡8.1 Abnormal Situation Task Assignments 220,000 1 †9.4 Alertness Management Practices* 10,350 2 1.1 Task Design 10,000 3 †6.5 Nuisance Alarms 10,000 3 †7.1 Pipeline Fundamentals Knowledge and Field Exposure 2,500 5 9.1 Controller Fatigue 2,000 6 †11.1 Control Room Design 1,525 7 4.1 Operational Information Accuracy and Availability 1,000 8 3.3 Schedule Communications 700 9 6.1 Alarm Availability and Accuracy 500 10 †6.4 Alarm Access and Acknowledgement 500 10 1.2 Console Workload 400 12 2.2 SCADA Information Access and Layout 400 12 3.2 Control Center Communications 400 12 3.4 Field Personnel Communications 400 12 5.1 Job Procedure Design 400 12 9.2 Controller Schedule and Rest 400 12 11.2 Control Room Staffing 400 12 5.2 Job Procedure Availability 350 19 5.3 Job Procedure Accuracy and Completeness 350 19 3.1 Shift Hand-off Procedures 300 21 ‡7.2 Emergency Response Training 250 22 †6.3 Alarm Interpretation 200 23 †2.1 Equipment Layout and Workstation Design 110 24 9.3 Slow Work Periods 105 25 8.2 Control Room Distractions 20 26 10.1 Automated Operations 10 27#

Attachment 1, passage 132Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-9 Risk Risk Level Level HF Topic # HF Topic Description Score Ranking 2.3 SCADA Information Content, Coding, and Presentation 0 28 6.2 Alarm Displays and Presentation 0 28 * One Performance Factor (9.4.1) Prevalence score in this Human Factors Topic was estimated on the basis of the Prevalence score for a similar Performance Factor (9.1.2). ‡ Topic consisted exclusively of Yes/No items in first-generation Controller Survey. † Topic consisted of some Yes/No items in first-generation Controller Survey. Table D-7 provides the Performance Factor Risk Level scores and rankings obtained from the trial application of the Controller Survey and Risk Likelihood rating activity conducted with members of participating companies during the development of this methodology. Note that Prevalence Score values for Yes/No items were approximated based on an established algorithm in scoring the test version of the survey; whereas the final form of the Survey does not have any Yes/No items. Guidance in Appendix E discusses the use of results similar to these in selecting operational review topics. Table D-7. Prevalence, Risk Likelihood, Risk Level Scores and Risk Level Ranking by Performance Factor obtained from the Trial Application of the Controller Survey and Risk Likelihood Rating Activity Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three) 10 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex 200 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities 350 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations 1.1.5 Some operations have a very small margin for error 200 1.2.1 Two or more control operations (e.g., line switches) must be done at the same time 1.2.2 Excessive telephone activity interferes with monitoring and control operations 1.2.3 Shift hand-off activities interfere with operations 1.2.4 Unusual work conditions (trainees, tours/visitors) interfere with operations 1.2.5 Unusual operational conditions (smart pigging, major repairs) interfere with operations 1.2.6 Controllers have to make important operational decisions without sufficient time to adequately consider alternatives 10 50 500 2 200 50 50 200 2 10 2 10 2 200 2 200 100 96 10000 13 175000 6 400 53 10000 13 200 10000 13 200 40000 8 20 97 20 97 400 53 400 53#

Attachment 1, passage 133Page D-10 PF ID 2.1.1 2.1.2 ‡2.1.3 ‡2.1.4 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.3.7 3.1.1 3.1.2 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Risk Risk Risk Prevalence Likelihood Level Level Prevalence Factor Score Score Score Ranking There are not enough display monitors to show all of the information that a Controller needs at one time during normal operations 2 10 20 97 There are not enough display monitors to show all of the information that a Controller needs at one time during abnormal situations 1 200 200 85 Monitoring and control activities are disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare) 50 10 500 45 Monitoring and control activities are disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast) 0 10 0 116 Inconsistencies in SCADA display design from screen to screen increase the difficulty of getting needed information 2 200 400 53 A cluttered, or complicated SCADA display increases the difficulty of finding needed information 2 200 400 53 The layout of information (e.g., lines, equipment, and data) on the SCADA display increases the difficulty of finding, identifying, and interpreting information 1 200 200 85 Needed information is not shown on the appropriate SCADA display 2 500 1000 29 Controllers must navigate between too many SCADA displays to view related information 200 Navigating between SCADA displays interferes with the flow of monitoring and control activities 1 10 The location or layout of SCADA control boxes/targets makes them difficult to use Information about which part of the pipeline system the current SCADA display represents is not adequately provided Some colors on SCADA displays make interpretation difficult Some labels on SCADA displays make interpretation difficult Some symbols on SCADA displays make interpretation difficult 10 1 10 0 200 0 10 1 10 1 10 2000 20 10 109 10 109 0 116 0 116 10 109 10 109 Controllers must transform values from the measurement scale presented on the SCADA display to another scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task 0 200 0 116 SCADA displays do not provide adequate system overview information for keeping track of system status 0 200 0 116 There is inconsistent use of units of measure (e.g., gallons, barrels, cubic meters) on SCADA displays 0 10 0 116 Shift hand-off procedures or tools do not adequately identify, track, and record information required by the Controller coming on shift 1 200 200 85 Formal shift hand-off procedures are not adequately followed by Controllers 2 200 400 53#

Attachment 1, passage 134Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-11 Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking 3.2.1 The exchange of required operations information between Controllers on different consoles is not adequate 2 200 400 53 3.2.2 Control center staff (not including field technicians) are not available to provide assistance with an operational issue when required 2 350 700 38 3.2.3 The lines of communication in the control room are not clearly defined or adhered to 2 105 210 82 3.3.1 Product delivery schedules are inaccurate 2 200 400 53 3.3.2 Changes in product delivery schedules are not communicated to Controllers at all 2 500 1000 29 3.3.3 Changes in product delivery schedules are communicated to Controllers without sufficient lead time 2 350 700 38 3.4.1 Field technicians are not available to assist Controllers with an operational issue when required 2 200 400 53 3.4.2 Important field information (e.g., operational and maintenance activities) is not provided directly to Controllers in a timely manner 2 200 400 53 3.4.3 Field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to Controllers 2 500 1000 29 3.4.4 Field personnel do not fully communicate important ongoing operational conditions (e.g., pigging or repairs) to Controllers 2 350 700 38 3.4.5 Controllers have difficulty communicating with field personnel due to a lack of available communications equipment 2 200 400 53 4.1.1 SCADA data from field instruments (meters, gauges, etc) are inaccurate 4.1.2 SCADA data are stale/out-of-date, or unavailable due to a communications problem (e.g., outage, time delay) 10 10 500 5000 17 200 2000 20 4.1.3 The SCADA display does not indicate that data are out-of-date or unavailable 2 500 1000 29 4.1.4 Changes in field system operational status (e.g., equipment identity or operational activities) are not adequately indicated in SCADA displays 2 200 400 53 4.1.5 Displayed pipeline schematics or operational parameters (e.g., MOPs) are inaccurate 2 500 1000 29 4.1.6 Manually entered batch, log, and/or summary information is not accurate 2 500 1000 29 4.1.7 Required information is not available on the SCADA display 2 500 1000 29 5.1.1 When to use a procedure is not clearly defined 2 200 400 53 5.1.2 Required technical detail is not provided by a procedure 2 200 400 53 5.1.3 Procedures are difficult to read 1 200 200 85 5.1.4 Critical information is difficult to find in a procedure 1 200 200 85#

Attachment 1, passage 135Page D-12 PF ID 5.1.5 5.1.6 5.2.1 5.2.2 5.2.3 5.3.1 5.3.2 5.3.3 5.3.4 6.1.1 6.1.2 6.1.3 6.2.1 6.2.2 6.2.3 6.2.4 6.2.5 6.2.6 6.3.1 6.3.2 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Risk Risk Risk Prevalence Likelihood Level Level Prevalence Factor Score Score Score Ranking Procedures do not meet the needs of both novice and experienced operators 2 200 400 53 Procedures and job aids used in responding to abnormal situations are difficult to follow 1 500 500 45 A specific required operations procedure is not available 1 350 350 81 Finding an individual procedure among the large overall number of procedures is difficult 2 200 400 53 Procedures and job aids required to identify and recover from abnormal situations are not readily available 0 500 0 116 Procedures contain out-of-date or inaccurate information 2 350 700 38 Procedure update notifications are not adequately provided to Controllers 1 200 200 85 Controllers do not understand the documented procedure 0 500 0 116 Controllers execute actions in a manner that is not consistent with established and documented procedures because the procedure is incorrect or incomplete 1 500 500 45 No alarm is available to notify the Controller about important operational status information (e.g., pressure or batch interface at a specific point in the line) 1 2000 2000 20 Alarms do not provide the Controller with sufficient lead time to take corrective actions (i.e., because of sensor location) 1 500 500 45 Changes in operating conditions triggered by external events that are outside of Controllers’ influence (e.g., equipment failure or maintenance on a feeder system) are not displayed on the SCADA 2 200 400 53 Alarm displays become too cluttered making it difficult to identify important alarms 2 200 400 53 The alarm display shows alarms from another console and Controllers have difficulty finding the alarms for their console 0 200 0 116 High-priority alarms are ineffective in attracting a Controller’s attention when performing other activities 0 500 0 116 The sound or loudness of critical alarms startles Controllers unnecessarily 0 10 0 116 The sound of an alarm does not clearly indicate the alarm priority 0 10 0 116 The color of an alarm does not clearly indicate the alarm priority 0 10 0 116 The displayed alarm description is difficult to interpret 1 200 200 85 There are multiple causes for some alarms, but insufficient information is provided to identify the actual cause 1 200 200 85#

Attachment 1, passage 136Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-13 Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking 6.3.3 Alarm summary information does not provide adequate information about conditions at the time that the alarm was triggered 6.3.4 Alarms are not displayed in a consistent format, making their interpretation difficult ‡6.3.5 It is difficult to determine the priority of an alarm 6.4.1 The process of clearing alarms interferes with monitoring and control operations 6.4.2 Controllers unintentionally acknowledge important alarms when there are too many alarms that need to be cleared 6.4.3 It is difficult to sort alarms by priority, time of occurrence, or other useful dimensions ‡6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screens, or keystrokes to access previously acknowledged alarms) 6.4.5 Controllers accidentally acknowledge or clear alarms for an adjacent console ‡6.5.1 The number of nuisance alarms limits the ability to quickly identify potentially important alarms 6.5.2 Monitoring and control operations are disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up) 1 200 0 200 1 200 2 10 2 350 200 1 500 2000 2 200 200 85 0 116 200 85 20 97 700 38 0 200 0 116 200 40000 8 500 45 500 1000000 1 400 53 ‡6.5.3 Monitoring and control activities are disrupted by unnecessary information alarms, or notifications being displayed on the alarm screen (e.g., action started, action completed, etc) 200 ‡6.5.4 Too many nuisance alarms are caused by equipment that is waiting to be fixed 200 6.5.5 Some alarms classified as critical do not represent true critical situations ‡7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter 500 ‡7.1.3 Controllers are not provided adequate training about hydraulics 350 ‡7.1.4 Controllers are not provided adequate training on field operations and field systems ‡7.1.5 Controllers are not adequately trained on specific console operations prior to working alone ‡7.1.6 Controllers are not provided refresher training frequently enough ‡7.1.7 Controllers are not provided adequate training before the introduction of a new pipeline 7.1.8 Controllers are not provided adequate training on a specific operational procedure, product, or tool before it is introduced into operation ‡7.2.1 Controllers are not adequately trained in emergency response 2000 50 2 10 200 10 10 2 1250 2 200 500 1 500 1 500 400000 2 10000 13 20 97 100000 7 3500 18 200 2000 20 2500 19 400 53 500 250000 5 500 45 500 45#

Attachment 1, passage 137Page D-14 PF ID ‡7.2.2 ‡8.1.1 ‡8.1.2 ‡8.1.3 ‡8.1.4 8.2.1 8.2.2 8.2.3 8.2.4 8.2.5 9.1.1 9.1.2 9.1.3 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 9.3.1 9.3.2 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Risk Risk Risk Prevalence Likelihood Level Level Prevalence Factor Score Score Score Ranking Controller are not adequately trained in handling abnormal situations Controllers are distracted in their response to abnormal situations by non-critical, ongoing duties (e.g., responding to phone calls) 0 500 2000 0 116 200 400000 2 Controllers are distracted in their response to abnormal situations by the need to provide required notifications 200 200 40000 8 Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations 2000 200 400000 2 Control room staff roles and responsibilities during abnormal situations are not well defined 2 200 400 53 Controllers are distracted from monitoring and controlling operations by the need to complete operations reports (e.g., operating sheets, production summaries, line status summaries) 2 10 20 97 Controllers end up completing work that is assigned to schedulers 2 10 20 97 Field personnel do not provide adequate or timely support to Controllers 2 200 400 53 Stressful relations with control room management distracts Controllers from monitoring and control operations 2 10 20 97 Stress resulting from productivity goals, incentives, or penalties distracts Controllers from monitoring and control operations 2 10 20 97 A Controller feels particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm) 200 A Controller feels drowsy or tired throughout a shift A Controller feels fatigued at the end of a shift 200 Controllers get insufficient sleep because of transitions in work shifts from day to night or night to day 200 Controllers get insufficient sleep because of being called in to work a shift on short notice Controllers get insufficient sleep because of overtime work Controllers get insufficient sleep because of twelve hour shifts Controllers get insufficient sleep because of ongoing understaffing Controllers get insufficient sleep because of shift start times Controllers experience reduced alertness during slow periods 10 2 350 10 10 2 200 2 200 2 10 2 200 2 10 2 105 2000 20 700 38 2000 20 2000 20 400 53 400 53 20 97 400 53 20 97 210 82 Controllers experience difficulty regaining alertness to deal with a challenging situation following a slow period 0 200 0 116#

Attachment 1, passage 138Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-15 Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking 9.4.1 Controllers report to work tired enough that they are concerned about their ability to run the pipeline* 10 ‡9.4.2 Controllers do not notify management when they report to work without adequate rest 10 10.1.1 Automation of control actions makes the Controller job more difficult 10.1.2 Too many steps are required to set up an automated sequence of control actions 10.1.3 Automated operation of some equipment conflicts or interferes with Controller actions 10.1.4 Controllers can forget to perform a manual control action because the initial steps are automated 10.1.5 Automation is not consistent across similar stations/locations 10.1.6 Controllers do not understand how automation works at a station/location 10.1.7 Controllers do not sufficiently trust the reliability of control action automation 10.1.8 There are some steps in an automated sequence that are not displayed by SCADA 10.1.9 There are specific control actions (e.g., line ups, line shutdown, and manifold flushing) that would benefit from automation ‡11.1.1 The location of break facilities keeps Controllers away from their console too long ‡11.1.2 The location of break facilities keeps Controllers from taking appropriate brief breaks 11.1.3 The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc) 11.1.4 Controllers on break cannot be reached to address an immediate operational situation 11.2.1 Another Controller’s long break times puts an excessive burden on the relieving Controller 11.2.2 Controller staffing is not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc) NA 2000 1 10 1 10 1 10 0 200 2 200 0 200 2 105 0 10 2 10 200 200 10 1 500 1 200 2 500 700 38 20000 12 10 109 10 109 10 109 0 116 400 53 0 116 210 82 0 116 20 97 105 21000 11 10 2000 20 105 1050 28 500 45 200 85 1000 29 11.2.3 Controller staffing is not adequate to allow for vacation, sick leave, and/or regularly scheduled days off 2 500 1000 29 11.2.4 Controllers work on their scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc.) 2 200 400 53 11.2.5 Controller staffing is not adequate to provide Controller assistance during busy normal operations 2 200 400 53 11.2.6 Controller staffing is not adequate to provide Controller assistance during abnormal situations 0 200 0 116 * Note: Risk level score from 9.1.2. ‡ Yes/No item in first-generation Controller Survey.#

Attachment 1, passage 139Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-17 RISK LEVEL CALCULATION SUMMARY SHEETS The following calculation summary sheets are intended to provide a recommended format for documenting the computations and results of the Risk Level score calculations at the detailed Performance Factor level and the more general Human Factors Topic level. These summary sheets are provided simply to illustrate a useful final format for documenting the results. It is recognized that actual Risk Level scores would be most efficiently calculated using a computer- based database and software application.#

Attachment 1, passage 140Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-19 Performance Factor Risk Level Calculation Summary Sheet Median Scaled PF ID Prevalence X Risk Likelihood Median Score = Risk Level Score Risk Level Rank Order Score 1.1.1 X = 1.1.2 X = 1.1.3 X = 1.1.4 X = 1.1.5 X = 1.2.1 X = 1.2.2 X = 1.2.3 X = … X = … X = … X = … X = 11.2.5 X = 11.2.6 X = Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 4 Risk Level Calculation Instructions, Sample Results, and Summary Sheets Page D-21 Human Factors Topic Risk Level Calculation Summary Sheet Mean HF HF Topic Sum of HF Topic Risk Topic Individual PF Risk Level Scores = Individual PF Risk Level ÷ Number of PFs = Risk Level ID Level Rank Scores Score Order 1.1 __ + __ + __ + __ + __ = ÷ 5 = 1.2 __ + __ + __ + __ + __ + __ = ÷ 6 = 2.1 __ + __ + __ + __ = ÷ 4 = 2.2 __ + __ + __ + __ + __ + __ + __ = ÷ 7 = 2.3 __ + __ + __ + __ + __ + __ + __ = ÷ 7 = 3.1 __ + __ = ÷ 2 = 3.2 __ + __ + __ = ÷ 3 = 3.3 __ + __ + __ = ÷ 3 = … … = ÷ … = … … = ÷ … = … … = ÷ … = 11.1 __ + __ + __ + __ = ÷ 4 = 11.2 __ + __ + __ + __ + __ + __ = ÷ 6 =#

Attachment 1, passage 141Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 5 Operational Review Topics Selection Guidance and Documentation Sheet Page E-1 APPENDIX E STEP 5 OPERATIONAL REVIEW TOPICS SELECTION GUIDANCE AND DOCUMENTATION SHEET#

Attachment 1, passage 142Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 5 Operational Review Topics Selection Guidance and Documentation Sheet Page E-3 STEP 5 OPERATIONAL REVIEW TOPICS SELECTION GUIDANCE Step 5 is conducted to systematically review all information relevant to control room human factors risks and select a set of topics to address during the conduct of operational reviews. Figure E-1 depicts the three activities that comprise this step, as well as the review of other inputs during this step. Guidance regarding the conduct of each of these sub-steps is provided below, followed by an Operational Review Topic Selection Documentation Sheet. 5.1 Review Human Factors Topic Risk Level Rankings 5.2 Review High-Risk Performance Factors Review Other Inputs: • Incidents • Accidents • New Risks • Regulation 5.3 Select Operational Review Topics Figure E-1. Step 5 Operational Review Topic Selection Activities 5.1. Review Human Factors Topic Risk Level Rankings The first source of information to consider in selecting operational review topics is the Human Factors Topic Risk Level rank-order list prepared during Step 4. This list ranks the 29 Human Factors Topics in their order of estimated risk to pipeline operations at a level that allows comprehensive and efficient consideration of the pertinent issues. In reviewing these topics, the risk management team should begin to establish a general understanding of the scope of the upcoming operational review. The Risk Level summaries prepared during Step 4 provide the Risk Level scores and rank-order summaries of Human Factors Topics and individual Performance Factors. Table E-1 provides the Human Factors Topic Risk Level scores and rankings obtained from the trial application of the Controller Survey and Risk Likelihood Rating Activity conducted with members of participating companies during the development of this methodology. Note that Prevalence Score values were approximated based on an established algorithm for Yes/No Controller Survey items in the first- generation version of the survey; whereas the final form of the Survey does not have any Yes/No items. The risk management team should prepare a table comparable to Table E-1 for their control room and compare the two tables. If an individual operator’s results diverge substantially from the norms in Table E-1, it would be advisable for the risk management team to review the raw data grooming and scoring procedures to ensure that errors were not introduced into the#

Attachment 1, passage 143Page E-4 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions results. The exception would be Human Factors Topics containing Yes/No questions, which have a significant estimated component that makes them less reliable and more subject to variation.2 Table E-1. Risk Obtained from the Trial Application of the Controller Survey and Risk Likelihood Rating Activity Risk Risk Level Level HF Topic # HF Topic Description Score Ranking ‡8.1 Abnormal Situation Task Assignments 220,000 1 †9.4 Alertness Management Practices* 10,350 2 1.1 Task Design 10,000 3 †6.5 Nuisance Alarms 10,000 3 †7.1 Pipeline Fundamentals Knowledge and Field Exposure 2,500 5 9.1 Controller Fatigue 2,000 6 †11.1 Control Room Design 1,525 7 4.1 Operational Information Accuracy and Availability 1,000 8 3.3 Schedule Communications 700 9 6.1 Alarm Availability and Accuracy 500 10 †6.4 Alarm Access and Acknowledgement 500 10 1.2 Console Workload 400 12 2.2 SCADA Information Access and Layout 400 12 3.2 Control Center Communications 400 12 3.4 Field Personnel Communications 400 12 5.1 Job Procedure Design 400 12 9.2 Controller Schedule and Rest 400 12 11.2 Control Room Staffing 400 12 5.2 Job Procedure Availability 350 19 5.3 Job Procedure Accuracy and Completeness 350 19 3.1 Shift Hand-off Procedures 300 21 ‡7.2 Emergency Response Training 250 22 †6.3 Alarm Interpretation 200 23 †2.1 Equipment Layout and Workstation Design 110 24 9.3 Slow Work Periods 105 25 8.2 Control Room Distractions 20 26 10.1 Automated Operations 10 27 2.3 SCADA Information Content, Coding, and Presentation 0 28 6.2 Alarm Displays and Presentation 0 28 * One Performance Factor (9.4.1) Prevalence score in this Human Factors Topic was estimated on the basis of the Prevalence score for a similar Performance Factor (9.1.2). ‡ Topic consisted exclusively of Yes/No items. † Topic consisted of some Yes/No items 2 Future applications of the Controller Survey could provide data that could be used to update Tables E-1 and E-2 with data based on the final version of the survey that does not include Yes/No survey items. Along with updating the scores in these tables, these data would also provide an appropriate basis for quantifying the reliability of obtained scores (quantified as sampling confidence intervals) which could provide additional diagnostic information for reviewers in identifying the nature and cause of any substantial results anomalies.#

Attachment 1, passage 144Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page E-5 Step 5 Operational Review Topics Selection Guidance and Documentation Sheet 5.2 Review High-Risk Performance Factors In addition to the Human Factors Topics rankings, the risk management team should also review the rank-order list of individual Performance Factors. The objective of this review is to identify any individual Performance Factor that appears to represent a level of relative operational risk indicating that its inclusion in the upcoming operational review would help to understand and/or manage potentially high-risk factors. These individual scores can serve as a “safety net” to catch potentially important Performance Factors that would otherwise be missed using the Human Factors Topic Risk Level rankings. Table E-2 provides an example of such a table, which presents the Performance Factors with the higher-ranking Risk Level scores that were obtained from the test application of the Controller Survey and Risk Likelihood rating activity conducted with members of participating companies. Review of this table reveals that the highest-ranking Performance Factor has a substantially higher Risk Level score than any other Performance Factor and the next three Performance Factors also have very high Risk Level scores. If these results were obtained with the revised Controller Survey (in which all items are based on a common response scale), it would be prudent to address at least the top-four Performance Factors in the subsequent operational review. However, given the potential anomaly associated with the Yes/No item scoring and the limited data from which these scores are based, the actual Risk Level scores presented in Table E-2 should not be assumed to provide an accurate reflection of current industry risk levels. Table E-2. Prevalence, Risk Likelihood, Risk Level Scores and Risk Level Ranking by Performance Factor obtained from the Trial Application of the Controller Survey and Risk Likelihood Rating Activity Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking ‡6.5.1 The number of nuisance alarms limits the ability to quickly identify potentially important alarms 2000 X 500 = 1,000,000 1 ‡6.5.3 Monitoring and control activities are disrupted by unnecessary information alarms, or notifications being displayed on the alarm screen (e.g., action started, action completed, etc) 2000 X 200 = 400,000 2 ‡8.1.1 Controllers are distracted in their response to abnormal situations by non-critical, ongoing duties 2000 X 200 = 400,000 2 ‡8.1.3 Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations 2000 X 200 = 400,000 2 ‡7.1.7 Controllers are not provided adequate training before the introduction of a new pipeline 500 X 500 = 250,000 5 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities 500 X 350 = 175,000 6 ‡7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter 200 X 500 = 100,000 7 1.2.2 Excessive telephone activity interferes with monitoring and control operations 200 X 200 = 40,000 8 ‡6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screens, or keystrokes to access previously acknowledged alarms) 200 X 200 = 40,000 8#

Attachment 1, passage 145Page E-6 Control Room Human Factors Risk Assessment and Management Guide Step 2 Controller Survey and Administration Instructions Risk Risk Risk Prevalence Likelihood Level Level PF ID Prevalence Factor Score Score Score Ranking ‡8.1.2 Controllers are distracted in their response to abnormal situations by the need to provide required notifications 200 X 200 = 40,000 8 ‡11.1.1 The location of break facilities keeps Controllers away from their console too long 200 X 105 = 21,000 11 ‡9.4.2 Controllers do not notify management when they report to work without adequate rest 2000 X 10 = 20,000 12 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex 50 X 200 = 10,000 13 1.1.5 Some operations have a very small margin for error 50 X 200 = 10,000 13 1.2.1 Two or more control operations (e.g., line switches) must be done at the same time 50 X 200 = 10,000 13 ‡6.5.4 Too many nuisance alarms are caused by equipment that is waiting to be fixed 50 X 200 = 10,000 13 4.1.1 SCADA data from field instruments (meters, gauges, etc) are inaccurate 10 X 500 = 5,000 17 ‡7.1.3 Controllers are not provided adequate training about hydraulics 10 X 350 = 3,500 18 ‡7.1.5 Controllers are not adequately trained on specific console operations prior to working alone 2 X 1250 = 2,500 19 ‡ Yes/No item in first-generation Controller Survey. 5.3. Select Operational Review Topics The final selection of operational review topics should take into account the results of activities 5.1 and 5.2, as well as any other pertinent information. The risk management team can use Human Factors Risk Level and Performance Factor Risk Level summaries for their control room in selecting the topics to be addressed in their operational review. In general, teams should select a manageable number of high-risk Human Factors Topics, while not excluding individual Performance Factors with particularly high Risk Levels, in selecting the operational review topics. At this time, no quantitative criteria can be provided for topic selection, due to the lack of an historical Risk Level database. However, the Risk Level score values should be considered and those that are substantially larger in value than others should be selected for inclusion in an operational review unless there are other compelling and defensible reasons for its exclusion. At the completion of the operational review selection activity, the review team should prepare an operational review plan that includes the identification of all Human Factors Topics to be addressed and the identification of any specific Performance Factors to be addressed separately. It is recognized that the current methodology includes a limited range of issues for consideration in selecting operational review topics. Therefore, an additional set of risk management team inputs labeled ‘Other Inputs’ are identified in Figure E-1, including incidents, accidents, new risks, and regulations. In reviewing all available inputs, the risk management team should select and document a set of operational review topics that they think represents the greatest potential operational risk that can be comprehensively addressed in the upcoming operational review with the resources available.#

Attachment 1, passage 146Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 5 Operational Review Topics Selection Guidance and Documentation Sheet Page E-7 OPERATIONAL REVIEW TOPICS SELECTION DOCUMENTATION SHEET The following documentation sheet can be used to record and document the results of the Step 5 selection of operational review topics by the human factors risk management team. Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 5 Operational Review Topics Selection Guidance and Documentation Sheet Page E-9 STEP 5 OPERATIONAL REVIEW TOPIC SELECTION Selection Topic Summary Sheet The topics listed below were selected on (date) by the (company name) human factors risk management team to be addressed in the upcoming control room operational reviews, scheduled to be conducted from (date) to (date). The following Human Factors Topics and corresponding Performance Factors will be addressed in the upcoming operational reviews. HF Topic HF Topic Risk Level Risk Level HF Topic ID and Title Included Performance Factor IDs and Titles Ranking Score In addition to the above Human Factors Topics, the following individual Performance Factors will also be addressed in the upcoming operational reviews. PF Risk PF Risk Level Level Performance Factor IDs and Titles Ranking Score#

Attachment 1, passage 147Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-1 APPENDIX F STEP 6 CONTROL ROOM OPERATIONAL REVIEW GUIDANCE AND WORKSHEETS#

Attachment 1, passage 148Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-3 STEP 6 OPERATIONAL REVIEW GUIDANCE The objective of an operational review is to take a closer look at those Human Factors Topics and individual Performance Factors that represent the greatest potential risk in control room operations. Specific information is obtained that will help the risk management team understand the nature of the operational risks, the working conditions contributing to those risks, and potential mitigations that could be implemented to reduce current risk levels. Step 6 involves planning, conducting, and summarizing the operational reviews. Figure F-1 depicts the three major activities that comprise this step, along with the four information collection activities. 6.1 6.1 Define Scope and Plan Define Scope and Plan for Operational Review for Operational Review 6.2 Conduct Information Collection Activities 6.2 Conduct Information Collection Activities Conduct Conduct Incident and Incident and Accident Accident Reviews Reviews Conduct Conduct Interviews Interviews Conduct Conduct Observations Observations Conduct Conduct Materials Materials Reviews Reviews 6. 3 6. 3 Summarize Summarize Operational Reviews Operational Reviews Figure F-1. Step 6 Operational Review Activities Effectively conducting Step 6 will require substantial resources and time. To support this challenging activity, the following guidance is provided at a relatively detailed level. In addition, a series of operational review worksheets are provided to help structure and ensure standardized documentation of the operational review process; and detailed guidance specific to individual Human Factors Topics is provided at the end of this appendix to help in focusing the operational review efforts on the relevant human factors issues. 6.1. Define Scope and Plan for Operational Review The operational review process begins with the identification of the review activities to be conducted and the preparation of materials needed to support those activities. Figure F-2 provides an overview of sub-step 6.1 activities. For each of the selected operational review topics, the risk management team should review the risk analysis results, Controller Survey comments, and the detailed operational review guidance provided at the end of this appendix to#

Attachment 1, passage 149Page F-4 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets determine the appropriate scope and specific information collection activities. In addition, the risk management team should consider other relevant operational information that is available at this time (e.g., recent safety incidents or areas of heightened concern). The following discussions provide general guidance regarding each activity in this sub-step. Review Risk Analysis Results 6.1 Define Scope and Plan for Operational Review Review Controller Survey Comments Review Information Collection Guidance Review Other Operational Information Prepare a Scoping Worksheet for each Selected Topic Figure F-2. Sub-step 6.1 operational review activities overview. Review Risk Analysis Results. The Step 5 topic selection results will provide summary scores for the estimated Prevalence, Risk Likelihood, and Risk Level for each of the individual Performance Factors included under the individual topic to be reviewed. Table F-1 is an example of such a table. A similar table should be generated by the risk management team during Step 5 for the topics selected for operational review in their control room. The risk management team should review the Performance Factor definitions and Risk Level scores to gain an initial sense of the relevant issues corresponding to individual review topics. Table F-1. Hypothetical Example Summary Table for Human Factors Topic 1.1 Risk Risk Risk 1.1 Task Design Prevalence Score Likelihood Level Level Score Score Ranking 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three) 10 10 100 26 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex 50 200 1,000 12 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities 500 350 175,000 5 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations 2 200 400 44 1.1.5 Some operations have a very small margin for error 50 200 1,000 12#

Attachment 1, passage 150Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page F-5 Step 6 Control Room Operational Review Guidance and Worksheets Review Controller Survey Comments. The Controller comments obtained from the Controller Survey provide critical information in defining the scope of the review for a selected topic. Trial administrations of this survey demonstrated that Controllers can provide very detailed and specific comments regarding the working conditions associated with each Performance Factor that may be affecting their job performance. When such comments are provided, they will provide useful issues for verification and clarification during the operational review. However – and just as importantly – some topics receive very few relevant comments. If a lack of comments coincides with relatively low Prevalence ratings, then this provides converging evidence supporting the lower priority of such topics. Table F-2 provides a summary of selected Controller comments for Human Factors Topic 1.1 (Task Design) that were obtained from the trial administration of the Controller Survey. The reader should note that these comments are for illustration only and reflect a small subset of all obtained comments from several control rooms. However, even a brief review of these comments illustrates the value of the Controller comments in helping to identify specific issues that should be addressed during the operational reviews. Table F-2. Selected Controller Comments for Human Factors Topic 1.1 (Task Design) 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three) ■ Every time we make a batch change this is at least a 4-step process and we make 20 changes a day. ■ I have 13 systems; chemicals, crude, and products making adjustments throughout the day, every day. ■ I have a couple of locations where control fails frequently and control has to be resent several times. ■ I have seven pipelines to operate at once. ■ It depends on the day, sometimes we start and stop several batches in an hour in which 3 steps are required. Other times we may not have anything for a couple of hours. ■ It takes four steps to make a set point change. That is a good thing as it makes you stop to insure it is the correct number you are putting in. 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex ■ Lack of automation through SCADA. ■ Line flushes and batch changes. ■ Line starts on several lines, batch changes daily. ■ Lines start up daily. ■ Most of the pipelines that I run are "remote" operations. That means all pipeline functions are performed by the Controller. ■ On our Flex system. ■ On the XX line, we catch many batch changes, perform many manifold flushes, start up lines each and every day. ■ One line is very large & requires a lot of effort to properly start & shut down. ■ One pipeline requires multiple stations/pumps starting. Takes 30 minutes to start.#

Attachment 1, passage 151Page F-6 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Table F-2., continued 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities ■ Everybody should be performing manual calculations of some sort. If they are not, I don't know how they are doing their job. ■ Everything's manual. ■ Figure rate conversions, batch times, etc. ■ Figuring stop times when multiple stations are running, and one might shut off after shift is over. ■ Floating a tank (stream in and stream out simultaneously), where for example, I am controlling what comes in, and someone else is controlling what goes out. ■ Frequently throughout the shift as we are setting up the shift sheet for the oncoming Controller. ■ Hourly over/sorts, daily log sheets, etc. ■ I always calculate amount of product in and out of tanks. 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations ■ Our pump stations are not set up the same ways. ■ Part of the job. ■ Periodic refinery suction issues. ■ PLC are all programmed different. ■ Several systems were combined to make this system, consistent controls have not been addressed. ■ Some automation, some not. ■ Some lines that run not as often have different pump/valve set ups. ■ Start up, plus line swings, shutdown. 1.1.5 Some operations have a very small margin for error ■ All batch changes have a small margin for error. ■ Automation would end almost all of this. ■ Batch cuts, log sheets, starting lines. ■ Calculating and performing batch cuts ■ Closing or opening head gates at least once a week ■ Flying switches on pumps when line is running close to max rate. ■ Manual batch ends. ■ Pipeline directives are ever-changing and adjustments must be made accordingly. ■ Sending incorrect flow setpoints can cause equipment damage and we send setpoints at several locations each day and some locations several times per day. ■ Several of the lines are run at close to maximum discharge. Changes on the line at one point could shut down the whole line due to a buildup of pressure. ■ Some of our pipelines have multiple pump stations and managing pressures is difficult during transient conditions. Review Information Collection Guidance. Detailed guidance regarding specific interview, observation, and materials review topics that can be investigated for each of the 29 Human Factors Topics is provided at the end of this appendix. This detailed guidance has been prepared as an aid in defining the scope for each operational review topic.#

Attachment 1, passage 152Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page F-7 Step 6 Control Room Operational Review Guidance and Worksheets Review Other Operational Information. In addition to the inputs identified in the present methodology, other review inputs, including recent incidents, recent accidents, newly identified operational risks, and emerging regulation could provide additional information that is relevant to the scope of an operational review plan. This information should also be considered, as appropriate, in defining the review scope and plan. Prepare a Scoping Worksheet for each Selected Topic. A Sub-step 6.1 Scoping Worksheet (provided in this appendix) should be completed for each selected operational review topic. Completion of the worksheet will ensure the consideration of all appropriate operational review activities and provide a record of the operational review plan. This worksheet basically identifies the specific information collection activities to be conducted and defines some limited initial direction for conducting the operational review. Instructions for completing each section of this worksheet are provided along with the worksheet in this appendix. 6.2. Conduct Information Collection Activities Four separate types of operational review information collection activities can be conducted in reviewing any specific topic, as depicted in Figure F-3, including incident and accident reviews, interviews, observations, and materials reviews. The specific type and focus of information activities conducted in addressing any individual topic will depend upon the relative level of operational risks associated with that topic, the availability of information to support each information collection activity, and the resources allocated to the operational review process. There is an advantage to conducting the information collection activities in the sequence shown in Figure F-3, since information obtained in earlier activities helps focus the content of later activities. However, other sequences are acceptable if there are logical or practical reasons for doing so. Following is some general guidance regarding the conduct of each type of information collection activity. The detailed operational review guidance provided at the end of this appendix identifies some of the specific information that can be collected by each type of activity for each of the 29 Human Factors Topics. 6.2 Conduct Information Collection Activities 6.2 Conduct Information Collection Activities Conduct Conduct Incident and Incident and Accident Accident Reviews Reviews Conduct Conduct Interviews Interviews Conduct Conduct Observations Observations Conduct Conduct Materials Materials Reviews Reviews Figure F-3. Step 6.2 information collection activities overview. Conduct Incident and Accident Reviews. If relevant incident and/or accident reports can be identified and are available for review, they can provide a useful starting point in understanding the nature of factors that have historically had an adverse affect on control room monitoring and control performance. Access to relevant accident, incident, and near-incident reports will depend on how well the following conditions can be met at a given control room:#

Attachment 1, passage 153Page F-8 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets  The control room’s current accident, incident, and near-incident reporting and analysis program maintains a record of information that is relevant to the Human Factors Topics and Performance Factors included in the Human Factors Taxonomy;  The control room’s reporting and analysis program maintains up-to-date and comprehensive records of accident, incident, and near-incident investigations; and  The risk management team is able to identify, obtain, and review relevant reports. It is recommended that the risk management team establish an operational period to be included in the report sample. Factors to consider in establishing this time period include changes in operational procedures, pipeline systems, or control room systems that would affect the relevance of the obtained data. The objectives of conducting a review of accidents, incidents, and near-incidents related to a review topic are to: 1. Develop a description of the working conditions corresponding to identified Human Factors Topics or Performance Factors; 2. Develop a description of the types of unsafe acts that can result from the identified working conditions; 3. Develop a description of the nature of the operational risk associated with these working conditions; and 4. Identify potential mitigations that may help in reducing the current operational risk level. In conducting the actual review, it will likely be useful to organize the findings and recommendations in reviewed reports in accordance with the Human Factors Taxonomy. In this way, the relevance of report findings to the human factors topics under consideration can be identified in a straight-forward manner. The Sub-step 6.2 Incident and Accident Review Worksheet in this appendix provides a template that can be used to document the results of the report review corresponding to each Human Factors Topic or Performance Factor selected for review. The level of detail addressed by each worksheet should be determined on the basis of the level of detail available in the incident and accident reports. Instructions that can be used to help standardize the content of completed Incident and Accident Review Worksheets are provided along with the worksheet. Conduct Interviews. Control room interviews will often provide much of the information obtained in an operational review. Interviews will tend to be most productive if they are conducted in a non-punitive manner; with the interviewer emphasizing the potential gains from understanding the nature, causes, and potential consequences associated with the topic that is under review. The sample of workers to be interviewed should be planned in advance. The Sub-step 6.2 Interview Worksheet should be completed in two stages. First, the specific questions to be asked in each interview should be identified and written in the left-hand portion of each working condition, potential unsafe act, nature of operational risks, and potential mitigations subsection. Detailed guidance regarding potential interview topics corresponding to each Human Factors Topic is provided at the end of this appendix. Separate identical worksheets that list these questions should be prepared in advance of interviews with each staff member. Enough space should be added to the question fields in the worksheet to accommodate detailed#

