[Federal Register Volume 74, Number 231 (Thursday, December 3, 2009)]
[Rules and Regulations]
[Pages 63310-63330]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E9-28469]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Pipeline and Hazardous Materials Safety Administration
49 CFR Parts 192 and 195
[Docket ID PHMSA-2007-27954; Amdt. Nos. 192-112 and 195-93]
RIN 2137-AE28
Pipeline Safety: Control Room Management/Human Factors
AGENCY: Pipeline and Hazardous Materials Safety Administration (PHMSA);
DOT.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: PHMSA is amending the Federal pipeline safety regulations to
address human factors and other aspects of control room management for
pipelines where controllers use supervisory control and data
acquisition (SCADA) systems. Under the final rule, affected pipeline
operators must define the roles and responsibilities of controllers and
provide controllers with the necessary information, training, and
processes to fulfill these responsibilities. Operators must also
implement methods to prevent controller fatigue. The final rule further
requires operators to manage SCADA alarms, assure control room
considerations are taken into account when changing pipeline equipment
or configurations, and review reportable incidents or accidents to
determine whether control room actions contributed to the event.
Hazardous liquid and gas pipelines are often monitored in a control
room by controllers using computer-based equipment, such as a SCADA
system, that records and displays operational information about the
pipeline system, such as pressures, flow rates, and valve positions.
Some SCADA systems are used by controllers to operate pipeline
equipment, while, in other cases, controllers may dispatch other
personnel to operate equipment in the field. These monitoring and
control actions, whether via SCADA system commands or direction to
field personnel, are a principal means of managing pipeline operation.
This rule improves opportunities to reduce risk through more
effective control of pipelines. It further requires
[[Page 63311]]
the statutorily mandated human factors management. These regulations
will enhance pipeline safety by coupling strengthened control room
management with improved controller training and fatigue management.
DATES: Effective Date: The effective date of this final rule is
February 1, 2010. Compliance Date: An operator must develop control
room management procedures by August 1, 2011 and implement the
procedures by February 1, 2012.
Incorporation by Reference Date: The incorporation by reference of
certain publications listed in this rule is approved by the Director of
the Federal Register as of February 1, 2010.
FOR FURTHER INFORMATION CONTACT: For technical information contact:
Byron Coy at (609) 989-2180 or by e-mail at [email protected]. For
legal information contact: Benjamin Fred at (202) 366-4400 or by e-mail
at [email protected]. All materials in the docket may be accessed
electronically at http://www.regulations.gov. General information about
PHMSA may be found at http://phmsa.dot.gov.
SUPPLEMENTARY INFORMATION:
I. Background
A. Pipelines
Approximately two-thirds of our domestic energy supplies are
transported by pipeline. There are roughly 170,000 miles of hazardous
liquid pipelines, 295,000 miles of gas transmission pipelines, and 1.9
million miles of gas distribution pipelines in the United States.
Hazardous liquid pipelines carry crude oil to refineries and refined
products to locations where these products are consumed or stored for
later use. Hazardous liquid pipelines also transport highly volatile
liquids (HVLs), other hazardous liquids such as anhydrous ammonia, and
carbon dioxide. The regulations in 49 CFR part 195 apply to owners and
operators of pipelines used in the transportation of hazardous liquids
and carbon dioxide. Throughout this document, the term ``hazardous
liquid'' refers to all products in pipelines regulated under part 195.
In addition, the term ``operator'' refers to both owners and operators
of pipeline facilities.
Gas transmission pipelines typically carry natural gas over long
distances from gas gathering, supply, or import facilities to
localities where it is used to heat homes, generate electricity, and
fuel industry. Gas distribution pipelines take natural gas from
transmission pipelines and distribute it to residential, commercial,
and industrial customers. The regulations in 49 CFR part 192 apply to
operators of pipelines that transport natural gas, flammable gas, or
gas which is toxic and corrosive. Throughout this document, the term
``gas'' refers to all gases in pipelines regulated under part 192.
B. Control Rooms and Controllers
Pipelines vary from small and simple to large and complex.
Pipelines often span broad geographic areas. Gas distribution pipelines
may cover entire metropolitan areas, literally street-by-street. Gas
transmission and hazardous liquid pipelines may traverse hundreds or
thousands of miles. Equipment exists throughout pipelines that must be
operated to control the safe movement of commodity. This includes pumps
and compressors to provide motive force and valves that control
pressure or change position to direct the flow of commodity. In many
cases, parameters measuring pipeline operations, such as pressure and
flow, are monitored from remote, central locations referred to as
control rooms. Pipeline equipment may also be operated remotely from
control rooms. The employees who monitor pipeline parameters and direct
certain actions from control rooms are known as controllers.
Most pipelines are underground and operate without disturbing the
environment or negatively impacting public safety. However, accidents
do occur occasionally. Effective control is one key component of
accident prevention.\1\ Controllers can help identify risks, prevent
accidents, and minimize commodity loss if provided with the necessary
tools and working environment. This rule will increase the likelihood
that pipeline controllers have the necessary knowledge, skills, and
abilities to help prevent accidents. The rule will also ensure that
operators provide controllers with the necessary training, tools,
procedures, management support, and environment where a controller's
actions can be effective in helping to assure safe operation.
---------------------------------------------------------------------------
\1\ The pipeline safety regulations in 49 CFR parts 191, 192,
and 193 refer to certain events on a gas pipeline system as
``incidents'' while part 195 refers to similar failures on a
hazardous liquid pipeline system as ``accidents.'' Throughout this
document the terms ``accident'' and ``incident'' may be used
interchangeably to mean an event or failure on a gas or hazardous
liquid pipeline.
---------------------------------------------------------------------------
Most operators use computer-based SCADA systems, distributed
control systems (DCS), or other less sophisticated systems to gather
key information electronically from field locations.\2\ These systems
are configured to present field data to the controllers, and may
include additional historical, trending, reporting, and alarm
management information. Controllers track routine operations
continuously and watch for developing abnormal operating or emergency
conditions. A controller may take direct action through the SCADA
system to operate equipment or the controller may alert and defer
action to others.
---------------------------------------------------------------------------
\2\ SCADA, DCS or other similar systems perform similar
functions. Throughout this document, where the term SCADA is used,
it should be interpreted to mean SCADA, DCS or other similar
systems.
---------------------------------------------------------------------------
Control rooms and controllers are critical to the safe operation of
pipelines. Control rooms often serve as the hub or command center for
decisions such as adjusting commodity flow or facilitating an
operator's initial response to an emergency. The control room is the
central location where humans or computers receive data from field
sensors. Commands from the control room may be transmitted back to
remotely controlled equipment. Field personnel also receive significant
information from the control room. In essence, the control room is the
``brain'' of many pipeline systems.
Errors made in control rooms can have significant effects on the
controlled systems. A controller's errors can initiate or exacerbate an
accident. A controller's improper action or lack of action can place
undue stresses on a pipeline, which could result in a subsequent
failure, the loss of service, or an increase in lost commodity and risk
to people, property, the environment, and the fuel supply. On the other
hand, proper controller responses to developing abnormal operating
conditions or accidents can alleviate the consequences of some events,
or prevent them altogether, regardless of the initial cause.
C. Knowledge and Information Are Required To Do the Job
A controller must possess certain abilities, and attain the
knowledge and skills necessary to complete the various tasks required
for a specific pipeline system. To attain the necessary knowledge and
skills, the controller is typically required to complete extensive on-
the-job training and is often closely observed by an experienced
controller for a period of time. The controller must also review and
understand appropriate procedures, including those associated with
emergency response, and repeatedly practice the correct responses to a
variety of abnormal operating conditions. Pipeline operators
periodically evaluate a controller's skills and knowledge through the
regulatory-
[[Page 63312]]
required operator qualification (OQ) process.
Pipeline controllers must have adequate and up-to-date information
about the conditions and operating status of the equipment they monitor
and control if they are to succeed in maintaining pipeline safety.
Incorrect, delayed, missing, or poorly displayed data may confuse a
controller and lead to problems despite the extensive training,
qualification, and abilities of the controller. SCADA systems perform
the function of gathering this information and displaying it to the
controller. Operators need to assure that SCADA systems perform this
important function correctly, and that the information is displayed in
a manner that facilitates controller understanding and recognition of
abnormal operating conditions.
D. Control Room Management
All of this must occur within an environment that facilitates
appropriate and correct actions. Operators must prudently manage the
factors affecting the controller. This includes relevant human factors,
such as factors that can affect controller fatigue, and operator
processes and procedures for managing the pipeline from the control
room. PHMSA refers to the combination of all these factors as control
room management. This rule requires that operators take specific
actions to assure that pipeline control room management contributes to
the safe operation of pipeline facilities.
E. NPRM
On September 12, 2008, PHMSA published a notice of proposed
rulemaking (NPRM) (73 FR 53076) proposing to require operators of
hazardous liquid pipelines, gas pipelines, and liquefied natural gas
(LNG) facilities to amend their existing written operations and
maintenance procedures, OQ programs, and emergency plans to assure
controllers and control room management practices and procedures are
adequate to maintain pipeline safety and integrity. In summary, the
NPRM proposed to revise the Federal pipeline safety regulations by:
(1) Requiring operators to amend their Operations and Maintenance
Manuals to address the human factors management plan required by the
Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006
(PIPES Act (Pub. L. 109-468), Section 12).
(2) Defining the terms alarm, controller, control room, and SCADA.
(3) Requiring operators to define roles and responsibilities so
that management and controllers have uniform expectations and
understandings about response requirements before an abnormal operating
condition or emergency arises.
(4) Requiring operators to establish procedures to facilitate
controllers receiving management input in a timely manner when
required.
(5) Requiring operators to assure that controllers receive the
timely and necessary information they need to fulfill their
responsibilities.
(6) Requiring operators to conduct an initial point-to-point
baseline verification for each SCADA system to validate and document
that field equipment configurations agree with computer displays.
(7) Requiring operators to record critical information during each
shift.
(8) Requiring operators to include in their written procedures a
limit on the length of time a controller may work and a requirement to
allow time for adequate rest between shifts.
(9) Requiring two levels of alarm management review.
(10) Requiring operators to establish thorough and frequent
communication between controllers, management, and field personnel when
planning and implementing changes to pipeline equipment and
configuration.
(11) Requiring operators to review all reportable accidents and
incidents and certain other events on a routine basis to identify and
correct deficiencies related to: Controller fatigue; field equipment;
procedures; SCADA system configuration and performance; and training.
(12) Requiring operators to include certain content in their
controller training programs. The proposed rule included a minimum set
of elements that would overlap and supplement existing OQ programs.
(13) Requiring additional controller qualifications to measure or
verify a controller's performance, including the prompt detection of,
and appropriate response to, abnormal and emergency conditions likely
to occur.
(14) Mandating that a senior executive officer validate certain
aspects of controller training, qualification, and compliance with the
requirements of this rule.
(15) Requiring operators to maintain records that demonstrate
compliance with the regulation and to document any deviations from
their control room management procedures.
The intent of the NPRM was to ensure that pipeline controllers
would have the necessary knowledge, skills, abilities, and
qualifications to help prevent accidents. The proposal was also
intended to assure that operators would provide controllers with
accurate information and the training, tools, procedures, management
support, and operating environment where a controller's actions can
help prevent accidents and minimize commodity losses. The requirements
proposed in the NPRM were based on a controller study conducted by
PHMSA that had identified areas for enhancement, an NTSB SCADA safety
study, and certain mandates in the PIPES Act.
F. PHMSA Controller Study
As detailed in the NPRM, PHMSA had been studying and evaluating
control room operations for many years and began developing control
room inspection guidance in 1999. Congress subsequently enacted the
Pipeline Safety Improvement Act of 2002 (PSIA) (Pub. L. 107-355), which
required a pilot program be conducted to evaluate the need for pipeline
controllers to be certified through tests and other requirements. In
response to the PSIA, PHMSA conducted the Controller Certification
(CCERT) project study and reported its findings to Congress within a
report dated December 17, 2006, entitled ``Qualification of Pipeline
Personnel.'' This project included a comprehensive review of existing
controller training, qualification processes, procedures, and
practices. This review also included identifying potential enhancements
to controller qualifications and control room operations, such as
validation and certification processes currently used in other
industries to enhance public safety. Additional information on the
CCERT study may be found in the NPRM.
G. NTSB SCADA Study
The NTSB conducted a safety study on hazardous liquid pipeline
SCADA systems during the same period PHMSA conducted its CCERT study.
While the PHMSA project addressed a wider perspective of interest, the
two studies include similar findings.\3\ The NTSB study identified
areas for potential improvement, which resulted in five
recommendations. Three are incorporated in this final rule. PHMSA is
addressing the other two recommendations independent of this
rulemaking.
---------------------------------------------------------------------------
\3\ See ``Supervisory Control and Data Acquisition (SCADA)
Systems in Liquid Pipelines,'' Safety Study NTSB/SS-05-02, adopted
November 29, 2005.
---------------------------------------------------------------------------
The impetus of the NTSB study was a number of hazardous liquid
accidents investigated by the NTSB in which there was a delay between
the initial
[[Page 63313]]
indications of a leak evident on the SCADA system and the controller's
initiation of response efforts. The NTSB designed its SCADA study to
examine how hazardous liquid pipeline companies use SCADA systems to
monitor and record operating data and to evaluate the role of SCADA
systems in leak detection. The study identified five areas for
potential improvement:
Display graphics.