Attachment 1, passage 154Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page F-9 Step 6 Control Room Operational Review Guidance and Worksheets interviewee responses. Instructions that can be used to help in preparing and completing Sub- step 6.2 Interview Worksheets are provided along with the worksheet. Conduct Observations. Observation of operational activities provides an opportunity to obtain information regarding current practices. Operational reviews often uncover discrepancies between ‘official’ and ‘actual’ practices, which can be useful in identifying the nature of risks and potential mitigations. It is important that observations be conducted by individuals who 1) are fully familiar with the operations being conducted, 2) understand the nature of the operational risks that are being addressed by the observations, and 3) fully understand operational standards and safety practices corresponding to these activities. In-house experts can provide a useful source of observers. However, if Controllers are being used to observe the performance of their colleagues, it is important to be sensitive to personal issues and relationships that may introduce a lack of objectivity in the observation results. Similarly, the use of supervisors may result in atypical behavior on the part of Controllers or some subjectivity in documented observations. There is a potential advantage of having observers drawn from a population that is not directly tied to operations at the control room where observations are being performed. Use of corporate operational experts or outside consultants with pipeline operations expertise should be considered. Some precautions that should be taken to ensure that the results obtained from observations accurately reflect current operational practices include the following:  Prepare an observation “definition sheet” that defines the activities to be observed and information to be recorded prior to conducting the observations.  Before conducting an observation, explain the purpose of the observations to those being observed. Emphasize the constructive objective of improving operational safety and efficiency.  Reinforce the constructive objectives in conducting observations by having personnel other than managers or supervisors serve as observers.  Conduct several observations of the same activity, balancing time of day, Controllers observed, and period of work shift across observations, as appropriate. Observations can be conducted in one of two formats.  Structured walk-through observations: These follow a basic script of activities that are the focus of the operational review. They can be walked through at an operational console, at a simulator console, or in a structured interview, depending upon the safety considerations and available resources.  Unobtrusive observations: These follow a basic script, but minimize the observer’s interference with ongoing operations. If explanations are required that might interfere with operations or compromise safety in any way, then a time to obtain those explanations from workers when they will not interfere with operations should be scheduled to take place as soon as possible following the observations. A good practice in this regard is to schedule a relief Controller for a brief period immediately following the observation period, so that the observed Controller can be interviewed while the recent activities are still fresh in his/her memory.#

Attachment 1, passage 155Page F-10 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Observational objectives, observation periods, and observation protocols should be planned and prepared in advance. General topics that could be addressed in observations are summarized below and some potential observation topics are identified under each Human Factors Topic summary at the end of this appendix.  Comparison of Controllers who are recently qualified with those who have a substantial level of operational experience in performing common activities (e.g., line start-up or product switching).  Comparison of performance to an established procedure (e.g., shift hand-off execution).  Sampling of ongoing activity levels (e.g., telephone communications frequency).  Review of current work space configurations and use. The Sub-step 6.2 Observation Worksheet in this appendix provides a very general form for use in planning and documenting the results of each observation period. Individual Observation Worksheets should be customized to reflect the objectives and activities corresponding to a particular observational activity. General guidance for documenting a series of observations, using the headings of the worksheet is provided along with the worksheet. Conduct Materials Reviews. A review of operational materials can be used in combination with Controller Survey comment analysis, incident report analysis, interviews, and/or observations to gain a more complete understanding of working conditions, operational risks, and potential mitigations associated with a particular operational review topic. Topics that are generally amenable to materials reviews are outlined below. Some specific materials review topics are identified in the detailed guidance provided at the end of this appendix, as applicable, under each Human Factors Topic.  Review of various operational procedures or tools to identify procedures that are out-of- date, inadequate, or inefficient.  Review of presented information (e.g., SCADA displays, on-line procedures, etc) to check for formatting and design inconsistencies.  Review of general operating policies or protocols to identify ones that are unnecessarily disruptive to Controller performance. The Sub-step 6.2 Materials Review Worksheet in this appendix provides a very general form for use in preparing for and documenting the results of each materials review. General guidance for completing the worksheet is provided along with the worksheet. 6.3. Summarize Operational Reviews At the conclusion of the individual information collection activities, the obtained information is integrated, summarized, and documented. The objectives of this step are listed below. 1. Identify specific working conditions affecting Controller performance and operational risk. 2. 3. Describe the nature of potential operational risks. Identify potential mitigations associated with a particular topic, providing some initial input for identifying the full range of potential human factors risk mitigation alternatives identified.#

Attachment 1, passage 156Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page F-11 Step 6 Control Room Operational Review Guidance and Worksheets 4. Establish an organizational record of operational conditions associated with a specific topic, which can serve as a basis for future reviews and comparisons. For each review topic, the summary should include:  A description of the specific working conditions that are adversely affecting monitoring and control performance;  The nature of operational risks associated with the topic under review; and  Potential mitigations to address specific working conditions and risks. A Step 6.3 Operational Review Summary Sheet is provided in this appendix, along with guidance for completing each entry in that summary sheet. The primary topics to be summarized are:  Working conditions corresponding to identified Human Factors Topics or Performance Factors;  Types of unsafe acts that can result from the identified working conditions;  Nature of the operational risk associated with these working conditions; and  Potential mitigations that may help in reducing the current operational risk level.#

Attachment 1, passage 157Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-13 OPERATIONAL REVIEW WORKSHEETS Following are the individual worksheets and instructions to be used in conducting an operational review.#

Attachment 1, passage 158Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-15 Sub-step 6.1 Scoping Worksheet Instructions This worksheet should be completed for each selected operational review topic. Completion of the worksheet will ensure the consideration of all appropriate operational review activities and provide a record of the operational review plan. This worksheet identifies the specific information collection activities to be conducted and defines some limited initial direction for conducting the operational review. Following are instructions for the completion of each section of this worksheet. Review Topic. This section identifies the Human Factors Topic or individual Performance Factor being addressed by the sub-step 6.1 Scoping Worksheet. The review topic should coincide with one of the Human Factors Topics or Performance Factors in the Human Factors Taxonomy. Accident, Incident, Near Incident Report Review. This box should be checked if any accident, incident, or near-incident reports are to be reviewed during the operational review. The risk management team should also indicate the type(s) of report(s), the source of the reports, the report time period to be reviewed, and any key selection criteria (such as key words used to search reports) that will be used to identify relevant reports. Interviews. This box should be checked if any interviews are to be conducted during the operational review. The risk management team should also indicate the interview sample group and sample sizes. It may be appropriate to indicate a mix of experience levels within each interviewee sample, as well as the number from each experience level. Appropriate interview topics can be identified through a review of the Controller comments corresponding to a topic, as well as the detailed guidance provided at the end of this appendix. Observations. This box should be checked if any observations are to be conducted during the operational review. The risk management team should also indicate the type of observation (unstructured or structured), the activities to be observed, the period of observation, and the observation objectives. Appropriate observation topics can be identified through a review of the Controller comments corresponding to a topic, as well as the detailed guidance provided at the end of this appendix. Materials Review. This box should be checked if any materials reviews are to be conducted during the operational review. The risk management team should indicate the materials to be reviewed, and the review objective. Appropriate materials review topics can be identified through interviews with Controllers, as well as the guidance provided at the end of this appendix.#

Attachment 1, passage 159Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-17 STEP 6 OPERATIONAL REVIEW Sub-step 6.1 Scoping Worksheet Review Topic: Accident, Incident, Near-Incident Report Review: Type of Report: Accident Incident Near-Incident Source of Reports: Time Period of Reports: Key Selection Criteria: Interviews: Interviewee Sample and Sample Size: Controllers: Supervisors: Schedulers: Others: Interview Topics: Observations: Type of Observation: Unstructured: Structured Walk-through: Activities to be observed: Period of Observation: Observation Objective: Materials Review: Materials to be Reviewed: Review Objective:#

Attachment 1, passage 160Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-19 Sub-step 6.2 Incident and Accident Review Worksheet Instructions This worksheet provides a template that can be used to document the results of the incident or accident report review corresponding to each Human Factors Topic or Performance Factor selected for operational review. The level of detail addressed by each worksheet should be determined on the basis of the level of detail available in the incident and accident reports. A separate worksheet should be used for each incident/accident report. Review Topic. This section identifies the individual Human Factors Topic and/or Performance Factor(s) being addressed by the report review. The Review Topic title should coincide with one of the Human Factors Topics and/or one or more of the Performance Factors provided in the Human Factors Taxonomy. Report Identifier. This section should identify the reports reviewed during this activity. The summary information should identify both the general type of report (e.g., accident report, incident report, or near-incident report) and a unique identifier that is consistent with company policy (i.e., the report identifier number) for each report. Working Condition Description. If the reports being reviewed provide the appropriate information, the reviewer should describe the working conditions associated with the review topic under consideration. This includes the specific operating conditions or factors that Controllers encounter at their work site while conducting pipeline monitoring and control activities and any other tasks associated with their job that are relevant to this review topic. Unsafe Act Descriptions. If the reports being reviewed provide the appropriate information, the reviewer should describe the general type of unsafe act(s), if any, identified in each report. An unsafe act is an action or inaction that contributes to the occurrence or severity of an incident or accident. Unsafe acts should be described in terms of a specific pipeline monitoring and control function and operational context (e.g., closed valve too late to avoid product mixing). It is important to note that identifying an unsafe act does not assign responsibility or blame to the individual who performed that action. Rather, the unsafe act description helps in understanding the nature of the operational challenges being faced. Unsafe acts can occur as a consequence of many factors that are outside of the influence of the individual who performs that act. Nature of Operational Risk. If the reports being reviewed provide the appropriate information, the reviewer should characterize the general nature of the operational risk associated with the review topic, using the following categories summarized in the worksheet: over pressure, pipeline rupture, spill or leak; delayed response to spill or leak; mixing of products; and delayed or incorrect product delivery. The purpose of defining the risk nature is to aid the reviewer in subsequently identifying potential mitigations. Many review topics could be associated with more than one general type of risk. Additionally, the review might benefit from providing more detail regarding each general type of risk identified (e.g., contamination of low sulfur diesel with regular unleaded gas). Potential Mitigations. If the reports being reviewed provide the appropriate information, the reviewer should identify potential mitigations that may represent remedies to the identified working conditions or system defenses, which have the potential to reduce operational risk. Alternatively, the reviewer may identify one or more mitigations based on his/her analysis of the reports. For each report, an effort should be made to identify these potential mitigations and their#

Attachment 1, passage 161Page F-20 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets source (report or reviewer). Potential mitigations are listed for each Human Factors Topic in the detailed operational review guidance at the end of this appendix. However, reviewers are encouraged to initially identify mitigations on the basis of information provided in the report and their own analysis of the report at this point in the information collection process to ensure that a broad range of potential mitigations are ultimately considered. Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-21 STEP 6 OPERATIONAL REVIEW Sub-step 6.2 Accident, Incident, and Near-Incident Report Summary Worksheet Review Topic: Report Identifier: Working Conditions Description: Unsafe Act Description: Nature of Operational Risk: Over pressure, pipeline rupture, spill, or leak:: Delayed response to spill or leak: Mixing of products: Delayed or incorrect product delivery: Potential Mitigations: Identified in report: Identified by report reviewer:#

Attachment 1, passage 162Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-23 Sub-step 6.2 Interview Worksheet Instructions This worksheet should be completed in two stages. First, the specific questions to be asked in each interview should be identified and written in the left-hand portion of each working condition, potential unsafe act, nature of operational risks, and potential mitigations subsection. A good starting point in developing interview questions is a review of the individual comments from the completed Controller Surveys. Detailed guidance regarding potential interview topics corresponding to each Human Factors Topic is provided at the end of this appendix. Separate identical worksheets that list these questions should be prepared in advance of interviews with each worker. Enough space should be added to the question fields in the worksheet to accommodate detailed interviewee responses. Review Topic. This section identifies the individual Human Factors Topic and/or Performance Factor(s) being addressed by the interview. The Review Topic title should coincide with one of the Human Factors Topics and/or one or more of the Performance Factors provided in the Human Factors Taxonomy. Staff Interviewed. The staff member interviewed should be identified in some manner. Identification may be as general as the staff member’s position or as specific as the individual’s name, depending upon the sensitivity of the topics under discussion and organizational policies. Working Conditions. This section provides space to prepare questions and record interview responses dealing with specific working conditions corresponding to the review topic. These questions should generally focus on the specific nature working conditions associated with the Performance Factor(s) included under the review topic, as well as an open-ended question about additional working conditions associated with the review topic. Verbatim interview responses, or closely paraphrased responses, should be recorded in the right-hand cell of this worksheet subsection. Potential Unsafe Acts. This section provides space to prepare questions and record interview responses dealing with specific potential unsafe acts corresponding to the review topic. These questions should generally ask the interviewee to recall and describe monitoring and/or control actions (or omissions of actions) that had the potential to contribute to the occurrence or severity of an ‘unacceptable incident’. Verbatim interview responses, or closely paraphrased responses, should be recorded in the right-hand cell of this worksheet subsection. Nature of Operational Risks. This section provides space to prepare questions and record interview responses dealing with the types of operational risks corresponding to the review topic. These questions should generally provide a leading question corresponding to each of the four general types of operational risks identified in this guide, as applicable: (1) Over pressure, pipeline rupture, spill or leak; (2) Delayed response to spill or leak; (3) Mixing of products; and (4) Delayed or incorrect product delivery. In addition, a final open-ended question directed at identifying any additional types of operational risks associated with the review topic is advisable. Verbatim interview responses, or closely paraphrased responses, should be recorded in the right- hand cell of this worksheet subsection. Potential Mitigations. This section provides space to prepare questions and record interview responses dealing with potential mitigations corresponding to the review topic. These questions should generally refer back to the working conditions and potential unsafe acts associated with#

Attachment 1, passage 163Page F-24 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets he specific the review topic. General questions could follow the following basic format outlined below. Verbatim interview responses, or closely paraphrased responses, should be recorded in the right-hand cell of this worksheet subsection.  What could be done to make [specific working condition identified] less likely to affect monitoring and control effectiveness?  If [specific unsafe act identified] occurred, what could be done to minimize the occurrence or severity of a resulting incident? Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-25 STEP 6 OPERATIONAL REVIEW Sub-step 6.2 Interview Worksheet Review Topic: Staff Interviewed: Working Conditions: Questions:   Responses:   Potential Unsafe Act: Questions:   Responses:   Nature of Operational Risk: Questions: Responses:     Potential Mitigations: Questions:   Responses:  #

Attachment 1, passage 164Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-27 Sub-step 6.2 Observation Worksheet Instructions This worksheet provides a very general form for use in planning and documenting the results of each observation period. Individual Observation Worksheets should be customized to reflect the objectives and activities corresponding to a particular observational activity. Review Topic. This worksheet section identifies the individual Human Factors Topic and/or Performance Factor(s) being addressed by the observation activity. The Review Topic title should coincide with one of the Human Factors Topics and/or one or more of the Performance Factors provided in the Human Factors Taxonomy. Observation Objective. This worksheet section should define the objective of conducting the observation. The objective statement should clearly define the scope of observational activities and the intended use of the results. An example Observation Objective could be: Observe shift hand-off activities during several day-to-night and night-to-day hand-offs to determine if current procedures are adequate and are being followed by Controllers. Observation Period. This worksheet section should identify the period of operations observed and recorded, indicating the place and time period, as appropriate. Observation Explanation. This worksheet section should provide a brief script that can be read to those being observed. The explanation should provide a consistent and accurate explanation of the observation activity. An example explanation could be: We are reviewing how hand-off procedures are being conducted to see if existing procedures need to be improved in any way. Please conduct your hand-off briefing as you would on any other day. Following the observation, I would like to identify a time to review my observations with you and obtain any suggestions that you may have regarding our current shift hand-off procedures and practices. A potential drawback of some observational activities is that Controllers may feel that they are being scrutinized and may not act as they normally would. In this case, it is useful to try to emphasize that it is not the Controller who is being scrutinized. To reinforce this constructive approach, the observer should emphasize that the focus of operational reviews and observational activities is on the specific job processes or procedures that Controllers are expected to follow, the organizational support provided to Controllers to help them in following those procedures, and potential system defenses that can be developed to minimize operational risk. Observation Protocol. This worksheet section should clearly define the data to be collected during the observations. Continuing with the shift hand-off as an example, an observation protocol could consist of a checklist of required and optional hand-off steps with a box to check whether or not each step was performed and space for comments regarding the execution of that step. Debriefing Topics. This worksheet section should identify the topics that should be addressed during the debriefing of the observed staff member. Completing the shift hand-off example, the table below provides four categories of debriefing topics that could be identified in advance, along with suggested questions corresponding to each topic. Verbatim debriefing responses, or closely paraphrased responses, should be recorded by the observer during the interview process.#

Attachment 1, passage 165Page F-28 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Debriefing Topic Debriefing Question Required Steps not Executed In observing the hand-off, I observed that you did not __________. Could you explain the reason for omitting this step? Optional Steps not Executed In observing the hand-off, I observed that you did not __________. Could you explain the reason for omitting this step? Additional Steps Executed In observing the hand-off, I observed that you __________. This step is not included in our procedures. Could you explain the reason for performing this step? Potential Mitigations We’ve identified a few areas where the hand-off activity could be improved. Do you have any specific suggestions for how we could ensure that hand-offs are consistently performed more effectively? Potential Mitigations. This worksheet section provides space to record potential mitigations corresponding to the review topic. Mitigations should be identified as those identified by the observed worker or the observer.#

Attachment 1, passage 166Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-29 STEP 6 OPERATIONAL REVIEW Sub-step 6.2 Observation Worksheet Review Topic: Observation Objective: Observation Period: Observation Explanation: Observation Protocol: Debriefing: Topic: Question: Response: Potential Mitigations: Identified by worker: Identified by observer:#

Attachment 1, passage 167Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-31 Sub-step 6.2 Materials Review Worksheet Instructions This worksheet provides a very general form for use in preparing for and documenting the results of each materials review. Review Topic. This worksheet subsection identifies the individual Human Factors Topic and/or Performance Factor(s) being addressed by the report review. The Review Topic title should coincide with one of the Human Factors Topics and/or one or more of the Performance Factors provided in the Human Factors Taxonomy. Materials Review Objective. This worksheet subsection should define the objective of conducting the materials review. The objective statement should clearly define the scope of materials review activities and intended use of the results. An example Materials Review Objective could be: Review communications logs for representative periods of day- and night-shift operations at each console and summarize the frequency and duration of outside communications at each console. Materials Reviewed. This worksheet subsection should clearly define the materials to be reviewed. In the preceding example, this would be Console Communications Logs. Materials Review Protocol. This worksheet subsection should clearly define the data to be collected during materials review. Continuing with the communications log example, a Materials Review protocol could consist of the following listing of raw data points and summary data:  Number and duration of incoming calls per hour at different times of the shift.  Number and duration of outgoing calls per hour at different times of the shift.  Distribution of hourly incoming and outgoing call frequency for each console, separated by Day- and Night-shifts. Potential Mitigations. This worksheet subsection provides space to record potential mitigations identified by the reviewer.#

Attachment 1, passage 168Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-33 STEP 6 OPERATIONAL REVIEW Sub-step 6.2 Materials Review Worksheet Review Topic: Materials Review Objective: Materials Reviewed: Materials Review Protocol: Potential Mitigations:#

Attachment 1, passage 169Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-35 Step 6.3 Operational Review Summary Sheet Instructions Following is guidance for completing each entry in the operational review summary sheet. Operational Review Topic. This summary sheet subsection identifies the Human Factors Topic or individual Performance Factor being addressed. The Review Topic title should coincide with one of the Human Factors Topics or Performance Factors provided in the Human Factors Taxonomy. Risk Level. This summary sheet subsection provides a space to indicate the overall relative Risk Level determined from earlier risk analysis activities. Repeating this information here may help reviewers in reflecting this operational Risk Level in their integration and summary of results. Contributing Operational Review Activities. For each of the four potential operational review activities listed, the reviewer should check each of those in which a review was conducted and one or more worksheets served as input to this summary sheet. Specific Working Conditions Identified, Potential Unsafe Acts Identified, Identified Operational Risks, and Potential Mitigations. This summary sheet subsection provides space to summarize and integrate the primary findings from the all of the information collection activities. This summary should be completed in a sequential manner, as summarized below: 1. Identify Specific Working Conditions. In this column, the individual working conditions associated with the review topic that were identified as a result of all information collection activities should be listed. 2. Potential Unsafe Acts. In this column, the individual unsafe acts identified as being associated with the review topic should be listed. 3. Nature of Operational Risk. In this column, the specific operational risks associated with the review topic should be listed. 4. Potential Mitigations. In this column, the potential mitigations associated with the review topic should be listed. Key Issues. This summary sheet subsection provides space to summarize some key issues that should be recognized in moving forward to the mitigation selection activity of the overall risk management process.#

Attachment 1, passage 170Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-37 STEP 6 OPERATIONAL REVIEW Sub-step 6.3 Operational Review Summary Sheet Operational Review Topic: Risk Level: Contributing Operational Review Activities: Accident, Incident, Near-Incident Report Review Interviews Observations Materials Review Specific Working Conditions Identified: Potential Unsafe Acts Identified: Identified Operational Risks: Potential Mitigations: Key Issues: 1. 2. 3.#

Attachment 1, passage 171Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-39 DETAILED OPERATIONAL REVIEW GUIDANCE The following detailed operational review guidance is for use in the preparation and execution of control room information collection activities specific to each Human Factors Topic and Performance Factor. These materials are organized under the 29 separate Human Factors Topics. The following headings and corresponding guidance are provided for each Human Factors Topic. Definition describes the scope of the Human Factors Topic. Performance Factor List summarizes all Performance Factors that are organized under each Human Factors Topic. Potential Interview Topics identifies general topics that could be addressed through interviews with control room staff or field personnel. Potential Observation Activities identifies, when applicable, some general observational activities that could be conducted during operational reviews. Potential Materials Review Topics identifies, when applicable, specific materials review objectives and activities that could be conducted. Potential Mitigations provides a summary of the mitigation titles identified in this management guide. This should not be considered a comprehensive list – more detailed and applicable mitigations may be identified during an operational review.#

Attachment 1, passage 172Page F-40 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 1.1 Task Design Definition This topic covers characteristics of Controller-specific activities and tasks that influence the level of task complexity and workload. Performance Factor List 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change set point) requires too many steps (e.g., more than three). 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex. 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities. 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations. 1.1.5 Some operations have a very small margin for error. Potential Interview Topics  Controller interview to identify field equipment that requires special procedures.  Controller interview to identify legacy procedures that do not fit current operational practice.  Controller interview to identify equipment that may not be functioning as expected (e.g., “flakey equipment” or “commands not going through”) and which may be contributing to higher workload.  Controller interview to identify specific control actions that have some steps that are clearly not required for operations, safety, etc., and unnecessarily add to Controller workload.  Controller interview to identify activities for which Controllers are formally required to perform manual calculations (including special operations such as pigging), in addition to the situations in which they do so even when it is not required (e.g., informal checks).  Controller interview to identify types of automation or job aids that could help with manual calculations.  Controller interview to identify which activities have small margins of error and how Controllers deal with this constraint.  Controller interview to identify suggestions for improving current operational procedures associated with specific task design issues.  Controller interview to identify specific unsafe acts that might result from difficulties with task design.#

Attachment 1, passage 173Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-41 Potential Observation Activities  Observation of expert versus novice Controller performance of common procedures.  Observation of expert versus novice Controller performance of selected complex tasks; looking for opportunities to improve upon current standard operating procedures.  Walk-through of work activities to identify all tasks that currently require manual calculations. Potential Materials Review Topics  Review of SCADA control ‘dialogue box’ design inconsistencies across similar equipment.  Review of SCADA control ‘dialogue box’ design to determine which functions require more than 3 steps to operate, and if the number of steps can be safely reduced. Potential Mitigations 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 Automate or Simplify Complex Tasks   — —  Replace Manual Calculations with Automated Tools — —  — — Allow Greater Control Over Timing of Control Actions — — — —  Situation-Specific Training — — — —  Review and Upgrade Equipment and/or Equipment Interfaces   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 174Page F-42 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 1.2 Console Workload Definition This topic covers aspects of console operation that are either particularly challenging to execute or that require highly focused attention and concentration to conduct in an error-free manner. Performance Factor List 1.2.1 Two or more control operations (e.g., line switches) must be done at the same time. 1.2.2 Excessive telephone activity interferes with monitoring and control operations. 1.2.3 Shift hand-off activities interfere with operations. 1.2.4 Unusual work conditions (trainees, tours/visitors) interfere with operations. 1.2.5 Unusual operational conditions (smart pigging, major repairs) interfere with operations. 1.2.6 Controllers have to make important operational decisions without sufficient time to adequately consider alternatives. Potential Interview Topics  Controller interview addressing specific conditions that lead to insufficient time availability and/or excessive work load.  Controller subjective workload interview, reviewing selected activities across consoles, and applying standardized rating procedures (i.e., Task Load Index (TLX) protocol).  Controller interview of specific instances when concurrent (simultaneous) control actions are required and the reasons they occur.  Controller interview about what options they have available for “time shifting” potentially concurrent activities, and any suggestions they have for facilitating this.  Controller review of instances when shift hand-off activities interfered with operations.  Controller interview to identify past conditions of excessive telephone activity.  Controller interview to identify past instances of unusual work conditions (trainees, tours/visitors) interfering with operations.  Controller interview to identify past instances of unusual operational conditions (smart pigging, major repairs) interfering with operations.  Controllers’ suggested strategies for maximizing the time available for making important operational decisions.  Controller interview to identify specific unsafe acts that might result from difficulties with console workload.#

Attachment 1, passage 175Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-43 Potential Observation Activities  Observation of Controller shift hand-off execution using structured check list. Potential Materials Review Topics  Comparison of available operations data pertinent to work load (e.g., SCADA control actions, keystrokes, phone calls across time and consoles).  Review of policies and communications regarding tours and visitor control.  Review of policies and communications regarding required operational condition notifications by Controllers.  Review of phone logs to identify sources of high numbers of calls, to subsequently determine if calls from some sources can be reduced. Potential Mitigations 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5 1.2.6 Allow Greater Control Over Timing of Control Actions   — — — — Workload Analysis/Rebalancing —    — — Automate or Simplify Complex Tasks — —  — — — Provide Decision Support Tools — — — — —  Situation-Specific Training — —  — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 176Page F-44 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 2.1 Equipment Layout and Workstation Design Definition This topic covers a Controller’s workspace at a console and the quality and characteristics of the equipment that they use to conduct their activities. Performance Factor List 2.1.1 There are not enough display monitors to show all of the information that a Controller needs at one time during normal operations. 2.1.2 There are not enough display monitors to show all of the information that a Controller needs at one time during abnormal situations. 2.1.3 Monitoring and control activities are disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare). 2.1.4 Monitoring and control activities are disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast). Potential Interview Topics  Controller interview addressing the number, location, and viewing of displays at each console to accommodate normal operations.  Controller interview addressing the number, location, and viewing of displays at each console to accommodate abnormal situations.  Controller interview to identify specific current difficulties and potential improvements in equipment layout and workstation design.  Controller interview to identify specific unsafe acts that might result from difficulties with equipment layout and workstation design. Potential Observation Activities  Ergonomic review of workstation and display layout, applying a standard workstation review protocol.  Collect anthropomorphic and related data on Controllers (e.g., standing height, sitting height, reach length, use of glasses/bi-focals, etc.) and compare with standard workstation layout guidelines.#

Attachment 1, passage 177Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-45 Potential Materials Review Topics  Analysis of pipeline information requirements for operations/critical tasks and which SCADA displays provide that information.  Analysis of the number of SCADA displays necessary to conduct a range of operations on various consoles, and the frequency (and particular operation) with which this number exceeds the number of available monitors. Potential Mitigations 2.1.1 2.1.2 2.1.3 2.1.4 Conduct Task Analysis   — — Conduct Ergonomic Audit — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 178Page F-46 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 2.2 SCADA Information Access and Layout Definition This topic covers the organization and layout of individual and related sets of SCADA displays, specific information elements, and the software controls that Controllers use to conduct their operation and monitoring activities. Performance Factor List 2.2.1 Inconsistencies in SCADA display design increase the difficulty of getting needed information. 2.2.2 A cluttered, or complicated SCADA display increases the difficulty of finding needed information. 2.2.3 The layout of information (e.g., lines, equipment, and data) on the SCADA display increases the difficulty of finding, identifying, and interpreting information. 2.2.4 Needed information is not shown on the appropriate SCADA display. 2.2.5 Controllers must navigate between more than two SCADA displays to view related information. 2.2.6 Navigating between SCADA displays interferes with the flow of monitoring and control activities. 2.2.7 The location or layout of SCADA control boxes/targets makes them difficult to use. Potential Interview Topics • Controller interview to identify specific SCADA display and control characteristics that make their operating activities more difficult than necessary. This type of interview may be most effective if it is subdivided into specific subtopics that are each addressed separately (e.g., screen consistency, display layout, information needs, navigation, etc).  Controller and SCADA engineer interviews addressing Controller participation in the process of changing SCADA controls and displays that directly affect Controller activities. Potential Observation Activities • Collect performance data on SCADA errors (e.g., cancelled operations), delete/backspace keystrokes, etc., and compare performance across displays.#

Attachment 1, passage 179Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-47 Potential Materials Review Topics • Review SCADA screens to identify inconsistent use of key display and control elements, in addition to departures from recommended design practices (e.g., display standards). • Review process for making changes to the SCADA to determine if there are adequate “quality control” steps in place to ensure that inconsistent display and control elements will not be introduced. Potential Mitigations 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 Conduct User Interface Design Evaluation        Involve Controllers in the Design Process        Conduct Task Analysis — — —   —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 180Page F-48 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 2.3 SCADA Information Content, Coding, and Presentation Definition This topic covers how information is presented in SCADA displays. Performance Factor List 2.3.1 Information about where the current SCADA display is within the pipeline system is not adequately provided. 2.3.2 Some colors on SCADA displays make data interpretation difficult. 2.3.3 Some labels on SCADA displays make data interpretation difficult. 2.3.4 Some symbols on SCADA displays make data interpretation difficult. 2.3.5 Controllers must transform values from the measurement scale presented on the SCADA display to another scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task. 2.3.6 SCADA displays do not provide adequate system overview information for keeping track of system status. 2.3.7 There is inconsistent use of units of measure (e.g., gallons, barrels, cubic meters) on SCADA displays. Potential Interview Topics • Controller interview to identify specific aspects of SCADA content, coding, and presentation that make their operating activities more difficult than necessary, or elements that are inadequate for conveying information in an accurate and timely manner. This type of interview may be most effective if it is subdivided into specific subtopics that are each addressed separately (e.g., overview information, colors, labels, symbols, etc).  Controller and SCADA engineer interviews addressing Controller participation in the process of changing SCADA controls and displays that directly affect Controller activities.  Controller interview to identify parameter values that require conversion during operations and inconsistent use of measurement scales.  SCADA developer interviews to review procedures for creating SCADA displays and making changes to existing displays to determine if there are adequate “quality control” steps in place to ensure that confusing or difficult-to-interpret information displays can be avoided or eliminated. Potential Observation Activities  None identified.#

Attachment 1, passage 181Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-49 Potential Materials Review Topics  Review SCADA color, labeling, and symbol design conventions to determine if they lead to adequate support of Controller information requirements, and if they are consistently adhered to by personnel responsible for making changes to the SCADA.  Review conventions for implementing measurement units in the SCADA to ensure that they promote consistent use of units. Potential Mitigations 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.3.7 Provide Overview Screens —  — — — — Conduct User Interface Design Evaluation —    — Conduct Information Consistency Review — — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 182Page F-50 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 3.1 Shift Hand-off Procedures Definition This topic covers the procedures and tools that Controllers use to communicate and document the information needs to be passed from one Controller to the next during shift hand-off. This also includes how well this process is executed. Performance Factor List 3.1.1 Shift hand-off procedures or tools do not adequately identify, track, and record information required by the Controller coming on shift. 3.1.2 Formal shift hand-off procedures are not adequately followed by Controllers. Potential Interview Topics  Controller interview addressing shift hand-off procedures or tools that do not adequately identify, track, and record information required by the Controller coming on shift.  Controller interview to identify aspects of shift hand-off procedures that are unnecessarily difficult or burdensome to conduct (the assumption being that Controllers may be more likely to skip these).  Controller interview to identify potential improvements in shift hand-off procedures or tools.  Controller interview to identify specific unsafe acts that might result from difficulties with shift hand- off procedures. Potential Observation Activities  Walk-through of current Controller shift hand-off procedures and common practices.  Observation of Controller shift hand-off execution using structured check list. Potential Materials Review Topics  Review of shift hand-off procedures to determine if they adequately support the recording and communication of needed information and that they avoid unnecessarily burdening Controllers with preparation for hand-off.  Review of any Controller- or console-specific hand-off work sheets.#

Attachment 1, passage 183Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-51 Potential Mitigations 3.1.1 3.1.2 Use Structured Forms or Checklists to Record Shift Hand-off Information — Schedule Maintenance Activities to Within a Single Shift — Rewrite Deficient Procedures Based on Task Requirements  Controller Shift Hand-off Anomaly Reporting Procedure   Shift Hand-off Observation/Evaluations —  Improve Communications Policies and Training —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 184Page F-52 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 3.2 Control Center Communications Definition This topic covers communication of information related to pipeline operation and monitoring between control center personnel, in addition to other types of support that Controllers receive from other control room staff. Performance Factor List 3.2.1 The exchange of required operations information between Controllers on different consoles is not adequate. 3.2.2 Control center staff are not available to provide assistance with an operational issue when required (separated from field technicians). 3.2.3 The lines of communication in the control room are not clearly defined or adhered to. Potential Interview Topics  Controller interview addressing issues in control room information exchange.  Controller interview to identify their understanding of lines of communications in addition to potential improvements.  Controller interview to identify specific unsafe acts that might result from difficulties with control room lines of communications and exchange of information. Potential Observation Activities  None identified. Potential Materials Review Topics  Map out formal and informal lines of communications (and back-up links for when some personnel are unavailable) for Controllers’ key operational activities to determine if they are clearly defined.#

Attachment 1, passage 185Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-53 Potential Mitigations 3.2.1 3.2.2 3.2.3 Improve Communications Policies and Training  — — Provide a “Float” Controller Who Can Take Over Non-control Activities — — Reassign Abnormal Situation Non-critical Duties — — Document Abnormal Situation Control Room Staff Roles and Responsibilities — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 186Page F-54 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 3.3 Schedule Communications Definition This topic covers information in delivery schedules in addition to the process of communicating the schedules and any relevant changes in their content. Performance Factor List 3.3.1 Product delivery schedules are inaccurate. 3.3.2 Changes in product delivery schedules are not communicated to Controllers at all. 3.3.3 Changes in product delivery schedules are communicated to Controllers without sufficient lead time. Potential Interview Topics  Controller and scheduler interviews addressing the overall schedule preparation and communication process to understand the nature of schedule preparation and communications problems.  Controller interview addressing specific problems they have with schedule communications.  Scheduler interview addressing specific difficulties meeting Controllers’ needs in developing and communicating schedules.  Scheduler interview to identify problems with information from external sources (e.g., suppliers) or from internal sources (e.g., out-dated SCADA data).  Controller interview to identify potential improvements in schedule communications.  Controller interview to identify specific unsafe acts that might result from difficulties with schedule communications. Potential Observation Activities  None Identified.#

Attachment 1, passage 187Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-55 Potential Materials Review Topics  Review representative sample of past schedules and tabulate problematic elements (e.g., incorrect information, missing information, etc.).  If available, compile and analyze information on time that schedule changes are submitted relative to actual scheduled delivery time to identify the frequency of short-notice changes, and if they are systematically associated with any factors (e.g., specific lines, customers, etc).  Review procedures for documenting and communicating schedule changes to determine if they allow for inadequate Controller notification (e.g., inaccurate information, last minute changes, failure to notify Controllers, etc.). Potential Mitigations 3.3.1 3.3.2 3.3.3 Minimize Unnecessary Manual Data Entry  — — Provide Computer-based Communications Tools —   Review and Revise Control Room Work Completion and Communication Protocols —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 188Page F-56 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 3.4 Field Personnel Communications Definition This topic covers the procedures and equipment used in communicating with field personnel, in addition to how well appropriate information is communicated. Performance Factor List 3.4.1 Field technicians are not available to provide assistance with an operational issue when required (separated from control center staff). 3.4.2 Important field information (e.g., operational and maintenance activities) is not provided directly to Controllers in a timely manner. 3.4.3 Field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to Controllers. 3.4.4 Field personnel do not fully communicate important ongoing operational conditions (e.g., pigging or repairs) to Controllers. 3.4.5 Controllers have difficulty communicating with field personnel due to a lack of available communications equipment. Potential Interview Topics  Controller interview addressing field technician availability.  Controller interview addressing specific instances of field information (e.g., operational and maintenance activities) not being provided directly to Controllers in a timely manner.  Controller interview addressing potential improvements in field personnel communications.  Field technician interview addressing Controller communications issues and potential improvements in communications.  Controller interview to identify specific unsafe acts that might result from difficulties with field personnel communications. Potential Observation Activities  None identified.#