Alarm management.
Controller training.
Controller fatigue data collection.
Leak detection systems.
While the NTSB SCADA study specifically addressed hazardous liquid
pipelines, the report included an appendix of all NTSB SCADA-related
recommendations since 1976, which resulted from investigations of both
hazardous liquid and gas pipeline accidents. Since 1976, the NTSB has
issued approximately 30 recommendations to various entities related to
SCADA systems involving both hazardous liquid and gas pipeline systems.
PHMSA considers the NTSB recommendations in the most-recent SCADA
safety study to be applicable for both gas and hazardous liquid
pipelines. The recommendations being addressed through this rulemaking
are as follows:
NTSB Recommendation P-05-1
Operators of hazardous liquid pipelines should be required to
follow the API Recommended Practice 1165 (API RP 1165) for the use of
graphics on the SCADA screens.
NTSB Recommendation P-05-2
PHMSA should require pipeline companies to have a policy for the
review and audit of SCADA-based alarms.
NTSB Recommendation P-05-3
Operators should be required to include simulator or non-
computerized simulations for training controllers in recognition of
abnormal operating conditions, in particular leak events.
H. PIPES Act of 2006
The PIPES Act introduced additional requirements for PHMSA with
respect to control room management and human factors. Section 12 of the
PIPES Act (codified at 49 U.S.C. 60137) requires PHMSA to issue
regulations requiring each operator of a gas or hazardous liquid
pipeline to develop, implement, and submit a human factors management
plan designed to reduce risks associated with human factors, including
fatigue, in each control room for the pipeline. The plan must include,
among other things, a maximum limit on the hours of service for
controllers working in a control room. PHMSA, or a state authorized to
exercise safety oversight, is required to review and approve operators'
human factors plans, and operators are required to notify PHMSA (or the
appropriate state) of any deviations from the plan. Section 19 of the
PIPES Act requires PHMSA to issue standards to implement the three
recommendations of the NTSB SCADA safety study described above. This
final rule fulfills requirements in sections 12 and 19 of the PIPES
Act.
II. Summary of Public Comments
PHMSA received a total of 144 comments on the NPRM, including
comments from trade associations, municipal operators, local
distribution companies (LDC), NTSB, LNG facilities, gas transmission
pipeline operators, other gas distribution pipeline operators,
hazardous liquid pipeline operators, state regulators, and private
citizens. In addition, PHMSA participated in two trade association
meetings during the public comment period: (1) On October 14-15, 2008,
at the American Petroleum Institute (API) and Association of Oil
Pipelines (AOPL) forum for control room management in Houston, Texas;
and (2) on October 30, 2008, at the American Gas Association (AGA)
control room management workshop in Ashburn, Virginia. Summaries of
PHMSA's interactions at these meetings are available in the docket.
Subsequent to the public comment period, on February 12, 2009, PHMSA
staff met with NTSB staff in Washington, DC to discuss NTSB's comments
on fatigue mitigation. A summary of this meeting is also in the docket.
The national pipeline trade associations, consisting of the AGA,
the American Public Gas Association (APGA), the API, the AOPL, and the
Interstate Natural Gas Association of America (INGAA), submitted a
joint comment on October 8, 2008, shortly after the NPRM was issued,
suggesting the agency withdraw the proposed rule. The associations
contended that the proposed rule was overly-broad, unduly burdensome,
and exceeded what the associations saw as the intent of Congress. They
proposed that PHMSA issue an amended proposed rule with a clear scope
and revised definitions that would reflect congressional intent and
input from previous public meetings, and that would incorporate
available consensus standards to a greater degree.
The trade associations submitted a second letter on November 12,
2008, reaffirming their previous suggestion that the proposed rule be
reissued. The second joint letter provided alternative rule language to
support the associations' suggested re-issuance of the proposed rule.
The letter also suggested that PHMSA provide its pipeline safety
advisory committees the opportunity to vote on their suggested
alternative language at a joint committee meeting scheduled for
December 2008.
AGA, APGA, INGAA, and API/AOPL also individually submitted comments
on the proposed rule. Other associations that submitted comments were:
The National Association of Pipeline Safety Representatives (NAPSR),
Northeast Gas Association (NGA), Texas Energy Coalition (TEC), Texas
Oil and Gas Association (TXOGA), and Texas Pipeline Association (TPA).
NGA supported AGA's comments and TEC, TXOGA, and TPA supported the
joint trade associations' comments and the associated alternative
regulatory language. APGA stated that the rule as written would have a
disproportionately greater impact on small utilities with no offsetting
benefits based on its survey that found, on average, 22 percent of
small public gas system employees would be classified as controllers
subject to this rule. APGA noted that the agency's Regulatory Impact
Analysis (RIA) did not address adequately the impact on small entities.
NAPSR is an organization of state agency pipeline safety managers
responsible for the administration of their state's pipeline safety
programs. NAPSR expressed concerns about jurisdictional authority in
situations where a pipeline crosses State boundaries while under the
control of a control room, or where a pipeline connects to a dispatch
center or communications center in another State. NAPSR proposed
adopting the definitions of control room and controller in API
Recommended Practice 1168 (API RP 1168) to resolve the issue of
jurisdictional authority.
Comments from individual pipeline operators generally echoed the
comments of the joint trade associations and the individual trade
associations. Their comments mainly addressed the scope of the proposed
rule. Many of these commenters were concerned with the proposed
definitions of ``controller'' and ``control room,'' contending that
these definitions would have the effect of making the proposed rule's
scope unreasonably broad. Another area of significant concern was the
proposed requirement to conduct a 100 percent baseline data point
verification of SCADA systems. Pipeline operators generally commented
that this proposed requirement would entail significant cost for very
limited benefit. The
[[Page 63314]]
pipeline operators all supported the alternative regulatory language
submitted by the joint trade associations or their own trade
association.
III. Advisory Committees Meeting
On December 11, 2008, the Technical Pipeline Safety Standards
Committee (TPSSC) and the Technical Hazardous Liquid Pipeline Safety
Standards Committee (THLPSSC) met jointly for their bi-annual public
meeting in Arlington, Virginia.\4\ This meeting included consideration
of the proposed control room management rule. As described above, the
joint trade associations had submitted comments suggesting that the
proposal be withdrawn and that the rule be significantly revised before
being reissued. The associations submitted proposed alternative rule
language as a basis for revision and had asked that the advisory
committees be afforded the opportunity to consider their revised
language if PHMSA did not withdraw the proposed rule.
---------------------------------------------------------------------------
\4\ The TPSSC and THLPSSC are statutorily-mandated advisory
committees that advise PHMSA on proposed safety standards, risk
assessments, and safety policies for natural gas pipelines and for
hazardous liquid pipelines. Both committees were established under
the Federal Advisory Committee Act (Pub. L. 92-463, 5 U.S.C. App. 1)
and the pipeline safety law (49 U.S.C. Chap. 601). Each committee
consists of 15 members--with membership evenly divided among the
Federal and State government, the regulated industry, and the
public. The committees advise PHMSA on technical feasibility,
practicability, and cost-effectiveness of each proposed pipeline
safety standard.
---------------------------------------------------------------------------
Based on the comments filed by the joint trade associations, those
received during the public meetings described above, and the general
trend of other comments, PHMSA presented the Advisory Committees with
three variations of the regulatory language being considered by the
Agency. These included the language proposed in the NPRM, the
alternative language proposed by the joint trade associations, and a
third option that reflected the trade associations' proposed language
with modifications to reflect critical NPRM language and other comments
that had been received. PHMSA provided these variations of the
regulatory language to facilitate the Advisory Committee members'
discussion of the rule and to provide a process by which the members
could recommend a certain course of action by PHMSA with regard to the
rule. Although PHMSA had not selected any particular course of action
at that time, PHMSA expressed its view that the third option might be
the most viable alternative.
The TPSSC discussed exempting gas distribution from all
requirements of this rulemaking action. After substantial discussion,
the TPSSC voted against recommending that PHMSA exclude distribution
from the rule, but voted in favor of recommending that PHMSA limit the
requirements placed on certain small distribution operators to fatigue
management and associated recordkeeping issues.
The Advisory Committees provided additional substantive and
editorial comments to the proposed definitions, the scope of part 192,
general requirements, requirements concerning SCADA systems,
verification, backup control, fatigue mitigation, alarm management,
change management, operating experience, and training requirements.
Also, members of the public were afforded an opportunity to comment
during the meeting, and several participants from the public provided
their viewpoints for the record. After further discussion among the
members, the TPSSC voted twelve to one, and the THLPSSC voted
unanimously in favor. Also, both Advisory Committees provided a
recommendation for PHMSA to make the changes noted during discussion. A
transcript of the Advisory Committees meeting is posted in the docket
(PHMSA-2007-27954-0184.2).
The Advisory Committees recommended the following changes to the
rule language proposed in the NPRM:
Changing the definitions of controller and control room to
limit the scope of the rule. The revised definitions would exclude
field personnel who operate equipment and operator personnel who use
SCADA information but who have no operational responsibility to respond
to SCADA indications.
Adding a scope statement to explicitly limit the
application of the rule to controllers using SCADA systems.
Excluding gas distribution pipelines serving less than
250,000 customers or gas transmission pipelines without compressor
stations from many of the requirements.
Reducing specificity in the elements operators would be
required to define as controllers' roles and responsibilities.
Limiting applicability of SCADA display guidance in API RP
1165 to SCADA systems that would be installed or undergo certain
changes after the rule became effective.
Requiring point-to-point verification of SCADA only when
new field equipment is installed or when changes are made to field
equipment or displays that could affect pipeline safety.
Eliminating requirements to implement additional measures
to monitor for fatigue when only a single controller is on duty.
Reducing the scope and frequency of required alarm
reviews.
Eliminating the proposed requirement that operators review
for lessons learned pipeline events that did not require reporting as
incidents and focusing required reviews of incidents on those events
where there is reason to believe that control room actions contributed
to the event.
Deferring to existing requirements for operator
qualification rather than imposing an additional qualification
requirement for controllers.
Eliminating the proposed requirement that a senior officer
of each pipeline company submit certification that the requirements of
the rule have been implemented.
Our changes to the final rule in response to the comments and
advisory committees' recommendations are discussed below in section V.
IV. Summary of Final Rule
This final rule imposes requirements for control room management
for all gas and hazardous liquid pipelines subject to parts 192 and 195
respectively that use SCADA systems and have at least one controller
and control room. The scope of the rule is narrower in several respects
than was proposed in the NPRM. First, for the reasons set forth below,
LNG facilities are not covered by the rule, and no new requirements are
adopted for part 193. In addition, changes to the proposed definition
of a controller focus the new requirements on persons who work in
control rooms and use SCADA systems to control their pipelines. The
scope of the final rule has also been revised for gas pipeline
operators such that each control room whose operations are limited to
either or both of distribution with fewer than 250,000 customers or gas
transmission without compressor stations must follow procedures with
appropriate documentation that implement only the requirements for
fatigue management, validation, and compliance and deviations.
Pipelines meeting these criteria are generally smaller and simpler.
They pose less complexity, obviating the need for the other
requirements in this rule.
This rule requires pipeline operators to have and follow written
control room management procedures. The operators must define the roles
and responsibilities of controllers in normal, abnormal, and emergency
operating
[[Page 63315]]
situations. The final rule does not enumerate specific responsibilities
that must be defined, as did the proposed rule. Instead, the final rule
leaves the scope of controller responsibilities to be defined by each
pipeline operator taking into consideration the characteristics of its
pipeline and its methods of safely managing pipeline operation.
Pipeline operators will be required by this final rule to assure
that new SCADA displays and displays for SCADA systems that are
expanded or replaced meet the provisions of the consensus standard
governing such displays, API RP 1165. Displays for gas pipelines are
required to meet only some provisions of the standard. The proposed
rule would not have limited applicability of this requirement to new or
modified SCADA systems. Operators will be required to validate the
accuracy of SCADA displays whenever field equipment is added or moved
and when other changes that may affect pipeline safety are made to
field equipment or SCADA displays. The proposed rule would have
required that all operators perform a 100 percent verification of
existing SCADA systems within a few years. This provision was not
included in the final rule. Pipeline operators will also be required to
test any backup SCADA systems and to test and verify a means to
manually operate the pipeline (in the event of a SCADA failure) at
least annually.
Pipeline operators must also establish a means of recording shift
changes and other situations in which responsibility for pipeline
operations is handed over from one controller to another. Such changes
in responsibility may occur at scheduled shift changes or within a
shift, when a controller is relieved for breaks and other reasons.
Handovers can also occur between control rooms, for example where only
one of multiple control rooms is used during night shifts. Pipeline
operators will need to define procedures for shift changes and other
circumstances in which responsibility for pipeline operation is
transferred from one controller to another. The procedures must include
the content of information to be exchanged during the turnover.
Pipeline operators must implement measures to prevent fatigue that
could influence a controller's ability to perform as needed. Operators
will need to schedule their shifts in a manner that allows each
controller enough off-duty time to achieve eight hours of continuous
sleep. Operators must train controllers and their supervisors to
recognize the effects of fatigue and in fatigue mitigation strategies.
Finally, each operator's procedures must establish a maximum limit on
the number of hours that a controller can work. PHMSA recognizes there
may be infrequent emergencies during which an operator may find the
need to deviate from the maximum limit it has established to ensure
adequate coverage in the control room for emergency response.
Accordingly, the regulation provides that an operator's procedures may
provide for the deviation from the maximum limit in the case of an
emergency. Such a deviation would only be permitted if necessary for
the safe operation of the pipeline facility. PHMSA or the head of the
appropriate State agency, as the case may be, may review the
reasonableness of any deviation from an operator's maximum limit on
hours of service when considering whether to take enforcement action.
All pipeline operators are subject to the fatigue management
requirement, even those whose operations do not involve multiple
shifts. Controller fatigue can affect even single-shift pipeline
operations and the PIPES Act requires that all pipeline operators have
a plan that addresses fatigue. PHMSA expects that small operators, many
of which operate only a single shift, will be able to meet these
requirements with little effort. Shift schedule rotation is not an
issue for these operators and written instructional material (e.g.,
pamphlets) that can be reviewed during scheduled training may be
sufficient to address the education and training requirements for such
small operators.
SCADA alarms are a key tool for managing pipeline operations, but
excessive numbers of alarms can overwhelm controllers. This final rule
will require pipeline operators to develop written alarm management
plans. These plans must include monthly reviews of data points that
have been taken off scan or have had forced or manual values for
extended periods. Operators will also need to verify correct alarm set-
points, eliminate erroneous alarms, and review their alarm management
plans at least annually. Proposed requirements for weekly reviews of
issues related to alarm management and specified elements to include in
annual reviews were not incorporated in the final rule. Some elements
that would have been included in those weekly reviews, particularly
``nuisance alarms,'' have been generalized to points that have had
alarms inhibited (which would likely result if nuisance alarms occur)
or which have generated false alarms, both of which are now required to
be included in monthly reviews. Operators will also be required to
monitor the content and volume of activity being directed to their
controllers (including alarms and actions directed to controllers from
sources other than the SCADA system) at least annually.
Pipeline operators will be required to consider the effects of
future changes to the pipeline on control room operations. They must
involve controllers, controller representatives, or their management in
planning prior to implementing significant hydraulic or configuration
changes that could affect control room operations. This participation
must be accomplished with enough time prior to the implementation to
allow adequate training, procedure development and review by the
affected controllers. Operators must also assure good communications
when field personnel are implementing physical changes to pipeline
equipment or configuration. Proposed requirements to track SCADA
maintenance, coordinate SCADA changes in advance, and consider effects
on control rooms in merger and acquisition plans have not been
incorporated.
Mergers and acquisitions are events that can introduce changes of
importance to controllers. Acquired assets are often added to existing
SCADA systems, or divested assets are removed. Other changes in
operating practices may occur as a result of management changes
associated with a merger. The proposed rule would have required that
merger, acquisition, and divestiture plans be developed and used to
establish and conduct controller training and qualification prior to
the implementation of any changes to the controller's responsibilities.
A unique section regarding merger, acquisition, and divestiture plans
for the control room has not been included in the final rule, because
these types of plans frequently include many elements that do not
affect control rooms and controllers. Nevertheless, PHMSA considers
that operators should take into account potential implications on
control rooms during such events. Other requirements of this rule
address many of the important factors affecting control room operations
and controllers in a merger, acquisition, or divestiture. For example,
operators will be required to consider additional alarms added to a
controller station to determine whether they could create a ``flood''
that would potentially overwhelm the controller. PHMSA expects that
operators would also consider alarm descriptors and prioritization if
changes are made to a controller console. Changes to SCADA systems to
incorporate new (or delete old) assets would trigger requirements
[[Page 63316]]
for display point validation and display design (i.e., required
elements of API RP 1165). PHMSA thus considers that important changes
associated with mergers, acquisitions, and divestitures are still
addressed within this rule even though the proposed explicit
requirement to address them in plans for these events has not been
included.
Pipeline operators will be required to review their operating
experience to identify lessons that might improve control room
management. Specifically, operators will be required to review any
reportable event and determine if control room actions contributed to
the event. This is more focused than the proposed requirement that
operators review all reported incidents. Operators must identify, from
these reviews, aspects of the event that may reflect on controller
fatigue, field equipment, operation of any relief device, procedures,
SCADA system configuration, and SCADA system performance. Operators
must include lessons learned in controller training programs. The
proposed rule requirement for operators to review ``near misses'' or
events that did not meet criteria for reporting was not adopted in this
rulemaking action, but such reviews are certainly encouraged.
Pipeline operators will be required to have formal training
programs including computer-based or non-computer (e.g., tabletop)
simulations to train controllers to recognize and deal with abnormal
events. The training must also provide controllers with a working
knowledge of the pipeline system, particularly as it may affect the
progression of abnormal events, and their communication
responsibilities under the operator's emergency response plans.
Proposed requirements that training include site-specific failure modes
of equipment and site visits to a representative sample of field
installations similar to those for which a controller is responsible
were not adopted.
Operators must, upon request of pipeline safety regulators, submit
their completed control room management programs to the regulator for
review. This replaces the proposed requirement that executives of
pipeline operating companies submit to regulators annually a signed
validation that: Controller training has been reviewed, only qualified
controllers have been allowed to operate the pipeline, and the company
continues to seek ways to improve control room operations. A request to
review the plan will usually be in the course of a regulatory
inspection where the adequacy of control room management plans and
training will be reviewed, as will the operator's compliance with each
of the above-referenced requirements.
The proposed requirements related to a qualification program for
controllers were not adopted. Controllers are still subject to existing
requirements for operator qualification, which address similar
subjects.
V. Response to the Comments
The responses to comments in this section reflect PHMSA's
consideration of the Advisory Committees' recommendations as well as
the individual comments in the docket. A review of all submitted
comments shows that the comments submitted by trade associations (API,
AOPL, INGAA, AGA, and APGA), jointly and individually, address the
comments of almost all pipeline operators. Some comments were on the
preamble to the proposed rule. These comments will not be responded to
unless they are relevant to this rulemaking action. Comments that were
beyond the scope of this rulemaking action are not being addressed.
A. Liquefied Natural Gas (LNG) Facilities
The joint trade associations; the Iowa Utilities Board; 11 LNG
facility and gas pipeline operators; AGA; APGA; and one individual
opposed addition of requirements into 49 CFR part 193 addressing LNG
facilities.
AGA and the LNG facility operators stated that the LNG facilities
should not be included in the final rule because: (1) It was not the
intent of Congress or the NTSB to include LNG in this regulation; (2)
Congress expressly limited the CCERT study in the Pipeline Safety Act
of 2002 to three pipeline facilities; (3) LNG facilities were not to be
included in the pilot study; (4) LNG facilities are operated as plant
sites with local control rooms; (5) Almost all of the text in the
proposed amendments to 49 CFR part 193 is copied verbatim from the
language for gas and hazardous liquid pipelines, but many of the
requirements that are logical for pipelines make no sense in operating
LNG plants; (6) The agency's own Regulatory Impact Analysis (RIA) study
of the proposed rule clearly demonstrates no benefit that would offset
the cost of including LNG facilities in the NPRM; (7) LNG facilities
are regulated by 49 CFR part 193 and NFPA 59A, as incorporated by
reference; and (8) The very detailed proposed control room rule creates
confusion when added to the existing regulations. AGA and the joint
trade associations suggested that PHMSA should initiate a separate
rulemaking action focused on issues relevant to LNG facilities if it
concludes that control room management requirements are needed for
these facilities.
Agency response--PHMSA agrees that the PIPES Act requirement
regarding control room management does not explicitly refer to LNG
facilities, nor are such facilities referenced in the PSIA legislation
with regard to the controller certification pilot study. Similarly,
NTSB did not address LNG facilities in its SCADA safety study and
related recommendations. At the same time, neither Congress nor NTSB
explicitly stated that control room management requirements should not
be included for LNG facilities. Given the broad authority of PHMSA to
regulate pipeline safety, including the safety of LNG facilities, the
silence of the PIPES Act and the NTSB safety study with respect to LNG
is not, by itself, a compelling reason why these facilities should be
excluded from this rulemaking. However, through further review and
consideration of the comments, PHMSA has determined that LNG should not
be included in this rulemaking action at this time.
After considering the comments and re-evaluating the basis for
applying the same requirements to part 193 for LNG facilities, PHMSA is
persuaded that there are several reasons why we should not have used
the same requirements. LNG facilities are different from pipelines. As
pointed out by commenters, LNG facilities exist on a single site,
rather than dispersed over hundreds or thousands of miles, and LNG
controllers thus have different knowledge of and working
responsibilities for facility equipment. LNG controllers can, and do,
walk to ``field'' equipment within minutes to monitor its condition or
take local operating actions, whereas pipeline controllers may
``interact'' with field equipment only via their SCADA systems. Because
they operate equipment locally, LNG controllers have better operational
knowledge of the equipment in their facilities, including its possible
failure modes, than do most pipeline controllers. All of these
differences diminish the value in improved safety that would result
from implementing the proposed requirements at LNG facilities.
In addition, the regulations in part 193 do not parallel precisely
those in the other parts. For example, part 193 includes specific
requirements applicable to control centers \5\ (49 CFR 193.2441) that
were not in parts 192 or
[[Page 63317]]
195 prior to this rulemaking. This could create some degree of overlap,
and potential confusion, if the requirements included in this final
rule for Parts 192 and 195 were also incorporated into part 193. PHMSA
thus has not included requirements for part 193 in this final rule.
---------------------------------------------------------------------------
\5\ Control centers is the term used in part 193 to refer to
what are called control rooms in this document.
---------------------------------------------------------------------------
B. Scope of the Rule and Related Definitions
AGA stated that the proposed definitions of controller and control
room had the effect of unreasonably expanding the scope of all rule
sections. AGA stated that the proposed rule would regulate local,
remote or field control rooms, panels and devices, but noted that
local, remote or field control rooms are usually hardwired instead of
operated via long-distance communications through SCADA. Because a
controller or a technician can address problems and concerns with a few
minutes' walk in these facilities, AGA contended local control rooms do
not need the complicated procedures placed in this proposed rule.
Other commenters agreed that the proposed definitions of
``controller'' and ``control room'' were unreasonably broad and that
they led to a scope that was broader than necessary. The Iowa Utilities
Board (Iowa) stated that by defining a controller as someone who
monitors ``or'' controls, instead of monitors ``and'' controls, the
scope of the rule would unreasonably expand to include any facility
with a pressure gauge, and any person who checks the pressure gauge.
The joint trade associations' alternative regulatory language included
revisions to definitions. Their alternate definitions for
``controller'' and ``control room'' are based on API RP 1168. API and
AOPL also stated that the NPRM definitions for ``controller'' and
``control room'' are too broad. They recommended the agency adopt the
API RP 1168 definitions for ``controller'' and ``control room'' as
proposed in the joint trade associations' alternate language. Iowa
agreed that the definition of controller and control room should be
based on the definitions in API RP 1168. Iowa also suggested that the
agency adopt the alternative regulatory language proposed by the trade
associations. NAPSR proposed adopting the API RP 1168 control room and
controller definitions to resolve the issue of jurisdictional authority
for pipelines crossing state lines. The Missouri Public Service
Commission (PSC) stated that it supports and concurs with the comments
submitted by NAPSR. PSC also believes that the definitions of ``control
room'' and ``controller'' noted in the NAPSR comments should be adopted
in the rulemaking. All individual gas and hazardous liquids pipeline
operators expressed similar concerns with the proposed rule definitions
of ``controller'' and ``control room.''
INGAA stated that the proposed regulations far exceed what Congress
intended regarding the range of subjects covered, the range of
facilities covered and the range of employees covered.
The joint trade associations stated that the proposed rule had no
scope statement to provide guidance regarding the application of the
proposed rule. API and AOPL stated that the scope of the NPRM exceeds
the intent of Congress. Individual pipeline operators echoed the
comments of the joint trade associations and the individual trade
associations. Many of the comment submitters are, like AGA, concerned
with broad definitions of ``controller'' and ``control room.'' Also,
some individuals commented that the scope of the proposed rule is too
broad.
APGA stated that the proposed rule should be re-written to be
limited to true pipeline controllers and made reasonable for those
operators. APGA noted that many small gas distribution pipeline
operators, including many of its members, do not have control rooms and
controllers in the same sense as do larger pipeline operators.
Agency response--PHMSA agrees that the proposed definitions of
``controller'' and ``control room'' had a rather pervasive effect on
the scope of the requirements in the rule. In particular, PHMSA agrees
with the Iowa Utilities Board that the proposed language could have
been read to include personnel who monitor a pressure gauge (or other
instrument) but have no authority or responsibility for pipeline
operation. This result was unintended. PHMSA did not intend these
requirements to apply to persons who may use SCADA information for non-
operational reasons, but rather to persons with operational duties and
responsibilities that involve use of SCADA and who thus can directly
effect on pipeline safety. PHMSA has made changes in the definitions in
the final rule to clarify this intent.
The inclusion of field control rooms and local control panels,
however, was intended. The proposed rule was intended to apply to these
control operations, in situations in which the person performing local
control actions could not actually see the effect of those actions,
based on the premise that the cognitive issues related to use of local
computer-based controls were similar to those associated with use of
SCADA in remote control rooms. PHMSA is persuaded by its review of the
public comments that while cognitive issues may be similar, the
potential effect on safety that could result from use of local
computer-based controls are much less. As a result, PHMSA has modified
the final rule to remove explicit requirements that local control
panels be included in the actions required by this rule. Local control
panels and field control rooms will only be included if they meet the
definitions included in this rule, i.e., if they can have an effect on
pipeline safety similar to that of a non-local control room.