Attachment 1, passage 189Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-57 Potential Materials Review Topics  Review communications equipment to assess compatibility and reliability (both equipment-based and location based—e.g., reception dead zones).  Review procedures for communicating to Controller when pipeline work that affects their operations will occur (including adequacy of normal and back-up lines of communication).  Review procedures and tools used to keep field technician “contact sheets” updated for the current shift. Potential Mitigations 3.4.1 3.4.2 3.4.3 3.4.4 3.4.5 Make Field Personnel Responsible for Maintain Current Contact Lists  — — — — Use Structured Forms or Communication Protocols for Communicating System/Equipment Status —   — Improve Communications Policies and Training —   — Improve Available Field Communications Equipment — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 190Page F-58 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 4.1 Operational Information Accuracy and Availability Definition This topic covers the level of accuracy and reliability of information that Controllers use to operate and monitor a pipeline system. Performance Factor List 4.1.1 SCADA data from field instruments (meters, gauges, etc) are inaccurate. 4.1.2 SCADA data are stale/out-of-date, or unavailable due to a communications problem (e.g., outage, time delay). 4.1.3 The SCADA display does not indicate that data are out-of-date or unavailable. 4.1.4 Changes in field system operational status (e.g., equipment identity or operational activities) are not adequately indicated in SCADA displays. 4.1.5 Displayed pipeline schematics or operational parameters (e.g., MOPs) are inaccurate. 4.1.6 Manually entered batch, log, and/or summary information is not accurate. 4.1.7 Required information is not available in the SCADA display. Potential Interview Topics  Controller interview to identify specific operational information accuracy and/or availability difficulties.  Controller interview to identify potential improvements in operational information accuracy and/or availability.  Controller interview to identify specific unsafe acts that might result from difficulties with operational information accuracy and/or availability.  This topic could lend itself to a group discussion addressing operational information accuracy difficulties and improvements. Potential Observation Activities  None identified.#

Attachment 1, passage 191Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-59 Potential Materials Review Topics  SCADA schematics review.  Operations review of manual data entry requirements and alternatives.  Review a sample of batch/log/summary sheets and determine how frequently errors occur. Potential Mitigations 4.1.1 4.1.2 4.1.3 4.1.4 4.1.5 4.1.6 4.1.7 Flag Inaccurate or Out-of-date Information    — — — — Coordinate Field Equipment Status Changes with SCADA — — —  — — — Conduct an Engineering Review — — — —  — — Minimize Unnecessary Manual Data Entry — — — — — — Conduct Task Analysis — — — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 192Page F-60 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 5.1 Job Procedure Design Definition This topic covers the information presented in job procedures, in addition to how this information is presented/structured. Performance Factor List 5.1.1 When to use a procedure is not clearly defined. 5.1.2 Required technical detail is not provided by a procedure. 5.1.3 Procedures are difficult to read. 5.1.4 Critical information is difficult to find in a procedure. 5.1.5 Procedures do not meet the needs of both novice and experienced operators. 5.1.6 Procedures and job aids used in responding to abnormal situations are difficult to follow. Potential Interview Topics  Job procedure developer interview to review job procedure design and testing practice.  Job procedure developer interview to review process for making and communicating changes to job procedures to determine if there are adequate “quality control” steps.  Controller interview to identify general shortcomings in procedures in terms of information content/level of detail, availability, readability, accuracy, presentation, ease of understanding, etc.  Controller interview to identify potential improvements in procedures.  Controller interview to identify specific unsafe acts that might result from difficulties with procedures. Potential Observation Activities  None identified.#

Attachment 1, passage 193Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-61 Potential Materials Review Topics  Use a structured review format to evaluate existing job procedures in terms of compliance with guidelines and standards, consistency of layout and information presentation, accuracy, etc. Potential Mitigations 5.1.1 5.1.2 5.1.3 5.1.4 5.1.5 5.1.6 Conduct an Engineering Review —  — — — — Use a Procedure Style/Writing Guide —    —  Warning/Caution Call-outs — — —  — — Controller Involvement in Procedure Reviews —     Adjustable Level of Procedure Detail —  — — — Implement Systematic Human Factors Procedure Design Process —  — —   Ensure Adequate Selection and Training Of Procedure Writers        Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 194Page F-62 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 5.2 Job Procedure Availability Definition This topic covers the availability of job procedures and how easy it is to find specific procedures when they are needed. Performance Factor List 5.2.1 A specific required operations procedure is not available. 5.2.2 Finding an individual procedure among the large overall number of procedures is difficult. 5.2.3 Procedures and job aids required to identify and recover from abnormal situations are not readily available. Potential Interview Topics  Controller interview to identify a) specific operations that require procedures but that do not have any or b) operations that require better procedures.  Controller interview to identify specific difficulties finding or accessing computer-based or hard-copy procedures.  Controller interview to identify unnecessary procedures.  Controller interview to identify specific unsafe acts that might result from difficulties with procedure availability. Potential Observation Activities  None identified. Potential Materials Review Topics  Review of job procedures to identify obsolete procedures (e.g., for equipment that is no longer part of the line, etc.).  Review tool or methods for finding and accessing hard-copy and computer-based procedures, taking into consideration the number of steps required to get to a procedure and what information Controllers need to know in order to find it (e.g., key words, equipment identification numbers, etc.).#

Attachment 1, passage 195Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-63 Potential Mitigations 5.2.1 5.2.2 5.2.3 Conduct an Engineering Review  —  Use a Procedure Style/Writing Guide — — Context Sensitive Procedures —   Implement Computer-based Procedures —   Implement Systematic Human Factors Procedure Design Process  —  Specify Procedure Availability and Access     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 196Page F-64 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 5.3 Job Procedure Accuracy and Completeness Definition This topic covers the extent to which job procedures are accurate, up-to-date, and contain information that can be comprehended by Controllers. Performance Factor List 5.3.1 Procedures contain out-of-date or inaccurate information. 5.3.2 Procedure update notifications are not adequately provided to Controllers. 5.3.3 Controllers do not understand the documented procedure. 5.3.4 Controllers execute actions in a manner that is not consistent with established and documented procedures because the procedure is incorrect or incomplete. Potential Interview Topics  Controller interview to identify specific and general procedures that are inaccurate or outdated.  Controller interview to identify potential improvements in job procedure accuracy and completeness.  Controller interview to identify specific unsafe acts that might result from difficulties with job procedure accuracy and completeness.  Job procedure developer interview to review process for making and communicating changes to job procedures to determine if there are adequate “quality control” steps. Potential Observation Activities  None identified. Potential Materials Review Topics  Review existing job procedures to check for inaccurate or outdated information.#

Attachment 1, passage 197Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-65 Potential Mitigations 5.3.1 5.3.2 5.3.3 5.3.4 Conduct an Engineering Review  — —  Use a Procedure Style/Writing Guide — — — Controller Involvement in Procedure Reviews — —   Implement Computer-based Procedures   — — Establish a Single Point of Contact to Manage Procedures and Manuals   — Implement Systematic Human Factors Procedure Design Process  —   Provide Procedure Writing Training — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 198Page F-66 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 6.1 Alarm Availability and Accuracy Definition This topic covers the degree to which SCADA alarms are appropriately triggered following system events that Controllers need to know about. Performance Factor List 6.1.1 No alarm is available to notify the Controller about important current operational status information (e.g., pressure or batch interface at a specific point in the line). 6.1.2 Alarms do not provide the Controller with sufficient lead time to take corrective actions (i.e., because of sensor location). 6.1.3 Changes in operating conditions triggered by external events that are outside of Controllers’ influence (e.g., equipment failure or maintenance on a feeder system) are not displayed on the SCADA. Potential Interview Topics  Controller interview to identify specific issues with alarm timing, availability, and accuracy.  Controller interview to identify potential improvements in alarm timing, availability, and accuracy.  Controller interview to identify specific unsafe acts that might result from difficulties with alarm timing, availability, and, accuracy. Potential Observation Activities  None identified. Potential Materials Review Topics  Create a frequency chart of alarm lead time from a data sample and identify the frequency with which lead times are below some acceptable criterion.#

Attachment 1, passage 199Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-67 Potential Mitigations 6.1.1 6.1.2 6.1.3 Develop an Alarm Philosophy Document   Conduct an Alarm Engineering Review     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 200Page F-68 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 6.2 Alarm Display and Presentation Definition This topic covers the how alarm messages look and sound to Controllers when presented, in addition to their overall layout and organization in the SCADA display. Performance Factor List 6.2.1 Alarm displays become too cluttered making it difficult to identify important alarms. 6.2.2 The alarm display shows alarms from another console and Controllers have difficulty finding the alarms for their console. 6.2.3 High-priority alarms are ineffective in attracting a Controller’s attention when performing other activities. 6.2.4 The sound or loudness of critical alarms startles Controllers unnecessarily. 6.2.5 The sound of an alarm does not clearly indicate the intended alarm priority. 6.2.6 The color of an alarm does not clearly indicate the intended alarm priority. Potential Interview Topics  Controller interview to identify specific difficulties identifying important alarms.  Controller interview to identify specific difficulties finding alarms.  Controller interview to identify situations (i.e., concurrent activities) in which they sometimes have difficulties identifying important alarms.  Controller interview to identify specific issues with the loudness, sound, or color of alarms. Potential Observation Activities  Walk-through of alarm screen locations.  Collect data on the time that passes between the onset of a critical alarm and when a Controller first acknowledges the alarm to determine if certain alarms or alarm types are associated with significantly longer response times. This analysis is potentially more informative if additional information about ongoing conditions can be incorporated (e.g., telephone activity, number of concurrent alarms, etc).  Collect data on number of active/displayed alarms under different operating conditions (e.g., start-up, batch switches, maintenance activities, etc).#

Attachment 1, passage 201Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-69 Potential Materials Review Topics  None identified. Potential Mitigations 6.2.1 6.2.2 6.2.3 6.2.4 6.2.5 6.2.6 User Interface Design Review       Alarm Prioritization    — — — Reduce Number of Alarms   — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 202Page F-70 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 6.3 Alarm Interpretation Definition This topic covers issues related to obtaining, viewing, and interpreting operational and system information provided to Controllers by alarms or the SCADA alarm display. Performance Factor List 6.3.1 The displayed alarm description is difficult to interpret. 6.3.2 There are multiple causes for some alarms, but insufficient information is provided to identify the actual cause. 6.3.3 Alarm summary information does not provide adequate information about conditions at the time that the alarm was triggered. 6.3.4 Alarms are not displayed in a consistent format, making their interpretation difficult. 6.3.5 It is difficult to determine the intended priority of an alarm. Potential Interview Topics  Controller interview to identify specific difficulties with alarm interpretation, and additional information that Controllers need from alarms but is not provided.  Controller interview to identify potential improvements in alarm interpretation.  Controller interview to identify specific unsafe acts that might result from difficulties with alarm interpretation. Potential Observation Activities  Structured review of Controller identification of alarms (would require a non-operational, but fully functional console). Potential Materials Review Topics  Review alarm naming and description conventions for inadequate or inconsistent application.#

Attachment 1, passage 203Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-71 Potential Mitigations 6.3.1 6.3.2 6.3.3 6.3.4 6.3.5 Alarm Description Review    — — User Interface Design Review — — —   Alarm Prioritization — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 204Page F-72 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 6.4 Alarm Access and Acknowledgement Definition This topic covers the processes for accessing and acknowledging active or previously acknowledged alarms in the SCADA. Performance Factor List 6.4.1 The process of clearing alarms interferes with monitoring and control operations. 6.4.2 Controllers unintentionally clear important alarms when there are too many alarms that need to be cleared. 6.4.3 It is difficult to sort alarms by priority, time of occurrence, or other useful dimensions. 6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screen, or keystrokes to access previously acknowledged alarms). 6.4.5 Controllers accidentally acknowledge or clear alarms for an adjacent console. Potential Interview Topics  Controller interview of specific difficulties with alarm acknowledgement.  Controller interview to identify potential improvements in alarm acknowledgement.  Controller interview to identify what types of alarm searching and sorting functionality that would make their operational activities easier to conduct.  Controller interview to identify specific unsafe acts that might result from difficulties with alarm access and/or acknowledgement. Potential Observation Activities  None identified.#

Attachment 1, passage 205Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-73 Potential Materials Review Topics  Review logs to identify how frequently Controllers inappropriately clear certain alarms (e.g., alarms from other consoles, high-priority alarms cleared with a page-clear function, etc.). Potential Mitigations 6.4.1 6.4.2 6.4.3 6.4.4 6.4.5 Provide a Function to Acknowledge Multiple Low-priority Alarms that Provide Redundant Information  — — — — Use a Different Process/Dialog Box to Acknowledge Important Alarms —  — — — Provide Functions to Temporarily Sort Alarms by Information Field — —  — — Provide Quick Access to Acknowledged Alarms from the Main Alarm Display — — —   Limit a Controller’s Ability to Acknowledge Alarms on Other Consoles — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 206Page F-74 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 6.5 Nuisance Alarms Definition This topic covers the “nuisance” alarms that occur during normal operations, that have little or no informational value with regard to pipeline control and monitoring, but impact Controller performance in some way (i.e., by requiring Controllers to acknowledge nuisance alarms, adding display clutter, or providing a distraction in some way, etc.). Performance Factor List 6.5.1 The number of nuisance alarms limits the ability to quickly identify potentially important alarms. 6.5.2 Monitoring and control operations are disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up). 6.5.3 Monitoring and control operations are disrupted by unnecessary information, alarms, or notifications coming into the alarm screen that are not required for operations (e.g., “action started” or “action completed”). 6.5.4 Too many nuisance alarms are caused by equipment that is waiting to be fixed. 6.5.5 Some alarms classified as critical do not represent true critical situations. Potential Interview Topics  Controller interview to identify specific alarms or types of alarms that serve no functional purpose and provide information that is not used in operations.  Controller interview of specific difficulties with nuisance alarms.  Controller interview to identify ways to reduce nuisance alarms.  Controller interview to identify specific unsafe acts that might result from difficulties with nuisance alarms. Potential Observation Activities  Collect data on the types of alarms active/displayed under different operating conditions (e.g., start-up, batch switches, maintenance activities, etc), and identify the proportion that provide useful/necessary information for operations and those that are unnecessary/nuisance alarms.#

Attachment 1, passage 207Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-75 Potential Materials Review Topics  Identify/catalog alarms that are displayed on the Controllers’ alarm display but serve no functional purpose in Controller operations (e.g., alarms used to log events, alarms intended for non-Controllers). Potential Mitigations 6.5.1 6.5.2 6.5.3 6.5.4 6.5.5 Alarm Documentation and Rationalization Review      Alarm Redefinition    —  Alarm Grouping    — — Alarm Limit Modification  — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 208Page F-76 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 7.1 Pipeline Fundamentals Knowledge and Field Exposure Definition This topic covers the effect of a broad range of Controller normal operations training, knowledge, and field exposure on pipeline monitoring and control performance. Many of the Performance Factors listed below have the potential to negatively affect a broad range of monitoring and control activities. Performance Factor List 7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter. 7.1.2 Controller on-the-job training does not provide the optimal assignment of mentor(s) to ensure exposure to a sufficient range of expertise and good operating practices. 7.1.3 Controllers are not provided adequate training about hydraulics. 7.1.4 Controllers are not provided adequate training on field operations and field systems. 7.1.5 Controllers are not adequately trained on specific console operations prior to working alone. 7.1.6 Controllers are not provided refresher training frequently enough. 7.1.7 Controllers are not provided adequate training before the introduction of a new pipeline. 7.1.8 Controllers are not provided adequate training on a specific operational procedure, product, or tool before it is introduced into operation. Potential Interview Topics  Training developer interview to discuss current pipeline fundamentals training.  Controller interview of training needs pertaining to pipeline fundamentals.  Controller interview to identify specific unsafe acts that might result from difficulties with training in pipeline fundamentals.  Controller interview addressing new system introduction difficulties and potential improvements.  Controller interview to identify specific unsafe acts that might result from difficulties with new system introduction.#

Attachment 1, passage 209Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-77 Potential Observation Activities  Observation of on-the-job mentoring. Potential Materials Review Topics  Review of current refresher training policy.  Review of current Operator Certification process.  Review of hydraulics training curriculum and how it applies to hydraulics knowledge requirements on each console.  Review of field operations orientation policy, communications, and history.  Review of on-the-job mentoring guidance.  Comparison of the number of hours that Controllers spent training for various new pipelines introduced, taking into account pipeline complexity and other factors that impact “learning time”. Potential Mitigations 7.1.1 7.1.2 7.1.3 7.1.4 7.1.5 7.1.6 7.1.7 7.1.8 Improve Controller Normal Operations Training — —   — — — Improve the On-the-Job Training Program  —   — —  Provide Special Topics Training     — — — — Improve New Procedure/Equipment Introduction Training — — — — — —   Improve Controller Knowledge, Skills and Abilities (KSA) Assessment —       Improve Controller Abnormal Situations Training — — —   — — Improve Simulator Training — — — —  — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 210Page F-78 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 7.2 Emergency Response Training Definition This topic covers the adequacy of Controller training for response to abnormal situations and emergencies. Performance Factor List 7.2.1 Controllers are not adequately trained in emergency response. 7.2.2 Controllers are not adequately trained in handling abnormal situations. Potential Interview Topics  Controller interview to identify abnormal situation and emergency response training requirements.  Curriculum developer interview to identify current emergency response training practices and future requirements.  Controller interview to identify specific unsafe acts that might result from difficulties with abnormal situation and emergency response training. Potential Observation Activities  Emergency response training activities.  Abnormal situation response training activities. Potential Materials Review Topics  Review of emergency response training curriculum, with a focus on checking that the curriculum is up- to-date regarding current operating practices and relevant pipeline system configuration/equipment, etc.  Review any available needs analysis for abnormal situation and emergency response training.#

Attachment 1, passage 211Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-79 Potential Mitigations 7.2.1 7.2.2 Improve the On-the-Job Training Program   Improve New Procedure/Equipment Introduction Training   Improve Controller KSA Assessment   Improve Controller Abnormal Situations Training   Improve Simulator Training    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 212Page F-80 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 8.1 Abnormal Situation Task Assignments Definition This topic covers specific aspects of control room task assignments and staff roles/responsibilities during abnormal situations that may negatively affect Controllers’ abilities to focus on and respond effectively to abnormal operating conditions. Performance Factor List 8.1.1 Controllers are distracted in their response to abnormal situations by non-critical, ongoing duties (e.g., responding to phone calls). 8.1.2 Controllers are distracted in their response to abnormal situations by the need to provide required notifications. 8.1.3 Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations. 8.1.4 Control room staff roles and responsibilities during abnormal situations are not well defined. Potential Interview Topics  Controller interview addressing specific difficulties with abnormal situation task assignment, notification activities, and concurrent non-critical duties.  Management interview addressing current abnormal situation task assignments and available options.  Controller interview to identify potential improvements in abnormal situation task assignments.  Controller interview to identify specific unsafe acts that might result from difficulties with abnormal situation task assignments. Potential Observation Activities  Abnormal event training activities.#

Attachment 1, passage 213Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-81 Potential Materials Review Topics  Abnormal event operating procedures review, with a focus on Controller critical and non-critical task responsibilities.  Review communications logs from past abnormal situations to identify the average number of calls made to comply with notification procedures and the average time spent conducting these activities.  Abnormal event training materials review, with a focus on checking that materials are up-to-date regarding current operating practices and relevant pipeline system configuration/equipment, etc. Potential Mitigations 8.1.1 8.1.2 8.1.3 8.1.4 Reassign Abnormal Situation Non-critical Duties   — Document Abnormal Situation Control Room Staff Roles and Responsibilities — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 214Page F-82 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 8.2 Control Room Distractions Definition This topic covers specific aspects of control center and pipeline system management policies, task assignments, and actual job performance that may serve as a distracter or stressor during normal operations, resulting in a negative affect upon Controller monitoring and control performance. Performance Factor List 8.2.1 Controllers are distracted from monitoring and controlling operations by the need to complete operations reports (e.g., operating sheets, production summaries, line status summaries). 8.2.2 Controllers end up completing work that is assigned to schedulers. 8.2.3 Field personnel do not provide adequate or timely support to Controllers. 8.2.4 Stressful relations with control room management distracts Controllers from monitoring and control operations. 8.2.5 Stress resulting from productivity goals, incentives, or penalties distracts Controllers from monitoring and control operations. Potential Interview Topics  Controller interview addressing current distractions and sources of unnecessary stress, along with strategies for reducing them.  Controller interview to identify tasks assigned to other personnel (e.g., schedulers) that Controllers often end up completing themselves.  Field technician interview to identify Controller communications and support requirements and procedures. Potential Observation Activities  None identified.#

Attachment 1, passage 215Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-83 Potential Materials Review Topics  Review of Controller operations report preparation requirements.  Review of Controller productivity incentives. Potential Mitigations 8.2.1 8.2.2 8.2.3 8.2.4 8.2.5 Reassign Normal Operations Control Center Duties and Assignments  — — — — Automate Paperwork through Existing Software Databases  — — — — Review and Revise Control Center Work Completion and Communication Protocols —  — — — Review and Revise Field Personnel Communications Protocols — —  — — Review and Revise Management Policies and Procedures — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 216Page F-84 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 9.1 Controller Fatigue Definition This topic includes Performance Factors that represent direct, first-hand reports of Controller fatigue. operations. Controller fatigue has the potential to negatively affect any function of monitoring and control Performance Factor List 9.1.1 A Controller feels particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm). 9.1.2 A Controller feels drowsy or tired throughout most of a shift. 9.1.3 A Controller feels fatigued at the end of a shift. Potential Interview Topics  Controller interview to review understanding of effective long-term fatigue management practices.  Controller interview to review understanding of effective short-term fatigue management practices.  Controller interview to review current practices to schedule and manage sleep at home. Potential Observation Activities  Formal Controller sleep activity monitoring (by sleep log or wrist activity monitor) to identify specific problem areas (Controllers sleep/rest schedules and/or work schedules). Potential Materials Review Topics  Evaluation of Controller work schedules using available shift schedule guidelines to identify specific gaps between the guidelines and current schedules.#

Attachment 1, passage 217Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-85 Potential Mitigations 9.1.1 9.1.2 9.1.3 Implement a Work Shift Schedule Modification    Review/Adjust Overtime Work Policies and Procedures    Conduct Sleep Disorder Screening    Conduct Controller Fatigue Management Training    Review/Adjust Policy on Employee Commute to Control Center    Implement Rest Break and Napping Policy and Procedures    Change the Control Room Environment to Reduce Fatigue    Provide Additional Stimulation During Slow Work Periods    Implement a Fatigue Recognition and Self-Reporting Policy and Procedures     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 218Page F-86 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 9.2 Controller Schedule and Rest Definition This topic covers specific working conditions that may contribute to Controller fatigue. Controller fatigue has the potential to negatively affect any function of monitoring and control operations. Performance Factor List 9.2.1 Controllers get insufficient sleep because of transitions in shift schedules from day to night or night to day. 9.2.2 Controllers get insufficient sleep because of being called in to work a shift on short notice. 9.2.3 Controllers get insufficient sleep because of overtime work. 9.2.4 Controllers get insufficient sleep because of twelve hour shifts. 9.2.5 Controllers get insufficient sleep because of ongoing understaffing. 9.2.6 Controllers get insufficient sleep because of shift start times. Potential Interview Topics • Controller interview to review challenges in adjusting to work shift schedule transitions and potential mitigations. • Controller interview to review challenges in being called into work on short notice and potential mitigations. • Controller interview to review challenges in getting sufficient sleep due to 12-hour shift and potential mitigations. • Controller interview to review challenges in getting sufficient sleep due to shift start times and potential mitigations. Potential Observation Activities • None identified.#

Attachment 1, passage 219Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-87 Potential Materials Review Topics • Review of staffing level plans and policies. • Review historical staffing levels. • Review of overtime policies. • Review historical overtime levels. • Review of short notice call-in policies. Potential Mitigations 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 Implement a Work Shift Schedule Modification — —  —  Review/Adjust Overtime Work Policies and Procedures —   — — — Conduct Sleep Disorder Screening — — — —  Conduct Controller Fatigue Management Training       Implement Rest Break and Napping Policy and Procedures     —  Change the Control Room Environment to Reduce Fatigue — —  —  Implement a Fatigue Recognition and Self-Reporting Policy and Procedures     —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 220Page F-88 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 9.3 Slow Work Periods Definition This topic includes Performance Factors that represent direct, first-hand reports of Controllers having alertness problems during slow work periods. Performance Factor List 9.3.1 Controllers experience reduced alertness during slow work periods. 9.3.2 Controllers experience difficulty regaining alertness to deal with a challenging situation following a slow work period. Potential Interview Topics  Controller interviews addressing specific conditions that lead to slow work periods and suggested strategies for maintaining alertness.  Controller subjective workload interview, reviewing selected activities across consoles, and applying standardized rating procedures (i.e., TLX protocol). Potential Observation Activities  None identified. Potential Materials Review Topics  Comparison of available operations data pertinent to work load (e.g., SCADA control actions, keystrokes, phone calls across time and consoles.#

Attachment 1, passage 221Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-89 Potential Mitigations 9.3.1 9.3.2 Implement a Work Shift Schedule Modification   Review/Adjust Overtime Work Policies and Procedures   Conduct Sleep Disorder Screening   Conduct Controller Fatigue Management Training   Implement Rest Break and Napping Policy and Procedures   Change the Control Room Environment to Reduce Fatigue   Provide Additional Stimulation During Slow Work Periods   Implement a Fatigue Recognition and Self-Reporting Policy and Procedures    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 222Page F-90 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 9.4 Alertness Management Practices Definition This topic covers two specific aspects of broader alertness management practices in the control room. Performance Factor List 9.4.1 Controllers report to work tired enough that they are concerned about their ability to run the pipeline. 9.4.2 Controllers do not notify management when they report to work without adequate rest. 9.4.3 Controllers report for work tired because they have not been provided training on sleep basics, personal alertness practices, and effective fatigue-reduction practices Potential Interview Topics  Controller and/or management interviews regarding their being provided with authoritative training on sleep basics, personal alertness management practices, and effective and ineffective fatigue countermeasures.  Controller and/or management interviews to identify past reviews of Controller work scheduling policies and practices steps for minimizing the negative affect of work shift schedules on Controller fatigue.  Controller and/or management interviews regarding procedures and mechanisms to promote Controller alertness on the job have that have been considered and implemented. Potential Observation Activities  Procedures and mechanisms to promote Controller alertness on the job have been considered and implemented, as appropriate.#

Attachment 1, passage 223Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-91 Potential Materials Review Topics  Review of documentation and communications regarding expected personal sleep and rest levels prior to taking responsibility at a console.  Review of policies and communications regarding Controllers reporting that they require additional rest prior to taking responsibility for pipeline operations.  Company fatigue management program materials.  Company/vendor fatigue management training materials. Potential Mitigations 9.4.1 9.4.2 Conduct Controller Fatigue Management Training — Implement a Fatigue Self-Reporting Policy and Procedures    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 224Page F-92 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 10.1 Automated Operations Definition This topic covers the ways in which certain aspects of the Controller’s job may be automated, such as the implementation of preset control points or alarms and the various uses of PCL (Program Control Logic). Performance Factor List 10.1.1 Automation of control actions makes the Controller job more difficult. 10.1.2 Too many steps are required to set up an automated sequence of control actions. 10.1.3 Automated operation of some equipment conflicts or interferes with Controller actions. 10.1.4 Controllers can forget to perform a manual control action because the initial steps are automated. 10.1.5 Automation is not consistent across similar stations/locations. 10.1.6 Controllers do not understand how automation works at a station/location. 10.1.7 Controllers do not sufficiently trust the reliability of control action automation. 10.1.8 There are some steps in an automated sequence that are not displayed by SCADA. 10.1.9 There are specific control actions (e.g., line ups, line shutdown, and manifold flushing) that would benefit from automation. Potential Interview Topics  Controller interview addressing specific difficulties with current automation.  Controller interview to identify potential areas of automation.  Controller interview to identify specific unsafe acts that might result from difficulties with automated operations. Potential Observation Activities  Walk-through of any particularly challenging activities identified through Controller interview.#

Attachment 1, passage 225Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-93 Potential Materials Review Topics  Review of the use of automation on a console to identify inconsistent implementation (e.g., same equipment/functions but different levels of automation—none, partial, full, etc).  Review notification/feedback information that Controllers receive in the SCADA or that is accessible to Controllers related to automation initiation, operation, and completion, especially under challenging conditions (e.g., communications loss). Potential Mitigations 10.1.1 10.1.2 10.1.3 10.1.4 10.1.5 10.1.6 10.1.7 Revise the Allocation of Control Functions Between Controllers and Automation —  — — — — Revise the Design and Implementation of Automated Controls —     — — Revise the Use of Feedback in Automated Controls — — —  —   Provide Special Topics Training — — — — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 226Page F-94 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 11.1 Control Room Design Definition This topic covers how well control room facilities and layout accommodate breaks. Performance Factor List 11.1.1 The location of break facilities keeps Controllers away from their console too long. 11.1.2 The location of break facilities keeps Controller from taking appropriate brief breaks. 11.1.3 The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.). 11.1.4 Controllers on break cannot be reached to address an immediate operational situation. Potential Interview Topics  Controller interview to identify potential improvements in control room layout.  Controller interview to identify specific unsafe acts that might result from difficulties having readily accessible break facilities.  This could be a good topic to conduct one or more larger control center meetings to review control room design challenges and potential improvements. Potential Observation Activities  Walk-through of control room and break facilities layout, including measuring the time required to travel between the control room and break facilities. Potential Materials Review Topics  None identified.#

Attachment 1, passage 227Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-95 Applicable Mitigation For Each Performance Factor 11.1.1 11.1.2 11.1.3 11.1.4 Revise the Location of Break Facilities   — — Revise Controller Break Protocols — —   Provide SCADA Alarm Monitors in Break Facilities     Revise Controller Local Communications — — —  Cross-train Controllers on Adjacent Consoles — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 228Page F-96 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets 11.2 Control Room Staffing Definition This topic covers the general level of control room staffing and work assignments in support of normal and abnormal operating conditions. Performance Factor List 11.2.1 Another Controller’s long break times puts an excessive burden on the relieving Controller. 11.2.2 Controller staffing is not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc.). 11.2.3 Controller staffing is not adequate to allow for vacation, sick leave, and/or regularly scheduled days off. 11.2.4 Controllers work on their scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc.). 11.2.5 Controller staffing is not adequate to provide Controller assistance during busy normal operations. 11.2.6 Controller staffing is not adequate to provide Controller assistance during abnormal situations. Potential Interview Topics  Controller interview to identify potential improvements in control room staffing.  Controller interview to identify specific unsafe acts that might result from difficulties with control room staffing.  This could be a good topic to conduct one or more larger control center meetings to review control room staffing challenges and potential improvements. Potential Observation Activities  None identified. Potential Materials Review Topics  Historical control room staffing level review.#

Attachment 1, passage 229Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Page F-97 Potential Mitigations 11.2.1 11.2.2 11.2.3 11.2.4 11.2.5 11.2.6 Adjust Controller Staffing Levels —      Review/Adjust Overtime Work Policies and Procedures — — —  — — Reassign Normal Operations Control Center Duties and Assignments — — —    Revise Controller Break Protocols — — — — — Revise Controller Local Communications — — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (this includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 230Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-1 APPENDIX G STEP 7 RISK MITIGATION STRATEGY DEVELOPMENT GUIDANCE AND WORKSHEETS#

Attachment 1, passage 231Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-3 STEP 7 RISK MITIGATION STRATEGY DEVELOPMENT GUIDANCE Step 7 is conducted to develop a risk mitigation strategy that identifies specific mitigations that are judged to provide a feasible approach for addressing the highest-priority human factors risks. Figure G-1 depicts the two activities in this step. The following discussion provides general risk mitigation strategy development guidance. A Step 7 Mitigation Assessment Worksheet that provides a format for organizing and recording information relevant to the mitigation selection process is also provided in this appendix along with the guidance for completing the worksheet. Risk mitigation descriptions are provided in the final section of this appendix. It is important to note that the specific strategy development process presented here has yet to be applied by pipeline operators; and it is likely that future applications will identify aspects requiring further refinement. 7.1 Identify and Assess Alternative Mitigations for Each Human Factors Topic 7.2 Prioritize Mitigations for Development and Implementation Figure G-1. Step 7 Risk Mitigation Strategy Development Activities 7.1. Identify and Assess Alternative Mitigations for each Human Factors Topic Potential mitigations can be identified through a review of the mitigation descriptions provided in this appendix, through the operational review findings completed during Step 6, and through input by professional colleagues and consultants. After identifying potential mitigations, the risk management team assesses each potential mitigation. Three applicable criteria are identified and defined below. Relevance is the extent to which a mitigation directly addresses the work conditions and system operational risks corresponding to a Performance Factor. Efficacy is the extent to which there is reliable and objective evidence supporting the effectiveness of a mitigation in reducing the prevalence of working conditions and level of operational risk. Compatibility is the extent to which a mitigation is consistent with current, or envisioned future, organizational policies and procedures. A Mitigation Review Key, provided along with the Mitigation Assessment Worksheet, provides a general set of ratings that may be used by the risk management team in assigning potential mitigations High, Medium, Low, or None ratings corresponding to each of the identified assessment criteria. The Mitigation Descriptions in the final section of this appendix, are intended to provide information that is relevant to this assessment activity. However, it is#

Attachment 1, passage 232Page G-4 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets expected that additional relevant information will be contributed by members of the risk management team. If this approach is used, it is suggested that the mitigation assessment process be conducted in one or more meetings of the risk management team dedicated to this purpose. Individual risk management team members could be assigned responsibility for assembling the information relevant to potential mitigations corresponding to one or more operational review topic and the associated mitigation, and responsibility for leading a discussion regarding the assessment of those potential mitigations. It is recommended that risk management team members collaborate in reviewing the relevance, efficacy, and compatibility of each potential mitigation to ensure full consideration of the pertinent evidence and issues. The objective of this activity is to decide whether or not one or more of the mitigations listed in worksheet 7.1 can be feasibly implemented in a way that meaningfully addresses the concerns associated with the identified Performance Factors. Worksheet 7.1 provides input information for this process, however, it is recognized that several other organizational factors and constraints also affect this process. Therefore, a specific approach for selecting mitigations for implementation is not provided, since this process will depend on an Operator’s specific organizational and operational factors. It is recommended, however, that Operators document the process used and the corresponding rational underlying their final decisions. 7.2. Prioritize Mitigations for Development and Implementation During the second Step 7 sub-step, the final analysis of potential mitigations is conducted in two activities. First, mitigations are prioritized with respect to their relative value in addressing problematic working conditions and reducing risk levels identified during the earlier risk assessment steps. Then, the development and implementation issues that were identified by the risk management team during this assessment are summarized and documented.#

Attachment 1, passage 233Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-5 STEP 7 MITIGATION ASSESSMENT WORKSHEET AND GUIDANCE Step 7 Mitigation Assessment Worksheet Guidance The Step 7 worksheet provides a very general outline of topics that can be considered by the risk management team in assessing alternative mitigations. The following guidance is divided into the four sections of the worksheet. Human Factors Topic, Risk Level Ranking, and Specific Monitoring and Control Operational Risks. These three entries should provide a summary of the very general scope addressed by the mitigations being considered – the Human Factors Topic being addressed, the corresponding Risk Level Ranking for this topic determined during Step 5, and the specific monitoring and control operational risks identified during Step 6. Associated Performance Factors, Problematic Working Conditions, and Applicable Mitigations. This next section of the worksheet provides more detailed mitigation information. When appropriate, this information should be documented at the level of individual Performance Factors, since this is often the level that mitigations are defined. For each Performance Factor nested under the identified Human Factors Topics included in the worksheet, the problematic working conditions identified in Step 5 and the applicable mitigations identified in Step 6 should be documented. Applicable Mitigations – Relevance, Efficacy, and Compatibility Ratings. The following Mitigation Review Key provides a general set of ratings that may be used by the risk management team in assigning potential mitigations High, Medium, Low, or None ratings corresponding to the relevance and efficacy of the mitigations identified in the corresponding descriptions. The Mitigation Descriptions in the final section of this appendix, provide additional information that is pertinent to the assessment of mitigation relevance and efficacy. The assessment of compatibility will require a review of corporate and control center policies, procedures, priorities and strategies.#

Attachment 1, passage 234Page G-6 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Mitigation Review Key Relevance: the extent that a mitigation directly addresses the work conditions and system operational risks corresponding to a Performance Factor HIGH Directly addresses work conditions and system operations MEDIUM Addresses some work conditions and/or system operations LOW Very limited relevance to work conditions and system operations NONE No relevance Efficacy: the extent that there is reliable and objective evidence supporting the effectiveness of a mitigation in reducing the prevalence of working conditions and level of operational risk HIGH Strong empirical support MEDIUM Reliable anecdotal evidence or strong theoretical/logical support LOW Very limited anecdotal or theoretical/logical support NONE No efficacy Compatibility: the extent that a mitigation is consistent with current, or envisioned future, organizational policies and procedures HIGH Fully consistent with current/future policies and procedures MEDIUM Acceptably consistent with current/future policies and procedures LOW Very limited consistency with current/future policies and procedures NONE No compatibility Key Mitigation Applicability, Development, and Implementation Issues. The last set of headings in the Alternative Mitigation Assessment Worksheet provide three general topics that may be identified by the risk management team on the basis of their mitigation assessment discussions. For each mitigation that is selected for further development planning, the following three issues can be addressed. Applicability Issues. Noteworthy strengths or limitations regarding the applicability of a mitigation for addressing operational risks or problematic working conditions identified in earlier steps or mitigation selection discussions. Development Issues. Advantages, disadvantages, or challenges in the development of a mitigation identified during the mitigation assessment discussions. General development issues may include time, cost, complexity, and risk concerns. Implementation Issues. Advantages, disadvantages, or challenges in the future implementation of a developed mitigation identified during the mitigation assessment discussions. General implementation issues may include the need to coordinate implementation with other control room activities, staff training requirements, the need to revise affected procedures and policies, and maintenance requirements and costs.#

Attachment 1, passage 235Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-7 STEP 7 RISK MITIGATION STRATEGY DEVELOPMENT Sub-step 7.1 Alternative Mitigation Assessment Worksheet Human Factors Topic: Risk Level Ranking: Specific Monitoring and Control Operational Risks: Associated Performance Factors, Problematic Working Conditions, and Applicable Mitigations Performance Factor Problematic Working Conditions Applicable Mitigations Applicable Mitigations – Relevance, Efficacy, and Compatibility Ratings Applicable Mitigation Relevance Rating Efficacy Rating Compatibility Rating Key Mitigation Applicability, Development, and Implementation Issues Mitigation Applicability Issues Development Issues Implementation Issues#