By revising the definition of control room in response to the
comments, the agency has also limited the scope to control rooms with
SCADA systems. In addition, the wording in the proposed definition is
changed from ``monitoring or controlling'' to ``monitoring and
controlling.'' It should be noted that a control room whose SCADA
system is used only to monitor incoming data is still included in the
requirements of the rule if the controllers otherwise act to
``control'' the pipeline. Some control rooms have only monitoring
capability in their SCADA system, but they achieve control through
controllers responding to incoming data by other means such as by
contacting field personnel and directing them to take action when
necessary. If controllers prompt others to action (or perform those
control action themselves) they are considered to ``control'' the
pipeline. Therefore, the change from ``or'' to ``and'' does not exclude
monitor-only control rooms from the scope of this rulemaking action.
The change from ``or'' to ``and'' principally excludes individuals who
may access and monitor SCADA system data for non-controller, incidental
reasons, such as maintenance planning, equipment efficiency, or
business logistics purposes. These persons cannot directly affect
pipeline safety, because they are unable to use the SCADA system to
take any controller actions.
With respect to the definition of controller, the agency similarly
narrowed the scope to eliminate persons who only use SCADA data
incidentally and thus cannot directly affect pipeline safety. The
definition now includes only those persons who monitor SCADA data from
a control room and have ``operational authority and accountability for
the remote operational functions of the pipeline facility as defined by
the pipeline operator.'' As in the case of ``control room,'' the
definition of ``controller'' has been modified from ``monitor or
control'' to ``monitor and control.'' If a
[[Page 63318]]
SCADA system is designed and used in a control room only for monitoring
purposes, and the individual contacts other personnel to initiate
corrective actions after monitoring the SCADA system, that person is
considered a controller.
PHMSA considers that these changes to the definitions of ``control
room'' and ``controller'' limit the scope of the proposed rule to those
persons and operating centers that can directly affect pipeline safety.
Most importantly, they eliminate the unintended apparent inclusion of
certain employees who use SCADA data only incidentally. PHMSA considers
that the revised definitions still encompass the majority of employees
and control centers that were intended as the focus of this rulemaking.
The changes in definitions address most, but not all comments
concerning scope.
PHMSA has revised the final rule to include a statement of scope to
clarify that it applies to each operator of a pipeline facility with a
controller working in a control room who monitors and controls all or
part of a pipeline facility through a SCADA system. PHMSA has also
revised the rule to exclude operators of some smaller gas pipeline
systems from many of the rule's provisions. Specifically, gas
distribution operators with less than 250,000 services and gas
transmission operators without compressor stations are required only to
comply with the provisions related to fatigue mitigation, validation,
and compliance and deviation. These small and simple pipelines require
far less controller action, obviating the need for the other
provisions. There are often few or no actions that controllers of small
distribution systems can take remotely. These systems operate at low
pressures, providing significant time to identify and respond to
unusual situations before any safety problem could result. Similarly,
there are few actions that a controller of a transmission pipeline that
does not include compressor stations can take to adversely affect
safety. Most such pipelines are short. They often are the gas supply
for local distribution companies, and are operated as an integral part
of their distribution pipelines. They meet the definition of
transmission pipelines because they operate above 20 percent SMYS or
serve one of the functions included in the definition in section 192.3,
but they represent a much smaller potential for safety issues. It
should be noted, however, that this limited exclusion applies only if
the operations from a gas operator's control room are limited to such
smaller operations. The full requirements of the rule apply to
operators of such pipelines if the operator also operates other
pipelines outside of this limited exclusion from the same control room.
For example, there may be large gas transmission operators who also
operate small distribution pipelines or large LDCs that also have or
operate transmission without compressors. In such cases, all the
provisions of this rule apply to all of the operator's pipeline
operations from a common control room.
C. Other Definitions
The joint trade associations proposed changes to the definition of
SCADA systems. The proposed rule would have defined these as ``a
computer-based system that gathers field data, provides a structured
view of pipeline system or facility operations, and may provide a means
to control pipeline operations.'' This definition would have
encompassed computer-based control systems in the field. The trade
associations proposed that this definition be limited to systems used
by controllers in the control room. This change is related to the
concern over scope and the definition of ``controller'' and ``control
room'' described above. The joint trade associations would also focus
the definition of ``alarm'' on safety-related parameters, omitting
reference to indications that operational parameters not related to
safety are outside expected conditions.
INGAA stated that the definition of ``alarm'' is not required or
even contemplated by Congress for gas transmission pipelines and,
therefore, should be deleted. On the definition of SCADA system, INGAA
recommended that the agency adopt the definition provided by the joint
trade associations.
Agency response--Alarm management is a significant factor in
control room management and is thus included in this rule. Excessive
numbers of alarms or alarms that are inaccurate or not prioritized can
overwhelm a controller, resulting in a failure to take appropriate
action. Assuring appropriate management of control room alarms requires
that the alarms of concern be defined. At the same time, PHMSA
understands the industry's concern that SCADA systems are used to alarm
many parameters that do not affect safety and that response to these
parameters is outside what should be PHMSA's concern. Accordingly,
PHMSA has revised the definition in the final rule to reflect that
alarms of concern are those providing either or both audible and
visible indications to controllers that equipment or processes are
outside operator-defined, safety-related parameters. However, the final
rule will require that operators monitor the content and volume of
activity being directed to each controller.
The final rule defines SCADA systems as a computer-based system or
systems used by a controller in a control room that collects and
displays information about a pipeline facility and may have the ability
to send commands back to the pipeline. This excludes local computer-
based control stations for the reasons described above. Also as
discussed above, control may be exercised by a controller notifying
other personnel to take action. Control may also be accomplished
through SCADA commands. The key factor is that the system provides
information that allows control to occur, and systems that cannot send
commands to operate pipeline equipment may thus still be SCADA systems
under this definition.
D. Regulatory Analysis
The joint trade associations stated that the preamble statement
vastly underestimates the cost of the proposed regulations. They stated
that the proposed rule would cost more than $100 million annually and
that the preliminary regulatory analyses should have concluded that
this was an economically significant rule under section 3(f)(1) of
Executive Order 12866 (58 FR 51735; October 4, 1993) and DOT's
regulatory policies and procedures (44 FR 11034; February 26, 1979).
Also, they stated that the proposed rule has a significant regulatory
impact within the meaning of 5 U.S.C. 601 et seq. They contended the
proposed rule is contrary to the Unfunded Mandates Reform Act of 1995
because a large portion of gas distribution systems are owned and
operated by municipalities and local governments. In addition, the
associations maintained that the proposed rule would impose substantial
costs to state and local governments contrary to Executive Order 13132.
AGA stated that its review of the proposed rule shows obvious
errors in the analysis. AGA stated that it obtained rough estimates
from some of its LDC members that show the proposed rule to be not cost
beneficial on a national basis, and that it will exceed the $100
million in annual costs threshold of a significant rule. AGA stated
that a comparison of implementation costs between the proposed rule and
that of the alternative regulatory language proposed by the joint trade
associations shows the costs of the alternative regulatory language are
approximately
[[Page 63319]]
14 to 15 percent of the costs of the proposed rule.
INGAA stated that the benefits of the proposed rule for the gas
transmission companies are unworthy of a rulemaking compared to the
expected annual costs for the next 10 years of nearly $140,000,000.\6\
INGAA contends a handful of anecdotal data from an appendix to an
unrelated study, some answers to hypothetical questions about
theoretical possibilities and a series of assumptions with no
foundation in the record do not constitute a legally defensible
foundation for imposing detailed and costly regulations on the gas
transmission pipeline industry.
---------------------------------------------------------------------------
\6\ INGAA provided estimated implementation costs for selected
requirements of the proposed rule at initial cost of $262,986,000
and annually at $139,798,000.
---------------------------------------------------------------------------
API and AOPL stated that they asked their members to comment on the
number of employees that would be covered under the definition of
``controller'' provided in the proposed rule; the aggregated cost
estimate for training and qualifying these additional employees; and
the estimated cost of point-to-point verification today and the
projected estimate under the proposed rule. They stated that the cost
estimates vary from operator to operator, but what each operator had in
common was a tremendous increase in the number of additional employees
that would need to be trained and qualified at an exorbitant cost. They
stated that estimates on the increased number of employees under the
proposed rule range from four times as many employees to train and
qualify to more than ten times the current number of ``traditional
controllers.'' The initial training and qualification costs ranged from
$1.2 million to more than $5 million per operator with operators
calculating these costs in a number of ways. The annual re-
qualification costs would average $500,000 per operator. The point-to-
point verification cost estimates averaged $500,000 per operator. They
stated that one of their members included lost revenue from having to
shut down the pump station, breakout storage tank areas, terminal
deliveries and other hard assets in order to complete the point-to-
point test. Also, they stated that the RIA did not have estimates for
Alarm management and Qualification. They stated that a company
estimated that it would cost $52,000 per year to review SCADA
operations at least once a week as proposed, and evaluating a
controller's physical abilities and implementing methods to address
gradual degradation would cost $60,000 initially for 400 controllers
and $8,000 annually thereafter.
Agency response--PHMSA has revised the regulatory analysis based on
the revised scope of the rule, relevant comments received, and
industry-submitted cost estimates. The scope of the rule is narrowed to
exclude some gas LDCs and some gas transmission operators from most
requirements in this rulemaking action. In addition, many of the
individual requirements have been narrowed.
PHMSA concludes that the widely varying estimates of cost between
our RIA and industry estimates resulted largely from confusion
concerning the definition of a controller. As discussed above, the
definition in the proposed rule had the unintended effect of appearing
to encompass pipeline operator employees who use SCADA data but have no
operational responsibilities for the pipeline. This significantly
increased the number of employees that would have been subject to the
requirements affecting controllers (e.g., fatigue mitigation, training
and qualification). PHMSA agrees that applying these requirements to a
much larger number of personnel would incur costs significantly higher
than estimated in the RIA. The revised definition in the final rule
focuses the requirements on controllers working in control rooms with
operational responsibility--and the revised RIA uses a more-realistic
estimate of the numbers of these personnel that will be affected.
Changes made in the final rule also significantly reduced the cost
of elements not depending on the number of controllers affected. A
major cost element was the proposed requirement for a one-time, 100
percent verification of SCADA systems. Commenters pointed out that this
requirement would have involved significant costs for very little
benefit. It is unlikely that such a ``baseline'' verification would
have identified significant problems that could affect safety. This is
because SCADA systems are already installed and in use by operators, so
readings have already been verified and problems of any significance
would likely have surfaced in the normal course of using a SCADA system
over time. Thus, PHMSA agrees that the significant effort that would be
required for a 100 percent baseline verification is unlikely to result
in commensurate safety benefit, and so the final rule eliminates that
requirement. It requires, instead, that SCADA displays be verified when
field equipment monitored by SCADA is moved or when other changes that
affect pipeline safety are made to field equipment or displays. These
kinds of changes can introduce errors that would affect subsequent
SCADA operations. For this reason, SCADA information is typically
verified when making these types of changes, to assure that the changes
have been implemented properly and that all equipment is functioning as
intended once work is completed. As a result, this re-focused SCADA
verification requirement imposes much lower additional costs. It
essentially has the effect of requiring that all pipeline operators
take the same actions that a conscientious operator would take even if
no requirement existed.
The scope of required alarm verifications is also significantly
reduced in this final rule. Commenters suggested that they would need
to hire additional staff solely to perform the weekly and monthly
reviews that would have been required by the proposed rule. PHMSA is
persuaded that the alarm conditions are unlikely to change so much on a
weekly basis, absent some significant ``event,'' that a thorough review
would be needed on such a frequency. Response to an event would
typically include the effect that the event may have had on alarms. The
final rule has reduced these requirements to a monthly review of more-
limited scope and an annual review of the alarm management plan,
significantly reducing expected costs.
The revised RIA considers the changes in scope of the final rule
and concludes that the rule is cost-beneficial.
E. Roles and Responsibilities
AGA stated that Congress intended for pipeline operators, not the
agency, to write their control room management plans due to the
diversity of control rooms. AGA stated that PHMSA should not dictate to
an operator what responsibilities and tasks should be written into an
operator's plan, which AGA considered was the effect of the specific
elements included in the proposed rule.
API and AOPL supported the language in Paragraphs (b)(1)-(3) of the
proposed rule (decision making during normal operations, role during
abnormal events, and emergency role) and recommended deletion of
paragraphs (b)(4) and (b)(5) (responsibility to coordinate with other
operators having pipelines in common corridors and shift change). API
and AOPL stated that operators currently maintain Emergency Response
plans that address multi-pipeline corridors and appropriate
notification and response procedures. They stated that these roles and
responsibilities for controllers and other
[[Page 63320]]
field personnel are clearly defined in the notification and response
procedures. They believed that PHMSA might find API RP 1168 useful in
developing control room management programs related to roles and
responsibilities.
INGAA stated that this section should be deleted in its entirety
because it runs counter to congressional direction and PHMSA's
authority under Section 12 of the PIPES Act.
Agency response--PHMSA agrees that it is appropriate for operators
to define roles and responsibilities for controllers, because of the
many varied circumstances of different pipelines, their control rooms,
and their operating practices. The proposed rule would have required
that operators define these roles and responsibilities, and this has
been retained in the final rule. The proposed rule went on to list
certain roles and responsibilities that operators were to include in
their definition. These have been deleted. PHMSA will verify during
inspections that operators have appropriately defined the roles and
responsibilities for their controllers.
PHMSA acknowledges API/AOPL's support of the proposed elements
addressing normal operations, abnormal operations, and emergencies.
These elements have been retained in the final 192.631(b) and
195.446(b) (Note: For editorial purposes PHMSA has moved the
requirements proposed as Sec. 195.454 to Sec. 195.446). PHMSA also
acknowledges the concerns expressed by AGA and gas pipeline operators
that these elements tend to dictate the content (in part) of the roles
and responsibilities the operator must define; however, PHMSA considers
it essential that an operator's defined roles and responsibilities
address normal, abnormal, and emergency operating conditions. The final
rule does not include specific responsibilities for each of these
conditions, but does require that the operator's definition consider
them all.
PHMSA disagrees that it is not necessary to address shift change.
Experience has shown the importance of controlling the transfer of
information between controllers. Incidents, accidents, and other
problems have occurred because of inadequate shift change. PHMSA has
deleted the specific alternative mechanisms for recording a shift
change that were included in the proposed rule (a system log-in feature
or recording in shift records), but the final rule still requires that
operators establish a method of recording controller shift changes.
Operators are also required to define the information that controllers
must discuss or exchange during shift changes and other instances in
which another controller assumes responsibility.
F. Providing Adequate Information
AGA disagrees with periodic point-to-point verification
requirements except to show that the SCADA system displays accurately
depict field configuration when any modification affecting safety is
made to field equipment or applicable software, and when new field
equipment is installed.
INGAA stated that ``Adequate'' would seem to include those points
that affect pipeline safety, and not each of the points that collect
information about the pipeline which are completely unrelated to
safety. INGAA estimates the safety-related points to be significantly
outnumbered by the non-safety-related points.
API and AOPL stated that their members' experience shows that re-
verification offers few safety benefits in return for the large
investment in SCADA system and field resources that would be required.
They suggested the emphasis of the regulation should be on management
of change, rather than re-verification.
The proposed requirement to implement API RP 1165 for SCADA
displays also caused concern. Pipeline operators objected to the
requirement to apply the standard to existing displays, noting that
controllers have been trained and have experience in using existing
systems and that any benefit from implementing the standard would
likely be small. Other operators objected to the incorporation of the
standard or suggested that alternatives be allowed. AGA and several
operators suggested that operators be required to implement the
``general'' requirements of the standard.
INGAA commented that the ``critical'' information required to be
exchanged during shift changes required more definition. Some pipeline
operators objected to the proposed requirement to provide an overlap
between shifts to allow for shift change. API and AOPL suggested that
PHMSA consider adopting API RP 1168 to govern shift change
requirements.
Agency response--PHMSA has eliminated from the final rule the
proposed requirement to perform 100 percent baseline verification of
SCADA systems. PHMSA has also eliminated the proposed requirement that
operators plan for systematic re-verification. As discussed above (see
paragraph D of this section), PHMSA concluded that a baseline
verification was unlikely to identify safety-related problems that had
not already been recognized through normal operations. Similarly, new
problems are likely to be identified as part of normal work before a
re-verification would find them. As a result, the significant effort
that would be required to implement these two requirements would result
in little foreseen safety benefit. The final rule requires that
operators verify SCADA when changes are made that can affect the
information displayed by SCADA. SCADA problems are most likely to be
introduced when making changes and verification that the SCADA system
functions as intended are a means of identifying such problems.
With respect to API RP 1165, PHMSA agrees that applying the
standard to existing displays is likely to lead to little safety
benefit for the cost incurred, since controllers have already been
trained and are experienced in using existing displays in their current
operations. In addition, changes made to existing displays would
require retraining of controllers and could introduce confusion
unnecessarily. When displays are changed, however, retraining will be
needed because of the change and the reasons for not disrupting
controllers' use of displays with which they are familiar no longer
apply. PHMSA has limited the requirement to apply the standard to
displays that are added, expanded or replaced after the date by which
the control room management procedures required by this rule must be
implemented. For gas pipelines, the final rule requires that only
certain sections of the standard be implemented. The cited sections
address the aspects that are most important to assuring that displays
are configured to be most useful to controllers for managing safe
pipeline operations, including human factors engineering. PHMSA is not
aware of equivalent standards that would accomplish the same purpose,
and has not provided for an alternative. Flexibility is available in
that operators need not implement a provision of API RP 1165 if they
demonstrate that the provision is not practical for the SCADA system
used.
PHMSA has eliminated the requirement to provide for overlap of
shifts to facilitate shift turnover. Overlaps will likely be needed to
accommodate the need to transfer information to an oncoming controller.
The transfer of information is required, obviating the need to specify
an overlap requirement in the regulation. The final rule for gas
pipeline operators requires that operators establish procedures for
when a different controller assumes responsibility, including the
content of information that must be exchanged, but
[[Page 63321]]
has deleted the requirement that ``critical'' information must be
included. It will be up to operators to define the information that is
important to impart to oncoming controllers. API RP 1168 provides
guidance that can assist in this definition. This standard is
incorporated by reference for this purpose for hazardous liquid
pipeline operators. PHMSA will verify during inspections that operators
have included in their definitions the information needed by their
controllers to assure pipeline safety.
G. Fatigue Mitigation
The National Transportation Safety Board (NTSB) stated that it does
not believe the proposed rule satisfactorily addresses mitigation of
controller fatigue. NTSB stated that the proposed rule should require
operators of pipeline facilities to incorporate fatigue research,
circadian rhythms, and sleep and rest requirements when establishing a
maximum limit on controller shift length, maximum limit on controller
hours of service, and schedule rotations. Also, NTSB stated that it
would like PHMSA to provide additional information about the agency's
criteria for evaluating operators' plans and to explain how the agency
intends to monitor the effectiveness of implementing those plans on
fatigue mitigation.
Some individuals suggested that the proposed rule does not go far
enough. Some suggested a need for a uniform maximum hours of work limit
to be established in the regulations. These individuals stated that the
rule needs to set standards to decrease the likelihood of controller
fatigue rather than passing that duty on to operators. They stated that
the proposed rule does not set standards regarding fixed versus
rotating shifts and does not set standards for the length of each
rotation. One individual suggested setting shifts at ten hours with two
hours overlap between beginning and end of shifts and with a three
consecutive day break. Some suggested using part-time workers to
overlap 12 hour shifts. One stated that the agency should redraft the
vague provisions found in the shift change and fatigue sections and
should provide more specific examples for the pipeline operators to
adequately comply with the rule. One individual stated that for the
proposed rule to increase vigilance and mitigate fatigue, the agency
must address boredom and monotony. One suggested that the agency should
consider methods that specifically address mental fatigue and an
adrenaline response training program for all pipeline workers.
Other citizens supported the proposed rule on fatigue mitigation.
One stated that fatigue management should be implemented on an intra-
company basis based on the individual needs of the controllers rather
than on an industry-wide scale. Others commended the agency for not
prescribing a maximum hours of work limit. Some supported the need for
testing of physical and visual abilities for controllers. One
individual suggested a requirement for controllers to check if they are
physically fit to perform the tasks assigned. One individual suggested
implementing a requirement that workers make observational entries
every quarter hour to ensure that they remain engaged in their duties
and maintain continual mental vigilance throughout a shift.
AGA objected to requiring that operators implement additional
measures to monitor for fatigue when a single controller is on duty.
AGA stated that the gas distribution industry's safety record has
demonstrated that a single controller can safely operate a pipeline.
API and AOPL suggested that PHMSA modify paragraph (d) of the
proposed rule to reflect that despite reasonable fatigue mitigation
measures the operator may not be able to ``prevent'' fatigue from
occurring. Also, they encouraged PHMSA to consider adopting the
language in Section 6 of API RP 1168 on Fatigue Management.
INGAA stated that the joint trade associations' substitute rule
addresses fatigue. INGAA stated that it urges adoption of these
provisions along with the rest of the substitute rule.
Agency response--Fatigue can be an important factor affecting
controller performance. NTSB has recommended that PHMSA establish
requirements in this area, and the PIPES Act requires that operator
human factors plans include a maximum hours of service limit. Fatigue
is something that affects all people at some time and many individual
comment submitters have suggested ways in dealing with this issue.
Nonetheless, PHMSA agrees that it is difficult to establish and enforce
regulations that ``prevent'' fatigue. In this final rule, PHMSA
requires that operators implement methods to reduce the risks
associated with fatigue.
Pipeline operators will be required to comply with a maximum hours
of service limit. This rule does not establish such a limit, but rather
requires that each operator establish a reasonable limit for itself.
This will allow consideration of factors that may be unique to the
operation of particular pipelines. Experience has also shown that
deviations from normal scheduling (e.g., requiring a controller to work
a double shift due to unexpected absence) can result in excessive
fatigue; establishing a limit will have the effect of reducing the
occurrence of these deviations.
At the same time, PHMSA recognizes there may be infrequent
emergencies during which an operator may find the need to deviate from
the maximum limit it has established to ensure adequate coverage in the
control room for emergency response. Accordingly, the regulation
provides that an operator's procedures may provide for the deviation
from the maximum limit in the case of an emergency. Such a deviation
would only be permitted if necessary for the safe operation of the
pipeline facility. PHMSA or the head of the appropriate State agency,
as the case may be, may review the reasonableness of any deviation from
an operator's maximum limit on hours of service when considering
whether to take enforcement action.
PHMSA has not included an explicit requirement that operators
incorporate fatigue research and circadian rhythms when establishing
their limits. Operators will be expected to have a scientific basis for
the limit they select. PHMSA expects that operators will consider
circadian effects, need for rest, and other factors highlighted by
relevant research, but PHMSA sees no benefit in including general
references to these factors in this rule. PHMSA has included in this
final rule a requirement that shift lengths and schedule rotations
provide controllers sufficient off-duty time to achieve eight hours of
continuous sleep. This addresses NTSB's concerns that sleep and rest
needs to be accommodated. PHMSA has already issued an advisory bulletin
providing guidance to pipeline operators on ways to manage fatigue,\7\
and may issue additional guidance if new research, operational
experience, or other factors indicate a need to do so.
---------------------------------------------------------------------------
\7\ ADB-05-06, August 11, 2005 (70 FR 46917).
---------------------------------------------------------------------------
PHMSA has not yet developed criteria for reviewing operator-
developed hours of service limits and human factors management
procedures, but plans to develop inspection criteria.
PHMSA has not included in this final rule a requirement to provide
additional measures to address fatigue in situations where a single
controller is on duty. Operators will need to address single-controller
situations in their fatigue management plans, but no particular
additional measures are required to monitor fatigue of a single
controller at this time.
[[Page 63322]]
H. Alarm Management
AGA stated that the proposed rule for alarm management is overly
prescriptive. AGA requested that language be written at a high level to
account for the diversity of control room systems used by different
operators.
API and AOPL stated that they believe the alarm management
requirement of the proposed rule is too prescriptive and will not
result in an application of ``best practices'' as currently written.
API and AOPL suggested that PHMSA require each operator to maintain an
alarm management plan based on currently accepted industry practices.
They stated that the plan should be based on a company's risk
assessment related to alarm management and include regular audits and
reviews of the alarm system performance to identify areas for training
and improvement. They also stated that a company should assess risks
associated with alarming and modify its program as needed on a less
frequent basis.
INGAA stated that this section should be deleted in its entirety
because it runs counter to congressional direction as expressed in
Section 12 of the PIPES Act and because it will not increase pipeline
safety. INGAA urged the agency to adopt the joint trade associations'
substitute rule for alarm management. INGAA also contended that the
requirement would be very costly to implement.
Agency response--The alarm management provisions included in the
NPRM were prescriptive and required frequent reviews. In addition, some
of the required review elements would have been difficult to identify.
For example, weekly reviews would have been required to include events
that should have resulted in alarms but did not. Such events could be
identified using SCADA data (even though they did not produce alarms)
but would have required detailed review to do so. PHMSA is persuaded by
the comments that the proposed provisions would have been burdensome
and might not necessarily have addressed factors important for alarm
management in particular pipeline control rooms. Instead, PHMSA has
adopted the suggestions to require that each operator have an alarm
management plan. Operators will develop those plans in recognition of
issues that have proven important to their operations.
The final rule continues to require that alarm management plans
include some critical elements. Foremost among these is a monthly
review of points impacting safety that are not providing current data
to controllers or points that may be triggering erroneous alarms.
Operators respond to problems that occur in SCADA systems (and which
can result in inaccurate information being displayed) by taking the
points ``off scan,'' which means operators manually ``force'' certain
information to be displayed. Controllers are generally made aware that
the affected data is not timely and accurate, but the forced values (or
no values at all) help prevent confusion. Operators return the data
points to normal operation once the problems with the SCADA system have
been identified and corrected. Generally, SCADA systems involve many
data points (often thousands) and controllers are able to manage
pipeline operations and respond to abnormal events even though some
data is not current. Still, PHMSA considers it important that SCADA
problems be addressed promptly, so that controllers have the most
accurate and timely information with which to diagnose and respond to
pipeline events. The monthly review is intended to assure that the need
to address SCADA problems promptly is not lost in the crush of other
activities.