Attachment 1, passage 236Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-9 RISK MITIGATION DESCRIPTIONS Two general types of mitigations are presented in this section. These include “High-level” mitigations that cut across specific Human Factors Topics, acting at an operator-wide level, and “Low-level” mitigations that are more specific to individual Human Factors Topics or Performance Factors. High-level Mitigations Numerous operator management policies and practices can establish a framework that can support focused mitigations. Because such policies and practices have a wide-spread effect on operational safety, it is difficult to categorize them under an individual Human Factors Topic, as has been done with the ‘Low-level Mitigations’ in this section. A number of these high-level mitigations are summarized below. In general, these mitigations are useful for promoting continuous improvement of safety-related operations and establishing a framework and work culture that can support more focused mitigation development and implementation. The following summary of these high-level mitigations is limited, because they tend to fall outside of the scope of the current methodology that is directed towards identifying and addressing specific human factors risks. Define corporate priorities (e.g., 1: safety; 2: environment; 3: production; etc.) and policies regarding appropriate responses to conditions associated with each priority. This activity can set the stage for communicating a corporate priority regarding safety and serve as a precursor to a review and revision of safety policies and procedures. Establish an incident reporting, investigation, analysis, and documentation system. Use of a structured and established accident investigation methodology has been shown to increase the consistency and interpretability of incident investigation findings. Methodologies for investigating the role of human factors in aviation and nuclear power plant have been developed and successfully applied for over a decade. The current Liquid Pipeline Operations Human Factors Taxonomy, which reflects the basic approach of these earlier efforts, could serve as a sound foundation for developing a standard methodology for investigating human factors contributions to incidents and accidents. Incorporate appropriate candidate testing during the hiring process. Valid candidate testing can increase the likelihood that new employees will have the capacity and aptitude to do well in a Controller position. The use of valid personnel selection procedures has been shown to reduce training costs and improve operational effectiveness in a wide range of process control work settings. A number of validated personnel selection tests are commercially available for use by pipeline operators. Establish and promote a continuous learning environment that stresses the priority of safety. Generally, establishing a non-punitive, rewarding environment that encourages employees to share their safety concerns and suggestions for improvement is commonly accepted as a positive measure towards improving safety in an organization. The basic approach could also aid in addressing cultural complacency that may set in when Controllers have learned to live with compensatory tactics, instead of recognizing and fixing operational difficulties.#

Attachment 1, passage 237Page G-10 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Mitigation Summary Table G-1 provides a summary of the 86 separate low-level mitigations that are identified as applicable to Performance Factors within each of the 29 Human Factors Topics in the remainder of this appendix. Because many mitigations are identified as being applicable to Performance Factors that are nested under more than one Human Factors Topic, there are 130 mitigation applications identified in this table. Table G-1. Summary of Mitigations Identified as Applicable to Performance Factors within each Human Factors Topic Human Factors Topic Applicable Mitigations 1.1 Task Design Automate or Simplify Complex Tasks Replace Manual Calculations with Automated Tools Allow Greater Control Over Timing of Control Actions Situation-Specific Training Review and Upgrade Equipment and/or Equipment Interfaces 1.2 Console Workload Allow Greater Control Over Timing of Control Actions Workload Analysis/Rebalancing Automate or Simplify Complex Tasks Provide Decision Support Tools Situation-Specific Training 2.1 Equipment Layout and Workstation Design Conduct Task Analysis Conduct Ergonomic Audit 2.2 SCADA Information Access and Layout Conduct User Interface Design Evaluation Involve Controllers in the Design Process Conduct Task Analysis 2.3 SCADA Information Content, Coding, and Presentation Provide Overview Screens Conduct User Interface Design Evaluation Conduct Information Consistency Review 3.1 Shift Hand-off Procedures Use Structured Forms or Checklists to Record Shift Hand-off Information Schedule Maintenance Activities to Within a Single Shift Rewrite Deficient Procedures Based on Task Requirements Controller Shift Hand-off Anomaly Reporting Procedure Shift Hand-off Observation/Evaluations Improve Communications Policies and Training 3.2 Control Center Communications Improve Communications Policies and Training Provide a “Float” Controller Who Can Take Over Non-control Activities Reassign Abnormal Situation Non-critical Duties Document Abnormal Situation Control Room Staff Roles and Responsibilities#

Attachment 1, passage 238Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-11 Human Factors Topic Applicable Mitigations 3.3 Schedule Communications Minimize Unnecessary Manual Data Entry Provide Computer-based Communications Tools Review and Revise Control Center Work Completion and Communication Protocols 3.4 Field Personnel Communications Make Field Personnel Responsible for Maintain Current Contact Lists Use Structured Forms or Communication Protocols for Communicating System/Equipment Status Improve Communications Policies and Training Improve Available Field Communications Equipment 4.1 Operational Information Accuracy and Availability Flag Inaccurate or Out-of-date Information Coordinate Field Equipment Status Changes with SCADA Conduct an Engineering Review Minimize Unnecessary Manual Data Entry Conduct Task Analysis 5.1 Job Procedure Design Conduct an Engineering Review Use a Procedure Style/Writing Guide Warning/Caution Call-outs Controller Involvement in Procedure Reviews Adjustable Level of Procedure Detail Implement Systematic Human Factors Procedure Design Process Ensure Adequate Selection and Training of Procedure Writers 5.2 Job Procedure Availability Conduct an Engineering Review Use a Procedure Style/Writing Guide Context Sensitive Procedures Implement Computer-based Procedures Implement Systematic Human Factors Procedure Design Process Specify Procedure Availability and Access 5.3 Job Procedure Accuracy and Completeness Conduct an Engineering Review Use a Procedure Style/Writing Guide Controller Involvement in Procedure Reviews Implement Computer-based Procedures Establish a Single Point of Contact to Manage Procedures and Manuals Implement Systematic Human Factors Procedure Design Process Provide Procedure Writing Training 6.1 Alarm Availability and Accuracy Develop an Alarm Philosophy Document Conduct an Alarm Engineering Review 6.2 Alarm Display and Presentation User Interface Design Review Alarm Prioritization Reduce Number of Alarms 6.3 Alarm Interpretation Alarm Description Review User Interface Design Review Alarm Prioritization#

Attachment 1, passage 239Page G-12 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets Human Factors Topic Applicable Mitigations 6.4 Alarm Access and Acknowledgement Provide a Function to Acknowledge Multiple Low-priority Alarms that Provide Redundant Information Use a Different Process/Dialog Box to Acknowledge Important Alarms Provide Functions to Temporarily Sort Alarms by Information Field Provide Quick Access to Acknowledged Alarms from the Main Alarm Display Limit a Controller’s Ability to Clear Alarms on Other Consoles 6.5 Nuisance Alarms Alarm Documentation and Rationalization Review Alarm Redefinition Alarm Grouping Alarm Limit Modification 7.1 Pipeline Fundamentals Knowledge and Field Exposure Improve Controller Normal Operations Training Improve the On-the-Job Training Program Provide Special Topics Training Improve New Procedure/Equipment Introduction Training Improve Controller KSA Assessment Improve Controller Abnormal Situations Training Improve Simulator Training 7.2 Emergency Response Training Improve the On-the-Job Training Program Improve New Procedure/Equipment Introduction Training Improve Controller KSA Assessment Improve Controller Abnormal Situations Training Improve Simulator Training 8.1 Abnormal Situation Task Assignments Reassign Abnormal Situation Non-critical Duties Document Abnormal Situation Control Room Staff Roles and Responsibilities 8.2 Control Room Distractions Reassign Normal Operations Control Center Duties and Assignments Automate Paperwork through Existing Software Databases Review and Revise Control Center Work Completion and Communication Protocols Review and Revise Field Personnel Communications Protocols Review and Revise Management Policies and Procedures 9.1 Controller Fatigue Implement a Work Shift Schedule Modification Review/Adjust Overtime Work Policies and Procedures Conduct Sleep Disorder Screening Conduct Controller Fatigue Management Training Review/Adjust Policy on Employee Commute to Control Center Implement Rest Break and Napping Policy and Procedures Change the Control Room Environment to Reduce Fatigue Provide Additional Stimulation during Slow Work Periods Implement a Fatigue Recognition and Self-Reporting Policy and Procedures#

Attachment 1, passage 240Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-13 Human Factors Topic Applicable Mitigations 9.2 Controller Schedule and Rest Implement a Work Shift Schedule Modification Review/Adjust Overtime Work Policies and Procedures Conduct Sleep Disorder Screening Conduct Controller Fatigue Management Training Implement Rest Break and Napping Policy and Procedures Change the Control Room Environment to Reduce Fatigue Implement a Fatigue Recognition and Self-Reporting Policy and Procedures 9.3 Slow Work Periods Implement a Work Shift Schedule Modification Review/Adjust Overtime Work Policies and Procedures Conduct Sleep Disorder Screening Conduct Controller Fatigue Management Training Implement Rest Break and Napping Policy and Procedures Change the Control Room Environment to Reduce Fatigue Provide Additional Stimulation during Slow Work Periods Implement a Fatigue Recognition and Self-Reporting Policy and Procedures 9.4 Alertness Management Practices Conduct Controller Fatigue Management Training Implement a Fatigue Recognition and Self-Reporting Policy and Procedures 10.1 Automated Operations Revise the Allocation of Control Functions Between Controllers and Automation Revise the Design and Implementation of Automated Controls Revise the Use of Feedback in Automated Controls Provide Special Topics Training 11.1 Control Room Design Revise the Location of Break Facilities Revise Controller Break Protocols Provide SCADA Alarm Monitors in Break Facilities Revise Controller Local Communications Cross-train Controllers on Adjacent Consoles 11.2 Control Room Staffing Adjust Controller Staffing Levels Review/Adjust Overtime Work Policies and Procedures Reassign Normal Operations Control Center Duties and Assignments Revise Controller Break Protocols Revise Controller Local Communications Risk Mitigation Descriptions The remainder of this appendix presents a total of 86 separate mitigations. The relevance of each mitigation is identified for each of the 138 Performance Factors included in the current Pipeline Operations Human Factors Taxonomy. These mitigation descriptions are organized in sets under the 29 Human Factors Topics and arranged in a multiple-page layout. The first page of each set includes three separate tables that provide the following summary information:#

Attachment 1, passage 241Page G-14 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 6 Control Room Operational Review Guidance and Worksheets  Human Factors Topic definition;  A list of the Performance Factors nested under the Human Factors Topic being addressed; and  A summary of applicable mitigations, their applicability to each Performance Factor, and the level of evidence supporting the applicability of each mitigation to each Performance Factor. The second and subsequent pages provide:  A brief discussion of the nature of each mitigation and the logic and/or evidence supporting its applicability; and  Key references that provide additional information regarding each mitigation, as appropriate.#

Attachment 1, passage 242Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 7 Risk Mitigations Strategy Development Guidance and Worksheets Page G-15 Risk Mitigation Descriptions#

Attachment 1, passage 243Page G-16 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 1.1 Task Complexity and Workload: Task Design Definition This topic covers characteristics of Controller-specific activities and tasks that influence the level of task complexity and workload. Performance Factor List 1.1.1 Execution of a control action (e.g., open/close valve, start/stop pump, change setpoint) requires too many steps (e.g., more than three). 1.1.2 Routine activities (e.g., line start up, batch cutting, or manifold flushing) are too complex. 1.1.3 Controllers make errors in performing manual calculations that are used directly as an input to operational activities. 1.1.4 Some equipment requires control actions that are different than similar equipment at the majority of locations. 1.1.5 Some operations have a very small margin for error. Applicable Mitigation For Each Performance Factor 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 Automate or Simplify Complex Tasks   — —  Replace Manual Calculations with Automated Tools — —  — — Allow Greater Control Over Timing of Control Actions — — — —  Situation-Specific Training — — — —  Review and Upgrade Equipment and/or Equipment Interfaces   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 244Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-17 Task Complexity and Workload: Task Design 1.1 Discussion Automate or Simplify Complex Tasks Controllers may be over-burdened during higher workload periods by control activities that could otherwise be automated or simplified in ways that will not compromise safety. If these activities can be automated or simplified to reduce the attention required of Controllers, then Controllers should be in a better position to manage their overall workload. One approach is to interview Controllers to identify high-workload periods and any candidate operational activities for automation or simplification. Key References: Moray, N. (2001). Humans and machines: Allocation of function. In J. Noys & M. Bransby (Eds.). People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers. Replace Manual Calculations with Automated Tools Manual calculations, manual record-keeping, or extensive data entry can be time consuming and error prone. This mitigation involves replacing some of these activities with automated tools, such as spreadsheets that automatically calculate necessary information or simplify data entry. While there may still be reasons for Controllers to manually conduct some of these activities (i.e., manual batch tracking may help maintain situation awareness), using them to perform calculations or as a double check can help reduce the time needed to perform these tasks and reduce errors. Key References: Sharit, J. (2006). Human Error. In G. Salvendy (Ed). Handbook of Human Factors and Ergonomics. (p. 708-760). New Jersey: Wiley & Sons. Allow Greater Control Over Timing of Control Actions If simultaneous line switching is a problem, then one option is to allow Controllers to change pipeline flow rate in order to introduce some lag in the time between line switches. The objective here is to stagger the scheduled occurrence of line switches. The targeted lag between separate switches would depend upon the reliability of schedule estimates for the pipelines involved and the time required to complete one switch. Guidelines regarding targeted lag times could be established for different pipelines within a control room. This approach may be feasible at many control rooms. However, staggering of more than two control actions over time could significantly increase or complicate the Controller’s tasks, and changes in timing might have “ripple” effects on subsequent operations that would have to be identified after each adjustment was made. Initial Controller training that addresses task prioritization and timing could facilitate the development and implementation of this mitigation. In addition, some of these issues could be addressed with automation to some extent, such as automatic detection of certain types of control activities that occur within a short interval. Key References: None#

Attachment 1, passage 245Page G-18 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 1.1 Task Complexity and Workload: Task Design Situation-Specific Training This involves providing Controllers ongoing training on specific operational situations to enhance and/or maintain their situation analysis and decision-making skills in response to specific operating conditions. Such training should improve and/or maintain Controllers’ abilities to recognize key information, execute control activities, form a “big picture” sense of a situation, and more clearly understand the impacts of their decisions. If Controllers have insufficient time to make decisions because they lack full expertise with the activities involved, then specific training in dealing with these situations (e.g., simulator-based training) can help them to make necessary decisions in less time. It should be noted that training is usually less optimal as a mitigation than reengineering or redesigning job tasks if the problems are based on poor task design. However, for issues that involve Controllers performing actions under time pressure, training that reduces decision or performance time can increase the safety margin by giving Controllers more time to act. Key References: None Review and Upgrade Equipment and/or Equipment Interfaces This involves reviewing control action operations across a console and identifying and implementing a standard optimal set of control actions for all sets of identical equipment. Key References: None#

Attachment 1, passage 246Page G-20 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 1.2 Task Complexity and Workload: Console Workload Definition This topic covers aspects of console operation that are either particularly challenging to execute or that require highly focused attention and concentration to conduct in an error-free manner. Performance Factor List 1.2.1 Two or more control operations (e.g., line switches) must be done at the same time. 1.2.2 Excessive telephone activity interferes with monitoring and control operations. 1.2.3 Shift hand-off activities interfere with operations. 1.2.4 Unusual work conditions (trainees, tours/visitors) interfere with operations. 1.2.5 Unusual operational conditions (smart pigging, major repairs) interfere with operations. 1.2.6 Controllers have to make important operational decisions without sufficient time to adequately consider alternatives. Applicable Mitigation For Each Performance Factor 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5 1.2.6 Allow Greater Control Over Timing of Control Actions   — — — — Workload Analysis/Rebalancing —    — — Automate or Simplify Complex Tasks — —  — — — Provide Decision Support Tools — — — — —  Situation-Specific Training — —  — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 247Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-21 Task Complexity and Workload: Console Workload 1.2 Discussion Allow Greater Control Over Timing of Control Actions If simultaneous line switching is a problem, then one option is to allow Controllers to change pipeline flow rate in order to introduce some lag in the time between line switches. This approach may be feasible at many control rooms. The lag time needed could be relatively short—a function of the time needed to execute the activity in question (e.g., line switch). However, staggering of more than two control actions over time could significantly increase or complicate the Controller’s tasks, and changes in timing might have “ripple” effects on subsequent operations that would have to be identified after each adjustment was made. Initial Controller training that addresses task prioritization and timing could facilitate the development and implementation of this mitigation. In addition, some of these issues could be addressed with automation to some extent, such as automatic detection of certain types of control activities that occur within a short interval. Key References: None Workload Analysis/Rebalancing This involves analyzing Controller workload levels at a console or across consoles. This can identify certain options for reducing workload levels at an individual console, including reassigning some tasks to another console or control room personnel, automating suitable activities, adopting automated communications systems to reduce the operator’s communications workload, or providing software that can warn Controllers about potential time conflicts, such as line switches that need to be performed at the same time. The basic approach involves measuring activity timelines coupled with general estimates of activity workload/difficulty (MacDonald, 2001). There are several existing tools and approaches for conducting these analyses (see Center for Chemical Process Safety, 2007; Attwood, Deeb & Danz-Reece, 2003). Key References: Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic Solutions for the Process Industries. Burlington, MA: Elsevier. Center for Chemical Process Safety (2007) Human Factors Methods for Improving Performance in the Process Industries. New Jersey: Jon Wiley & Sons. MacDonald, W. (2001). Train Controllers, interface design and mental workload. In J. Noys & M. Bransby (Eds.). People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers. Automate or Simplify Complex Tasks Controllers may be over-burdened during higher workload periods by control activities that could otherwise be automated or simplified in ways that will not compromise safety. If these activities can be automated or simplified to reduce the attention required of Controllers, then Controllers should be in a better position to manage their overall workload. One approach is to interview Controllers to identify high-workload periods and any candidate operational activities for automation or simplification. Key References: Moray, N. (2001). Humans and machines: Allocation of function. In J. Noys & M. Bransby (Eds.). People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers.#

Attachment 1, passage 248Page G-22 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 1.2 Task Complexity and Workload: Console Workload Provide Decision Support Tools Decision support tools are typically computerized procedures or documented heuristics that aid users in decision-making. If implemented and used appropriately, they can aid decision-making by walking users through the relevant set of decision questions and often pulling the relevant decision parameters directly from the SCADA system. Such aids may reduce decision-making time. Moreover, this can increase the quality of decisions by making users aware of a broader set of decision options. Note, however, that decision support systems are only applicable in addressing certain types of situations (i.e., ones that are highly predicable), and should be implemented with caution. Key References: Skourup, C. & Aune, A. (2001). Decision support in process control plants. In J. Noys & M. Bransby (Eds.). People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers. Situation-Specific Training This involves providing Controllers ongoing training on specific operational situations to enhance and/or maintain their situation analysis and decision-making skills in response to specific operating conditions. Such training should improve and/or maintain Controllers’ abilities to recognize key information, execute control activities, form a “big picture” sense of a situation, and more clearly understand the impacts of their decisions. If Controllers have insufficient time to make decisions because they lack full expertise with the activities involved, then specific training in dealing with these situations (e.g., simulator-based training) can help them to make necessary decisions in less time. It should be noted that training is usually less optimal as a mitigation than reengineering or redesigning job tasks if the problems are based on poor task design. However, for issues that involve Controllers performing actions under time pressure, training that reduces decision or performance time can increase the safety margin by giving Controllers more time to act. Key References: None#

Attachment 1, passage 249Page G-24 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 2.1 Displays and Controls: Equipment Layout and Workstation Design Definition This topic covers a Controller’s workspace at a console and the quality and characteristics of the equipment that they use to conduct their activities. Performance Factor List 2.1.1 There are not enough display monitors to show all of the information that a Controller needs at one time during normal operations. 2.1.2 There are not enough display monitors to show all of the information that a Controller needs at one time during abnormal situations. 2.1.3 Monitoring and control activities are disrupted by inadequate display monitor placement (e.g., too low, too high, or positioned so that there is screen glare). 2.1.4 Monitoring and control activities are disrupted by inadequate monitor display quality (e.g., clarity, brightness, contrast). Applicable Mitigation For Each Performance Factor 2.1.1 2.1.2 2.1.3 2.1.4 Conduct Task Analysis   — — Conduct Ergonomic Audit — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 250Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-25 Displays and Controls: Equipment Layout and Workstation Design 2.1 Discussion Conduct Task Analysis This involves identifying all the key tasks that Controllers must perform to complete specific job functions (e.g., starting up a line, executing a batch switch, etc). These tasks are analyzed in terms of the component elements, including information acquisition activities, mental calculations, decisions, control actions, and so forth. This is a structured analysis--typically conducted by a human factors professional working with qualified operations personnel familiar with control room operations. The analysis examines task-specific scenarios to identify various requirements needed for Controllers to effectively conduct their work. Task analysis provides important information that can be incorporated into the design process. This includes information about what specific information Controllers need to assess a situation and make decisions, the number of steps required to complete tasks, the demands placed on the Controller, how work can be allocated among staff, etc. The results of a task analysis can then be used to design or modify the user interface so that certain objectives are met (e.g., ensuring that required information is available on a display; adding automation to reduce the number of control actions, etc). In the present context, task analysis could be conducted with a focus on the adequacy of information displays during normal and abnormal situations. In conducting a task analysis, it is important to carefully review abnormal situations; which, depending on the abnormal situation procedures, may influence the selection and layout of critical equipment (e.g., number displays per console). A critical task identification and analysis is a key element of a task analysis conducted to address equipment layout and workstation design issues associated with abnormal situations. Key References: Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington, MA: Elsevier. Kirwan, B. & Ainsworth, L. (Eds.). (1992). A guide to task analysis. Bristol PA: Taylor & Francis. O’Hara, J., Higgins, J., Persensky, J., Lewis, P., & Bongarra, J. (2004). Human factors engineering program review model (NUREG-0711, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Conduct Ergonomic Audit This involves using a structured approach to evaluate specific aspects of a control room (e.g., console design, console configuration/layout, chairs, mouse/keyboard design and location, lighting, etc.) to determine if they fall within acceptable ranges, as established in existing guidelines or standards. There are several guidelines and standards that provide explicit recommendations for most aspects of control room and workspace design. Evaluations of existing workspaces are typically multi-faceted and comprised of several activities including: 1) familiarization, 2) problem identification, 3) background, 4) data collection and analysis, 5) evaluation, 6) recommendations, and 7) follow-up (see Attwood, Deeb, & Danz-Reece, 2003). This type of analysis is typically conducted by a qualified human factors expert or consultant. Key References: ISO 11604. Ergonomic design of control centres. Geneva, Switzerland: International Standards Organization. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington, MA: Elsevier.#

Attachment 1, passage 251Page G-26 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 2.2 Displays and Controls: SCADA Information Access and Layout Definition This topic covers the organization and layout of individual and related sets of SCADA displays, specific information elements, and the software controls that Controllers use to conduct their operation and monitoring activities. Performance Factor List 2.2.1 Inconsistencies in SCADA display design increase the difficulty of getting needed information. 2.2.2 A cluttered, or complicated SCADA display increases the difficulty of finding needed information. 2.2.3 The layout of information (e.g., lines, equipment, and data) on the SCADA display increases the difficulty of finding, identifying, and interpreting information. 2.2.4 Needed information is not shown on the appropriate SCADA display. 2.2.5 Controllers must navigate between more than two SCADA displays to view related information. 2.2.6 Navigating between SCADA displays interferes with the flow of monitoring and control activities. 2.2.7 The location or layout of SCADA control boxes/targets makes them difficult to use. Applicable Mitigation For Each Performance Factor 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 Conduct User Interface Design Evaluation        Involve Controllers in the Design Process        Conduct Task Analysis — — —   —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 252Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-27 Displays and Controls: SCADA Information Access and Layout 2.2 Discussion Conduct User Interface Design Evaluation This involves comparing the specific set of features (e.g., labels, navigation, and screen layout) of the current SCADA implementation with existing design guidelines. One formalized approach is to conduct a “Standards Inspection” which involves having an expert inspect the interface for compliance with existing standards or guidelines (e.g., Wixon et al., 1994). The most relevant available design guidelines are those from the American Petroleum Institute (API, 2008). The NUREG-700 standards for the nuclear power industry are also highly relevant for SCADA user interface design and they provide detailed specifications. Some of the high-level topics related to user interface design that should be addressed in a SCADA user interface design review include: - Information Displays, including user customization of display layout - User-Interface Interaction and Management - Controls - Alarm Systems - Safety Function and Parameter Monitoring Systems - Group-View Display Systems - Soft Control Systems - Computer-based Procedure Systems - Computerized Operator Support Systems - Communication Systems It is important to note that changes in the SCADA user interface need to be carefully managed, since they can significantly impact Controller’s operational activities, especially those that rely on heavily trained and practiced information acquisition and control actions. Important steps in this process include: 1) conducting an initial survey, 2) scoping the design or improvement effort, 3) preparing the design team, 4) briefing Controllers, 5) executing the design, 6) obtaining user feedback, and 7) transferring to the new system (see Attwood, Deeb, & Danz-Reece, 2003). Key References: American Petroleum Institute. (2008). Recommended practice for pipeline SCADA displays (API RP 1165). Washington DC: API. Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington MA: Elsevier. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Wixon, D., Jones, S., Tse, L., and Casaday, G. (1994). Inspections and design reviews: Framework, history, and reflection. In Nielsen, J., and Mack, R.L. (Eds.), Usability Inspection Methods (p. 79-104). New York: John Wiley & Sons. Involve Controllers in the Design Process This involves including Controllers in the SCADA display development and review process using multi-disciplinary design teams that also include other relevant personnel (e.g., software engineers, control room supervisors, management, etc). In this way, SCADA information and control requirements can be evaluated on key dimensions such as ease of use or availability of needed information by the individuals that will be using the system. This is an iterative approach that allows designers to refine the SCADA implementation based on end-user feedback, and is also an effective method for incorporating information about the practical work conditions that end-use face into this process. Key References: ISO 13407. (1999). Human centred design process for interactive systems. Geneva: Switzerland: International Organization for Standardization (ISO). Carey, M. (2001). Proposed framework for addressing human factors in IEC 61508. Norwich, UK: Health and Safety Executive.#

Attachment 1, passage 253Page G-28 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 2.2 Displays and Controls: SCADA Information Access and Layout Conduct Task Analysis This involves identifying all the key tasks that Controllers must perform to complete specific job functions (e.g., starting up a line, executing a batch switch, etc). These tasks are analyzed in terms of the component elements, including information acquisition activities, mental calculations, decisions, control actions, and so forth. This is a structured analysis--typically conducted by a human factors professional working with qualified operations personnel familiar with control room operations. The analysis examines task-specific scenarios to identify various requirements needed for Controllers to effectively conduct their work. Task analysis provides important information that can be incorporated into the design process. This includes information about what specific information Controllers need to assess a situation and make decisions, the number of steps required to complete tasks, the demands placed on the Controller, how work can be allocated among staff, etc. The results of a task analysis can then be used to design or modify the user interface so that certain objectives are met (e.g., ensuring that required information is available on a display; adding automation to reduce the number of control actions, etc). In the present context, task analysis could be conducted with a focus on the adequacy of information displays during normal and abnormal situations. In conducting a task analysis, it is important to carefully review abnormal situations; which, depending on the abnormal situation procedures, may influence the selection and layout of critical equipment (e.g., number displays per console). A critical task identification and analysis is a key element of a task analysis conducted to address equipment layout and workstation design issues associated with abnormal situations. Key References: Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington, MA: Elsevier. Kirwan, B. & Ainsworth, L. (Eds.). (1992). A guide to task analysis. Bristol PA: Taylor & Francis. O’Hara, J., Higgins, J., Persensky, J., Lewis, P., & Bongarra, J. (2004). Human factors engineering program review model (NUREG-0711, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 254Page G-30 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 2.3 Displays and Controls: SCADA Information Content, Coding, and Presentation Definition This topic covers how information is presented in SCADA displays. Performance Factor List 2.3.1 Information about where the current SCADA display is within the pipeline system is not adequately provided. 2.3.2 Some colors on SCADA displays make data interpretation difficult. 2.3.3 Some labels on SCADA displays make data interpretation difficult. 2.3.4 Some symbols on SCADA displays make data interpretation difficult. 2.3.5 Controllers must transform values from the measurement scale presented on the SCADA display to another scale (e.g., psi to bar, gallons/min to liters/min, etc.) to complete a task. 2.3.6 SCADA displays do not provide adequate system overview information for keeping track of system status. 2.3.7 There is inconsistent use of units of measure (e.g., gallons, barrels, cubic meters) on SCADA displays. Applicable Mitigation For Each Performance Factor 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.3.7 Provide Overview Screens —  — — — — Conduct User Interface Design Evaluation —    — Conduct Information Consistency Review — — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 255Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Displays and Controls: SCADA Information Content, Coding, and Presentation Page G-31 2.3 Discussion Provide Overview Screens This involves including dedicated screens in the SCADA that provide a summary of key information across an extended section or entire pipeline system. The NTSB reference below reports that the overview screen was one of the SCADA displays Controllers used most often. Most of these displays are shown as schematic representations or in a tabular format that groups specific information according to operational characteristics, which allows easy comparison across parameter sets. Key References: American Petroleum Institute. (2008). Recommended practice for pipeline SCADA displays. Washington DC: API. National Transportation Safety Board. (2005. Supervisory Control and Data Acquisition (SCADA) in liquid pipelines. Washington DC: Author. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Conduct User Interface Design Evaluation This involves comparing the specific set of features (e.g., labels, navigation, and screen layout) of the current SCADA implementation with existing design guidelines. One formalized approach is to conduct a “Standards Inspection” which involves having an expert inspect the interface for compliance with existing standards or guidelines (e.g., Wixon et al., 1994). The most relevant available design guidelines are those from the American Petroleum Institute (API, 2008). The NUREG-700 standards for the nuclear power industry are also highly relevant for SCADA user interface design and they provide detailed specifications. Some of the high-level topics related to user interface design that are covered in the NUREG-700 standards include: - Information Displays - User-Interface Interaction and Management - Controls - Alarm Systems - Safety Function and Parameter Monitoring Systems - Group-View Display Systems - Soft Control Systems - Computer-based Procedure Systems - Computerized Operator Support Systems - Communication Systems It is important to note that changes in the SCADA user interface need to be carefully managed, since they can significantly impact Controller’s operational activities, especially those that rely on heavily trained and practiced information acquisition and control actions. Important steps in this process include: 1) conducting an initial survey, 2) scoping the design or improvement effort, 3) preparing the design team, 4) briefing Controllers, 5) executing the design, 6) obtaining user feedback, and 7) transferring to the new system (see Attwood, Deeb, & Danz-Reece, 2003). Key References: American Petroleum Institute. (2008). Recommended practice for pipeline SCADA displays (API RP 1165). Washington DC: API. Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington MA: Elsevier. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Wixon, D., Jones, S., Tse, L., and Casaday, G. (1994). Inspections and design reviews: Framework, history, and reflection. In Nielsen, J., and Mack, R.L. (Eds.), Usability Inspection Methods (p. 79-104). New York: John Wiley & Sons.#

Attachment 1, passage 256Page G-32 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 2.3 Displays and Controls: SCADA Information Content, Coding, and Presentation Conduct Information Consistency Review This involves reviewing all SCADA display screens and compiling an inventory of measurement parameters displayed and the corresponding units used to represent them in each case. A single set of common units should be adopted for the entire SCADA display system and the use of inconsistent measurement units should be minimized. Note, however, that there may be a reason to have a different type of measurement unit available for a parameter (e.g., if a display used in the field uses different units). One way to deal with this may be to keep default units within the SCADA on the same scales, yet provide a conversion function (e.g., clicking on the unit label to toggle between unit types) that provides an easy way to show a variable in a different unit type (possibly as a separated dialog box). If the unit is changed, a salient visual indicator should accompany the altered value (e.g., different font, size, or color). Also, some process for automatically resetting changed units back to the original/default units (e.g., if the Controller navigates away from the screen) should be used to prevent interpretation errors based on the incorrect units being used. Implementation of this mitigation could involve the establishment of an ongoing procedure for Controllers to report identified SCADA information inconsistencies. This reporting process could be coupled with a corrective actions procedure and follow-up review process. Key References: None#

Attachment 1, passage 257Page G-34 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.1 Communications: Shift Hand-off Procedures Definition This topic covers the procedures and tools that Controllers use to communicate and document the information needs to be passed from one Controller to the next during shift hand-off. This also includes how well this process is executed. Performance Factor List 3.1.1 Shift hand-off procedures or tools do not adequately identify, track, and record information required by the Controller coming on shift. 3.1.2 Formal shift hand-off procedures are not adequately followed by Controllers. Applicable Mitigation For Each Performance Factor 3.1.1 3.1.2 Use Structured Forms or Checklists to Record Shift Hand-off Information — Schedule Maintenance Activities to Within a Single Shift — Rewrite Deficient Procedures Based on Task Requirements  Controller Shift Hand-off Anomaly Reporting Procedure   Shift Hand-off Observation/Evaluations —  Improve Communications Policies and Training —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 258Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-35 Communications: Shift Hand-off Procedures 3.1 Discussion Use Structured Forms or Checklists to Record Shift Hand-off Information This involves incorporating structured forms or checklists that contain fields and set protocols to ensure that Controllers cover the information that needs to be communicated during shift hand-off. It provides a script for efficiently going through relevant information, and importantly, helps ensure that all necessary information is covered. It may also be useful to designate some types of fields as mandatory or discretionary. For example, in one study, mandatory fields included those related to safety, maintenance and technical problems, work outstanding, comments/remarks, and signatures; while discretionary fields included those related to environmental matters, plant conditions, production and quality, personnel issues, external events, actions taken during shift, and routine duties (Larder, 1999). Another consideration is that these types of forms and checklists are typically most effective if Controllers participate in the tool development and refinement process. Key References: Larder, R. (1999). Safe communications at shift handover: Setting and implementing standards. Edinburgh, UK: The Keil Centre. Larder, R. (1996). Effective shift handover – A literature review (Offshore Technology Report – OTO 96 003). Norwich, UK: Health and Safety Executive. Schedule Maintenance Activities to Within a Single Shift Analysis of previous serious process control incidents shows that inadequate communication of ongoing maintenance activities or changes in the system across shifts is one of the most frequent contributors to incidents (Larder, 1996). One approach for minimizing the risk from maintenance activities is to--where possible--schedule maintenance work and special operations so that they can be started and completed within a single work shift. This diminishes the chance that important information about temporary system changes is missed or misrepresented. When this is not possible and the activity crosses shifts, efforts should be taken to heighten the level of awareness regarding the ongoing activity on the part of Controllers in their execution of shift change-over and cross checks with the field maintenance inspector. Key References: Larder, R. (1996). Effective shift handover – A literature review (Offshore Technology Report – OTO 96 003). Norwich, UK: Health and Safety Executive. Rewrite Deficient Procedures Based on Task Requirements If shift hand-off procedures are deficient, they need to be rewritten based on an analysis of what procedures are required for a specific operation. Conducting a Task Analysis that identifies and describes each step required to complete an activity is the typical method for obtaining this information. The key references listed below provide information about how to conduct the appropriate analyses. Key References: Drury, C.G. (1983). Task analysis methods in industry. Applied Ergonomics, 14(1), 19-28. Kirwan, B. & Ainsworth, L. (Eds.). (1992). A guide to task analysis. Bristol PA: Taylor & Francis.#

Attachment 1, passage 259Page G-36 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.1 Communications: Shift Hand-off Procedures Controller Shift Hand-off Anomaly Reporting Procedure This involves establishing a policy and procedure whereby Controllers can report any omissions, errors, etc. in any shift hand-off activities. The reporting and review would probably be best implemented as a non-punitive, Controller-centered procedure, with support provided by shift leaders or team leaders, so that participation and compliance could be maximized. This would be an ongoing continuous improvement process. Key References: None Shift Hand-off Observation/Evaluations In general, this involves periodic observation and evaluation by third-party reviewers of actual shift hand-offs. The objective is to evaluate the hand-off based on certain criteria reflecting good practices and to provide feedback to Controllers on areas where improvements can be made. Observations can be conducted by assigned Controllers or by a Controller supervisor knowledgeable about the past 24 hours of operation. Following observation, a debriefing between the observer and Controller can address specific areas that were not conducted in accordance with established procedures. This process could also support the development of improved shift hand-off training or coaching plans. Key References: None Improve Communications Policies and Training This involves taking measures to improve communication among personnel. Operators should not assume that Controllers and other personnel have the necessary verbal and writing communication skills to adequately communicate without additional training and support. The primary way to improve operator-wide communication would involve training, in both general communication practices and situation-specific training (e.g., for shift hand-off or field communication). It could also involve giving greater weight to communication protocols and practice in operation policies. As in the case of shift hand-off practices, the communication process could be audited by reviewing the taped voices of the Controller and field operator or third party customer during a normal shift. The identification of deviations from established policy and practice could provide the basis for a subsequent Controller debriefing and the refinement of communications training plans. Key References: Larder, R. (1996). Effective shift handover – A literature review (Offshore Technology Report – OTO 96 003). Norwich, UK: Health and Safety Executive.#

Attachment 1, passage 260Page G-38 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.2 Communications: Control Center Communications Definition This topic covers communication of information related to pipeline operation and monitoring between control center personnel, in addition to other types of support that Controllers receive from other control room staff. Performance Factor List 3.2.1 The exchange of required operations information between Controllers on different consoles is not adequate. 3.2.2 Control center staff are not available to provide assistance with an operational issue when required (separated from field technicians). 3.2.3 The lines of communication in the control room are not clearly defined or adhered to. Applicable Mitigation For Each Performance Factor 3.2.1 3.2.2 3.2.3 Improve Communications Policies and Training  — — Provide a “Float” Controller Who Can Take Over Non-control Activities — — Reassign Abnormal Situation Non-critical Duties — — Document Abnormal Situation Control Room Staff Roles and Responsibilities — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 261Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-39 Communications: Control Center Communications 3.2 Discussion Improve Communications Policies and Training This involves taking measures to improve communication among personnel. Operators should not assume that Controllers and other personnel have the necessary verbal and writing communication skills to adequately communicate without additional training and support. The primary way to improve operator-wide communication would involve training, in both general communication practices and situation-specific training (e.g., for shift hand-off or field communication). It could also involve giving greater weight to communication protocols and practice in operation policies. As in the case of shift hand-off practices, the communication process could be audited by reviewing the taped voices of the Controller and field operator or third party customer during a normal shift. The identification of deviations from established policy and practice could provide the basis for a subsequent Controller debriefing and the refinement of communications training plans. Key References: Larder, R. (1996). Effective shift handover – A literature review (Offshore Technology Report – OTO 96 003). Norwich, UK: Health and Safety Executive. Provide a “Float” Controller Who Can Take Over Non-control Activities This mitigation would involve adjusting control room staffing so that there is a “floating” Controller on-site who is not scheduled to operate a particular console. If their support is not required at a console, these Controllers can work on special projects. However, if other Controllers conducting operational activities become overburdened with tasks, then the “float” Controller provides someone familiar with pipeline operation that can help out with non-critical activities (e.g., answering phones) until the workload of the on-duty Controller subsides. Key References: None#