The final rule will also require that operators monitor the content
and volume of activity being directed to each controller. This
requirement is intended to identify so-called alarm ``floods,'' which
can involve many alarms (often not relating to pipeline safety)
occurring simultaneously or in a short period. Such floods can
overwhelm the capability of a controller to recognize problems and
events that may underlie the alarms, and thus delay prompt response.
PHMSA accepts the point made by commenters that the agency should not
be regulating use of SCADA alarms for purposes not related directly to
pipeline safety, but still considers that it is important to assure
that controllers' ability to respond appropriately to safety-related
alarms is not compromised. The requirement to monitor for volume and
content of activity is intended to do this. Operators who identify
situations in which controllers are receiving more information or
required to perform more activities than they can process and address
will be expected to take appropriate corrective action in a timely
fashion.
It is also critical that operators verify correct alarm set points
and descriptions, review their alarm management plans regularly, but at
least annually, and address deficiencies identified in their reviews.
Accordingly, these elements are also included in the final rule.
I. Operating Experience
AGA requested that the proposed requirements related to review of
operating experience be deleted in their entirety, because AGA
contended that they are duplicative of other sections in 49 CFR parts
191 and 192. AGA, INGAA, and others also objected to the proposed
requirement that operators establish a threshold for near-miss events
(i.e., events of some significance but which do not meet criteria for
reporting to regulators as an incident) and include them in periodic
reviews. The comments noted that this concept is impractical and would
be difficult to enforce, that it effectively elevates these ``near-
miss'' events to equality with incidents requiring reporting, and that
it would add significant additional burden for very little benefit.
INGAA stated that this section should be deleted in its entirety
because it runs counter to congressional direction as expressed in
Section 12 of the PIPES Act and because it will not increase pipeline
safety.
API and AOPL suggested deleting requirements associated with the
need to review accuracy, timeliness and portrayal of field information
on SCADA displays and review of events that do not meet the threshold
for reporting as accidents.
One individual commented that having controllers review non-
reportable events, along with other activities that this rule is
imposing on controllers, would require an excessive amount of valuable
time.
Agency response--PHMSA does not agree that the proposed review
requirements duplicate existing requirements. The requirements in this
rule will build on existing requirements to identify and report
incidents that meet certain criteria. PHMSA recognizes that those
regulations require that operators review events to identify
information that must be reported. The requirements in this rule are
focused on identifying the effect of operational events on controllers,
controller workload, and the ability of controllers to manage pipeline
operations safely. PHMSA expects that these additional considerations
will be included in the reviews of incidents currently conducted.
Adding these considerations to existing reviews should result in
minimal additional burden, but will help improve safe pipeline
operations. The final rule will require that operators consider, in
their reviews of reportable events, deficiencies relating to controller
fatigue, field equipment, the operation of any relief device, SCADA
system configuration, and SCADA
[[Page 63323]]
performance. Operators will be required to incorporate lessons learned
from these reviews into controller training programs.
PHMSA is persuaded that the requirement to conduct similar reviews
for events that do not meet reporting criteria (i.e., near-miss events)
is not necessary at this time. These events are not subject to reviews
related to the need to submit information concerning the event, because
operators are not required to report them. Accordingly, the entire
review effort would be additional, rather than control-room
considerations being a minimal addition of effort to an already-
required review. Furthermore, these events have less safety
significance than those that must be reported. The proposed provision
to review near-miss events for control room lessons has thus not been
included in the final rule, but PHMSA encourages operators to use near-
miss information to advance pipeline safety.
J. Change Management
AGA requested that change management be removed from the proposed
rule. AGA stated that the concept is best left to individuals familiar
with an operator's entire operations and maintenance manual. AGA
further stated that the person managing operations and maintenance
should address the changes that can impact the job of a controller or
any pipeline function. AGA stated that since most changes to a pipeline
system have nothing to do with controllers, the change management
concept should not be introduced into pipeline safety through a control
room management rule.
API and AOPL recommended that PHMSA consider replacing the proposed
language concerning change management with the language contained in
Section 7 of API RP 1168. They stated that the proposed language is too
prescriptive, would cause delays in implementation, and result in
additional costs with no real benefit to justify these additional
procedures.
INGAA stated that this section should be deleted in its entirety
because it runs counter to congressional direction as expressed in
Section 12 of the PIPES Act, and because it will not increase pipeline
safety.
Agency response--Not all pipeline changes affect controllers or
control room operations. Some do, however, and it is important that
controllers recognize that such changes are occurring, have sufficient
training before they occur, and understand how they will affect the
response of the pipeline to operational events. PHMSA has thus retained
requirements for change management in the final rule.
At the same time, PHMSA agrees that the proposed requirements were
too prescriptive and that pipeline operators should have flexibility in
integrating change management into their organizational structure and
business operations. The final rule requires that gas pipeline
operators establish communications between control room
representatives, management, and field personnel when planning and
implementing physical changes to pipeline equipment or configurations.
Operators must seek control room or control room management
participation prior to implementing significant pipeline hydraulic or
configuration changes. Field personnel will also be required to notify
the controller when emergency conditions exist or when making field
changes that affect control room operations. These requirements will
assure that changes that could affect the ability of controllers to
monitor the pipeline and assure safe operation are identified early so
that training programs and procedures can be modified, if needed, and
controllers can be made aware of changes that could affect their
activities.
Operators of hazardous liquid pipelines will be required to
implement change management provisions in Section 7 of API RP 1168.
These are similar to the requirements for gas pipeline operators
discussed above. PHMSA recognizes that Section 7 of API RP 1168, and
other recommended practices incorporated by reference, commonly use the
word ``should'' to denote a recommendation or that which is advised but
not required. For example, paragraph 7.1 of API RP 1168 states that
``[p]ipeline control room personnel should be included in the project
or change design and planning process.'' Where a standard incorporated
by reference utilizes words of recommendation, such as ``should,'' an
operator is expected to follow such provisions unless the operator has
documented the technical basis for not implementing the recommendation.
This has been PHMSA's position with regard to compliance with standards
incorporated by reference that utilize words of recommendation. See,
e.g., 64 FR 15926, Apr. 2, 1999. In the above-referenced example, an
operator would be expected to include control room personnel in the
project or change design and planning process unless the operator can
show the technical basis for why this could not occur.
K. Training and Qualification
A citizen suggested the use of videos instead of site visits for
controllers. One individual suggested the use of a standardized
examination for certification of controllers based on each pipeline's
configuration, and a requirement for operators to consider the
educational background of the individuals applying for a controller
position. Another individual suggested controller feedback on training.
AGA requested that the Training section be deleted because 49 CFR
part 192, subpart N provides operator qualification rules for all
pipeline employees performing covered tasks.
INGAA stated that this section should be deleted in its entirety
because it exceeds congressional direction and PHMSA's authority under
Section 12 of the PIPES Act and because it will not increase pipeline
safety.
API and AOPL stated that under the proposed rule's overly broad
definitions of ``controller'' and ``control room,'' operators would
have to expend considerable resources to meet the proposed
requirements. They suggested deleting some sections from the proposed
rule.
One individual agreed with an industry practice of a three year re-
qualification period rather than annual re-qualification as proposed by
PHMSA.
Agency response--Training is an important element of this rule. In
many ways, training needs for controllers are different from those for
other pipeline employees. Existing operator qualification requirements
(subpart N of part 192 and subpart G of part 195) address training and
qualification for specific tasks meeting certain criteria (called
``covered tasks''). Controllers require training that goes beyond
specific tasks. They must be able to recognize abnormal and emergency
events from the indications and alarms that these events will produce
through SCADA. NTSB has recognized that controllers need this training
and has recommended that PHMSA establish requirements for controller
training that include simulator or non-computerized (e.g., tabletop
exercises) training to recognize abnormal operating conditions, in
particular leak events. The PIPES Act mandates that PHMSA implement
standards in response to this NTSB recommendation. Accordingly, PHMSA
has included such training requirements in this final rule.
PHMSA has revised the final rule to eliminate some of the specific
elements that the proposed rule would have required to be included in
this training. In particular, PHMSA has eliminated
[[Page 63324]]
the requirements that controller training include site visits to a
representative sample of pipeline facilities similar to those for which
the controller is responsible and that controllers receive hydraulic
training sufficient to attain a thorough knowledge of the pipeline
system. PHMSA agrees that these proposed requirements would have
entailed benefit that was difficult to quantify. A site visit, for
example, might impart some knowledge concerning what is required to
operate equipment at the site but would be unlikely to result in
lasting detailed knowledge about equipment operation and the potential
effects of equipment failures. Instead, the final rule requires that
controller training be sufficient to obtain a working knowledge of the
pipeline system, especially during the development of abnormal
conditions. Controller training must also include use of simulators or
non-computerized simulations for training in identification of abnormal
operating conditions. These requirements will assure that controllers
receive the training recommended by NTSB, and required by the PIPES
Act, while allowing operators flexibility to design training programs
that fit their operations.
L. Executive Validation
AGA requested that the senior executive validation requirements be
removed from the rule. AGA commented that since the executive cannot
approve the plan on the agency's behalf, it is not logical for the
executive to independently approve the plan just to have the agency
subsequently approve or reject the plan.
API and AOPL stated that they would like to work with PHMSA to more
clearly define operator accountability. They stated that the paragraph,
as currently worded with ``senior executive officer,'' is
inappropriate. They stated that the definition of ``senior executive
officer'' differs among operators, and API and AOPL would like to
better understand what the term means to PHMSA. They stated that many
of their members also commented that verifying that ergonomic and
fatigue factors continue to be addressed or that controllers are
involved in finding ways to improve safety is more appropriate for a
lower level of management than what would constitute a ``senior
executive officer.'' Even if it were appropriate for executive signoff,
they said they believe the current language of the proposed amendments
is too narrow and specific.
INGAA stated that requirements for executive validation should be
deleted in their entirety. INGAA said this section is inconsistent with
congressional direction and will not increase pipeline safety. INGAA
stated that it understands the value of the proposed requirement to
validate that the requirements of this rule have been implemented,
since it could engender increased confidence and oversight of the
respective control rooms and associated processes.
INGAA stated that it sees no demonstrable safety benefit discussed
in the proposed rule and there are no tangible benefits to be gained by
promulgating this section.
One individual stated that the senior executive officer validation
should be required every three years.
Agency response--The purpose of this proposed provision was to
assure management attention to control room issues. A senior executive
would have been required to certify annually that the operator had
reviewed controller training and qualification programs and found them
adequate, that only qualified controllers had been allowed to operate
the pipeline, that the requirements of this rule had been complied
with, that the operator continued to address fatigue and ergonomic
issues, and that controllers were involved in continuing efforts to
sustain and improve safety. This was not intended to substitute for
approval of a plan by the regulator, but rather to assure that a plan
submitted to the regulator had obtained appropriate management approval
within the operator's organization.
PHMSA agrees with commenters that it is likely that specific
actions included within the proposed verification would be performed by
lower-level managers and staff. The extent of actions that might have
been required (or implied) was unclear in some cases. For example,
ergonomic issues are not otherwise addressed in the proposed rule, but
only in the proposed requirement that a senior officer certify that
they were continuing to be addressed. PHMSA has, therefore, decided not
to include the proposed requirement for periodic management
certification in this rulemaking action.
PHMSA has included in this final rule a requirement that operators,
upon request, must submit their completed control room management plans
to PHMSA or, in the case of an intrastate pipeline facility regulated
by the state, to the appropriate state agency. PHMSA expects that
regulators (state or PHMSA) will generally review plans, and compliance
with the requirements of this final rule, through the regular
inspection process.
M. Qualification of Pipeline Personnel
INGAA stated that it supported the development of 49 CFR part 192,
subpart N, when it was initially promulgated, and still believes it to
be valid, including as it applies to controllers. Also, INGAA stated
that it supports the use of the national consensus-based standard ASME
B31Q, which addresses controller issues as well. INGAA stated that it
does not see the need for a qualification section in this proposed
rule, and notes the PIPES Act does not contemplate this section,
either.
API and AOPL stated that they believe PHMSA would create confusion
by keeping this particular paragraph in the final rule. They recommend
that PHMSA delete proposed paragraph (i) and consider incorporating the
requirements into the current subpart G--Qualification of Pipeline
Personnel. They stated that if ``qualification'' refers to any other
purpose than ``OQ'', then PHMSA needs to clarify that requirement. API
and AOPL stated that they support the concept in paragraph (i)(2) of
the proposed rule concerning evaluating a controller's physical
abilities; however, they recommended that it be deleted because it
creates confusion among operators until further research can be
performed to develop standardized thresholds for the various physical
attributes. Also, they stated their concern that compliance with the
requirements in this paragraph could result in violation of the
Americans with Disabilities Act.
AGA expressed concern that PHMSA is essentially rewriting the
Operator Qualification rule. AGA stated that the two paragraphs for
controller training and qualification are almost as long as 49 CFR part
192, subpart N, which provides operator qualification rules for all
pipeline covered employees.
Agency response--PHMSA is persuaded by the comments to eliminate
from this final rule specific requirements for periodic qualification
of controllers, deferring to the existing operator qualification
regulations in that regard. PHMSA recognizes, however, that certain
changes to operators' controller qualification criteria will result
from implementing the new requirements in this final rule and that
operators will incorporate those changes, as necessary, into their
qualification programs.
N. Implementation
The proposed rule would have established different deadlines for
preparing and implementing control room management procedures,
[[Page 63325]]
depending on the type of pipeline or control room. Proposed time frames
varied from 12 to 30 months after publication of the final rule.
Industry comments generally found the proposed time frames
inappropriate. The draft alternative rule language submitted by the
joint trade associations included a requirement that procedures be
written within 18 months following publication of the final rule and be
implemented within 3 years of publication.
Agency response--The elimination of local control stations from the
final rule's scope, and its focus on control rooms using SCADA systems,
makes it unnecessary to establish differing implementation schedules
for control regimes of differing complexity. PHMSA agrees that the
implementation time frames proposed by the joint trade associations
would allow for a thorough process development phase before
implementation, a familiarity with standards under development (such as
International Society of Automation (ISA) 18.02 and API RP 1167), and
an appropriate implementation time to promote consistency and
understanding among operators. We have therefore, incorporated these
time frames into the final rule.
VI. Regulatory Analyses and Notices
A. Statutory/Legal Authority for This Rulemaking
This final rule is published under the authority of the Federal
Pipeline Safety Law (49 U.S.C. 60101 et seq.). Section 60102 authorizes
the Secretary of Transportation to issue regulations governing design,
installation, inspection, emergency plans and procedures, testing,
construction, extension, operation, replacement, and maintenance of
pipeline facilities. This rulemaking also carries out the mandates of
the PIPES Act of 2006--to address human factors and other aspects of
control room management for pipelines where controllers use supervisory
control and data acquisition (SCADA) systems (section 12) and to
publish standards implementing certain NTSB recommendations (section
19).
B. Executive Order 12866 and DOT Policies and Procedures
This rulemaking action has been designated a significant regulatory
action under Executive Order 12866 (58 FR 51735; Oct. 4, 1993). The
rule is also a significant regulatory action under the U.S. Department
of Transportation regulatory policies and procedures (44 FR 11034; Feb.
26, 1979) because of the substantial congressional, industry, and
public interest in control room operations and human factors management
plans. Therefore, the Office of Management and Budget (OMB) has
reviewed a copy of this rulemaking.
The expected benefits of the rulemaking action are the reduction in
pipeline incidents and accidents resulting from controller error and
the associated societal costs that can be attributed to improved
control room management and operations. The estimated benefits consist
of two distinct measures: (1) The reduction in incidents and accidents
due to errors attributed to control room personnel and (2) the
reduction of societal costs related to those incidents and accidents
that can be traced to factors related to control room operations
management. Control room personnel errors can occur, for example, when
a fatigued control room worker reads a pressure indicator incorrectly
and increases pressure, leading to a pipeline rupture. Control room
management errors occur when a procedure or process is not in place
resulting in failure to detect an abnormal condition or a failure to
respond to an incident or accident appropriately. For example, alarm
systems may not be audited and an incident occurs that does not trigger
an alarm. The remedial action (the rule) addresses both personnel error
and operations management.
This rulemaking action is not expected to adversely affect the
economy or the environment. For those costs and benefits that can be
quantified the present value of net benefits, discounted at 7 percent,
are expected to be about $6 million over a ten-year period after all of
the requirements are implemented. This rule is also not expected to
have an annual effect of more than $100 million on the national
economy; therefore, the rule is not considered an economically
significant regulatory action within the meaning of Executive Order
12866.
A complete RIA, including an analysis of costs and benefits, is
available in the docket.
C. Regulatory Flexibility Act
Under the Regulatory Flexibility Act (5 U.S.C. 601 et seq.), PHMSA
must consider whether its rulemaking actions would have a significant
economic impact on a substantial number of small entities. There were
some changes going from the NPRM to the final rule that considered the
concerns of small businesses. First, in response to industry's comments
and to reduce the burden on small firms, PHMSA redefined the criteria
to better differentiate between large operations that would be subject
to all the requirements and those smaller operations that would have
more limited regulation. PHMSA clarified the type of operators that
would be affected by refining the definitions of controller and control
room to determine which operators would need to be subject to the
requirements. Then, PHMSA separated the operators based on risk to
determine which operators needed to comply with the requirements. This
redefinition reduced the number of requirements for small entities.
Most small firms are now only required to comply with certain
requirements mandated by law, namely fatigue mitigation (including
training), and recordkeeping for compliance purposes.
Second, to better understand the distribution of systems based on
size in the pipeline industry, PHMSA examined the operators' annual
reports to further separate the firms by small, medium and large
operations. The categories for this analysis were determined either by
the number of pipeline miles, the number of customers served, or the
complexity of the business. PHMSA has made every effort to limit the
economic impact to small firms by taking steps to exempt gas
distribution operators with fewer than 250,000 services from many of
the requirements likely to have more than minimal cost impacts.
Based on the submission of annual reports, PHMSA estimates that
there are 220 hazardous liquid (HL) system operators with fewer than 50
miles of pipeline that meet the definition of small entities. Also
PHMSA estimated that 1,257 of 1,330 gas distribution systems and 475 of
950 transmission systems (for a total of 1,732 gas systems) fit the
definition of a small operator.
The table below summarizes the expected compliance cost per small
operator.
----------------------------------------------------------------------------------------------------------------
First-year costs Annual recurring costs
----------------------------------------------------------------------------------------------------------------
Low High Low High
----------------------------------------------------------------------------------------------------------------
$6,000 $9,000 $2,300 $2,800
----------------------------------------------------------------------------------------------------------------
[[Page 63326]]
Although PHMSA does not have revenue data for the individual small
pipeline operators, based on the most recent published operator revenue
data, the estimated costs are significantly less than one percent of
revenues for most firms and there is not likely to be a significant
impact on a substantial small number of operators.\8\
---------------------------------------------------------------------------
\8\ See: http://www.ibisworld.com/industry/retail.aspx?indid=1179&chid=1; http://www.ibisworld.com/industry/retail.aspx?indid=1184&chid=1; http://www.ibisworld.com/industry/retail.aspx?indid=1181&chid=1; http://www.bts.gov/publications/national_transportation_statistics/html/table_03_18.html.
---------------------------------------------------------------------------
Therefore, based on this information showing that the economic
impact of this rule on small entities will be minor, I certify under
section 605 of the Regulatory Flexibility Act that these regulations
will not have a significant impact on a substantial number of small
entities. The final Regulatory Flexibility Analysis is available in the
docket.
D. Executive Order 13175
PHMSA has analyzed this rulemaking action according to Executive
Order 13175, ``Consultation and Coordination with Indian Tribal
Governments.'' Because this rulemaking action would not significantly
or uniquely affect the communities of the Indian tribal governments or
impose substantial direct compliance costs, the funding and
consultation requirements of Executive Order 13175 do not apply.
E. Paperwork Reduction Act
As required by the Paperwork Reduction Act of 1995 (44 U.S.C.
3507(d)), DOT will submit all necessary documents to request the Office
of Management and Budget (OMB) grant approval for a new information
collection. A copy of the analysis document will also be entered in the
docket. The RIA contains detailed information on how PHMSA arrived at
the cost and time estimates noted below.
This final rule contains information collection requirements that
affect hazardous liquid and gas pipeline systems. The rule requires
hazardous liquid and gas pipeline operators to keep records on the
following sections: Control room management procedures; roles and
responsibilities of pipeline controllers; information on SCADAs,
fatigue mitigation; alarm management; change management; operating
experience; training; compliance validation; and deviations. PHMSA
estimates that it would take pipeline operators approximately 127,328
hours per year to comply with the rule's recordkeeping and record
retention requirements. PHMSA estimates that the total costs are
approximately between $4.3 million and $5.9 million the first-year and
approximately between $4.2 million and $5.8 million in successive
years. The RIA has the details on the estimates used in this analysis.
F. Unfunded Mandates Reform Act of 1995
This rulemaking action does not impose unfunded mandates under the
Unfunded Mandates Reform Act of 1995. It does not result in costs of
$141.3 million or more to either State, local, or tribal governments,
in the aggregate, or to the private sector, and is the least burdensome
alternative that achieves the objective of this rulemaking action.
G. National Environmental Policy Act
PHMSA has analyzed this rulemaking action for the purposes of the
National Environmental Policy Act (42 U.S.C. 4321 et seq.). The agency
has determined that implementation of this rule will not have any
significant impact on the quality of the human environment. The
environmental assessment is available for review in the docket.
H. Executive Order 13132
PHMSA has analyzed this rulemaking action according to Executive
Order 13132 (``Federalism''). The rulemaking action does not have a
substantial direct effect on the States, the relationship between the
national government and the States, or the distribution of power and
responsibilities among the various levels of government. This
rulemaking action does not impose substantial direct compliance costs
on State and local governments. Further, no consultation is needed to
discuss the preemptive effect of the proposed rule. The pipeline safety
laws, specifically 49 U.S.C. 60104(c), prohibits State safety
regulation of interstate pipelines. Under the pipeline safety law,
States have the ability to augment pipeline safety requirements for
intrastate pipelines regulated by PHMSA, but may not approve safety
requirements less stringent than those required by Federal law. A State
may also regulate an intrastate pipeline facility PHMSA does not
regulate. It is these statutory provisions, not the rule, that govern
preemption of State law. Therefore, the consultation and funding
requirements of Executive Order 13132 do not apply.
I. Executive Order 13211
Transporting gas and hazardous liquids impacts the nation's
available energy supply. However, this rulemaking action is not a
``significant energy action'' under Executive Order 13211 and is not
likely to have a significant adverse effect on the supply,
distribution, or use of energy. Further, the Administrator of the
Office of Information and Regulatory Affairs has not identified this
rulemaking action as a significant energy action.
J. Privacy Act Statement
You may search the electronic form of comments received in response
to any of our dockets by the name of the individual submitting the
comment (or signing the comment if submitted for an association,
business, labor union, etc.). You may review DOT's complete Privacy Act
Statement in the Federal Register published on April 11, 2000 (65 FR
19477).
List of Subjects
49 CFR Part 192
Incorporation by reference, Gas, Natural gas, Pipeline safety,
Reporting and recordkeeping requirements.
49 CFR Part 195
Anhydrous ammonia, Carbon dioxide, Incorporation by reference,
Petroleum, Pipeline safety, Reporting and recordkeeping requirements.
0
For the reasons set forth in the preamble, the Pipeline and Hazardous
Materials Safety Administration is amending 49 CFR Chapter I as
follows:
PART 192--TRANSPORTATION OF NATURAL GAS AND OTHER GAS BY PIPELINE:
MINIMUM FEDERAL SAFETY STANDARDS
0
1. The authority citation for part 192 is revised to read as follows:
Authority: 49 U.S.C. 5103, 60102, 60104, 60108, 60109, 60110,
60113, 60116, 60118, and 60137; and 49 CFR 1.53.
0
2. In Sec. 192.3, definitions for ``alarm,'' ``control room,''
``controller,'' and ``Supervisory Control and Data Acquisition (SCADA)
system'' are added in appropriate alphabetical order as follows:
Sec. 192.3 Definitions.
* * * * *
Alarm means an audible or visible means of indicating to the
controller that equipment or processes are outside operator-defined,
safety-related parameters.
Control room means an operations center staffed by personnel
charged with the responsibility for remotely monitoring and controlling
a pipeline facility.
Controller means a qualified individual who remotely monitors and
[[Page 63327]]
controls the safety-related operations of a pipeline facility via a
SCADA system from a control room, and who has operational authority and
accountability for the remote operational functions of the pipeline
facility.
* * * * *
Supervisory Control and Data Acquisition (SCADA) system means a
computer-based system or systems used by a controller in a control room
that collects and displays information about a pipeline facility and
may have the ability to send commands back to the pipeline facility.
* * * * *
0
3. Amend Sec. 192.7 as follows:
0
a. In paragraph (b) add ``202-366-4595'' after ``20590-001;''
0
b. In the table in paragraph (c)(2), item B.(7) is added to read as
follows:
Sec. 192.7 What documents are incorporated by reference partly or
wholly in this part?
* * * * *
(c) * * *
(2) * * *
------------------------------------------------------------------------
Source and name of referenced
material 49 CFR reference
------------------------------------------------------------------------
* * * * * * *
B. * * * ..................................
(7) API Recommended Practice 1165 Sec. 192.631(c)(1).
``Recommended Practice for Pipeline
SCADA Displays,'' (API RP 1165)
First edition (January 2007).
* * * * * * *
------------------------------------------------------------------------
* * * * *
0
4. In Sec. 192.605, paragraph (b)(12) is added to read as follows:
Sec. 192.605 Procedural manual for operations, maintenance, and
emergencies.
* * * * *
(b) * * *
(12) Implementing the applicable control room management procedures
required by Sec. 192.631.
* * * * *
0
5. In Sec. 192.615, paragraph (a)(11) is added to read as follows:
Sec. 192.615 Emergency plans.
(a) * * *
(11) Actions required to be taken by a controller during an
emergency in accordance with Sec. 192.631.
* * * * *
0
6. Section 192.631 is added to Subpart L to read as follows:
Sec. 192.631 Control room management.
(a) General.
(1) This section applies to each operator of a pipeline facility
with a controller working in a control room who monitors and controls
all or part of a pipeline facility through a SCADA system. Each
operator must have and follow written control room management
procedures that implement the requirements of this section, except that
for each control room where an operator's activities are limited to
either or both of:
(i) Distribution with less than 250,000 services, or
(ii) Transmission without a compressor station, the operator must
have and follow written procedures that implement only paragraphs (d)
(regarding fatigue), (i) (regarding compliance validation), and (j)
(regarding compliance and deviations) of this section.