Attachment 1, passage 262Page G-40 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.2 Communications: Control Center Communications Reassign Abnormal Situation Non-critical Duties Section 1.1 includes a brief discussion of the mitigation “Automate or Simplify Complex Tasks”, which provides an initial basis for the current mitigation. As stated in Section 1.1, Controllers may be over-burdened during higher workload periods by control activities that could otherwise be automated or simplified in ways that will not compromise safety (Moray, 2001). Recent research suggests that individuals working under task-based stress have difficulty effectively identifying the cause of complex problems (Van Hiel & Mervielde, 2007). If these activities can be modified so that they require less direct attention by Controllers, then they should be in a better position to manage other demands. One method that can be used in developing a reassignment strategy is to interview Controllers to identify specific non- critical duties that are currently assigned during abnormal situations. The focus of the current mitigation is the reassignment of duties assigned to the Controller responsible for console operations once an abnormal operating condition that requires the full attention of a responsible party has been identified. A related, critical factor in revising any Controller abnormal situation assignments is the availability of one or more qualified individuals to assist with and support ongoing operations at the affected console. Personnel support options which could apply to a control room, depending upon its configuration and staffing, include the involvement of one or more of the following: a qualified shift supervisor; a qualified cross-trained Controller currently operating an adjacent console; a qualified Controller currently serving in a support role in the control room; a capable (but not fully qualified) Controller who would be supporting operations under the supervision of the responsible and qualified Controller; or transferring operations to field personnel. Operators with remote SCADA capability could involve assistance being provided by support personnel located outside of the control room. Key References: Moray, N. (2001). Humans and machines: Allocation of function. In J. Noys & M. Bransby (Eds.), People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers. Van Hiel, A., & Mervielde, I. (2007). The search for complex problem-solving strategies in the presence of stressors. Human Factors, 49, 1072-1082. Document Abnormal Situation Control Room Staff Roles and Responsibilities This mitigation is basically the formalization and documentation of any role and responsibility reassignments resulting from the implementation of the preceding mitigation. The topic of procedure design is generally addressed under Human Factors Topic 5.1. The focus of the current mitigation is on the formal documentation and formatting of these abnormal situation non-critical duty reassignments in operating procedures. Any revision of control room staff roles and responsibilities would likely be best implemented with control room training of the involved individuals (see Human Factors Topic 7.2, Emergency Response Training) – and preferably through team training if a team response is defined. Key References: None#

Attachment 1, passage 263Page G-42 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.3 Communications: Schedule Communications Definition This topic covers information in delivery schedules in addition to the process of communicating the schedules and any relevant changes in their content. Performance Factor List 3.3.1 Product delivery schedules are inaccurate. 3.3.2 Changes in product delivery schedules are not communicated to Controllers at all. 3.3.3 Changes in product delivery schedules are communicated to Controllers without sufficient lead time. Applicable Mitigation For Each Performance Factor 3.3.1 3.3.2 3.3.3 Minimize Unnecessary Manual Data Entry  — — Provide Computer-based Communications Tools —   Review and Revise Control Room Work Completion and Communication Protocols —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 264Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-43 Communications: Schedule Communications 3.3 Discussion Minimize Unnecessary Manual Data Entry This would involve automating schedule or log entries to reduce the opportunity that schedulers or Controllers have to make data entry errors. Although it is unlikely that manual data entry could be eliminated entirely, other automation features, such as verification logic (e.g., similar to line balancing) could be used to check for implausible values. Key References: Sharit, J. (2006). Human Error. In G. Salvendy (Ed). Handbook of Human Factors and Ergonomics. (p. 708-760). New Jersey: Wiley & Sons. Provide Computer-based Communications Tools This mitigation provides a means of both facilitating and tracking communications between schedulers and Controllers. In its simplest form, schedulers and Controllers could be encouraged to provide scheduling communications via e-mail. An intermediate level of implementation could involve a communications site that was dedicated to schedule communications. A more elaborate implementation could involve automated communications forms that required the entry of key delivery parameters (e.g., origin, destination, product volume, flow rate, scheduled start, scheduled stop, and operational considerations). Key References: None. Review and Revise Control Room Work Completion and Communication Protocols The intent of this mitigation is to establish and implement operational procedures and controls that will define and reinforce responsibility for delivery schedule work completion, as defined in control room duties and assignments. In this regard, a communications protocol could entail a practice as uncomplicated as the requirement for management notification following schedule completion; or involve more complex sign-off procedures to trigger management alerts when schedule deadlines are not met. Key References: Penington, J. (1992). A preliminary communications systems assessment. In B. Kirwan & L. Ainsworth (Eds.), A Guide to Task Analysis. London: Taylor & Francis.#

Attachment 1, passage 265Page G-44 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 3.4 Communications: Field Personnel Communications Definition This topic covers the procedures and equipment used in communicating with field personnel, in addition to how well appropriate information is communicated. Performance Factor List 3.4.1 Field technicians are not available to provide assistance with an operational issue when required (separated from control center staff). 3.4.2 Important field information (e.g., operational and maintenance activities) is not provided directly to Controllers in a timely manner. 3.4.3 Field personnel communicate incorrect information about equipment (e.g., pumps and valves) status to Controllers. 3.4.4 Field personnel do not fully communicate important ongoing operational conditions (e.g., pigging or repairs) to Controllers. 3.4.5 Controllers have difficulty communicating with field personnel due to a lack of available communications equipment. Applicable Mitigation For Each Performance Factor 3.4.1 3.4.2 3.4.3 3.4.4 3.4.5 Make Field Personnel Responsible for Maintain Current Contact Lists  — — — — Use Structured Forms or Communication Protocols for Communicating System/Equipment Status —   — Improve Communications Policies and Training —   — Improve Available Field Communications Equipment — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 266Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-45 Communications: Field Personnel Communications 3.4 Discussion Assign Field Personnel the Responsibility for Maintaining Current Contact Lists This involves field personnel being responsible for maintaining a list of available field personnel as required for each facility. This would include personnel to be contacted as back-up personnel and those to be identified as part of an escalation process,. This can save Controllers from having to spend time going through a list of contacts until they find one that is available to respond. It requires using a centralized list that can be accessed and updated by both Controllers and field technicians. Key References: None Use Structured Forms or Communication Protocols for Communicating System/Equipment Status This involves using established protocols or structured forms/checklists for communicating specific information about equipment or system status. It provides a script for efficiently going through relevant information, and importantly, helps ensure that all necessary information is covered. Key References: None Improve Communications Policies and Training This involves taking measures to improve communication among personnel. Operators should not assume that Controllers and other personnel have the necessary verbal and writing communication skills to adequately communicate without additional training and support. The primary way to improve operator-wide communication would involve training, in both general communication practices and situation-specific training (e.g., for shift hand-off or field communication). It could also involve giving greater weight to communication protocols and practice in operation policies. As in the case of shift hand-off practices, the communication process could be audited by reviewing the taped voices of the Controller and field operator or third party customer during a normal shift. The identification of deviations from established policy and practice could provide the basis for a subsequent Controller debriefing and the refinement of communications training plans. Key References: Larder, R. (1996). Effective shift handover – A literature review (Offshore Technology Report – OTO 96 003). Norwich, UK: Health and Safety Executive. Improve Available Field Communications Equipment There are a number of approaches that can be taken to improve field equipment communications, including the installation of a local radio frequency communications system, obtaining better cell phone coverage or reliability, and extending land line coverage. Key References: None#

Attachment 1, passage 267Page G-46 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 4.1 System Information Accuracy and Access: Operational Information Accuracy and Availability Definition This topic covers the level of accuracy and reliability of information that Controllers use to operate and monitor a pipeline system. Performance Factor List 4.1.1 SCADA data from field instruments (meters, gauges, etc) are inaccurate. 4.1.2 SCADA data are stale/out-of-date, or unavailable due to a communications problem (e.g., outage, time delay). 4.1.3 The SCADA display does not indicate that data are out-of-date or unavailable. 4.1.4 Changes in field system operational status (e.g., equipment identity or operational activities) are not adequately indicated in SCADA displays. 4.1.5 Displayed pipeline schematics or operational parameters (e.g., MOPs) are inaccurate. 4.1.6 Manually entered batch, log, and/or summary information is not accurate. 4.1.7 Required information is not available in the SCADA display. Applicable Mitigation For Each Performance Factor 4.1.1 4.1.2 4.1.3 4.1.4 4.1.5 4.1.6 4.1.7 Flag Inaccurate or Out-of-date Information    — — — — Coordinate Field Equipment Status Changes with SCADA — — —  — — — Conduct an Engineering Review — — — —  — — Minimize Unnecessary Manual Data Entry — — — — — — Conduct Task Analysis — — — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 268Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-47 System Information Accuracy and Access: Operational Information Accuracy and Availability 4.1 Discussion Flag Inaccurate or Out-of-date Information Data displayed by the SCADA should be validated and the system should provide a visual indicator if data are invalid or are not being updated at the specified refresh rate. Validation approaches include range checks for failed instruments, comparisons of redundant sensors, or analytical redundancy (inter-comparisons of measured variables using mathematical models; see API RP 1165 and NUREG-0700, 5.3-2). If data cannot be validated automatically by the SCADA, one option is to provide capabilities for Controllers to indicate or flag a data value as being inaccurate or stale directly in the SCADA display. One example is to provide a capability to manually activate a colored frame around a value that does not obscure any other information, but serves as a visual reminder that the data value is invalid. This would only be applicable if a small number of values are identified as being inaccurate, and manually confirmed as such. Having to mark a data value in this way should result in follow-up with SCADA engineers or other relevant field personnel to have the problem corrected as soon as possible with a maintenance tracking/reporting process in place. Key References: American Petroleum Institute. (2008). Recommended practice for pipeline SCADA displays (API RP 1165). Washington DC: API. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Coordinate Field Equipment Status Changes with SCADA This involves ensuring that there is a formal process in place, such as Management of Change (MOC) procedures, to update equipment status information in the SCADA. Responsibility for doing this should fall to field personnel and system personnel. If electronic equipment status logs are used, it may be useful to make this information available to SCADA engineers via the SCADA so that they can view an historical record of work done on certain equipment. Key References: None Conduct an Engineering Review This involves systematically comparing the representation and placement of equipment displayed in schematic-based SCADA displays with current system schematics (i.e., current P&ID’s). Functionally important relationships between equipment (e.g., whether a sensor is upstream or downstream of a valve) should be verified, and corresponding changes made to the SCADA if discrepancies are identified, documenting any changes via the established MOC procedures. Key References: None Minimize Unnecessary Manual Data Entry This would involve automating schedule or log entries to reduce the opportunity that schedulers or Controllers have to make data entry errors. Although it is unlikely that manual data entry could be eliminated entirely, other automation features, such as verification logic (e.g., similar to line balancing) could be used to check for implausible values. Key References: Sharit, J. (2006). Human Error. In G. Salvendy (Ed). Handbook of human factors and ergonomics (p. 708-760). New Jersey: Wiley & Sons.#

Attachment 1, passage 269Page G-48 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 4.1 System Information Accuracy and Access: Operational Information Accuracy and Availability Conduct Task Analysis This involves identifying all the key tasks that Controllers must perform to complete specific job functions (e.g., starting up a line, executing a batch switch, etc). These tasks are analyzed in terms of the component elements, including information acquisition activities, mental calculations, decisions, control actions, and so forth. This is a structured analysis--typically conducted by a human factors professional working with qualified operations personnel familiar with control room operations. The analysis examines task-specific scenarios to identify various requirements needed for Controllers to effectively conduct their work. Task analysis provides important information that can be incorporated into the design process. This includes information about what specific information Controllers need to assess a situation and make decisions, the number of steps required to complete tasks, the demands placed on the Controller, how work can be allocated among staff, etc. The results of a task analysis can then be used to design or modify the user interface so that certain objectives are met (e.g., ensuring that required information is available on a display; adding automation to reduce the number of control actions, etc). In the present context, task analysis could be conducted with a focus on the adequacy of information displays during normal and abnormal situations. Key References: Attwood, D.A., Deeb, J.M., & Danz-Reece, M.E., (2003). Ergonomic solutions for the process industries. Burlington, MA: Elsevier. Kirwan, B. & Ainsworth, L. (Eds.). (1992). A guide to task analysis. Bristol PA: Taylor & Francis. O’Hara, J., Higgins, J., Persensky, J., Lewis, P., & Bongarra, J. (2004). Human factors engineering program review model (NUREG-0711, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 270Page G-50 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.1 Job Procedures: Job Procedure Design Definition This topic covers the information presented in job procedures, in addition to how this information is presented and structured. Performance Factor List 5.1.1 When to use a procedure is not clearly defined. 5.1.2 Required technical detail is not provided by a procedure. 5.1.3 Procedures are difficult to read. 5.1.4 Critical information is difficult to find in a procedure. 5.1.5 Procedures do not meet the needs of both novice and experienced operators. 5.1.6 Procedures and job aids used in responding to abnormal situations are difficult to follow. Applicable Mitigation For Each Performance Factor 5.1.1 5.1.2 5.1.3 5.1.4 5.1.5 5.1.6 Conduct an Engineering Review —  — — — — Use a Procedure Style/Writing Guide —    —  Warning/Caution Call-outs — — —  — — Controller Involvement in Procedure Reviews —     Adjustable Level of Procedure Detail —  — — — Implement Systematic Human Factors Procedure Design Process —  — —   Ensure adequate selection and training of procedure writers        Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 271Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-51 Job Procedures: Job Procedure Design 5.1 Discussion Conduct an Engineering Review This involves a comprehensive review of all procedures, or a subset of critical procedures, by a team of reviewers (including Controllers) to verify that the technical information is valid, accurate, and reflects modifications in the pipeline system since the procedures were written. This can be an ongoing and systematic process and/or one that is also driven by Controller feedback (i.e., when they find or suspect potential inaccuracies). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Use a Procedure Style/Writing Guide This involves bringing procedures into compliance with a style/writing guide that provides explicit specifications for the format, content, and wording of all procedures. Existing procedure guides from the DOE provide concise procedure development, writing, and presentation guidelines that have been developed based by subject-matter experts input and the best available information. Key References: DOE-STD-1029-92. (1998) Writer’s guide for technical procedures. Washington, DC: US Department of Energy. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Warning/Caution Call-outs This involves displaying alert “boxes” or “callouts” immediately ahead of the appropriate step in a procedure that highlights critical information. The standard convention is to use a “Warning” for information that protects personnel from harm and “Caution” for information that protects equipment from harm. An example is shown below. … 8. Step 8 instructions  WARNING – Turning off equipment X without first doing Y can cause Z if… 9. Step 9 instructions about how to turn off equipment X. … Saliency coding is a similar approach, and involves using a color or other visual display property (e.g., bold font) to make critical information more noticeable. However it is important that the method used for making critical information more salient does not become distracting or degrade readability (e.g., flashing text). The method used should conform with adopted style guidelines. Key References: DOE-STD-1029-92. (1998) Writer’s guide for technical procedures. Washington, DC: US Department of Energy.#

Attachment 1, passage 272Page G-52 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.1 Job Procedures: Job Procedure Design Controller Involvement in Procedure Reviews This involves including Controllers in the procedure development and review process. In this way, procedures can be evaluated on key dimensions such as readability and clarity by the individuals that will be using them. Also, if these reviews are conducted in a constructive environment, it gives Controllers an opportunity to provide input on how certain tasks are conducted within the constraints of what Controller actually face during operations, which may be different than simplified or idealized conditions envisions during procedure development. Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Adjustable Level of Procedure Detail With computer-based procedures, it is possible to provide different levels of detail for operational tasks. This involves starting with global, overview information such as activity flow-charts and allowing end-users to increase the level of detail and specificity provided on subsequent sub-screens. This also allows Controllers to efficiently drill down to specific technical information (e.g., equipment operating parameters in different modes) while minimizing screen clutter. Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Implement Systematic Human Factors Procedure Design Process This is a comprehensive approach that incorporates human factors design principles into an integrated process for developing, implementing, validating, and continuously reviewing procedures. This approach may include an emphasis on any or all of the following considerations: - Human factors program management - Operating experience review - Functional analysis - Task analysis - Staffing review - Human reliability analysis - Human-system interface design - Procedure development - Training program development - Human factors verification and validation Two considerations that are particularly relevant to Performance Factor 5.1.2 are the Function analysis and Task analyses. These analyses are conducted to define roles and responsibilities and identify activities that Controllers must perform to accomplish operational objectives in addition to their information requirements. Key References: Marsden, P. (1996). Procedures in the nuclear industry. In N. Stanton (Ed.) Human factors in nuclear safety. London: Taylor & Francis. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 273Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page 53 Job Procedures: Job Procedure Design 5.1 Ensure adequate selection and training of procedure writers Each of the PFs in this HF topic could be helped by the proper selection of procedure writers and the proper training of writers on procedure guidelines, including training in the application of a procedure style/writing guide. Key References: None#

Attachment 1, passage 274Page G-54 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.2 Job Procedures: Job Procedure Availability Definition This topic covers the availability of job procedures and how easy it is to find specific procedures when they are needed. Performance Factor List 5.2.1 A specific required operations procedure is not available. 5.2.2 Finding an individual procedure among the large overall number of procedures is difficult. 5.2.3 Procedures and job aids required to identify and recover from abnormal situations are not readily available. Applicable Mitigation For Each Performance Factor 5.2.1 5.2.2 5.2.3 Conduct an Engineering Review  —  Use a Procedure Style/Writing Guide — — Context Sensitive Procedures —   Implement Computer-based Procedures —   Implement Systematic Human Factors Procedure Design Process  —  Specify Procedure Availability and Access     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 275Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-55 Job Procedures: Job Procedure Availability 5.2 Discussion Conduct an Engineering Review This involves a comprehensive review of all procedures, or a subset of critical procedures, by a team of reviewers (including Controllers) to verify that the technical information is valid, accurate, and reflects modifications in the pipeline system since the procedures were written. This can be an ongoing and systematic process and/or one that is also driven by Controller feedback (i.e., when they find or suspect potential inaccuracies). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Use a Procedure Style/Writing Guide This involves bringing procedures into compliance with a style/writing guide that provides explicit specifications for the format, content, and wording of all procedures. Existing procedure guides from the DOE provide concise procedure development, writing, and presentation guidelines that have been developed based by subject-matter experts input and the best available information. Key References: DOE-STD-1029-92. (1998) Writer’s guide for technical procedures. Washington, DC: US Department of Energy. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Context Sensitive Procedures This involves taking into account current system information/status in the display of operational procedures. In its simplest form it involves making procedure information available from SCADA schematic/or system displays. For example, this includes the option to display technical information or start/shut-down procedures by selecting that piece of equipment on the SCADA display. More sophisticated implementation can take into account operational status (e.g., displaying start-up procedures if equipment is shut down) or emergency status (e.g., displaying emergency procedures when operating parameters go out of normal range). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Implement Computer-based Procedures Computer-Based Procedures (CBPs) involve presenting procedure information in electronic format. A key advantage of CBPs is that it makes it easier to update and maintain a central set of procedures that can be accessed from multiple locations (both within and outside a control room). Moreover, there is existing software available to manage the procedure maintenance. Note, however, that Controllers perform differently when they are using CBP and Paper-Based Procedures (PBP), and each mode is associated with a separate set of usage problems, in addition to preference differences among Controllers (see NUREG/CR-6634). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 276Page G-56 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.2 Job Procedures: Job Procedure Availability Implement Systematic Human Factors Procedure Design Process This is a comprehensive approach that incorporates human factors design principles into an integrated process for developing, implementing, validating, and continuously reviewing procedures. This approach may include an emphasis on any or all of the following considerations: - Human factors program management - Operating experience review - Functional analysis - Task analysis - Staffing review - Human reliability analysis - Human-system interface design - Procedure development - Training program development - Human factors verification and validation Key References: Marsden, P. (1996). Procedures in the nuclear industry. In N. Stanton (Ed.) Human factors in nuclear safety, London: Taylor & Francis. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Specify Procedure Availability and Access Each of the required PFs in this HF topic could be helped by developing procedure policies under the Safety Management System that specify the required availability and access of all procedures. Key References: None#

Attachment 1, passage 277Page G-58 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.3 Job Procedures: Job Procedure Accuracy and Completeness Definition This topic covers the extent to which job procedures are accurate, up-to-date, and contain information that can be comprehended by Controllers. Performance Factor List 5.3.1 Procedures contain out-of-date or inaccurate information. 5.3.2 Procedure update notifications are not adequately provided to Controllers. 5.3.3 Controllers do not understand the documented procedure. 5.3.4 Controllers execute actions in a manner that is not consistent with established and documented procedures because the procedure is incorrect or incomplete. Applicable Mitigation For Each Performance Factor 5.3.1 5.3.2 5.3.3 5.3.4 Conduct an Engineering Review  — —  Use a Procedure Style/Writing Guide — — — Controller Involvement in Procedure Reviews — —   Implement Computer-based Procedures   — — Establish a Single Point of Contact to Manage Procedures and Manuals   — Implement Systematic Human Factors Procedure Design Process  —   Provide Procedure Writing Training  — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 278Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-59 Job Procedures: Job Procedure Accuracy and Completeness 5.3 Discussion Conduct an Engineering Review This involves a comprehensive review of all procedures, or a subset of critical procedures, by a team of reviewers (including Controllers) to verify that the technical information is valid, accurate, and reflects modifications in the pipeline system since the procedures were written. This can be an ongoing and systematic process and/or one that is also driven by Controller feedback (i.e., when they find or suspect potential inaccuracies). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Use a Procedure Style/Writing Guide This involves bringing procedures into compliance with a style/writing guide that provides explicit specifications for the format, content, and wording of all procedures. Existing procedure guides from the DOE provide concise procedure development, writing, and presentation guidelines that have been developed based by subject-matter experts input and the best available information. Key References: DOE-STD-1029-92. (1998) Writer’s guide for technical procedures. Washington, DC: US Department of Energy. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Controller Involvement in Procedure Reviews This involves including Controllers in the procedure development and review process. In this way, procedures can be evaluated on key dimensions such as readability and clarity by the individuals that will be using them. Also, if these reviews are conducted in a constructive environment, it gives Controllers an opportunity to provide input on how certain tasks are conducted within the constraints of what Controller actually face during operations, which may be different than simplified or idealized conditions envisions during procedure development. Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission. Implement Computer-based Procedures Computer-Based Procedures (CBPs) involve presenting procedure information in electronic format. A key advantage of CBPs is that it makes it easier to update and maintain a central set of procedures that can be accessed from multiple locations (both within and outside a control room). Moreover, there is existing software available to manage the procedure maintenance. Note, however, that Controllers perform differently when they are using CBP and Paper-Based Procedures (PBP), and each mode is associated with a separate set of usage problems, in addition to preference differences among Controllers (see NUREG/CR-6634). Key References: O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 279Page G-60 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 5.3 Job Procedures: Job Procedure Accuracy and Completeness Establish a Single Point of Contact to Manage Procedures and Manuals This involves establishing a policy and corresponding operational procedures to establish and maintain a single procedures and manuals point of contact. Responsibilities that could be assigned to this position include: - Establishing and maintaining a process to report and address any problems encountered in procedures and manuals - Serve as the quality control reviewer of all procedure and manual changes - Implement all procedure and manual changes - Provide and verify acknowledgement of all change notifications - Manage all procedure and manual files and records - Ensure regulatory compliance of all procedures and manuals Key References: None Implement Systematic Human Factors Procedure Design Process This is a comprehensive approach that incorporates human factors design principles into an integrated process for developing, implementing, validating, and continuously reviewing procedures. This approach may include an emphasis on any or all of the following considerations: - Human factors program management - Operating experience review - Functional analysis - Task analysis - Staffing review - Human reliability analysis - Human-system interface design - Procedure development - Training program development - Human factors verification and validation Key References: Marsden, P. (1996). Procedures in the nuclear industry. In N. Stanton (Ed.) Human factors in nuclear safety, London: Taylor & Francis. O’Hara, J.M., Higgins, J.C., Stubler, W.F., & Kramer, J. (2002). Computer-based procedure systems: Technical basis and human factors review guidance (NUREG/CR-6634). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 280Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-61 Job Procedures: Job Procedure Accuracy and Completeness 5.3 Provide Procedure Writing Training Technical staff who are assigned procedures and manuals writing responsibilities should have the basic skills, knowledge, and reference materials to perform their assignment effectively. Procedure writing training courses are available from process control consulting firms, technical communications consulting firms, and many community colleges, colleges, and universities. Basic training topics may include task analysis and design, identifying when procedures are required, the step-by-step procedure writing process, alternative procedure layouts and formats, procedure assessment and refinement, and regulatory compliance issues. Key References: None#

Attachment 1, passage 281Page G-62 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.1 Alarm Presentation and Management: Alarm Availability and Accuracy Definition This topic covers the degree to which SCADA alarms are appropriately triggered following system events that Controllers need to know about. Performance Factor List 6.1.1 No alarm is available to notify the Controller about important current operational status information (e.g., pressure or batch interface at a specific point in the line). 6.1.2 Alarms do not provide the Controller with sufficient lead time to take corrective actions (i.e., because of sensor location). 6.1.3 Changes in operating conditions triggered by external events that are outside of Controllers’ influence (e.g., equipment failure or maintenance on a feeder system) are not displayed on the SCADA. Applicable Mitigation For Each Performance Factor 6.1.1 6.1.2 6.1.3 Develop an Alarm Philosophy Document   Conduct an Alarm Engineering Review     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 282Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-63 Alarm Presentation and Management: Alarm Availability and Accuracy 6.1 Discussion Develop an Alarm Philosophy Document This involves developing a comprehensive Alarm Philosophy Document that should pertain to all aspects of an operator’s alarm system design, implementation, and maintenance. According to Hollifield & Habibi (2007), “the goal of the Alarm Management Philosophy document is to provide best practice guidelines for the definition, design, reengineering, implementation, and ongoing maintenance of the alarm management system.” The scope of the Alarm Philosophy Document should be comprehensive, and should specifically cover (see Hollifield & Habibi, 2007): - Alarm selection - Priority determination - Alarm configuration - Alarm handling methods - Alarm system performance monitoring - Nuisance alarm resolution - Alarm detection, presentation, and annunciation - Operator interface for alarms - Operator response to alarms - Alarm system management of change Hollifield and Habibi (2007) provide further discussion related to the development of an Alarm Philosophy Document, in addition to providing an outline of an example alarm philosophy in their Appendix 2. Note that this is a high-level mitigation that has aspects that could affect all of the Human Factors Topics related to Alarm Presentation and Management. Key References: Hollifield, B. & Habibi, E. (2006) The alarm management handbook. Houston, TX: PAS.#

Attachment 1, passage 283Page G-64 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.1 Alarm Presentation and Management: Alarm Availability and Accuracy Conduct an Alarm Engineering Review This involves conducting a review of the conditions that trigger alarms and associated alarm timing to determine if they are adequate to support Controller operations. NUREG-0700 standards provide applicable recommendations for when alarms should be provided and how alarm timing should be implemented. Suggested criteria for selecting alarm conditions from this document include: - Monitoring critical safety functions and key parameters, - Preventing personnel hazards, - Avoiding significant damage to equipment having a safety function, - Assuring that technical specifications are met - Monitoring emergency procedure decision points, and - Monitoring pipeline conditions appropriate to pipeline operations from start-up through shut-down. NUREG-0700 also recommends that set points be determined to ensure that Controllers can “monitor and take appropriate action for each category of alarms, e.g., respond to out-of-tolerance conditions in a timely manner.” This guidance would have to be modified so that it is consistent with operating practices in the pipeline industry, however, this standard still provides a useful starting point. Another valuable source that provides more implementation-specific information is the Alarm Management Handbook, which covers some of these activities as part of the alarm rationalization and documentation review (see 6.5; Hollifield & Habibi, 2006). It might also be useful to include information from a task analysis of Controller’s operational requirements when running a specific line or line segment. This would essentially involve identifying the information that is needed by Controllers to safely operate and monitor a line, specifically with regard to the information provided by various system sensors that trigger alarms. The objective should be to ensure or confirm that the alarm system is set up to provide all the information that Controllers need and that it is presented with sufficient time for them to take necessary actions. Continuous improvement activities that could support ongoing engineering review activities could include a procedure to obtain Controller input regarding required alarms, establishing and maintaining standards for PLC applications, and incorporating alarm availability and accuracy into a near-accident and loss investigation and analysis process (see the discussion under General Guidance in Applying this Guide. Key References: Engineering Equipment & Materials Users’ Association (EEMUA). (2007). EEMUA Publication No. 191 Alarm systems – A guide to design, management and procurement. London: Author. Hollifield, B. & Habibi, E. (2006) The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 284Page G-66 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.2 Alarm Presentation and Management: Alarm Displays and Presentation Definition This topic covers the how alarm messages look and sound to Controllers when presented, in addition to their overall layout and organization in the SCADA display. Performance Factor List 6.2.1 Alarm displays become too cluttered making it difficult to identify important alarms. 6.2.2 The alarm display shows alarms from another console and Controllers have difficulty finding the alarms for their console . 6.2.3 High-priority alarms are ineffective in attracting a Controller’s attention when performing other activities. 6.2.4 The sound or loudness of critical alarms startles Controllers unnecessarily. 6.2.5 The sound of an alarm does not clearly indicate the intended alarm priority. 6.2.6 The color of an alarm does not clearly indicate the intended alarm priority. Applicable Mitigation For Each Performance Factor 6.2.1 6.2.2 6.2.3 6.2.4 6.2.5 6.2.6 User Interface Design Review       Alarm Prioritization    — — — Reduce Number of Alarms   — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 285Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-67 Alarm Presentation and Management: Alarm Displays and Presentation 6.2 Discussion User Interface Design Review All of the Performance Factors identified under this topic are related to problems with alarm presentation or annunciation. There are many existing guidelines, standards, and references that provided information about recommended practices for designing and implementing various aspects of visual and auditory displays. These cover issues such as - Spatial layout of a the display - Use of colors for meeting different objectives (e.g., visibility, attention-getting, conveying priority, visibility by those with color blindness, etc) - Use of sounds for meeting different objectives (e.g., attention-getting, conveying priority, audibility by those with hearing loss caused by different factors, such as ageing, etc) The first part of a user interface design review would involve evaluating the current alarm visual and auditory properties to determine whether or not they are within recommended values. The API RP 1165 provides recommendations for the design of alarm systems. If values outside of recommended ranges are found, the next step would be to investigate the feasibility of implementing visual and auditory display changes that better conform to recommended values. Note that changes, especially to the visual display, will likely have implications for other aspects of the SCADA display, and tradeoffs may have to be evaluated (e.g., using a recommended color in an alarm display, may be inconsistent with how that color is used elsewhere). Key References: Bransby, M. (2001). Design of alarm systems. In J. Noys & M. Bransby (Eds.). People in control: Human factors in control room design (pp. 207- 222). London: The Institution of Electrical Engineers. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Alarm Prioritization Prioritization involves categorizing different alarms based on their importance and using different visual and auditory display properties (e.g., color, capitalization, etc.) to indicate the priority level. This approach provides a quick way for Controllers to identify and focus on the most important alarm messages. A common category scheme is to use high, medium, and low level categories, with high priority alarms shown in the most visually salient display characteristics and accompanied by an attention-getting alarm sound. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. National Transportation Safety Board. (2005). Supervisory Control and Data Acquisition (SCADA) in liquid pipelines. Washington DC: Author.#

Attachment 1, passage 286Page G-68 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.2 Alarm Presentation and Management: Alarm Displays and Presentation Reduce Number of Alarms Alarm display clutter can be addressed by reducing the number of alarms presented in the display. Applicable approaches are covered in greater detail in the alarm review mitigation strategy discussed in topic 6.5. The general approach involves establishing an organizational alarm philosophy, and then implementing that philosophy in a sound alarm management program. Some key individual strategies for reducing alarms include: - Reduce the alarms from adjacent consoles (e.g., eliminate altogether, or only present highest-priority alarms) - Reduce the overall number of alarms displayed (See Alarm Rationalization and Documentation in 6.5) - Group alarms that are functionally related (e.g., equipment status alarms) However, there are practical limits to this approach because alarms provide key information for developing awareness of what is going on in the pipeline system, in addition to providing specific operational information. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 287Page G-70 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.3 Alarm Presentation and Management: Alarm Interpretation Definition This topic covers issues related to obtaining, viewing, and interpreting operational and system information provided to Controllers by alarms or the SCADA alarm display. Performance Factor List 6.3.1 The displayed alarm description is difficult to interpret. 6.3.2 There are multiple causes for some alarms, but insufficient information is provided to identify the actual cause. 6.3.3 Alarm summary information does not provide adequate information about conditions at the time that the alarm was triggered. 6.3.4 Alarms are not displayed in a consistent format, making their interpretation difficult. 6.3.5 It is difficult to determine the intended priority of an alarm. Applicable Mitigation For Each Performance Factor 6.3.1 6.3.2 6.3.3 6.3.4 6.3.5 Alarm Description Review    — — User Interface Design Review — — —   Alarm Prioritization — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 288Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-71 Alarm Presentation and Management: Alarm Interpretation 6.3 Discussion Alarm Description Review This involves identifying specific problematic alarm descriptions or types of alarms and forming an Alarm Description Review group to evaluate and suggest changes to alarm descriptions. The review group should consist of multiple Controllers; however, other groups also affected by potential changes should be included (e.g., SCADA engineering and field technicians). The objective should be to identify Controllers’ alarm information requirements, including both (1) specific information to identify an alarm (or related group of alarms), and (2) information about the underlying conditions. Key References: None Interface Design Review All of the Performance Factors identified under this topic are related to problems with alarm presentation or annunciation. There are many existing guidelines, standards, and references that provided information about recommended practices for designing and implementing various aspects of visual and auditory displays. These cover issues such as - Spatial layout of a the display - Use of colors for meeting different objectives (e.g., visibility, attention-getting, conveying priority, visibility by those with color blindness, etc) - Use of sounds for meeting different objectives (e.g., attention-getting, conveying priority, audibility by those with hearing loss caused by different factors, such as ageing, etc) The first part of a user interface design review would involve evaluating the current alarm visual and auditory properties to determine whether or not they are within recommended values. The API RP 1165 provides recommendations for the design of alarm systems. If values outside of recommended ranges are found, the next step would be to investigate the feasibility of implementing visual and auditory display changes that better conform to recommended values. Note that changes, especially to the visual display, will likely have implications for other aspects of the SCADA display, and tradeoffs may have to be evaluated (e.g., using a recommended color in an alarm display, may be inconsistent with how that color is used elsewhere). Key References: Bransby, M. (2001). Design of alarm systems. In J. Noys & M. Bransby (Eds.). People in control: Human factors in control room design (pp. 207- 222). London: The Institution of Electrical Engineers. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 289Page G-72 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.3 Alarm Presentation and Management: Alarm Interpretation Alarm Prioritization Prioritization involves categorizing different alarms based on their importance and using different visual and auditory display properties (e.g., color, capitalization, etc) to indicate the priority level. This approach provides a quick way for Controllers to identify and focus on the most important alarm messages. A common category scheme is to use high, medium, and low level categories, with high priority alarms shown in the most visually salient display characteristics and accompanied by an attention-getting alarm sound. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. National Transportation Safety Board. (2005). Supervisory Control and Data Acquisition (SCADA) in liquid pipelines. Washington DC: Author.#

Attachment 1, passage 290Page G-74 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.4 Alarm Presentation and Management: Alarm Access and Acknowledgment Definition This topic covers the processes for accessing and acknowledging active or previously acknowledged alarms in the SCADA. Note that some or all of the suggested mitigations may not be feasible based on SCADA functionality. Performance Factor List 6.4.1 The process of clearing alarms interferes with monitoring and control operations. 6.4.2 Controllers unintentionally clear important alarms when there are too many alarms that need to be cleared. 6.4.3 It is difficult to sort alarms by priority, time of occurrence, or other useful dimensions. 6.4.4 Previously acknowledged alarms are not immediately available (i.e., it takes two or more steps, screen, or keystrokes to access previously acknowledged alarms). 6.4.5 Controllers accidentally acknowledge or clear alarms for an adjacent console. Applicable Mitigation For Each Performance Factor 6.4.1 6.4.2 6.4.3 6.4.4 6.4.5 Provide a Function to Acknowledge Multiple Low-priority Alarms that Provide Redundant Information  — — — — Use a Different Process/Dialog Box to Acknowledge Important Alarms —  — — — Provide Functions to Temporarily Sort Alarms by Information Field — —  — — Provide Quick Access to Acknowledged Alarms from the Main Alarm Display — — —   Limit a Controller’s Ability to Acknowledge Alarms on Other Consoles — — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 291Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-75 Alarm Presentation and Management: Alarm Access and Acknowledgment 6.4 Discussion Provide a Function to Acknowledge Multiple Low-priority Alarms that Provide Redundant Information This involves implementing a function on the primary alarm display to reduce the control actions required to acknowledge low-priority alarms that provide the same information, (e.g., the same low-priority alarm appearing multiple times because it occurs repeatedly over time). One way to do this would be to provide an option in the alarm display to “batch clear” all redundant instances of certain alarm information. Note that it is important that this functionality should not be provided for critical alarms or alarms providing necessary information in order to avoid accidental clearing of key alarms. Also, this approach should not be used if Controllers do not have easy access to a display showing previously-acknowledged alarms. This mitigation assumes a vigorous program for establishing low- priority alarms. Key References: None Use a Different Process/Dialog Box to Acknowledge Important Alarms This involves implementing a process that is notably different for acknowledging important alarms than other alarms. This can take the form of a dialog box with different visual properties, (e.g., different color, box size, or with a sound notification), or an additional confirmation step in the acknowledgment sequence. The overall strategy is to make the process of acknowledging important alarms sufficiently different from other alarms so that Controllers will be less likely to accidently acknowledge an important alarm if they are rapidly acknowledging many alarms in a short period of time. Key References: None Provide Functions to Temporarily Sort Alarms by Information Field This involves implementing sort capabilities into the primary alarm display. It should be noted that O’Hara et al. (2002) recommend that alarms be logically ordered in a way that facilitates understanding of the cause of the alarms (e.g., temporal or spatial organization); however, sorting capabilities can make it easier for Controllers to find specific alarms under some conditions. Sorting capabilities should function like sorting capabilities found in common software (e.g., clicking on the field header sorts by that field; Galitz 2002). Also, providing visual indicators that the alarm display is in a sorted state (e.g., by changing the font type) would help reduce the chance that Controllers could confuse the sorted display with the normal display. Accordingly there should also be an easy method for canceling the sort (e.g., cancel button), or cancelling should occur automatically after a brief time period to restore the original alarm display order. Key References: Galitz, W.O. (2002). The essential guide to user interface design: An introduction to GUI design principles and techniques. New York: John Wiley & Sons, Inc. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 292Page G-76 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.4 Alarm Presentation and Management: Alarm Access and Acknowledgment Provide Quick Access to Acknowledged Alarms from the Main Alarm Display This involves 1) providing a dedicated display that shows previously acknowledged alarms, and 2) providing a software control (e.g., button) on the main alarm display that Controllers can activate if they need to quickly access previously acknowledged alarms and active alarm details. This control should be in a dedicated location on the main alarm screen and always be visible unless there are important reasons for not displaying it (e.g., it would require removing more important controls from the display). Activation of this control could either bring up the acknowledged-alarms display, or a confirmation dialog box, if accidental navigation from the main alarm display is a concern. Key References: None Limit a Controller’s Ability to Acknowledge Alarms on Other Consoles The basic approach to this mitigation is to prevent Controllers from acknowledging alarms displayed on other consoles under most circumstances. (There may be exceptions to this, such as if a Controller is qualified to operate the other console, and is covering for the other Controller). Since alarms from other consoles will clutter their own alarm displays and make it more difficult to find important alarms, the ability to acknowledge other-console alarms can reduce clutter. One way to accomplish this is to provide the ability for Controllers to acknowledge these alarms originating from their own alarm displays, but decoupling this acknowledgment from other consoles so that the alarms remain visible on other consoles. If it is necessary to allow a Controller to acknowledge alarms from other consoles’ displays (e.g., to reduce the workload of another Controller), then a special confirmation process (e.g., a confirmation dialog) should be implemented to minimize the chance that alarms are accidentally acknowledged. Moreover, either protocols or automatic notifications should be used to ensure that Controller for the console that is having its alarms cleared understands that this is occurring. Key References: None#

Attachment 1, passage 293Page G-78 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.5 Alarm Presentation and Management: Nuisance Alarms Definition This topic covers the “nuisance” alarms that occur during normal operations, yet have little or no informational value with regard to pipeline control and monitoring, but impact Controller performance in some way (i.e., by requiring Controllers to acknowledge nuisance alarms, adding display clutter, or providing a distraction in some way, etc.) Performance Factor List 6.5.1 The number of nuisance alarms limits the ability to quickly identify potentially important alarms. 6.5.2 Monitoring and control operations are disrupted by a flood of alarms (e.g., triggered by conditions such as communications loss or equipment start-up). 6.5.3 Monitoring and control operations are disrupted by unnecessary information, alarms, or notifications coming into the alarm screen that are not required for operations (e.g., “action started” or “action completed”). 6.5.4 Too many nuisance alarms are caused by equipment that is waiting to be fixed. 6.5.5 Some alarms classified as critical do not represent true critical situations. Applicable Mitigation For Each Performance Factor 6.5.1 6.5.2 6.5.3 6.5.4 6.5.5 Alarm Documentation and Rationalization Review      Alarm Redefinition    —  Alarm Grouping    — — Alarm Limit Modification  — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 294Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-79 Alarm Presentation and Management: Nuisance Alarms 6.5 Discussion Alarm Documentation and Rationalization Review An alarm documentation and rationalization review is a systematic and logical process for determining, prioritizing, and documenting alarms. It essentially involves taking a closer look at all or some subset of alarms and identifying alarms that can be modified so that they are more useful or less of a nuisance, based on predefined criteria. It typically involves a working group that includes management, Controllers, and engineering personnel. Information about alarm activity is typically tracked in advance, and system performance objects are developed based on previous performance. The Alarm Management Handbook (Hollifield & Habibi, 2007) provides a list of uses for this process, including: - To configure the correct alarms on an existing system, which typically leads to a fewer number of configured alarms - To correct a mis-configured system for performance improvement - To initially determine the proper alarm configuration on a new system - To ensure consistency in alarm settings - To eliminate duplicate alarms - To ensure proper and meaningful priority and trip-point settings - To configure alarms on points added or modified by projects or as needed based on operational changes - To provided detailed alarm information for use by the operators - In conjunction with Process Hazard Analysis, Safety Interlock Level revalidation, or Layer of Protection Analysis, if alarms are specified - To create proper configuration on nuisance alarms as they are identified - To create the Master Alarm Database, used as a reference for State-Based alarm management, flood suppression, and audit/enforcement mechanisms Alarm reviews can be led by a consultant or management, but Controllers need to be involved in the process to provide their feedback about the importance and impact of various alarms. System performance engineers should also be involved if alarms bands will be modified. The Alarm Management Handbook (Hollifield & Habibi, 2007) provides an outline of the basic approach for conducting an alarm documentation and rationalization review. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive. Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS. Alarm Redefinition This mitigation is conducted to eliminate alarm messages for events that, based on closer examination, should not be alarms. This can be done as part of an alarm documentation and rationalization review (see previous mitigation). An example of the type of information that is sometimes presented on the Controller’s alarm display that can usually be eliminated includes changes in equipment or system status that do not impact operations and monitoring, and which may be presented as alarms only to produce an historical log of status changes. In this case, a separate log or display can be created for these types of messages to keep them separate from actual alarms. Key References: Hollifield, B. & Habibi, E. (2006). The alarm management handbook. Houston, TX: PAS.#

Attachment 1, passage 295Page G-80 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 6.5 Alarm Presentation and Management: Nuisance Alarms Alarm Grouping This involves using a single alarm that serves as an “umbrella” alarm for a set of related alarms tied to the same piece of equipment or common initiating cause. Grouping is particularly useful for presenting information about change in status (e.g., pump 25% open, pump 50% open, etc), and for providing an easily accessible summary of the event history. These alarms are typically reactivated and require re-acknowledgement when additional sub-alarm events occur. These alarms should be displayed in a manner so that they can be expanded to show all of the individual alarms within the group if the Controller needs more specific information about a specific event or message. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive. Alarm Limit Modification This involves modifying the alarm triggering limits to reduce the occurrence of situations in which system operating parameters exceed alarm-trigger levels, but the system operational conditions are still considered within normal or acceptable ranges. Specific strategies include - Tuning of limits, which involves reviewing the value of alarm limits to ensure that they are set at values which properly take into account normal variations in the process signal and the hazard that the alarm is preventing. - Deviation alarms, which can be used for some signals under automatic control that have a set point or set operating range. This can reduce alarms when the set point is set differently from its normal value and when the absolute value limits are occasionally transiently exceeded. - Adjustable limits, which typically involve setting temporary alarm limits that are tuned to accommodate different operational modes (e.g., transport of different types of products). - Alarm suppression. Alarm logic can be developed to suppress alarms under certain conditions. For example, when a pump is shut down, there is no need for a low pressure or a low flow alarm. Key References: Bransby, M. L., & Jenkins, J. (1998). The management of alarm systems (Report No. CRR 166). Norwich, UK: Health & Safety Executive.#

Attachment 1, passage 296Page G-82 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 7.1 Controller Training: Pipeline Fundamentals Knowledge and Field Exposure Definition This topic covers the effect of a broad range of Controller normal operations training, knowledge, and field exposure on pipeline monitoring and control performance. Many of the Performance Factors listed below have the potential to negatively affect a broad range of monitoring and control activities. Performance Factor List 7.1.1 Controller training does not adequately prepare Controllers to respond to all the situations that they are likely to encounter. 7.1.2 Controller on-the-job training does not provide the optimal assignment of mentor(s) to ensure exposure to a sufficient range of expertise and good operating practices. 7.1.3 Controllers are not provided adequate training about hydraulics. 7.1.4 Controllers are not provided adequate training on field operations and field systems. 7.1.5 Controllers are not adequately trained on specific console operations prior to working alone. 7.1.6 Controllers are not provided refresher training frequently enough. 7.1.7 Controllers are not provided adequate training before the introduction of a new pipeline. 7.1.8 Controllers are not provided adequate training on a specific operational procedure, product, or tool before it is introduced into operation. Applicable Mitigation For Each Performance Factor 7.1.1 7.1.2 7.1.3 7.1.4 7.1.5 7.1.6 7.1.7 7.1.8 Improve Controller Normal Operations Training — —   — — — Improve the On-the-Job Training Program  —   — —  Provide Special Topics Training     — — — — Improve New Procedure/Equipment Introduction Training — — — — — —   Improve Controller KSA Assessment —       Improve Controller Abnormal Situations Training — — —   — — Improve Simulator Training — — — —  — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 297Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Controller Training: Pipeline Fundamentals Knowledge and Field Exposure Page G-83 7.1 Discussion Improve Controller Normal Operations Training Improving Controller normal operations training is a very broad mitigation that is only limited in scope by the inclusion of other specific training mitigation topics in this area. The basic emphasis of this mitigation is on the systematic development of training that is consistent with Government regulations and practice (e.g., the PHMSA Operator Qualifications Program requirements), widely accepted organizational training systems (c.f. Goldstein & Ford, 2002), and specific process control industry guidance and practice, which is perhaps best represented by NRC Guidance (NRC, 1993) and the PHMSA Operator Qualifications review materials (PHMSAForm-14, Rev 5, March 2007; and PHMSAForm-15, Rev 3, March 2007). At a very general level, most current authoritative training system guidance identifies some configuration of the following key components of a successful training program. Salas and Cannon-Bowers (2001) provide a useful critical review of the current status of the science of training. Organizational Analysis addresses the availability and requirements for organizational support of a training program; as well as the organizational objectives that are supported by training, as discussed in depth by Goldstein and Ford (2002). Job and Task Analysis is conducted to define the KSAs that are required for successful job and task performance. Such analyses traditionally employ a behavioral perspective, focusing on the job encumbent’s performance. However, recent efforts directed at better understanding job encumbents’ decision-making processes and requirements employ cognitive task analysis (Schraagen, Chipman, & Shalin, 2000) in defining the appropriate learning requirements and activities from a psychological perspective. Training Design encompasses the activities involved in establishing the training environment, selecting and designing the method and mode of instructional delivery, and applying specific learning approaches in the design of the set of training activities that will comprise a training module, course, or curriculum. Training Implementation addresses the implementation of the training design and its delivery. Key factors include instructor/mentor selection and preparation, and training monitoring and quality control mechanisms. Training Evaluation and Validation addresses the extent that the organizational and training objectives are achieved by the implemented training, as well as the extent that specific training methods can be shown to contribute to meeting those objectives. This topic is closely aligned with Controller KSA Assessment, which is addressed as a separate mitigation in the document. Key References: Goldstein, I. & Ford, J. (2002). Training in organizations: Needs assessment, development, and evaluation. Belmont, CA: Wadsworth Group. Pipeline and Hazardous Materials Administration. (2007) PHMSAForm-14, Rev 5, March 2007; and PHMSAForm-15, Rev 3, March 2007. U.S. Nuclear Regulatory Commission (1993). Training review criteria and procedures (NUREG-1220, Rev. 1). Washington, DC: Author. Salas, E. & Cannon-Bowers, J. (2001). The science of training: A decade of progress. Annual Review of Psychology, 52, 471-498. Schaagen, J., Chipman, S., & Shalin, V., Eds. (2000). Cognitive task analysis. Mahwah, NJ: Erlbaum.#

Attachment 1, passage 298Page G-84 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 7.1 Controller Training: Pipeline Fundamentals Knowledge and Field Exposure Improve the On-the-Job Training Program On-the-job training (OJT) represents a one of several training delivery methods; but one that is historically wide-spread and popular in the pipeline industry. In the OQ environment, OJT involves assigning trainees to a console and one or more qualified Controller mentors. The trainee first observes operations and then works under very close supervision until the trainee has successfully completed their certification assessment and is legally qualified to operate the console without direct supervision. Goldstein and Ford point-out some potential advantages of OJT over other types of training, including direct transfer of learned behavior to the actual work equipment and setting and the opportunity for the trainee to receive immediate feedback on the effectiveness of job behaviors. However, OJT requires careful definition of learning objectives and activities, as well as the careful selection and training of OJT supervisors to ensure that it is implemented in a successful and cost-effective manner. The Nuclear Regulatory Commission (1993) provides a useful checklist for reviewing and assessing the quality and value of an OJT session. Key References: Goldstein, I. & Ford, J. (2002). Training in organizations: Needs assessment, development, and evaluation. Belmont, CA: Wadsworth Group. U.S. Nuclear Regulatory Commission (1993). Training review criteria and procedures (NUREG-1220, Rev. 1). Washington, DC: Author. Provide Special Topics Training This mitigation specifically addresses concerns raised by a subset of liquid pipeline Controllers during the research stages of this project. During interviews, a number of Controllers indicated that they had not received sufficient training in hydraulics, field operations procedures, or field systems layout. A commonly-held view among Controllers is that training in these ‘special topics’ provides them with a more complete understanding of operations; thereby better preparing them to understand and respond appropriately to abnormal conditions that are associated with such topics. The diagnosis of abnormal conditions is commonly seen as representing knowledge-based performance (versus skill- or rule- based performance). There is considerable general research evidence that expert problem solving is facilitated by both deeper and more complex knowledge of the system and its underlying operation (c.f., Reason, 1990, Chapter 3). Such an expert knowledge base is developed through exposure to the underlying physics of a system (e.g., hydraulics) and specific operational details (e.g., field operations and field systems). One common practice for field operations and layout training is to have Controller trainees without specific experience in the field operations that will be under their perview is to have them spend some supervised time in those field locations. Key References: Reason, J. (1990) Human error. Cambridge, UK: Cambridge University Press. Improve New Procedure/Equipment Introduction Training PHMSA OQ Inspecition Form 14 provides the following guidance regarding the management of changes to procedures, tools, standards, and related operational factors. The rule requires that the operator communicate changes that affect covered tasks to individuals performing those covered tasks. In order to perform this effectively, the operator must have a change management methodology so that it knows when changes are occurring, what changes have an impact on covered task performance, the relative significance of the change and how it affects the continued qualification of individuals, and mechanisms to effectively communicate changes to qualified individuals.(p. 17) Key References: Pipeline and Hazardous Materials Administration. (2007). PHMSAForm-14, Rev 5, March 2007.#

Attachment 1, passage 299Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Controller Training: Pipeline Fundamentals Knowledge and Field Exposure Page G-85 7.1 Improve Controller KSA Assessment Wright, Turner, and Hornbury (2003) provide a relatively comprehensive summary of competence assessment methods that have applicability to pipeline monitoring and control. PHMSA Form 14 (Rev. 5) includes review criteria for evaluation methods. The guidance provided in this form identifies the following factors as important in determining whether the basic requirements for Controller performance assessment meet the requirements of the Operator Qualifications rule. 1. 2. 3. 4. 5. The evaluation methods used are derived from the requirements of the covered tasks, and consider any unique needs (e.g., the inability to read) of the individuals being evaluated. Evaluation methods are consistently applied across the operator’s organization such that all individuals performing the same covered task are evaluated using consistent methods. Evaluation methods include the evaluation of an individual’s KSAs to ensure that the individual can perform the assigned covered tasks. Evaluations consisting of observations of on-the-job performance are limited to tasks where justification for employing this method has been established by the operator. The written program should specify the certifications that are accepted for performance of covered tasks (by company and contract individuals) and specific re-evaluation intervals that are associated with the certifications. In addition to the above requirements, PHMSA Form 14 (Rev.5) also specifically addresses the need to establish appropriate reevaluation intervals, taking into account regulatory practice and/or performance history for similar tasks; the need for task-specific reevaluation intervals; and the consideration of task complexity, criticality, and frequency of performance. Key References: Pipeline and Hazardous Materials Administration. (2007). PHMSAForm-14, Rev 5, March 2007. Wright, M., Turner, D, & Horbury, H. (2003). Competence assessment for the hazardous industries. Norwich, UK: HSE Books. Improve Controller Abnormal Situations Training Controller training under abnormal operating conditions represents a critical consideration in process control industries. Schaafstal, et al. (2000) report on the value of troubleshooting training that met their requirements of a ‘structured troubleshooting’ approach, which consists of: (a) a system-independent troubleshooting strategy that provides a standard approach that can be applied across systems; (b) providing functional models of the systems involved; and (c) providing the underlying system-specific domain knowledge corresponding to the systems involved. Another abnormal situations training approach that has received research support as a generally effective strategy for training emergency response skills is team coordination training for those conditions when emergency procedures call for the involvement of more than one control room member (Salas & Cannon-Bowers, 2001). Finally, because much of the content of abnormal situations training addresses KSAs that are seldom exercised by Controllers, it is reasonable to expect that skills and knowledge will decay without periodic refresher training. Therefore, an additional important aspect of abnormal situations training is the determination of the interval between training. Key References: Salas, E. & Cannon-Bowers, J. (2001). The science of training: A decade of progress. Annual Review of Psychology, 52, 471-498. Schaafstal, A, Schraagen, J M., & van Berlo, M. (2000). Cognitive task analysis and innovation of training: The case of structured troubleshooting. Human Factors, 42, 75-86.#

Attachment 1, passage 300Page G-86 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 7.1 Controller Training: Pipeline Fundamentals Knowledge and Field Exposure Improve Simulator Training Simulator training applications are not limited to abnormal operating condition training. Indeed, a substantial level of both military and commercial aircrew training for normal operations is now conducted using simulators. However, in many process control industries, the opportunity of presenting infrequent (or even never-before-encountered) conditions through simulation tend to result in a focus on abnormal operating condition training. With the introduction of the Operator Qualification rule, pipeline operators are required to demonstrate Controller qualifications under abnormal conditions. A number of operators have addressed this requirement through the development of simulator training (Wike, Hall, Miller, & Hays, 2002). These industry representatives reviewed the applications and effectiveness of simulators with various levels of pipeline system and SCADA interface fidelity. All authors noted the substantial challenges in the development, installation, and maintenance of simulators with high levels of system and SCADA interface fidelity. With respect to fidelity, most training researchers argue that psychological fidelity, which translates into the representation of conditions that require accurate replication of task behaviors, is the most critical characteristic (Salas & Cannon-Bowers, 2001). Thus, task requirements-based selection of simulation characteristics has been proposed as the best approach in selecting simulator fidelity levels (Folkes, Dwyer, Oser, & Salas, 1998). Reason (1990) serves as a valuable skeptic in asking whether or not simulators are effective in training abnormal response skills that will be valuable in the actual operating environment. His primary argument is based on the logical concern of accurately simulating events that have either never been seen or, never even been imagined. A partial counter- argument to this concern points to the value of past incidents and accidents in helping to define abnormal conditions of concern; which is an area where Reason has, himself, been an innovator. Once an abnormal condition has been defined and an appropriate level of simulation has been incorportated into training, research suggests that structured abnormal condition simulation is valuable in providing operators with relevant feedback and accelerating the learning process (Antolovits & Izso, 1999). Key References: Antalovits, M., & Izso, L. (1999). Self-assessment and learning in nuclear power plant simulation training. In J. Misumi, B. Wilpert, & R. Miller (Eds.), Nuclear Safety: A Human Factors Perspective (pp. 243-256). London: Taylor & Francis. Fowlkes, J., Dwyer, D., Oser, R., & Salas, E. (1998). Event-based approach to training (EBAT). International Journal of Aviation Psychology, 8, 209- 222. Reason, J. (1990) Human error. Cambridge, UK: Cambridge University Press. Salas, E. & Cannon-Bowers, J. (2001). The science of training: A decade of progress. Annual Review of Psychology, 52, 471-498. Wike, A., Hall, R., Miller, R., & Hays, R. (2002). The use of simulators to comply with legislated pipeline Controller proficiency testing. Proceedings of the 4th International Pipeline Conference. New York, NY: The American Society of Mechanical Engineers.#

Attachment 1, passage 301Page G-88 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 7.2 Controller Training: Emergency Response Training Definition This topic covers the adequacy of Controller training for response to abnormal situations and emergencies. Performance Factor List 7.2.1 Controllers are not adequately trained in emergency response. 7.2.2 Controller are not adequately trained in handling abnormal situations. Applicable Mitigation For Each Performance Factor 7.2.1 7.2.2 Improve the On-the-Job Training Program   Improve New Procedure/Equipment Introduction Training   Improve Controller KSA Assessment   Improve Controller Abnormal Situations Training   Improve Simulator Training    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 302Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-89 Controller Training: Emergency Response Training 7.2 Discussion Improve the On-the-Job Training Program On-the-job training (OJT) represents a one of several training delivery methods; but one that is historically wide-spread and popular in the pipeline industry. In the OQ environment, OJT involves assigning trainees to a console and one or more qualified Controller mentors. The trainee first observes operations and then works under very close supervision until the trainee has successfully completed their certification assessment and is legally qualified to operate the console without direct supervision. Goldstein and Ford point-out some potential advantages of OJT over other types of training, including direct transfer of learned behavior to the actual work equipment and setting and the opportunity for the trainee to receive immediate feedback on the effectiveness of job behaviors. However, OJT requires careful definition of learning objectives and activities, as well as the careful selection and training of OJT supervisors to ensure that it is implemented in a successful and cost-effective manner. The Nuclear Regulatory Commission (1993) provides a useful checklist for reviewing and assessing the quality and value of an OJT session. Key References: Goldstein, I. & Ford, J. (2002). Training in organizations: Needs assessment, development, and evaluation. Belmont, CA: Wadsworth Group. U.S. Nuclear Regulatory Commission (1993). Training review criteria and procedures (NUREG-1220, Rev. 1). Washington, DC: Author. Improve New Procedure/Equipment Introduction Training PHMSA OQ Inspecition Form 14 provides the following guidance regarding the management of changes to procedures, tools, standards, and related operational factors. The rule requires that the operator communicate changes that affect covered tasks to individuals performing those covered tasks. In order to perform this effectively, the operator must have a change management methodology so that it knows when changes are occurring, what changes have an impact on covered task performance, the relative significance of the change and how it affects the continued qualification of individuals, and mechanisms to effectively communicate changes to qualified individuals.(p. 17). Key References: Pipeline and Hazardous Materials Administration. (2007). PHMSA Form-14, Rev 5, March 2007.#

Attachment 1, passage 303Page G-90 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 7.2 Controller Training: Emergency Response Training Improve Controller KSA Assessment Wright, Turner, and Hornbury (2003) provide a relatively comprehensive summary of competence assessment methods that have applicability to pipeline monitoring and control. PHMSA Form 14 (Rev. 5) includes review criteria for evaluation methods. The guidance provided in this form identifies the following factors as important in determining whether the basic requirements for Controller performance assessment meet the requirements of the Operator Qualifications rule 1. 2. 3. 4. 5. The evaluation methods used are derived from the requirements of the covered tasks, and consider any unique needs (e.g., the inability to read) of the individuals being evaluated. Evaluation methods are consistently applied across the operator’s organization such that all individuals performing the same covered task are evaluated using consistent methods. Evaluation methods include the evaluation of an individual’s KSAs to ensure that the individual can perform the assigned covered tasks. Evaluations consisting of observations of on-the-job performance are limited to tasks where justification for employing this method has been established by the operator. The written program should specify the certifications that are accepted for performance of covered tasks (by company and contract individuals) and specific re-evaluation intervals that are associated with the certifications. In addition to the above requirements, PHMSA Form 14 (Rev.5) also specifically addresses the need to establish appropriate reevaluation intervals, taking into account regulatory practice and/or performance history for similar tasks; the need for task-specific reevaluation intervals; and the consideration of task complexity, criticality, and frequency of performance. Key References: Pipeline and Hazardous Materials Administration. (2007). PHMSA Form-14, Rev 5, March 2007. Wright, M., Turner, D, & Horbury, H. (2003). Competence assessment for the hazardous industries. Norwich, UK: HSE Books. Improve Controller Abnormal Situations Training Controller training under abnormal operating conditions represents a critical consideration in process control industries. Schaafstal, et al. (2000) report on the value of troubleshooting training that met their requirements of a ‘structured troubleshooting’ approach, which consists of: (a) a system-independent troubleshooting strategy that provides a standard approach that can be applied across systems; (b) providing functional models of the systems involved; and (c) providing the underlying system-specific domain knowledge corresponding to the systems involved. Another abnormal situations training approach that has received research support as a generally effective strategy for training emergency response skills is team coordination training for those conditions when emergency procedures call for the involvement of more than one control room member (Salas & Cannon-Bowers, 2001). Finally, because much of the content of abnormal situations training addresses KSAs that are seldom exercised by Controllers, it is reasonable to expect that skills and knowledge will decay without periodic refresher training. Therefore, an additional important aspect of abnormal situations training is the determination of the interval between training. Key References: Salas, E. & Cannon-Bowers, J. (2001). The science of training: A decade of progress. Annual Review of Psychology, 52, 471-498. Schaafstal, A, Schraagen, J M., & van Berlo, M. (2000). Cognitive task analysis and innovation of training: The case of structured troubleshooting. Human Factors, 42, 75-86.#

Attachment 1, passage 304Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-91 Controller Training: Emergency Response Training 7.2 Improve Simulator Training Simulator training applications are not limited to abnormal operating condition training. Indeed, a substantial level of both military and commercial aircrew training for normal operations is now conducted using simulators. However, in many process control industries, the opportunity of presenting infrequent (or even never-before-encountered) conditions through simulation tend to result in a focus on abnormal operating condition training. With the introduction of the Operator Qualification rule, pipeline operators are required to demonstrate Controller qualifications under abnormal conditions. A number of operators have addressed this requirement through the development of simulator training (Wike, Hall, Miller, & Hays, 2002). These industry representatives reviewed the applications and effectiveness of simulators with various levels of pipeline system and SCADA interface fidelity. All authors noted the substantial challenges in the development, installation, and maintenance of simulators with high levels of system and SCADA interface fidelity. With respect to fidelity, most training researchers argue that psychological fidelity, which translates into the representation of conditions that require accurate replication of task behaviors, is the most critical characteristic (Salas & Cannon-Bowers, 2001). Thus, task requirements-based selection of simulation characteristics has been proposed as the best approach in selecting simulator fidelity levels (Folkes, Dwyer, Oser, & Salas, 1998). Reason (1990) serves as a valuable skeptic in asking whether or not simulators are effective in training abnormal response skills that will be valuable in the actual operating environment. His primary argument is based on the logical concern of accurately simulating events that have either never been seen or, never even been imagined. A partial counter- argument to this concern points to the value of past incidents and accidents in helping to define abnormal conditions of concern; which is an area where Reason has, himself, been an innovator. Once an abnormal condition has been defined and an appropriate level of simulation has been incorportated into training, research suggests that structured abnormal condition simulation is valuable in providing operators with relevant feedback and accelerating the learning process (Antolovits & Izso, 1999). Key References: Antalovits, M., & Izso, L. (1999). Self-assessment and learning in nuclear power plant simulation training. In J. Misumi, B. Wilpert, & R. Miller (Eds.), Nuclear Safety: A Human Factors Perspective (pp. 243-256). London: Taylor & Francis. Fowlkes, J., Dwyer, D., Oser, R., & Salas, E. (1998). Event-based approach to training (EBAT). International Journal of Aviation Psychology, 8, 209- 222. Reason, J. (1990) Human error. Cambridge, UK: Cambridge University Press. Salas, E. & Cannon-Bowers, J. (2001). The science of training: A decade of progress. Annual Review of Psychology, 52, 471-498. Wike, A., Hall, R., Miller, R., & Hays, R. (2002). The use of simulators to comply with legislated pipeline Controller proficiency testing. Proceedings of the 4th International Pipeline Conference. New York, NY: The American Society of Mechanical Engineers.#

Attachment 1, passage 305Page G-92 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 8.1 Coping with Stress: Abnormal Event Task Assignments Definition This topic covers specific aspects of control room task assignments and staff roles/responsibilities during abnormal situations that may negatively affect Controllers’ abilities to focus on and respond effectively to abnormal operating conditions. Performance Factor List 8.1.1 Controllers are distracted in their response to abnormal situations by non-critical, ongoing duties (e.g., responding to phone calls). 8.1.2 Controllers are distracted in their response to abnormal situations by the need to provide required notifications. 8.1.3 Controllers are distracted in their response to abnormal situations by the need to continue to monitor and control unrelated, ongoing operations. 8.1.4 Control room staff roles and responsibilities during abnormal situations are not well defined. Applicable Mitigation For Each Performance Factor 8.1.1 8.1.2 8.1.3 8.1.4 Reassign Abnormal Situation Non-critical Duties   — Document Abnormal Situation Control Room Staff Roles and Responsibilities — — —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 306Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-93 Coping with Stress: Abnormal Event Task Assignments 8.1 Discussion Reassign Abnormal Situation Non-critical Duties Section 1.1 includes a brief discussion of the mitigation “Automate or Simplify Complex Tasks”, which provides an initial basis for the current mitigation. As stated in Section 1.1, Controllers may be over-burdened during higher workload periods by control activities that could otherwise be automated or simplified in ways that will not compromise safety (Moray, 2001). Recent research suggests that individuals working under task-based stress have difficulty effectively identifying the cause of complex problems (Van Hiel & Mervielde, 2007). If these activities can be modified so that they require less direct attention by Controllers, then they should be in a better position to manage other demands. One method that can be used in developing a reassignment strategy is to interview Controllers to identify specific non- critical duties that are currently assigned during abnormal situations. The focus of the current mitigation is the reassignment of duties assigned to the Controller responsible for console operations once an abnormal operating condition that requires the full attention of a responsible party has been identified. A related, critical factor in revising any Controller abnormal situation assignments is the availability of one or more qualified individuals to assist with and support ongoing operations at the affected console. Personnel support options which could apply to a control room, depending upon its configuration and staffing, include the involvement of one or more of the following: a qualified shift supervisor; a qualified cross-trained Controller currently operating an adjacent console; a qualified Controller currently assigned a serving in a support role in the control room; a capable (but not fully qualified) Controller who would be supporting operations under the supervision of the responsible and qualified Controller; and transferring operations to field personnel. Operators with remote SCADA capability could obtain assistance from support personnel located outside of the control room. Key References: Moray, N. (2001). Humans and machines: Allocation of function. In J. Noys & M. Bransby (Eds.), People in Control: Human Factors in Control Room Design. London: The Institution of Electrical Engineers. Van Hiel, A., & Mervielde, I. (2007). The search for complex problem-solving strategies in the presence of stressors. Human Factors, 49, 1072-1082. Document Abnormal Situation Control Room Staff Roles and Responsibilities This mitigation is basically the documentation of any reassignments resulting from the implementation of the preceding mitigation. The topic of procedure design is generally addressed under Human Factors Topic 5.1. The focus of the current mitigation is on the formal documentation of these reassignments in operating procedures, which may include emergency operating procedures that provide prescriptive guidance intended to be applied in real-time by control room staff during an abnormal situation. Any revision of control room staff roles and responsibilities would likely be best implemented with control room training of the involved individuals (see Human Factors Topic 7.2, Emergency Response Training) – including team training if a team response is defined. Key References: None#

Attachment 1, passage 307Page G-94 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 8.2 Coping with Stress: Control Room Distractions Definition This topic covers specific aspects of control room and pipeline system management policies, task assignments, and actual job performance that may serve as a distracter or stressor during normal operations, resulting in a negative affect upon Controller monitoring and control performance. Performance Factor List 8.2.1 Controllers are distracted from monitoring and controlling operations by the need to complete operations reports (e.g., operating sheets, production summaries, line status summaries). 8.2.2 Controllers end up completing work that is assigned to schedulers. 8.2.3 Field personnel do not provide adequate or timely support to Controllers. 8.2.4 Stressful relations with control room management distracts Controllers from monitoring and control operations. 8.2.5 Stress resulting from productivity goals, incentives, or penalties distracts Controllers from monitoring and control operations. Applicable Mitigation For Each Performance Factor 8.2.1 8.2.2 8.2.3 8.2.4 8.2.5 Reassign Normal Operations Control Room Duties and Assignments  — — — — Automate Paperwork through Existing Software Databases  — — — — Review and Revise Control Center Work Completion and Communication Protocols —  — — — Review and Revise Field Personnel Communications Protocols — —  — — Review and Revise Management Policies and Procedures — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 308Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-95 Coping with Stress: Control Room Distractions 8.2 Discussion Reassign Normal Operations Control Room Duties and Assignments A very basic topic that is addressed through several focused mitigations discussed in this document is the analysis and design of the Controller job. There are numerous methods to analyze the physical and cognitive activities required in pipeline monitoring and control operations (see Kirwan & Ainsworth, 1992; Schaagen, Chipman, & Shalin, 2000 for overviews of appropriate methods). But the key here is the identification and remediation of specific distractions during normal operations. Thus, a focused review of Controller concerns and identified critical incidents could be the most appropriate initial course of action if it is determined that such distractions represent a risk of concern at a control room or console. Following such an analysis, specific changes in duties and assignments could be identified and implemented. Key References: Kirwan, B., & Ainsworth, L. (Eds.). (1992). A guide to task analysis. London: Taylor & Francis. Schaagen, J., Chipman, S., & Shalin, V., Eds. (2000). Cognitive task analysis. Mahwah, NJ: Erlbaum. Automate Paperwork through Existing Software Databases Many operations reports are generated manually by Controllers who are referencing data available in a software database. The automated generation of these reports could be implemented through the enhancement of these existing software databases. Report generation programs could be developed in-house or by vendors who specialize in such services. Key References: None Review and Revise Control Room Work Completion and Communication Protocols This mitigation is a logical extension of Performance Factor 8.2.2, Controllers end up completing work that is assigned to schedulers. The intent of this mitigation is to establish and implement operational procedures and controls that will define and reinforce responsibility for delivery schedule work completion, as defined in control room duties and assignments. In this regard, a communications protocol could entail a practice as uncomplicated as the requirement for management notification following schedule completion; or involve more complex sign-off procedures to trigger management alerts when schedule deadlines are not met. Key References: Penington, J. (1992). A preliminary communications systems assessment. In B. Kirwan & L. Ainsworth (Eds.), A Guide to Task Analysis. London: Taylor & Francis.#

Attachment 1, passage 309Page G-96 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 8.2 Coping with Stress: Control Room Distractions Review and Revise Field Personnel Communications Protocols This mitigation is directly analogous to the preceding one, except that it addresses field personnel communications protocols. Among some operators, a potential complicating factor in developing an effective field personnel communications protocol concerns formal intra- and inter-company authorities. In some cases, field personnel who are relied upon to provide operational information may work for a different company than the Controller; which would require inter-company negotiations to ensure that responsibilities and protocols that effectively address operational risks are established. (See also 3.4) Key References: Penington, J. (1992). A preliminary communications systems assessment. In B. Kirwan & L. Ainsworth (Eds.), A Guide to Task Analysis. London: Taylor & Francis. Review and Revise Management Policies and Procedures Potentially distracting management policies and practices can include the general methods employed to resolve personnel issues and concerns; as well as more specific performance-based goals, incentives, and penalties used to reinforce management goals among Controllers. If such factors are identified as representing operational risk, the revision of management policies and procedures should be conducted in a manner that is consistent with establishing an effective organizational safety culture (see Wilson-Donnelly, Priest, Burke, & Salas, 2004 for a general discussion of this topic). Key References: Wilson-Donnelly, K., Priest, H., Burke, S., & Salas, E. (2004). Tips for creating a safety culture in organizations. Ergonomics in Design, 12, 25-30.#

Attachment 1, passage 310Page G-98 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.1 Controller Alertness: Controller Fatigue Definition This topic includes Performance Factors that represent direct, first-hand reports of Controller fatigue. Performance Factor List 9.1.1 A Controller feels particularly drowsy or fatigued during early afternoon and/or early morning (e.g., around 2-5 am/pm). 9.1.2 A Controller feels drowsy or tired throughout most of a shift. 9.1.3 A Controller feels fatigued at the end of a shift. Applicable Mitigation For Each Performance Factor 9.1.1 9.1.2 9.1.3 Implement a Work Shift Schedule Modification    Review/Adjust Overtime Work Policies and Procedures    Conduct Sleep Disorder Screening    Conduct Controller Fatigue Management Training    Review/Adjust Policy on Employee Commute to Control Center    Implement Rest Break and Napping Policy and Procedures    Change the Control Room Environment to Reduce Fatigue    Provide Additional Stimulation During Slow Work Periods    Implement a Fatigue Self-Reporting Policy and Procedures     Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 311Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-99 Controller Alertness: Controller Fatigue 9.1 Discussion Implement a Work Shift Schedule Modification A number of specific modifications to the current work shift schedule can be considered, as summarized below. A very fundamental mitigation directed at reducing Controller fatigue involves the adoption of an 8-hour shift schedule. In addition to anticipated reductions in Controller fatigue, the feasibility of this mitigation is influenced by a broad range of issues, including available personnel, employee labor costs, employee administration costs, and employee acceptance. Research evidence comparing 8-hour and 12-hour shifts has identified a number of advantages and disadvantages of either schedule. One area of caution regarding 12-hour shifts concerns decrements in worker performance on tasks requiring sustained attention coupled by quick and accurate responses. A particular area of concern that should be addressed in evaluating 8-hour versus 12-hour work schedules for pipeline Controllers is the effectiveness of contact and communications with supervisors and managers. Limited contact with managers and difficulties reorienting with the overall system status after longer periods away are specific challenges associated with 12-hour shift schedules that have been reported by several researchers. On the other hand, Smiley and Moray (1989) have highlighted the potential advantage with 12-hour shifts of frequent hand-offs between the same two Controller teams. There are numerous alternative 12-hour shift schedules that are intended to address various factors, including: circadian disruption, overall Controller staffing levels, and overtime policies. Work shifts that rotate in the direction of later start- times (forward rotation) seem to be easier for the worker to accomplish, since they involve staying up later rather than waking earlier. Forward shift rotation also seems to have less of a negative impact on worker performance. In 12-hour work shifts, this suggests the value of maximizing day-night-rest transitions over night-day-rest transitions. Short rotation schedules (e.g., 2-4 days), which minimize disruption of the circadian cycle, have been observed to have less of a negative impact on sleep loss, alertness, and well-being. Breaks greater than 24 hours between 12-hour day and night shifts were associated with slightly higher levels of alertness and lower levels of chronic fatigue. Morning shifts starting no earlier than 7:00 AM are reported to reduce on-shift fatigue by minimizing the disruption of workers’ sleep prior to the start of the shift. However, trade-offs between start time and the effects during daytime and nighttime 12-hour shifts suggest that the notion of defining one optimal start and finish time may be situation specific, making general recommendations impractical. There are several software tools that are available to aid in defining and/or evaluating rotating 24-7 work schedules on the basis of established scheduling guidelines and/or predicted worker alertness levels. The U.S. Department of Transportation sponsored the development of one tool, Work Schedule Representation and Analysis Software (RAS) (Ximes Gmbh, 2003), which evaluates work schedules on the basis of specific criteria and initial threshold values established on the basis of available scheduling guideline research. A similar spreadsheet-based tool developed under sponsorship of the Health & Safety Executive of England was recently made publicly available at http://www.hse.gov.uk/research/rrhtm/rr446.htm. Whether a software tool or general guidelines are used, there are a number of useful work schedule guidelines that are based on empirical research. Operators can conduct a comparison between their schedules and such guidelines, then adjust/revise their shift schedules accordingly.#

Attachment 1, passage 312Page G-100 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.1 Controller Alertness: Controller Fatigue Key References: Axelson, J. (2005). Long shifts, short rests and vulnerability to shift work. Stockholm: Department of Psychology. (Accessed March 5, 2008 at http://www.diva-portal.org/su/abstract.xsql?dbid=453) Folkard, S. & Barton, J. (1993). Does the “forbidden zone” for sleep onset influence morning shift sleep duration? Ergonomics, 36, 85-91. Spencer, M., Robertson, K. & Folkard, S. (2006). The development of a fatigue /risk index for shiftworkers. UK: Health and Safety Executive Kecklund, G. & Akerstedt, T. (1995). Effects of timing of shifts on sleepiness and sleep duration. Journal of Sleep Research, 4, Suppl. 2, 47-50. Mitchell, R. and Williamson, A. (2000). Evaluation of an 8 hour versus a 12 hours shift roster on employees at a power station. Applied Ergonomics, 31, 83-93. Moores, J. (1990). A meta-analytic review of the effects of compressed work schedules. Applied Human Resource Management Research, 1, 12-8. Pati, A. K., Chandrawanshi, A., & Reinberg, A. (2001). Shift work: Consequences and management. Current Science, 81, 32-52. Rosa, R. R. (1991). Performance, alertness, and sleep after 3.5 years of 12h shifts: A follow-up study. Work and Stress, 5(2), 107-116. Smiley, A., Moray, N. (1989). Review of 12-hours shifts at nuclear generating stations (Report to Atomic Energy Control Board, Project No. 2.131.1). Ottawa, Canada. Tepas, D. I., Paley, M .J., Popkin, S. M. (1997). Work schedules and sustained performance. In G. Salvendy (Ed.) Handbook of Human Factors and Ergonomics (pp. 1021-1058). New York: John Wiley & Sons. Tucker, P., Smith, L., Macdonald, I., & Folkhard, S. (1999). Distribution of rest days in 12 hour shift systems: impacts on health, wellbeing, and on shift alertness. Occupational Environmental Medicine, 56, 206-214. Ximes GmbH. (2003). Work schedule representation and analysis software (RAS). Accessible at: http://hfcc.dot.gov/ofm/index.html Review/Adjust Overtime Work Policies and Procedures Overtime policies are one of several factors that must be considered in establishing a specific work schedule. The PHMSA Advisory Bulletin (ADB-05-06) provides some guidance on this topic, including advising operators to: (1) “limit work schedules to no more than 12 hours in any 24 hour period except in extraordinary or emergency situations; and to develop a policy or procedure to manage unusual circumstances where a Controller is required to work more than 12 hours in any 24 hour period;” and (2) schedule “overtime on an individual basis, not the shift of Controllers and Controller supervisors; and that Controller fatigue should be considered in allowing overtime.” There is a substantial amount of research that reports relationships between extended overtime hours and health problems among workers. Van der Hulst (2003) provides a comprehensive summary of this research and concludes that “there is good reason to be concerned about the possible detrimental effects of long work hours on health, in particular cardiovascular disease, diabetes, illnesses leading to disability retirement, subjectively reported physical ill health, and subjective fatigue.” One of the major concerns with excessive overtime in 12-hour shift schedules is the cumulative build-up of fatigue over days or weeks and the corresponding extended period of off-time required by individuals to fully recover from the resulting sleep debt. In a recent review of this topic, QinetiQ & Folkard (2006) note the lack of clear field research results, but find recent laboratory studies providing good evidence for significant levels of cumulative fatigue following two weeks of limited sleep. The effects of overtime on predicted worker fatigue and operational risks can be predicted using either of the work schedule evaluation tools identified in the discussion of modified work shift schedules. Key References: Van der Hulst, M. (2003). Long work hours and health. Scandinavian Journal of Work, Environment, and Health, 29, 171-188. QinetiQ & Folkard (2006). Fatigue risk index calculator. Available at http://www.hse.gov.uk/research/rrhtm/rr446.htm#

Attachment 1, passage 313Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-101 Controller Alertness: Controller Fatigue 9.1 Conduct Sleep Disorder Screening Sleep disorders can disrupt sleep, which can lead directly to Controller fatigue; or they can contribute to fatigue associated with long work hours. The condition of sleep apnea affects as many as 1 out of 20 people. This is a breathing disorder involving periodic interruptions of breathing during sleep. Medical specialists can be consulted to determine if a specific condition exists that is interfering with sleep, and proper medical interventions can help to alleviate the problem. Self-screening to identify potential sleep disorders is one approach that is supported by the National Sleep Foundation. That organization’s website provides a range of self-assessment tools, educational information, and referral sources as http://www/sleepfoundation.org/ . McCallum et al. (2003) report that several U.S. transportation operators who have identified worker alertness as an operational risk have instituted confidential sleep disorder screening as part of their broader fatigue management programs. Given the safety-critical nature of Controller and field personnel job performance, consideration should be given to including sleep disorder screening as part of an operator’s pre- employment and regular company physical exams. Key References: McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. Accessible at: http://hfcc.dot.gov/ofm/index.html Conduct Controller Fatigue Management Training The fundamental factors that affect worker alertness on the job are the quantity, quality, and timing of their sleep. In addition, informed use of caffeine during the job is one of the most effective mitigations for short-term fatigue reduction. Because both of these factors are best managed by an informed worker, alertness management training can serve as a useful component of an alertness management program. Such training can include topics that address what the Controller, his/her family, and the company can do to reduce work fatigue. A word of caution regarding all training programs was provided by Tepas (1993), who indicated that he was unable to uncover any research demonstrating the value of such programs. Training should not be relied upon as the only mitigation, especially since research has yet to demonstrate the value of such programs. Most workers will be more motivated to adopt effective life style changes and employ short-term tactics if they perceive the recognition by management of the shared responsibility to manage alertness (Monk, 1990). Educational topics should be limited in number to the most relevant and practical, so that they might be remembered and applied. Particularly important topics for a 12-hour rotating shift control room environment would likely include the following: - Sleep basics – circadian rhythm, work shift lags, sleep requirements, sleep debts - Family responsibilities in supporting good sleep hygiene - Effective fatigue countermeasures Key References: McCallum. M., Sanquist, T., Mitler, M., & Krueger, G. (2003). Commercial Transportation Operator Fatigue Management Reference. Washington, DC: U.S. Department of Transportation. Monk, T. H. (1990). The relationship of chronobiology to sleep schedules and performance demands. Work and Stress, 4(3), 227-236. Tepas, D. (1993). Educational programmes for shiftworkers, their families, and prospective shiftworkers. Ergonomics, 36, 199-209.#

Attachment 1, passage 314Page G-102 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.1 Controller Alertness: Controller Fatigue Review/Adjust Policy on Employee Commute to Control Center Reduced sleep time over several days of a recurring 12-hour work shift can result in a substantial sleep debt on the part of the worker. One factor that can contribute to reduced sleep time during a 12-hour shift is extensive commute times between an employee’s residence and place of work. Knauth and Hornberger (2003) cite other authors who recommend moving closer to the place of work to both increase sleep opportunities and reduce an employee’s exposure to drowsy driving. This observation was supported by Controller interview findings during the current project. Operators could address this factor by reviewing and adjusting their policy regarding employee commute times, as appropriate. Depending upon the control center location, it may be appropriate to establish a limit of approximately 60 minutes each way. Key References: Knauth, P. & Hornberger, S. (2003). Preventive and compensatory measures for shift workers. Organizational Medicine; 53, 109-116. Implement Rest Break and Napping Policy and Procedures Pipeline operators are advised in the PHMSA Advisory Bulletin (ADB-05-06) to establish “work relief periods and other measures during Controller shifts to promote alertness and enhance capabilities for effective decision-making”. Control rooms commonly have minimal staffing levels during night shifts, reducing the opportunity for Controllers to take rest breaks or naps during night shifts, when their alertness would be expected to be lower than during day shifts. However, the demonstrated effectiveness of both rest breaks and naps suggests that they should be seriously considered by operators facing operational risks associated with Controller alertness that cannot be readily addressed through work shift scheduling. The value of short breaks from work during night shift work, especially when coupled with food intake or moderate activity, is in providing a temporary relief from fatigue that is the result of time on task. However, such breaks do not appear to relieve fatigue due to lack of sleep. Akerstedt (1998) reviewed the research on napping during night shifts and indicates that “the overall impression is that napping may be the most effective countermeasure against sleepiness at work”. McCallum et al. (2003) provide a summary of factors affecting the appropriateness and scheduling of brief naps, including the need to provide allowances for the short, 5-15 minute period of reduced alertness (sleep inertia) immediately after awakening. An on-site rest facility can provide a general environment that is conducive to falling asleep quickly and providing Controllers with an opportunity for regenerative brief naps or short sleep periods. Such a facility can have the added benefit of helping workers avoid commuting during especially low levels of alertness following a nighttime shift or unavoidable extended shifts. Key References: Akerstedt, T. (1998). Shift work and disturbed sleep/wakefulness. Sleep Med Rev, 2(2), 117-28 Della Rocco, P.S., Comperatore, C., Caldwell, L., and Cruz, C. (2000). Effects of napping on night shift performance. Washington, DC: DOT Federal Aviation Administration. McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. (Accessible at: http://hfcc.dot.gov/ofm/index.html) Rosekind, M., Smith, R., Miller, D., Co, E., Gregory, K., Webbon, L., Gander, P., & Lebazqz, V. (1995). Alertness management: strategic naps in operational settings. Journal of Sleep Research, 4, Supplement 2, 62-66.#

Attachment 1, passage 315Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-103 Controller Alertness: Controller Fatigue 9.1 Change the Control Room Environment to Reduce Fatigue Modifications to control room environments can be targeted at either adjustments to circadian cycles of workers or more general stimulation and immediate increases in alertness. The notice accompanying PHMSA Advisory Bulletin (ADB- 05-06) suggests that control room lighting and temperature can be manipulated to reduce Controller fatigue during both daytime and nighttime shifts. However, there are some qualifications to this general statement. Individuals’ circadian rhythms have been successfully adjusted through laboratory administration of relatively high artificial light levels (3- 4,000 lux) (Cajochen et al., 2000). Late night exposure delays the rhythm whereas morning exposure advances the rhythm. This technique could have value in helping individuals adjust to extended nighttime work. However, any effective shift in the circadian cycle of an individual working a relatively brief series of nighttime shifts might be offset by the loss of sleep during a more difficult readjustment to the daytime cycle. Efforts to modify work environments in an attempt to stimulate workers and reduce fatigue have been reviewed by Akerstedt and Landstrom (1998), as summarized below. - Lower levels of light (in the 1-2,000 lux range) are judged to have more general stimulating effects, but adequate field research has not yet been conducted to support reliable guidance for implementation. - There is a common sense notion that social interaction and light exercise are effective near-term fatigue countermeasures; however, Akerstedt and Landstrom were not aware of any research demonstrating the effectiveness of either approach. - High room temperatures (30-35 degrees C) are generally associated with reduced alertness; so these temperature levels should be avoided. Relatively severe decreases in temperature appear to be required to reduce the onset of fatigue for even brief periods. - Poor ventilation can result in reduced alertness if it is associated with increased levels of carbon monoxide; which can be offset by improved ventilation and corresponding reductions in carbon monoxide in the working environment. Key References: Akerstedt, T; Landstrom, U. (1998). Work place countermeasures of night shift fatigue. International Journal of Industrial Ergonomics, 21, 167-178. Cajochen, C., Zeitzer, J., Czeisler, C., & Dijk, D. (2000). Dose-response relationship for light intensity and ocular and electroencephalographic correlates of human alertness. Behavioral Brain Research, 115, 75-83. Provide Additional Stimulation During Slow Work Periods Controllers have reported reduced alertness levels following extended periods of low stimulation. Providing additional stimulation is a logical mitigation in addressing slow work periods. One set of mitigations can involve providing an external source of stimulation and/or entertainment, such as access to television, music, video, or the internet. Conversation with co-workers is another means of increasing stimulation. Such activities have been shown to temporarily increase physiological stimulation and serve as a short-term means of maintaining awareness. An alternative mitigation is to provide an opportunity for short, moderate-level exercise, such as through the use of an exercise cycle, treadmill, or elliptical walker. Research indicates that brief periods of exercise can reduce feelings of sleepiness, although job performance does not appear to improve. Key References: McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. (Accessible at: http://hfcc.dot.gov/ofm/index.html) Reyer, L. & Horne, J. (1998). Evaluation of ‘in car’ countermeasures to sleepiness: Cold air and radio. Sleep, 21, 46-50.#

Attachment 1, passage 316Page G-104 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.1 Controller Alertness: Controller Fatigue Implement a Fatigue Recognition and Self-Reporting Policy and Procedures Subjective reports of personal fatigue levels have been demonstrated to provide generally reliable data. So, it would appear that there could be an opportunity to avoid particularly high periods of operational risk when individuals are experiencing excessive levels of fatigue if they could report such instances. Unfortunately, many operators have limited flexibility to address such situations without disrupting the work schedule of other Controllers and placing a work schedule burden on a co-worker. However, in those operations with adequate staffing to respond to self-reported levels of high fatigue, there could be substantial benefits. A few factors to consider in the implementation of such a policy are outlined below. - Self reporting cannot have any retribution associated with it. It must be emphasized that the intent of the policy is to reduce operational risk and help Controllers deal with unusual circumstances that result in exceptionally low levels of alertness. - In companies that have instituted a self-reporting policy, the frequency of reporting is very low – in the neighborhood of once per year – and the resulting benefits with respect to demonstrating the priority of safety and worker well-being may far outweigh the potential costs of rare personnel rescheduling demands. - This policy could be coupled with a rest facility, providing a Controller with the opportunity to obtain a restorative sleep of 2-6 hours while an off-duty or on-duty relief worker provided support at the console. - An extreme implementation of this policy, which some operators have in place, calls for shutting-down console operations if a Controller reports that s/he is excessively fatigued and no relief Controller is available. Key References: None#

Attachment 1, passage 317Page G-106 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.2 Controller Alertness: Controller Schedule and Rest Definition This topic covers specific working conditions that may contribute to Controller fatigue. Performance Factor List 9.2.1 Controllers get insufficient sleep because of transitions in shift schedules from day to night or night to day. 9.2.2 Controllers get insufficient sleep because of being called in to work a shift on short notice. 9.2.3 Controllers get insufficient sleep because of overtime work. 9.2.4 Controllers get insufficient sleep because of twelve hour shifts. 9.2.5 Controllers get insufficient sleep because of ongoing understaffing. 9.2.6 Controllers get insufficient sleep because of shift start times. Applicable Mitigation For Each Performance Factor 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 Implement a Work Shift Schedule Modification — —  —  Review/Adjust Overtime Work Policies and Procedures —   — — — Conduct Sleep Disorder Screening — — — —  Conduct Controller Fatigue Management Training       Implement Rest Break and Napping Policy and Procedures     —  Change the Control Room Environment to Reduce Fatigue — —  —  Implement a Fatigue Recognition and Self-Reporting Policy and Procedures     —   Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 318Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-107 Controller Alertness: Controller Schedule and Rest 9.2 Discussion Implement a Work Shift Schedule Modification A number of specific modifications to the current work shift schedule can be considered, as summarized below. A very fundamental mitigation directed at reducing Controller fatigue involves the adoption of an 8-hour shift schedule. In addition to anticipated reductions in Controller fatigue, the feasibility of this mitigation is influenced by a broad range of issues, including available personnel, employee labor costs, employee administration costs, and employee acceptance. Research evidence comparing 8-hour and 12-hour shifts has identified a number of advantages and disadvantages of either schedule. One area of caution regarding 12-hour shifts concerns decrements in worker performance on tasks requiring sustained attention coupled by quick and accurate responses. A particular area of concern that should be addressed in evaluating 8-hour versus 12-hour work schedules for pipeline Controllers is the effectiveness of contact and communications with supervisors and managers. Limited contact with managers and difficulties reorienting with the overall system status after longer periods away are specific challenges associated with 12-hour shift schedules that have been reported by several researchers. On the other hand, Smiley and Moray (1989) have highlighted the potential advantage with 12-hour shifts of frequent hand-offs between the same two Controller teams. There are numerous alternative 12-hour shift schedules that are intended to address various factors, including: circadian disruption, overall Controller staffing levels, and overtime policies. Work shifts that rotate in the direction of later start- times (forward rotation) seem to be easier for the worker to accomplish, since they involve staying up later rather than waking earlier. Forward shift rotation also seems to have less of a negative impact on worker performance. In 12-hour work shifts, this suggests the value of maximizing day-night-rest transitions over night-day-rest transitions. Short rotation schedules (e.g., 2-4 days), which minimize disruption of the circadian cycle, have been observed to have less of a negative impact on sleep loss, alertness, and well-being. Breaks greater than 24 hours between 12-hour day and night shifts were associated with slightly higher levels of alertness and lower levels of chronic fatigue. Morning shifts starting no earlier than 7:00 AM are reported to reduce on-shift fatigue by minimizing the disruption of workers’ sleep prior to the start of the shift. However, trade-offs between start time and the effects during daytime and nighttime 12-hour shifts suggest that the notion of defining one optimal start and finish time may be situation specific, making general recommendations impractical. There are several software tools that are available to aid in defining and/or evaluating rotating 24-7 work schedules on the basis of established scheduling guidelines and/or predicted worker alertness levels. The U.S. Department of Transportation sponsored the development of one tool, Work Schedule RAS (Ximes Gmbh, 2003), which evaluates work schedules on the basis of specific criteria and initial threshold values established on the basis of available scheduling guideline research. A similar spreadsheet-based tool developed under sponsorship of the Health & Safety Executive of England was recently made publicly available at http://www.hse.gov.uk/research/rrhtm/rr446.htm. Whether a software tool or general guidelines are used, there are a number of useful work schedule guidelines that are based on empirical research. Operators can conduct a comparison between their schedules and such guidelines, then adjust/revise their shift schedules accordingly.#

Attachment 1, passage 319Page G-108 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.2 Controller Alertness: Controller Schedule and Rest Key References: Axelson, J. (2005). Long shifts, short rests and vulnerability to shift work. Stockholm: Department of Psychology. (Accessed March 5, 2008 at http://www.diva-portal.org/su/abstract.xsql?dbid=453) Folkard, S. & Barton, J. (1993). Does the “forbidden zone” for sleep onset influence morning shift sleep duration? Ergonomics, 36, 85-91. Kecklund, G. & Akerstedt, T. (1995). Effects of timing of shifts on sleepiness and sleep duration. Journal of Sleep Research, 4, Suppl. 2, 47-50. Mitchell, R. and Williamson, A. (2000). Evaluation of an 8 hour versus a 12 hours shift roster on employees at a power station. Applied Ergonomics, 31, 83-93. Moores, J. (1990). A meta-analytic review of the effects of compressed work schedules. Applied Human Resource Management Research, 1, 12-8. Pati, A. K., Chandrawanshi, A., & Reinberg, A. (2001). Shift work: Consequences and management. Current Science, 81, 32-52. Rosa, R. R. (1991). Performance, alertness, and sleep after 3.5 years of 12h shifts: A follow-up study. Work and Stress, 5(2), 107-116. Smiley, A., Moray, N. (1989). Review of 12-hours shifts at nuclear generating stations (Report to Atomic Energy Control Board, Project No. 2.131.1). Ottawa, Canada. Tepas, D. I., Paley, M .J., Popkin, S. M. (1997). Work schedules and sustained performance. In G. Salvendy (Ed.) Handbook of Human Factors and Ergonomics (pp. 1021-1058). New York: John Wiley & Sons. Tucker, P., Smith, L., Macdonald, I., & Folkhard, S. (1999). Distribution of rest days in 12 hour shift systems: impacts on health, wellbeing, and on shift alertness. Occupational Environmental Medicine, 56, 206-214. Ximes GmbH. (2003). Work schedule representation and analysis software (RAS). Accessible at: http://hfcc.dot.gov/ofm/index.html Review/Adjust Overtime Work Policies and Procedures Overtime policies are one of several factors that must be considered in establishing a specific work schedule. The PHMSA Advisory Bulletin (ADB-05-06) provides some guidance on this topic, including: advising operators to: (1) “limit work schedules to no more than 12 hours in any 24 hour period except in extraordinary or emergency situations; and to develop a policy or procedure to manage unusual circumstances where a Controller is required to work more than 12 hours in any 24 hour period;” and (2) schedule “overtime on an individual basis, not the shift of Controllers and Controller supervisors; and that Controller fatigue should be considered in allowing overtime.” There is a substantial amount of research that reports relationships between extended overtime hours and health problems among workers. Van der Hulst (2003) provides a comprehensive summary of this research and concludes that “there is good reason to be concerned about the possible detrimental effects of long work hours on health, in particular cardiovascular disease, diabetes, illnesses leading to disability retirement, subjectively reported physical ill health, and subjective fatigue.” One of the major concerns with excessive overtime in 12-hour shift schedules is the cumulative build-up of fatigue over days or weeks and the corresponding extended period of off-time required by individuals to fully recover from the resulting sleep debt. In a recent review of this topic, QinetiQ & Folkard (2006) note the lack of clear field research results, but find recent laboratory studies providing good evidence for significant levels of cumulative fatigue following two weeks of limited sleep. The effects of overtime on predicted worker fatigue and operational risks can be predicted using either of the work schedule evaluation tools identified in the discussion of modified work shift schedules. Key References: Van der Hulst, M. (2003). Long work hours and health. Scandinavian Journal of Work, Environment, and Health, 29, 171-188. QinetiQ & Folkard (2006). Fatigue risk index calculator. Available at http://www.hse.gov.uk/research/rrhtm/rr446.htm#

Attachment 1, passage 320Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-109 Controller Alertness: Controller Schedule and Rest 9.2 Conduct Sleep Disorder Screening Sleep disorders can disrupt sleep, which can lead directly to Controller fatigue; or they can contribute to fatigue associated with long work hours. The condition of sleep apnea affects as many as 1 out of 20 people. This is a breathing disorder involving periodic interruptions of breathing during sleep. Medical specialists can be consulted to determine if a specific condition exists that is interfering with sleep, and proper medical interventions can help to alleviate the problem. Self-screening to identify potential sleep disorders is one approach that is supported by the National Sleep Foundation. That organization’s website provides a range of self-assessment tools, educational information, and referral sources as http://www/sleepfoundation.org/ . McCallum et al. (2003) report that several U.S. transportation operators who have identified worker alertness as an operational risk have instituted confidential sleep disorder screening as part of their broader fatigue management programs. Given the safety-critical nature of Controller and field personnel job performance, consideration should be given to including sleep disorder screening as part of an operator’s pre- employment and regular company physical exams. Key References: McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. Accessible at: http://hfcc.dot.gov/ofm/index.html Conduct Controller Fatigue Management Training The fundamental factors that affect worker alertness on the job are the quantity, quality, and timing of their sleep. In addition, informed use of caffeine during the job is one of the most effective mitigations for short-term fatigue reduction. Because both of these factors are best managed by an informed worker, alertness management training can serve as a useful component of an alertness management program. Such training can include topics that address what the Controller, his/her family, and the company can do to reduce work fatigue. A word of caution regarding all training programs was provided by Tepas (1993), who indicated that he was unable to uncover any research demonstrating the value of such programs. Training should not be relied upon as the only mitigation, especially since research has yet to demonstrate the value of such programs. Most workers will be more motivated to adopt effective life style changes and employ short-term tactics if they perceive the recognition by management of the shared responsibility to manage alertness (Monk, 1990). Educational topics should be limited in number to the most relevant and practical, so that they might be remembered and applied. Particularly important topics for a 12-hour rotating shift control room environment would likely include the following: - Sleep basics – circadian rhythm, work shift lags, sleep requirements, sleep debts - Family responsibilities in supporting good sleep hygiene - Effective fatigue countermeasures Key References: McCallum. M., Sanquist, T., Mitler, M., & Krueger, G. (2003). Commercial Transportation Operator Fatigue Management Reference. Washington, DC: U.S. Department of Transportation. Monk, T. H. (1990). The relationship of chronobiology to sleep schedules and performance demands. Work and Stress, 4(3), 227-236. Tepas, D. (1993). Educational programmes for shiftworkers, their families, and prospective shiftworkers. Ergonomics, 36, 199-209.#

Attachment 1, passage 321Page G-110 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.2 Controller Alertness: Controller Schedule and Rest Implement Rest Break and Napping Policy and Procedures Pipeline operators are advised in the PHMSA Advisory Bulletin (ADB-05-06) to establish “work relief periods and other measures during Controller shifts to promote alertness and enhance capabilities for effective decision-making”. Control rooms commonly have minimal staffing levels during night shifts, reducing the opportunity for Controllers to take rest breaks or naps during night shifts, when their alertness would be expected to be lower than during day shifts. However, the demonstrated effectiveness of both rest breaks and naps suggests that they should be seriously considered by operators facing operational risks associated with Controller alertness that cannot be readily addressed through work shift scheduling. The value of short breaks from work during night shift work, especially when coupled with food intake or moderate activity, is in providing a temporary relief from fatigue that is the result of time on task. However, such breaks do not appear to relieve fatigue due to lack of sleep. Akerstedt (1998) reviewed the research on napping during night shifts and indicates that “the overall impression is that napping may be the most effective countermeasure against sleepiness at work”. McCallum et al. (2003) provide a summary of factors affecting the appropriateness and scheduling of brief naps, including the need to provide allowances for the short, 5-15 minute period of reduced alertness (sleep inertia) immediately after awakening. An on-site rest facility can provide a general environment that is conducive to falling asleep quickly and providing Controllers with an opportunity for regenerative brief naps or short sleep periods. Such a facility can have the added benefit of helping workers avoid commuting during especially low levels of alertness following a nighttime shift or unavoidable extended shifts. Key References: Akerstedt, T. (1998). Shift work and disturbed sleep/wakefulness. Sleep Med Rev, 2(2), 117-28. Della Rocco, P.S., Comperatore, C., Caldwell, L., and Cruz, C. (February 2000). Effects of napping on night shift performance. Washington, DC: DOT Federal Aviation Administration. McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. Accessible at: http://hfcc.dot.gov/ofm/index.html Rosekind, M., Smith, R., Miller, D., Co, E., Gregory, K., Webbon, L., Gander, P., & Lebazqz, V. (1995). Alertness management: Strategic naps in operational settings. Journal of Sleep Research, 4, Supplement 2, 62-66. Change the Control Room Environment to Reduce Fatigue Modifications to control room environments can be targeted at either adjustments to circadian cycles of workers or more general stimulation and immediate increases in alertness. The notice accompanying PHMSA Advisory Bulletin (ADB- 05-06) suggests that control room lighting and temperature can be manipulated to reduce Controller fatigue during both daytime and nighttime shifts. However, there are some qualifications to this general statement. Individuals’ circadian rhythms have been successfully adjusted through laboratory administration of relatively high artificial light levels (3- 4,000 lux) (Cajochen et al., 2000). Late night exposure delays the rhythm whereas morning exposure advances the rhythm. This technique could have value in helping individuals adjust to extended nighttime work. However, any effective shift in the circadian cycle of an individual working a relatively brief series of nighttime shifts might be offset by the loss of sleep during a more difficult readjustment to the daytime cycle.#

Attachment 1, passage 322Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-111 Controller Alertness: Controller Schedule and Rest 9.2 Efforts to modify work environments in an attempt to stimulate workers and reduce fatigue have been reviewed by Akerstedt and Landstrom (1998), as summarized below. - Lower levels of light (in the 1-2,000 lux range) are judged to have more general stimulating effects, but adequate field research has not yet been conducted to support reliable guidance for implementation. - There is a common sense notion that social interaction and light exercise are effective near-term fatigue countermeasures; however, Akerstedt and Landstrom were not aware of any research demonstrating the effectiveness of either approach. - High room temperatures (30-35 degrees C) are generally associated with reduced alertness; so these temperature levels should be avoided. Relatively severe decreases in temperature appear to be required to reduce the onset of fatigue for even brief periods. - Poor ventilation can result in reduced alertness if it is associated with increased levels of carbon monoxide; which can be offset by improved ventilation and corresponding reductions in carbon monoxide in the working environment. Key References: Akerstedt, T; Landstrom, U. (1998). Work place countermeasures of night shift fatigue. International Journal of Industrial Ergonomics, 21, 167-178. Cajochen, C., Zeitzer, J., Czeisler, C., & Dijk, D. (2000). Dose-response relationship for light intensity and ocular and electroencephalographic correlates of human alertness. Behavioral Brain Research, 115, 75-83. Implement a Fatigue Recognition and Self-Reporting Policy and Procedures Subjective reports of personal fatigue levels have been demonstrated to provide generally reliable data. So, it would appear that there could be an opportunity to avoid particularly high periods of operational risk when individuals are experiencing excessive levels of fatigue if they could report such instances. Unfortunately, many operators have limited flexibility to address such situations without disrupting the work schedule of other Controllers and placing a work schedule burden on a co-worker. However, in those operations with adequate staffing to respond to self-reported levels of high fatigue, there could be substantial benefits. A few factors to consider in the implementation of such a policy are outlined below. - Self reporting cannot have any retribution associated with it. It must be emphasized that the intent of the policy is to reduce operational risk and help Controllers deal with unusual circumstances that result in exceptionally low levels of alertness. - In companies that have instituted a self-reporting policy, the frequency of reporting is very low – in the neighborhood of once per year – and the resulting benefits with respect to demonstrating the priority of safety and worker well-being may far outweigh the potential costs of rare personnel rescheduling demands. - This policy could be coupled with a rest facility, providing a Controller with the opportunity to obtain a restorative sleep of 2-6 hours while an off-duty or on-duty relief worker provided support at the console. - An extreme implementation of this policy, which some operators have in place, calls for shutting-down console operations if a Controller reports that s/he is excessively fatigued and no relief Controller is available. Key References: None#

Attachment 1, passage 323Page G-112 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.3 Controller Alertness: Slow Work Periods Definition This topic includes Performance Factors that represent direct, first-hand reports of Controllers having alertness problems during slow work periods. Performance Factor List 9.3.1 Controllers experience reduced alertness during slow work periods. 9.3.2 Controllers experience difficulty regaining alertness to deal with a challenging situation following a slow work period. Applicable Mitigation For Each Performance Factor 9.3.1 9.3.2 Implement a Work Shift Schedule Modification   Review/Adjust Overtime Work Policies and Procedures   Conduct Sleep Disorder Screening   Conduct Controller Fatigue Management Training   Implement Rest Break and Napping Policy and Procedures   Change the Control Room Environment to Reduce Fatigue   Provide Additional Stimulation during Slow Work Periods   Implement a Fatigue Self-Reporting Policy and Procedures    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 324Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-113 Controller Alertness: Slow Work Periods 9.3 Discussion Implement a Work Shift Schedule Modification A number of specific modifications to the current work shift schedule can be considered, as summarized below. A very fundamental mitigation directed at reducing Controller fatigue involves the adoption of an 8-hour shift schedule. In addition to anticipated reductions in Controller fatigue, the feasibility of this mitigation is influenced by a broad range of issues, including available personnel, employee labor costs, employee administration costs, and employee acceptance. Research evidence comparing 8-hour and 12-hour shifts has identified a number of advantages and disadvantages of either schedule. One area of caution regarding 12-hour shifts concerns decrements in worker performance on tasks requiring sustained attention coupled by quick and accurate responses. A particular area of concern that should be addressed in evaluating 8-hour versus 12-hour work schedules for pipeline Controllers is the effectiveness of contact and communications with supervisors and managers. Limited contact with managers and difficulties reorienting with the overall system status after longer periods away are specific challenges associated with 12-hour shift schedules that have been reported by several researchers. On the other hand, Smiley and Moray (1989) have highlighted the potential advantage with 12-hour shifts of frequent hand-offs between the same two Controller teams. There are numerous alternative 12-hour shift schedules that are intended to address various factors, including: circadian disruption, overall Controller staffing levels, and overtime policies. Work shifts that rotate in the direction of later start- times (forward rotation) seem to be easier for the worker to accomplish, since they involve staying up later rather than waking earlier. Forward shift rotation also seems to have less of a negative impact on worker performance. In 12-hour work shifts, this suggests the value of maximizing day-night-rest transitions over night-day-rest transitions. Short rotation schedules (e.g., 2-4 days), which minimize disruption of the circadian cycle, have been observed to have less of a negative impact on sleep loss, alertness, and well-being. Breaks greater than 24 hours between 12-hour day and night shifts were associated with slightly higher levels of alertness and lower levels of chronic fatigue. Morning shifts starting no earlier than 7:00 AM are reported to reduce on-shift fatigue by minimizing the disruption of workers’ sleep prior to the start of the shift. However, trade-offs between start time and the effects during daytime and nighttime 12-hour shifts suggest that the notion of defining one optimal start and finish time may be situation specific, making general recommendations impractical. There are several software tools that are available to aid in defining and/or evaluating rotating 24-7 work schedules on the basis of established scheduling guidelines and/or predicted worker alertness levels. The U.S. Department of Transportation sponsored the development of one tool, Work Schedule RAS (Ximes Gmbh, 2003), which evaluates work schedules on the basis of specific criteria and initial threshold values established on the basis of available scheduling guideline research. A similar spreadsheet-based tool developed under sponsorship of the Health & Safety Executive of England was recently made publicly available at http://www.hse.gov.uk/research/rrhtm/rr446.htm. Whether a software tool or general guidelines are used, there are a number of useful work schedule guidelines that are based on empirical research. Operators can conduct a comparison between their schedules and such guidelines, then adjust/revise their shift schedules accordingly.#

Attachment 1, passage 325Page G-114 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.3 Controller Alertness: Slow Work Periods Key References: Axelson, J. (2005). Long shifts, short rests and vulnerability to shift work. Stockholm: Department of Psychology. (Accessed March 5, 2008 at http://www.diva-portal.org/su/abstract.xsql?dbid=453) Folkard, S. & Barton, J. (1993). Does the “forbidden zone” for sleep onset influence morning shift sleep duration? Ergonomics, 36, 85-91. Kecklund, G. & Akerstedt, T. (1995). Effects of timing of shifts on sleepiness and sleep duration. Journal of Sleep Research, 4, Suppl. 2, 47-50. Mitchell, R. and Williamson, A. (2000). Evaluation of an 8 hour versus a 12 hours shift roster on employees at a power station. Applied Ergonomics, 31, 83-93. Moores, J. (1990). A meta-analytic review of the effects of compressed work schedules. Applied Human Resource Management Research, 1, 12-8. Pati, A. K., Chandrawanshi, A., & Reinberg, A. (2001). Shift work: Consequences and management. Current Science, 81, 32-52. Rosa, R. R. (1991). Performance, alertness, and sleep after 3.5 years of 12h shifts: A follow-up study. Work and Stress, 5(2), 107-116. Smiley, A., Moray, N. (1989). Review of 12-hours shifts at nuclear generating stations (Report to Atomic Energy Control Board, Project No. 2.131.1). Ottawa, Canada. Tepas, D. I., Paley, M .J., Popkin, S. M. (1997). Work schedules and sustained performance. In G. Salvendy (Ed.) Handbook of Human Factors and Ergonomics (pp. 1021-1058). New York: John Wiley & Sons. Tucker, P., Smith, L., Macdonald, I., & Folkhard, S. (1999). Distribution of rest days in 12 hour shift systems: impacts on health, wellbeing, and on shift alertness. Occupational Environmental Medicine, 56, 206-214. Ximes GmbH. (2003). Work schedule representation and analysis software (RAS). Accessible at: http://hfcc.dot.gov/ofm/index.html Review/Adjust Overtime Work Policies and Procedures Overtime policies are one of several factors that must be considered in establishing a specific work schedule. The PHMSA Advisory Bulletin (ADB-05-06) provides some guidance on this topic, including: advising operators to: (1) “limit work schedules to no more than 12 hours in any 24 hour period except in extraordinary or emergency situations; and to develop a policy or procedure to manage unusual circumstances where a Controller is required to work more than 12 hours in any 24 hour period;” and (2) schedule “overtime on an individual basis, not the shift of Controllers and Controller supervisors; and that Controller fatigue should be considered in allowing overtime.” There is a substantial amount of research that reports relationships between extended overtime hours and health problems among workers. Van der Hulst (2003) provides a comprehensive summary of this research and concludes that “there is good reason to be concerned about the possible detrimental effects of long work hours on health, in particular cardiovascular disease, diabetes, illnesses leading to disability retirement, subjectively reported physical ill health, and subjective fatigue.” One of the major concerns with excessive overtime in 12-hour shift schedules is the cumulative build-up of fatigue over days or weeks and the corresponding extended period of off-time required by individuals to fully recover from the resulting sleep debt. In a recent review of this topic, QinetiQ & Folkard (2006) note the lack of clear field research results, but find recent laboratory studies providing good evidence for significant levels of cumulative fatigue following two weeks of limited sleep. The effects of overtime on predicted worker fatigue and operational risks can be predicted using either of the work schedule evaluation tools identified in the discussion of modified work shift schedules. Key References: Van der Hulst, M. (2003). Long work hours and health. Scandinavian Journal of Work, Environment, and Health, 29, 171-188. QinetiQ & Folkard (2006). Fatigue risk index calculator. Available at http://www.hse.gov.uk/research/rrhtm/rr446.htm#

Attachment 1, passage 326Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-115 Controller Alertness: Slow Work Periods 9.3 Conduct Sleep Disorder Screening Sleep disorders can disrupt sleep, which can lead directly to Controller fatigue; or they can contribute to fatigue associated with long work hours. The condition of sleep apnea affects as many as 1 out of 20 people. This is a breathing disorder involving periodic interruptions of breathing during sleep. Medical specialists can be consulted to determine if a specific condition exists that is interfering with sleep, and proper medical interventions can help to alleviate the problem. Self-screening to identify potential sleep disorders is one approach that is supported by the National Sleep Foundation. That organization’s website provides a range of self-assessment tools, educational information, and referral sources as http://www/sleepfoundation.org/ . McCallum et al. (2003) report that several U.S. transportation operators who have identified worker alertness as an operational risk have instituted confidential sleep disorder screening as part of their broader fatigue management programs. Given the safety-critical nature of Controller and field personnel job performance, consideration should be given to including sleep disorder screening as part of an operator’s pre- employment and regular company physical exams. Key References: McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. Accessible at: http://hfcc.dot.gov/ofm/index.html Conduct Controller Fatigue Management Training The fundamental factors that affect worker alertness on the job are the quantity, quality, and timing of their sleep. In addition, informed use of caffeine during the job is one of the most effective mitigations for short-term fatigue reduction. Because both of these factors are best managed by an informed worker, alertness management training can serve as a useful component of an alertness management program. Such training can include topics that address what the Controller, his/her family, and the company can do to reduce work fatigue. A word of caution regarding all training programs was provided by Tepas (1993), who indicated that he was unable to uncover any research demonstrating the value of such programs. Training should not be relied upon as the only mitigation, especially since research has yet to demonstrate the value of such programs. Most workers will be more motivated to adopt effective life style changes and employ short-term tactics if they perceive the recognition by management of the shared responsibility to manage alertness (Monk, 1990). Educational topics should be limited in number to the most relevant and practical, so that they might be remembered and applied. Particularly important topics for a 12-hour rotating shift control room environment would likely include the following: - Sleep basics – circadian rhythm, work shift lags, sleep requirements, sleep debts - Family responsibilities in supporting good sleep hygiene - Effective fatigue countermeasures Key References: McCallum. M., Sanquist, T., Mitler, M., & Krueger, G. (2003). Commercial Transportation Operator Fatigue Management Reference. Washington, DC: U.S. Department of Transportation. Monk, T. H. (1990). The relationship of chronobiology to sleep schedules and performance demands. Work and Stress, 4(3), 227-236. Tepas, D. (1993). Educational programmes for shiftworkers, their families, and prospective shiftworkers. Ergonomics, 36, 199-209.#

Attachment 1, passage 327Page G-116 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.3 Controller Alertness: Slow Work Periods Implement Rest Break and Napping Policy and Procedures Pipeline operators are advised in the PHMSA Advisory Bulletin (ADB-05-06) to establish “work relief periods and other measures during Controller shifts to promote alertness and enhance capabilities for effective decision-making”. Control rooms commonly have minimal staffing levels during night shifts, reducing the opportunity for Controllers to take rest breaks or naps during night shifts, when their alertness would be expected to be lower than during day shifts. However, the demonstrated effectiveness of both rest breaks and naps suggests that they should be seriously considered by operators facing operational risks associated with Controller alertness that cannot be readily addressed through work shift scheduling. The value of short breaks from work during night shift work, especially when coupled with food intake or moderate activity, is in providing a temporary relief from fatigue that is the result of time on task. However, such breaks do not appear to relieve fatigue due to lack of sleep. Akerstedt (1998) reviewed the research on napping during night shifts and indicates that “the overall impression is that napping may be the most effective countermeasure against sleepiness at work”. McCallum et al. (2003) provide a summary of factors affecting the appropriateness and scheduling of brief naps, including the need to provide allowances for the short, 5-15 minute period of reduced alertness (sleep inertia) immediately after awakening. An on-site rest facility can provide a general environment that is conducive to falling asleep quickly and providing Controllers with an opportunity for regenerative brief naps or short sleep periods. Such a facility can have the added benefit of helping workers avoid commuting during especially low levels of alertness following a nighttime shift or unavoidable extended shifts. Key References: Akerstedt, T. (1998). Shift work and disturbed sleep/wakefulness. Sleep Med Rev, 2(2), 117-28. Della Rocco, P.S., Comperatore, C., Caldwell, L., and Cruz, C. (February 2000). Effects of napping on night shift performance. Washington, DC: DOT Federal Aviation Administration. McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. Accessible at: http://hfcc.dot.gov/ofm/index.html Rosekind, M., Smith, R., Miller, D., Co, E., Gregory, K., Webbon, L., Gander, P., & Lebazqz, V. (1995). Alertness management: Strategic naps in operational settings. Journal of Sleep Research, 4, Supplement 2, 62-66.#

Attachment 1, passage 328Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-117 Controller Alertness: Slow Work Periods 9.3 Change the Control Room Environment to Reduce Fatigue Modifications to control room environments can be targeted at either adjustments to circadian cycles of workers or more general stimulation and immediate increases in alertness. The notice accompanying PHMSA Advisory Bulletin (ADB- 05-06) suggests that control room lighting and temperature can be manipulated to reduce Controller fatigue during both daytime and nighttime shifts. However, there are some qualifications to this general statement. Individuals’ circadian rhythms have been successfully adjusted through laboratory administration of relatively high artificial light levels (3- 4,000 lux) (Cajochen et al., 2000). Late night exposure delays the rhythm whereas morning exposure advances the rhythm. This technique could have value in helping individuals adjust to extended nighttime work. However, any effective shift in the circadian cycle of an individual working a relatively brief series of nighttime shifts might be offset by the loss of sleep during a more difficult readjustment to the daytime cycle. Efforts to modify work environments in an attempt to stimulate workers and reduce fatigue have been reviewed by Akerstedt and Landstrom (1998), as summarized below. - Lower levels of light (in the 1-2,000 lux range) are judged to have more general stimulating effects, but adequate field research has not yet been conducted to support reliable guidance for implementation. - There is a common sense notion that social interaction and light exercise are effective near-term fatigue countermeasures; however, Akerstedt and Landstrom were not aware of any research demonstrating the effectiveness of either approach. - High room temperatures (30-35 degrees C) are generally associated with reduced alertness; so these temperature levels should be avoided. Relatively severe decreases in temperature appear to be required to reduce the onset of fatigue for even brief periods. - Poor ventilation can result in reduced alertness if it is associated with increased levels of carbon monoxide; which can be offset by improved ventilation and corresponding reductions in carbon monoxide in the working environment. Key References: Akerstedt, T; Landstrom, U. (1998). Work place countermeasures of night shift fatigue. International Journal of Industrial Ergonomics, 21, 167-178. Cajochen, C., Zeitzer, J., Czeisler, C., & Dijk, D. (2000). Dose-response relationship for light intensity and ocular and electroencephalographic correlates of human alertness. Behavioral Brain Research, 115, 75-83. Provide Additional Stimulation During Slow Work Periods Controllers have reported reduced alertness levels following extended periods of low stimulation. Providing additional stimulation is a logical mitigation in addressing slow work periods. One set of mitigations can involve providing an external source of stimulation and/or entertainment, such as access to television, music, video, or the internet. Conversation with co-workers is another means of increasing stimulation. Such activities have been shown to temporarily increase physiological stimulation and serve as a short-term means of maintaining awareness. An alternative mitigation is to provide an opportunity for short, moderate-level exercise, such as through the use of an exercise cycle, treadmill, or elliptical walker. Research indicates that brief periods of exercise can reduce feelings of sleepiness, although job performance does not appear to improve. Key References: McCallum, M.; Sanquist, T.; Mitler, M.; & Krueger, G. (2003). Commercial transportation operator fatigue management reference (pp. 3-1-8). Washington, D.C.: U.S. Department of Transportation Research and Special Programs Administration. (Accessible at: http://hfcc.dot.gov/ofm/index.html) Reyer, L. & Horne, J. (1998). Evaluation of ‘in car’ countermeasures to sleepiness: Cold air and radio. Sleep, 21, 46-50.#

Attachment 1, passage 329Page G-118 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.3 Controller Alertness: Slow Work Periods Implement a Fatigue Recognition and Self-Reporting Policy and Procedures Subjective reports of personal fatigue levels have been demonstrated to provide generally reliable data. So, it would appear that there could be an opportunity to avoid particularly high periods of operational risk when individuals are experiencing excessive levels of fatigue if they could report such instances. Unfortunately, many operators have limited flexibility to address such situations without disrupting the work schedule of other Controllers and placing a work schedule burden on a co-worker. However, in those operations with adequate staffing to respond to self-reported levels of high fatigue, there could be substantial benefits. A few factors to consider in the implementation of such a policy are outlined below. - Self reporting cannot have any retribution associated with it. It must be emphasized that the intent of the policy is to reduce operational risk and help Controllers deal with unusual circumstances that result in exceptionally low levels of alertness. - In companies that have instituted a self-reporting policy, the frequency of reporting is very low – in the neighborhood of once per year – and the resulting benefits with respect to demonstrating the priority of safety and worker well-being may far outweigh the potential costs of rare personnel rescheduling demands. - This policy could be coupled with a rest facility, providing a Controller with the opportunity to obtain a restorative sleep of 2-6 hours while an off-duty or on-duty relief worker provided support at the console. - An extreme implementation of this policy, which some operators have in place, calls for shutting-down console operations if a Controller reports that s/he is excessively fatigued and no relief Controller is available. Key References: None#

Attachment 1, passage 330Page G-120 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 9.4 Controller Alertness: Alertness Management Practices Definition This topic covers two specific aspects of broader alertness management practices in the control room. Performance Factor List 9.4.1 Controllers have not been provided training on sleep basics, personal alertness practices, and effective fatigue-reduction practices. 9.4.2 Controllers do not notify management when they report to work without adequate rest. Applicable Mitigation For Each Performance Factor 9.4.1 9.4.2 Conduct Controller Fatigue Management Training — Implement a Fatigue Recognition and Self-Reporting Policy and Procedures    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 331Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-121 Controller Alertness: Alertness Management Practices 9.4 Discussion Conduct Controller Fatigue Management Training The fundamental factors that affect worker alertness on the job are the quantity, quality, and timing of their sleep. In addition, informed use of caffeine during the job is one of the most effective mitigations for short-term fatigue reduction. Because both of these factors are best managed by an informed worker, alertness management training can serve as a useful component of an alertness management program. Such training can include topics that address what the Controller, his/her family, and the company can do to reduce work fatigue. A word of caution regarding all training programs was provided by Tepas (1993), who indicated that he was unable to uncover any research demonstrating the value of such programs. Training should not be relied upon as the only mitigation, especially since research has yet to demonstrate the value of such programs. Most workers will be more motivated to adopt effective life style changes and employ short-term tactics if they perceive the recognition by management of the shared responsibility to manage alertness (Monk, 1990). Educational topics should be limited in number to the most relevant and practical, so that they might be remembered and applied. Particularly important topics for a 12-hour rotating shift control room environment would likely include the following: - Sleep basics – circadian rhythm, work shift lags, sleep requirements, sleep debts - Family responsibilities in supporting good sleep hygiene - Effective fatigue countermeasures Key References: McCallum. M., Sanquist, T., Mitler, M., & Krueger, G. (2003). Commercial Transportation Operator Fatigue Management Reference. Washington, DC: U.S. Department of Transportation. Monk, T. H. (1990). The relationship of chronobiology to sleep schedules and performance demands. Work and Stress, 4(3), 227-236. Tepas, D. (1993). Educational programmes for shiftworkers, their families, and prospective shiftworkers. Ergonomics, 36, 199-209. Implement a Fatigue Recognition and Self-Reporting Policy and Procedures Subjective reports of personal fatigue levels have been demonstrated to provide generally reliable data. So, it would appear that there could be an opportunity to avoid particularly high periods of operational risk when individuals are experiencing excessive levels of fatigue if they could report such instances. Unfortunately, many operators have limited flexibility to address such situations without disrupting the work schedule of other Controllers and placing a work schedule burden on a co-worker. However, in those operations with adequate staffing to respond to self-reported levels of high fatigue, there could be substantial benefits. A few factors to consider in the implementation of such a policy are outlined below. - Self reporting cannot have any retribution associated with it. It must be emphasized that the intent of the policy is to reduce operational risk and help Controllers deal with unusual circumstances that result in exceptionally low levels of alertness. - In companies that have instituted a self-reporting policy, the frequency of reporting is very low – in the neighborhood of once per year – and the resulting benefits with respect to demonstrating the priority of safety and worker well-being may far outweigh the potential costs of rare personnel rescheduling demands. - This policy could be coupled with a rest facility, providing a Controller with the opportunity to obtain a restorative sleep of 2-6 hours while an off-duty or on-duty relief worker provided support at the console. - An extreme implementation of this policy, which some operators have in place, calls for shutting-down console operations if a Controller reports that s/he is excessively fatigued and no relief Controller is available. Key References: None#

Attachment 1, passage 332Page G-122 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 10.1 Automation: Automated Operations Definition This topic covers the ways in which certain aspects of the Controller’s job may be automated, such as the implementation of preset control points or alarms and the various uses of PCL (Program Control Logic). Performance Factor List 10.1.1 Automation of control actions makes the Controller job more difficult. 10.1.2 Too many steps are required to set up an automated sequence of control actions. 10.1.3 Automated operation of some equipment conflicts or interferes with Controller actions. 10.1.4 Controllers can forget to perform a manual control action because the initial steps are automated. 10.1.5 Automation is not consistent across similar stations/locations. 10.1.6 Controllers do not understand how automation works at a station/location. 10.1.7 Controllers do not sufficiently trust the reliability of control action automation. Applicable Mitigation For Each Performance Factor 10.1.1 10.1.2 10.1.3 10.1.4 10.1.5 10.1.6 10.1.7 Revise the Allocation of Control Functions Between Controllers and Automation —  — — — — Revise the Design and Implementation of Automated Controls —     — — Revise the Use of Feedback in Automated Controls — — —  —   Provide Special Topics Training — — — — —    Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 333Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-123 Automation: Automated Operations 10.1 Discussion Revise the Allocation of Control Functions Between Controllers and Automation As defined by O’Hara et al. (2004) with reference to nuclear power plant control, “function allocation is the analysis of the requirements for plant control and the assignment of control functions to (1) personnel (e.g., manual control), (2) system elements (e.g., automatic control and passive, self-controlling phenomena), and (3) combinations of personnel and system elements (e.g., shared control and automatic system with manual backup).” Most pipeline systems allocate control across all three of these basic modes in controlling system components, (e.g., pumps and valves). O’Hara et al. identify the following factors as relevant in the function allocation process: performance demands; human and machine capabilities/limitations; existing practices; operating experience; regulatory requirements; technical feasibility; and cost. Most pipeline systems have been in place for decades and the issue of function allocation involves a consideration of retrofit requirements. In existing pipeline systems, the technical feasibility and cost of changes from the current function allocation scheme will be significantly influenced by the capabilities of the current SCADA and field systems. Migration to a new SCADA system with added automation capabilities and/or field systems with added remote control features can have very significant cost impacts. Review and revision of control function allocation should involve close participation by a team of Controllers who monitor or execute the functions under consideration, along with the field operations personnel affected by such changes and control center SCADA engineers who would implement any revisions. An important caveat in revising the allocation of control functions is to avoid unnecessary control automation. Madhaven, Wiegmann, and Lacson (2006) recently reported research demonstrating that operator trust is especially vulnerable for functions that can easily be performed by operators. Basically, if there is not a general issue with Controller workload and errors cannot be traced to specific manual control actions, then there should be a compelling basis for automating such functions. Key References: Hollifield, B. & Habibi, E. (2006) The alarm management handbook. Houston, TX: PAS. O’Hara, J., Higgins, J., Persensky, J., Lewis, P., & Bongarra, J. (2004). Human factors engineering program review model (NUREG-0711, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Madhavan, P. Wiegmann, D., & Lacson, F. (2006). Automation failures on tasks easily performed by operators undermine trust in automated aids. Human Factors, 48, 241-256.#

Attachment 1, passage 334Page G-124 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 10.1 Automation: Automated Operations Revise the Design and Implementation Automated Controls The design and implementation of specific automated pipeline controls will be constrained by the current level of automation, SCADA system capabilities, and field system capabilities. Sheridan (2002) defines six general levels of control, which he refers to as (1) direct human control, (2) indirect human control, (3) computer-aided indirect control, (4) supervisory control, (5) remote supervisory control, and (6) remote multi-task supervisory control. Most pipeline SCADA automated control falls within levels 3 through 6 in Sheridan’s scheme; and each level and specific implementation requires detailed analysis of the control functions and corresponding SCADA user interface features. The type of controls used in SCADA-based pipeline automated control functions have been termed ‘soft controls’ by O’Hara et al. (2002), reflecting that the interfaces between the Controller and the SCADA system are mediated by software rather than by direct physical connections. Two general areas in soft control design that are addressed in detail by O’Hara et al., include information displays and user-system interaction. Important soft control information display considerations include the means for selecting the components to be controlled, the display areas where input is entered, and the formats used for entering data. The considerations in the design of soft control user-system interactions are addressed by O’Hara et al. (2002) under the three separate types of interaction of selecting variables or components to be controlled, providing the control input, and monitoring the system’s response. A separate mitigation in this section specifically addresses the use of feedback to allow Controllers a means of monitoring the system’s response. The redesign of automated controls should involve close participation by a team of Controllers who monitor or execute the functions under consideration, along with the field operations personnel affected by such changes and control center SCADA engineers who would implement any redesigns. Key References: Hollifield, B. & Habibi, E. (2006) The alarm management handbook. Houston, TX: PAS. O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Sheridan, T. (2002). Human and automation. Santa Monica, CA: John Wiley & Sons, Inc in cooperation with the Human Factors and Ergonomics Society.#

Attachment 1, passage 335Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-125 Automation: Automated Operations 10.1 Revise the Use of Feedback in Automated Controls The use of feedback in automated controls has been separated from the general discussion of automated control design, due to its relationship to the two relatively unique automation concerns of (1) Controllers forgetting to perform a manual control action because the initial steps are automated (Performance Factor 10.1.4) and (2) Controllers not sufficiently trusting the reliability of control action automation (Performance Factor 10.1.7). System feedback to the Controller at the appropriate time following the initiation of an automated step can serve as a memory prompt to Controllers when they are required to initiate a subsequent manual step or system input. This is simply a logical mitigation to minimize the likelihood of a lapse in the Controller’s memory. Preliminary research suggests that such lapses are considered by Controllers to occur infrequently, but that they are also judged to be associated with substantial operational risk. Therefore, a careful review of control actions that involve initial automated steps followed by manual steps would help to define the potential scope of mitigations of this type. System feedback to the Controller regarding the consequences of automated control actions is also a critical requirement in establishing and maintaining appropriate Controller trust of automation, as well as the Controller’s understanding of the function and reliability of automated system controls. In reviewing the research relevant to system design and operator trust of automation, Lee and See (2004) note that the appropriate level of trust reflects the correct calibration between a person’s trust in automation and the automation capabilities and reliability. Critical features of system feedback that have been shown to affect appropriate calibration of operator trust include feedback timeliness, completeness, and accuracy. With respect to completeness, Parasuraman and Riley (1997) note that as the level of automation increases, the amount of feedback to the operator must increase correspondingly so that an accurate understanding of the operational situation is maintained. The redesign of automated control feedback should involve close participation by a team of Controllers who monitor or execute the functions under consideration, along with the field operations personnel affected by such changes and control center SCADA engineers who would implement any revisions. Key References: Hollifield, B. & Habibi, E. (2006) The alarm management handbook. Houston, TX: PAS. Lee, J., & See, K. (2004). Trust in automation: Designing for appropriate reliance. Human Factors, 46, 50-80. Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39, 230-252 Provide Special Topics Training Parasuraman and Riley (1997) reviewed the research pertaining to automation use, misuse, disuse, and abuse and concluded that better operator knowledge of how automation works results in more appropriate use of automation. In particular, these authors advocate training operators about how to make rational decisions regarding their use of automation; as well as training regarding the operational philosophy underlying the current applications of automation. Operators also report that hands-on training with automation helps Controller trainees to better understand and gain trust in automation functions. This mitigation is more fully addressed in Section 7.1, which is directly relevant to the objectives of mitigating a lack of understanding and/or trust of automated control. Key References: Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39, 230-252#

Attachment 1, passage 336Page G-126 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 11.1 Control Room Design and Staffing: Control Room Design Definition This topic covers how well control room staffing, facilities, and layout accommodate breaks. Performance Factor List 11.1.1 The location of break facilities keeps Controllers away from their console too long. 11.1.2 The location of break facilities keeps Controllers from taking appropriate brief breaks. 11.1.3 The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.). 11.1.4 Controllers on break cannot be reached to address an immediate operational situation. Applicable Mitigation For Each Performance Factor 11.1.1 11.1.2 11.1.3 11.1.4 Revise the Location of Break Facilities   — — Revise Controller Break Protocols — —   Provide SCADA Alarm Monitors in Break Facilities     Revise Controller Local Communications — — —  Cross-train Controllers on Adjacent Consoles — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 337Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-127 Control Room Design and Staffing: Control Room Design 11.1 Discussion Revise the Location of Break Facilities Current practice regarding the location of break facilities varies substantially within the industry, depending on the control room staffing policy, operational philosophy, overall scope of operations, and control center physical layout. In general, newer control centers tend to have more readily accessible break facilities. The appropriate mitigation strategy in addressing identified risks in this area – changing the location of break facilities – would likely best be defined through consultation with control room staff, management, and facilities managers. There is limited guidance in the public literature regarding this mitigation, but O’Hara et al. (2004) provide the following relevant recommendations for the design of nuclear power plant control room break facilities. - A clean and well designed restroom and kitchen or eating area should be provided within (preferably) or near the control room isolation boundary. Since formal breaks are not scheduled in most control rooms, it is important that personnel have access to these facilities without delay. It is preferable that they be used only by control room personnel. - Consideration should be given to providing a rest area (separate from the eating area) conducive to relaxation and revitalization, especially where shifts are long. Key References: O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Revise Controller Break Protocols This mitigation is a component of the broader area of Controller break policies and practices. This mitigation can be applied in addressing potential risks associated with two Performance Factors: ‘The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.)’ (Performance Factor 11.1.3) and ‘Controllers on break cannot be reached to address an immediate operational situation’ (Performance Factor 11.1.4). Addressing issues related to Performance Factor 11.1.3 would likely require corresponding adjustments to control room staffing (see 11.2) and/or assignments in order to provide console coverage during scheduled and unscheduled personal breaks. Addressing Performance Factor 11.1.4 would likely require policies and procedures related to control room communications, including the provision of equipment identified in the following mitigation description. An ongoing, yet evolving, issue concerns Controllers who take smoking breaks during their shifts. With many facilities going smokeless, these individual are often required to go to a designated smoking area and arrange coverage of their console during their smoking break. Policies and procedures regarding this practice may be required to ensure proper console coverage. Key References: None#

Attachment 1, passage 338Page G-128 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 11.1 Control Room Design and Staffing: Control Room Design Provide SCADA Alarm Monitors in Break Facilities Providing a means of maintaining situational awareness and being alerted to abnormal situations during a break can be accomplished by providing SCADA alarm monitors in break facilities. This is similar to a common practice onboard commercial ships that provide an electronic chart display in watch standers’ staterooms and mess halls. Although there is no research evidence supporting this practice, there is substantial anecdotal evidence regarding its value. Key References: None Revise Controller Local Communications Operators have identified several approaches to address difficulties in maintaining communications with Controllers during their shift when they are away from their console, including the use of pagers, intercoms, and cell phones to contact Controllers during their break. It should be noted that an emerging issue that is coupled with local laws regarding smoking in public areas is access to Controllers who are taking a break to smoke during their shift. Limited guidance regarding this mitigation was identified in the public literature, although O’Hara et al. (2004) provide the following relevant recommendations for nuclear power plant control room personnel communications. - Provision should be made for Controller communication if break facilities are out of voice contact with the control room, so that an operator taking a break can be contacted as necessary by personnel in the control room - Intercom systems should be provided to interconnect the control room with important plant areas and other areas where control room or operating personnel might be. Areas served by intercoms might include the shift supervisor's office, plant security office, operators' lounge, locker rooms, and restrooms. - Provide hand held alarm notification systems that are carried by Controllers when away from the console. Key References: O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission. Cross-train Controllers on Adjacent Consoles Cross training Controllers on adjacent consoles, along with providing duplicate alarms on adjacent consoles, provides several benefits with respect to control room staffing and providing the opportunity for breaks. Key References: None#

Attachment 1, passage 339Page G-130 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 11.2 Control Room Design and Staffing: Control Room Staffing Definition This topic covers the general level of control room staffing and work assignments in support of normal and abnormal operating conditions. Performance Factor List 11.2.1 Another Controller’s long break times puts an excessive burden on the relieving Controller. 11.2.2 Controller staffing is not adequate to cover for sudden problems (e.g., family emergencies, sudden serious illness, etc.). 11.2.3 Controller staffing is not adequate to allow for vacation, sick leave, and/or regularly scheduled days off. 11.2.4 Controllers work on their scheduled day off because of required participation in extra activities (e.g., special projects, meetings, training, etc.). 11.2.5 Controller staffing is not adequate to provide Controller assistance during busy normal operations. 11.2.6 Controller staffing is not adequate to provide Controller assistance during abnormal situations. Applicable Mitigation For Each Performance Factor 11.2.1 11.2.2 11.2.3 11.2.4 11.2.5 11.2.6 Adjust Controller Staffing Levels —      Review/Adjust Overtime Work Policies and Procedures (See 9.1) — — —  — — Reassign Normal Operations Control room Duties and Assignments — — —    Revise Controller Break Protocols — — — — — Revise Controller Local Communications — — — — —  Solid empirical evidence supporting an established mitigation that has been repeatedly shown to effectively address this Performance Factor; or supported by recommendations from established standards (e.g., NUREG)  Some empirical evidence suggesting that mitigation may be effective in addressing Performance Factor (This includes existing implementations of the mitigation even though the outcome may be undocumented)  There is no existing evidence supporting the effectiveness of this mitigation, but a logical and/or anecdotal case can be made for why this mitigation is applicable to this Performance Factor — Mitigation is not applicable to Performance Factor#

Attachment 1, passage 340Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-131 Control Room Design and Staffing: Control Room Staffing 11.2 Discussion Adjust Controller Staffing Levels Adjusting Controller staffing levels is a very general mitigation that may be required in order to implement more specific mitigations that address proposed control staff assignments, Controller work schedule adjustments, personnel overtime policies, and/or personnel vacation policies (all of which are addressed as individual mitigations elsewhere in this document). Brabazon and Conlin (2001) present a procedure for assessing the safety of alternative control room staffing arrangements. However, the current risk assessment and mitigation methodology that has been tailored to liquid pipeline control room operations would appear to be more applicable and adaptable to individual pipeline operator issues than that procedure, which was developed for a broader range of chemical industries. In assessing alternative staffing levels, various commercially available staff scheduling tools are available. It is likely that many of these programs would be useful in assessing the feasibility of alternative modifications to staff assignments, work schedules, and overtime policies with various staffing levels. An additional perspective that should be considered is that abnormal situations should drive staffing levels. That is, staffing levels should be estimated by a critical task identification and analysis. Key References: Brabazon, P. & Conlin, H. (2001). Assessing the safety of staffing arrangements for process operations in the chemical and allied industries. Norwich, UK: Health and Safety Executive. Review/Adjust Overtime Work Policies and Procedures Overtime policies are one of several factors that must be considered in establishing a specific work schedule. The PHMSA Advisory Bulletin (ADB-05-06) provides some guidance on this topic, including advising operators to: (1) “limit work schedules to no more than 12 hours in any 24 hour period except in extraordinary or emergency situations; and to develop a policy or procedure to manage unusual circumstances where a Controller is required to work more than 12 hours in any 24 hour period;” and (2) schedule “overtime on an individual basis, not the shift of Controllers and Controller supervisors; and that Controller fatigue should be considered in allowing overtime.” There is a substantial amount of research that reports relationships between extended overtime hours and health problems among workers. Van der Hulst (2003) provides a comprehensive summary of this research and concludes that “there is good reason to be concerned about the possible detrimental effects of long work hours on health, in particular cardiovascular disease, diabetes, illnesses leading to disability retirement, subjectively reported physical ill health, and subjective fatigue.” One of the major concerns with excessive overtime in 12-hour shift schedules is the cumulative build-up of fatigue over days or weeks and the corresponding extended period of off-time required by individuals to fully recover from the resulting sleep debt. In a recent review of this topic, QinetiQ & Folkard (2006) note the lack of clear field research results, but find recent laboratory studies providing good evidence for significant levels of cumulative fatigue following two weeks of limited sleep. The effects of overtime on predicted worker fatigue and operational risks can be predicted using either of the work schedule evaluation tools identified in the discussion of modified work shift schedules. Key References: Van der Hulst, M. (2003). Long work hours and health. Scandinavian Journal of Work, Environment, and Health, 29, 171-188. QinetiQ & Folkard (2006). Fatigue risk index calculator. Available at http://www.hse.gov.uk/research/rrhtm/rr446.htm#

Attachment 1, passage 341Page G-132 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions 11.2 Control Room Design and Staffing: Control Room Staffing Reassign Normal Operations Control Room Duties and Assignments A very basic topic that is addressed through several focused mitigations discussed in this document is the analysis and design of the Controller job. There are numerous methods to analyze the physical and cognitive activities required in pipeline monitoring and control operations (see Kirwan & Ainsworth, 1992; Schaagen, Chipman, & Shalin, 2000 for overviews of appropriate methods). But the key here is the identification and remediation of specific distractions during normal operations. Thus, a focused review of Controller concerns and identified critical incidents could be the most appropriate initial course of action if it is determined that such distractions represent a risk of concern at a control room or console. Following such an analysis, specific changes in duties and assignments could be identified and implemented. Key References: Kirwan, B., & Ainsworth, L. (Eds.) (1992). A guide to task analysis. London: Taylor & Francis. Schaagen, J., Chipman, S., & Shalin, V. (Eds.). (2000). Cognitive task analysis. Mahwah, NJ: Erlbaum. Revise Controller Break Protocols This mitigation is a component of the broader area of Controller break policies and practices. This mitigation can be applied in addressing potential risks associated with two Performance Factors: ‘The lack of breaks during a shift makes it difficult to meet basic personal needs (i.e., food, bathroom, illness, etc.)’ (Performance Factor 11.1.3) and ‘Controllers on break cannot be reached to address an immediate operational situation’ (Performance Factor 11.1.4). Addressing issues related to Performance Factor 11.1.3 would likely require corresponding adjustments to control room staffing (see 11.2) and/or assignments in order to provide console coverage during scheduled and unscheduled personal breaks. Addressing Performance Factor 11.1.4 would likely require policies and procedures related to control room communications, including the provision of equipment identified in the following mitigation description. An ongoing, yet evolving, issue concerns Controllers who take smoking breaks during their shifts. With many facilities going smokeless, these individual are often required to go to a designated smoking area and arrange coverage of their console during their smoking break. Policies and procedures regarding this practice may be required to ensure proper console coverage. Key References: None#

Attachment 1, passage 342Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Risk Mitigation Descriptions Page G-133 Control Room Design and Staffing: Control Room Staffing 11.2 Revise Controller Local Communications Operators have identified several approaches to address difficulties in maintaining communications with Controllers during their shift when they are away from their console, including the use of pagers, intercoms, and cell phones to contact Controllers during their break. It should be noted that an emerging issue that is coupled with local laws regarding smoking in public areas is access to Controllers who are taking a break to smoke during their shift. Limited guidance regarding this mitigation was identified in the public literature, although O’Hara et al. (2004) provide the following relevant recommendations for nuclear power plant control room personnel communications. - Provision should be made for Controller communication if break facilities are out of voice contact with the control room, so that an operator taking a break can be contacted as necessary by personnel in the control room - Intercom systems should be provided to interconnect the control room with important plant areas and other areas where control room or operating personnel might be. Areas served by intercoms might include the shift supervisor's office, plant security office, operators' lounge, locker rooms, and restrooms. - Provide hand held alarm notification systems that are carried by Controllers when away from the console. Key References: O’Hara, J., Brown, W., Lewis, P, & Persensky, J. (2002). Human-system interface design review guidelines (NUREG-0700, Rev. 2). Washington, DC: U.S. Nuclear Regulatory Commission.#

Attachment 1, passage 343Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page H-1 Step 8 Mitigation Development and Implementation Guidance and Worksheet APPENDIX H STEP 8 MITIGATION DEVELOPMENT AND IMPLEMENTATION GUIDANCE AND WORKSHEET#

Attachment 1, passage 344Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page H-3 Step 8 Mitigation Development and Implementation Guidance and Worksheet STEP 8 RISK MITIGATION DEVELOPMENT AND IMPLEMENTATION GUIDANCE Step 8 is conducted to develop and implement the selected risk mitigations. Figure H-1 depicts the four activities in this step. Considerations regarding each of these activities are discussed below, along with some guidance for risk mitigation development and implementation planning. A worksheet that can be used to support mitigation development planning is provided at the end of this appendix. 8.1 8.1 Establish a Establish a Mitigation Mitigation Development Plan Development Plan 8.2 8.2 Develop Develop and Refine and Refine Mitigations Mitigations 8.4 8.4 Implement Implement Mitigations Mitigations 8.3 8.3 Obtain User Feedback Obtain User Feedback Figure H-1. Step 8 Risk Mitigation Development and Implementation Activities 8.1. Establish a Mitigation Development Plan This sub-step takes the set of mitigations prioritized during the preceding Step 7 and incorporates a subset of them into an integrated mitigation development plan. Sub-step 8.1 will likely involve an ongoing, iterative process in which the requirements for the development and implementation of high-priority mitigations are identified, available budgets are reviewed, and the scope of an individual phase of mitigation development and implementation is matched to the organization’s objectives and budget. The Step 8 Mitigation Develop Plan Worksheet at the end of this appendix provides a general format that can be used to define and document required elements of the development plan for an individual mitigation. It is suggested that this worksheet be adapted to meet organizational objectives and practices; and then used as a working document until the mitigation development plan for the final set of mitigations to be developed has been selected. Following is some general guidance, divided into three activities, regarding the establishment of a mitigation development plan. Define development objectives and mitigation characteristics. Members of the risk management team may begin preparing their development plan by first analyzing a subset of mitigations that they estimate to roughly match current organizational objectives, available staff, and budgetary resources. Estimate development schedule and resource requirements. Following the initial characterization of mitigations, members of the risk management team may next begin to estimate the resources required for mitigation development. Resource estimates may be based upon a number of sources, including:#

Attachment 1, passage 345Page H-4 Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Step 8 Mitigation Development and Implementation Guidance and Worksheet  Institutional knowledge provided by risk management team members or from other company staff who have had experience developing similar mitigations;  Industry knowledge provided by other pipeline operators who have relevant experience and are willing to share it; and  Vendor estimates from experts with experience developing similar mitigations. Match development and implementation efforts to available resources. This final activity during Step 8.1 is conducted to both refine the description of mitigations and match the scope of the overall mitigation development plan to available resources. This process could take several forms, depending upon the policies and practices within the individual operator. One possibility is that the risk management team meets with management to present their initial mitigation development plans, along with recommendations on a course of action; then management could provide direction regarding development objectives and resource constraints. Such an initial meeting could be followed by one or more subsequent meetings in which refined plans are presented to management by the risk management team for review and guidance. Individual Step 8 Mitigation Develop Plan Worksheets can be completed for each of the mitigations that will potentially be developed and implemented during the upcoming phase of mitigation development and implementation. 8.2. Develop and Refine Mitigations Mitigation development will entail the execution of the development plan and coordination of the user feedback activities, as depicted in Figure H-1. Depending on the nature and scope of the mitigation, development and refinement may be conducted as an iterative activity involving the periodic collection and review of user feedback. This information should be used to determine if development objectives are successfully addressing those working conditions and monitoring and control activities identified in the mitigation development plan. Because development and refinement varies widely between potential mitigations, this document provides very limited guidance regarding this and subsequent activities. 8.3. Obtain User Feedback User feedback may be a central component of a mitigation development and implementation effort, depending upon the nature and scope of the mitigation. When feedback is obtained, representative users should be identified in advance, making certain that the full range of users’ inputs will be obtained, as appropriate for the specific mitigation characteristics and objectives. When applicable, feedback should be obtained using a structured question format that addresses the specific mitigation development objectives and the individual components and characteristics of the mitigation. One reference in developing these protocols may be the operational review guidance provided in other project documentation. 8.4. Implement Mitigations Mitigation implementation can proceed once a complete, first-generation mitigation is prepared. Depending upon the nature of the mitigation, implementation may involve some degree of an extended development activity. Critical components of implementation include user introduction, along with any required training and orientation; as well as user feedback, using the structured approach employed during mitigation development and refinement, as appropriate.#

Attachment 1, passage 346Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page H-5 Step 8 Mitigation Development and Implementation Guidance and Worksheet Post Mitigation Implementation Assessment Following mitigation implementation, operators will have the opportunity to assess the effectiveness of their risk mitigation efforts. As depicted in Figure 4 in the Methodology Overview of this guide, the current methodology provides the opportunity to implement a “risk mitigation feedback loop” to assess changes over time in the level of operational risks associated with specific Human Factors Topics and Performance Factors. Specifically, by re-administering the Controller Survey and Risk Likelihood Rating Activity after an appropriate period following the implementation of a series of mitigations, an operator will be able to assess the relative levels of various potential operational risks and identify changes in the nature and relative extent of those risks. Formally determining the effectiveness of mitigations in a complex organization is extremely difficult, due to the many uncontrolled events that tend to logically confound any clear-cut comparison. However, the relatively specific and detailed nature of the Performance Factors defined in this methodology should afford a reasonable opportunity for operators to gain some insights regarding the effectiveness of their risk management efforts. Some basic guidance regarding the implementation of this Risk Management Feedback Loop are summarized below.  The selection of Controller Survey respondents should follow the survey administration guidance in follow-up surveys and use the same target population so that a valid and reliable sample is obtained.  Some mitigations are more focused than others and these will provide the best opportunity to assess their effectiveness; since comparisons with the relevant set of Performance Factors will be possible. This may also require the computation of specific risk scores for the purpose of before and after comparison that are based on a pre-defined set of Performance Factors.  An adequate time should pass between full implementation of the mitigations prior to the reassessment of control room risks. This period will vary for the type of mitigations. However, most of the individual survey items ask Controllers to estimate the frequency that they have encountered working conditions associated with specific Performance Factors over the past year. Optimally, time should be provided for operations to stabilize following mitigation implementation; followed by an additional year before survey re- administration.  A control room is an evolving organization and it is likely that the introduction of this methodology will stimulate other efforts to reduce operational risk. These changes will logically confound an assessment of the specific effects of individual mitigations. If general improvement – as evidenced in the reduction in the relative standing of individual risks – is obtained, however, it is likely that overall improvement will also be obtained .#

Attachment 1, passage 347Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page H-7 Step 8 Mitigation Development and Implementation Guidance and Worksheet RISK MITIGATIONS DEVELOPMENT AND IMPLEMENTATION PLANNING WORKSHEET AND INSTRUCTIONS Members of the risk management team may document their mitigation development plan that includes the entries provided in the accompanying worksheet. This worksheet is intended to identify useful topics that could be documented at the completion of a planning effort. Following are definitions and discussions corresponding to each of the suggested headings in the worksheet. Potential Mitigation: This is the title or name of the mitigation adopted by the risk management team. Performance Factors being Addressed: These are the Performance Factors selected to be addressed by this mitigation. Importantly, these may represent a subset of all Performance Factors that might logically be addressed by a mitigation, due to such factors as limited relevance, the Risk Level of some Performance Factors, and a lack of overlap in mitigation characteristics when applied to multiple Performance Factors. Mitigation Development Rank-Order: These are the development rank-orders assigned to each mitigation during Step 7. Development and Implementation Issues: This is a summary of key issues that may affect the objectives, characteristics, and development resource requirements. Development Objective: This is a succinct statement regarding the specific operational safety and/or efficiency objectives corresponding to the development of this mitigation. The objective statement should reference the working conditions, pipeline monitoring and control activities, operational risks, and operational efficiencies identified as target issues during the operational review and risk mitigation strategy development activities. Mitigation Characteristics: This is a general description of the characteristics of the mitigation. The Mitigation Descriptions in this document may serve as a starting point for the risk management team in their definition of these mitigations descriptions. In general, these characteristics should represent descriptions of the end-product of the mitigation development and implementation activity, in terms of the physical properties of the mitigation, staff involvement, and operational activities represented by this mitigation. Schedule: This is the general development schedule for the mitigation. Depending on the scope of the development effort and organizational practice, it may be appropriate to identify development schedule phases and milestones. Staff Requirements: A critical resource at any control center is its staff. Depending on the scope of development and organizational practice, It may be useful to estimate the individual staff members required for mitigation development, the hours required of staff, and the length of time they will be required. Budget Requirements: The budgetary requirements for mitigation development can be defined in accordance with organizational practice.#

Attachment 1, passage 348Liquid Pipeline Operator’s Control Room Human Factors Risk Management Guide Page H-9 Step 8 Mitigation Development and Implementation Guidance and Worksheet STEP 8 MITIGATION DEVELOP PLAN WORKSHEET Potential Mitigation: Performance Factors being Addressed Mitigation Development Rank-Order Development and Implementation Issues Development Objective Mitigation Characteristics Schedule Staff Requirements Budget Requirements#