(2) The procedures required by this section must be integrated, as
appropriate, with operating and emergency procedures required by
Sec. Sec. 192.605 and 192.615. An operator must develop the procedures
no later than August 1, 2011 and implement the procedures no later than
Febraury 1, 2012.
(b) Roles and responsibilities. Each operator must define the roles
and responsibilities of a controller during normal, abnormal, and
emergency operating conditions. To provide for a controller's prompt
and appropriate response to operating conditions, an operator must
define each of the following:
(1) A controller's authority and responsibility to make decisions
and take actions during normal operations;
(2) A controller's role when an abnormal operating condition is
detected, even if the controller is not the first to detect the
condition, including the controller's responsibility to take specific
actions and to communicate with others;
(3) A controller's role during an emergency, even if the controller
is not the first to detect the emergency, including the controller's
responsibility to take specific actions and to communicate with others;
and
(4) A method of recording controller shift-changes and any hand-
over of responsibility between controllers.
(c) Provide adequate information. Each operator must provide its
controllers with the information, tools, processes and procedures
necessary for the controllers to carry out the roles and
responsibilities the operator has defined by performing each of the
following:
(1) Implement sections 1, 4, 8, 9, 11.1, and 11.3 of API RP 1165
(incorporated by reference, see Sec. 192.7) whenever a SCADA system is
added, expanded or replaced, unless the operator demonstrates that
certain provisions of sections 1, 4, 8, 9, 11.1, and 11.3 of API RP
1165 are not practical for the SCADA system used;
(2) Conduct a point-to-point verification between SCADA displays
and related field equipment when field equipment is added or moved and
when other changes that affect pipeline safety are made to field
equipment or SCADA displays;
(3) Test and verify an internal communication plan to provide
adequate means for manual operation of the pipeline safely, at least
once each calendar year, but at intervals not to exceed 15 months;
(4) Test any backup SCADA systems at least once each calendar year,
but at intervals not to exceed 15 months; and
(5) Establish and implement procedures for when a different
controller assumes responsibility, including the content of information
to be exchanged.
(d) Fatigue mitigation. Each operator must implement the following
methods to reduce the risk associated with controller fatigue that
could inhibit a controller's ability to carry out the roles and
responsibilities the operator has defined:
(1) Establish shift lengths and schedule rotations that provide
controllers off-duty time sufficient to achieve eight hours of
continuous sleep;
(2) Educate controllers and supervisors in fatigue mitigation
strategies and how off-duty activities contribute to fatigue;
(3) Train controllers and supervisors to recognize the effects of
fatigue; and
(4) Establish a maximum limit on controller hours-of-service, which
may provide for an emergency deviation from the maximum limit if
necessary for the safe operation of a pipeline facility.
[[Page 63328]]
(e) Alarm management. Each operator using a SCADA system must have
a written alarm management plan to provide for effective controller
response to alarms. An operator's plan must include provisions to:
(1) Review SCADA safety-related alarm operations using a process
that ensures alarms are accurate and support safe pipeline operations;
(2) Identify at least once each calendar month points affecting
safety that have been taken off scan in the SCADA host, have had alarms
inhibited, generated false alarms, or that have had forced or manual
values for periods of time exceeding that required for associated
maintenance or operating activities;
(3) Verify the correct safety-related alarm set-point values and
alarm descriptions at least once each calendar year, but at intervals
not to exceed 15 months;
(4) Review the alarm management plan required by this paragraph at
least once each calendar year, but at intervals not exceeding 15
months, to determine the effectiveness of the plan;
(5) Monitor the content and volume of general activity being
directed to and required of each controller at least once each calendar
year, but at intervals not to exceed 15 months, that will assure
controllers have sufficient time to analyze and react to incoming
alarms; and
(6) Address deficiencies identified through the implementation of
paragraphs (e)(1) through (e)(5) of this section.
(f) Change management. Each operator must assure that changes that
could affect control room operations are coordinated with the control
room personnel by performing each of the following:
(1) Establish communications between control room representatives,
operator's management, and associated field personnel when planning and
implementing physical changes to pipeline equipment or configuration;
(2) Require its field personnel to contact the control room when
emergency conditions exist and when making field changes that affect
control room operations; and
(3) Seek control room or control room management participation in
planning prior to implementation of significant pipeline hydraulic or
configuration changes.
(g) Operating experience. Each operator must assure that lessons
learned from its operating experience are incorporated, as appropriate,
into its control room management procedures by performing each of the
following:
(1) Review incidents that must be reported pursuant to 49 CFR part
191 to determine if control room actions contributed to the event and,
if so, correct, where necessary, deficiencies related to:
(i) Controller fatigue;
(ii) Field equipment;
(iii) The operation of any relief device;
(iv) Procedures;
(v) SCADA system configuration; and
(vi) SCADA system performance.
(2) Include lessons learned from the operator's experience in the
training program required by this section.
(h) Training. Each operator must establish a controller training
program and review the training program content to identify potential
improvements at least once each calendar year, but at intervals not to
exceed 15 months. An operator's program must provide for training each
controller to carry out the roles and responsibilities defined by the
operator. In addition, the training program must include the following
elements:
(1) Responding to abnormal operating conditions likely to occur
simultaneously or in sequence;
(2) Use of a computerized simulator or non-computerized (tabletop)
method for training controllers to recognize abnormal operating
conditions;
(3) Training controllers on their responsibilities for
communication under the operator's emergency response procedures;
(4) Training that will provide a controller a working knowledge of
the pipeline system, especially during the development of abnormal
operating conditions; and
(5) For pipeline operating setups that are periodically, but
infrequently used, providing an opportunity for controllers to review
relevant procedures in advance of their application.
(i) Compliance validation. Upon request, operators must submit
their procedures to PHMSA or, in the case of an intrastate pipeline
facility regulated by a State, to the appropriate State agency.
(j) Compliance and deviations. An operator must maintain for review
during inspection:
(1) Records that demonstrate compliance with the requirements of
this section; and
(2) Documentation to demonstrate that any deviation from the
procedures required by this section was necessary for the safe
operation of a pipeline facility.
PART 195--TRANSPORTATION OF HAZARDOUS LIQUIDS BY PIPELINE
0
7. The authority citation for part 195 is amended to read as follows:
Authority: 49 U.S.C. 5103, 60102, 60104, 60108, 60109, 60116,
60118, and 60137; and 49 CFR 1.53.
0
8. In Sec. 195.2, definitions for ``alarm,'' ``control room,''
``controller,'' and ``Supervisory Control and Data Acquisition (SCADA)
system'' are added in appropriate alphabetical order as follows:
Sec. 195.2 Definitions.
* * * * *
Alarm means an audible or visible means of indicating to the
controller that equipment or processes are outside operator-defined,
safety-related parameters.
* * * * *
Control room means an operations center staffed by personnel
charged with the responsibility for remotely monitoring and controlling
a pipeline facility.
Controller means a qualified individual who remotely monitors and
controls the safety-related operations of a pipeline facility via a
SCADA system from a control room, and who has operational authority and
accountability for the remote operational functions of the pipeline
facility.
* * * * *
Supervisory Control and Data Acquisition (SCADA) system means a
computer-based system or systems used by a controller in a control room
that collects and displays information about a pipeline facility and
may have the ability to send commands back to the pipeline facility.
* * * * *
0
9. Amend 195.3 as follows:
0
a. In paragraph (b) add ``202-366-4595'' after ``20590-001'';
0
b. In the table in paragraph (c) items B.(18) and B.(19) are added to
read as follows:
Sec. 195.3 Incorporation by reference.
* * * * *
(c) * * *
[[Page 63329]]
------------------------------------------------------------------------
Source and name of referenced
material 49 CFR reference
------------------------------------------------------------------------
* * * * * * *
B. * * *
(18) API Recommended Practice 1165 Sec. 195.446(c)(1).
``Recommended Practice for Pipeline
SCADA Displays,'' (API RP 1165)
First Edition (January 2007).
(19) API Recommended Practice 1168 Sec. 195.446(c)(5).
``Pipeline Control Room
Management,'' (API RP 1168) First
Edition (September 2008).
* * * * * * *
------------------------------------------------------------------------
0
10. In Sec. 195.402, paragraph (c)(15) and (e)(10) are added to read
as follows:
Sec. 195.402 Procedural manual for operations, maintenance, and
emergencies.
* * * * *
(c) * * *
(15) Implementing the applicable control room management procedures
required by Sec. 195.446.
* * * * *
(e) * * *
(10) Actions required to be taken by a controller during an
emergency, in accordance with Sec. 195.446.
* * * * *
0
11. Section 195.446 is added to read as follows:
Sec. 195.446 Control room management.
(a) General. This section applies to each operator of a pipeline
facility with a controller working in a control room who monitors and
controls all or part of a pipeline facility through a SCADA system.
Each operator must have and follow written control room management
procedures that implement the requirements of this section. The
procedures required by this section must be integrated, as appropriate,
with the operator's written procedures required by Sec. 195.402. An
operator must develop the procedures no later than August 1, 2011 and
implement the procedures no later than February 1, 2012.
(b) Roles and responsibilities. Each operator must define the roles
and responsibilities of a controller during normal, abnormal, and
emergency operating conditions. To provide for a controller's prompt
and appropriate response to operating conditions, an operator must
define each of the following:
(1) A controller's authority and responsibility to make decisions
and take actions during normal operations;
(2) A controller's role when an abnormal operating condition is
detected, even if the controller is not the first to detect the
condition, including the controller's responsibility to take specific
actions and to communicate with others;
(3) A controller's role during an emergency, even if the controller
is not the first to detect the emergency, including the controller's
responsibility to take specific actions and to communicate with others;
and
(4) A method of recording controller shift-changes and any hand-
over of responsibility between controllers.
(c) Provide adequate information. Each operator must provide its
controllers with the information, tools, processes and procedures
necessary for the controllers to carry out the roles and
responsibilities the operator has defined by performing each of the
following:
(1) Implement API RP 1165 (incorporated by reference, see Sec.
195.3) whenever a SCADA system is added, expanded or replaced, unless
the operator demonstrates that certain provisions of API RP 1165 are
not practical for the SCADA system used;
(2) Conduct a point-to-point verification between SCADA displays
and related field equipment when field equipment is added or moved and
when other changes that affect pipeline safety are made to field
equipment or SCADA displays;
(3) Test and verify an internal communication plan to provide
adequate means for manual operation of the pipeline safely, at least
once each calendar year, but at intervals not to exceed 15 months;
(4) Test any backup SCADA systems at least once each calendar year,
but at intervals not to exceed 15 months; and
(5) Implement section 5 of API RP 1168 (incorporated by reference,
see Sec. 195.3) to establish procedures for when a different
controller assumes responsibility, including the content of information
to be exchanged.
(d) Fatigue mitigation. Each operator must implement the following
methods to reduce the risk associated with controller fatigue that
could inhibit a controller's ability to carry out the roles and
responsibilities the operator has defined:
(1) Establish shift lengths and schedule rotations that provide
controllers off-duty time sufficient to achieve eight hours of
continuous sleep;
(2) Educate controllers and supervisors in fatigue mitigation
strategies and how off-duty activities contribute to fatigue;
(3) Train controllers and supervisors to recognize the effects of
fatigue; and
(4) Establish a maximum limit on controller hours-of-service, which
may provide for an emergency deviation from the maximum limit if
necessary for the safe operation of a pipeline facility.
(e) Alarm management. Each operator using a SCADA system must have
a written alarm management plan to provide for effective controller
response to alarms. An operator's plan must include provisions to:
(1) Review SCADA safety-related alarm operations using a process
that ensures alarms are accurate and support safe pipeline operations;
(2) Identify at least once each calendar month points affecting
safety that have been taken off scan in the SCADA host, have had alarms
inhibited, generated false alarms, or that have had forced or manual
values for periods of time exceeding that required for associated
maintenance or operating activities;
(3) Verify the correct safety-related alarm set-point values and
alarm descriptions when associated field instruments are calibrated or
changed and at least once each calendar year, but at intervals not to
exceed 15 months;
(4) Review the alarm management plan required by this paragraph at
least once each calendar year, but at intervals not exceeding 15
months, to determine the effectiveness of the plan;
(5) Monitor the content and volume of general activity being
directed to and required of each controller at least once each calendar
year, but at intervals not exceeding 15 months, that will assure
controllers have sufficient time to analyze and react to incoming
alarms; and
(6) Address deficiencies identified through the implementation of
paragraphs (e)(1) through (e)(5) of this section.
(f) Change management. Each operator must assure that changes that
could affect control room operations are coordinated with the control
room
[[Page 63330]]
personnel by performing each of the following:
(1) Implement section 7 of API RP 1168 (incorporated by reference,
see Sec. 195.3) for control room management change and require
coordination between control room representatives, operator's
management, and associated field personnel when planning and
implementing physical changes to pipeline equipment or configuration;
and
(2) Require its field personnel to contact the control room when
emergency conditions exist and when making field changes that affect
control room operations.
(g) Operating experience. Each operator must assure that lessons
learned from its operating experience are incorporated, as appropriate,
into its control room management procedures by performing each of the
following:
(1) Review accidents that must be reported pursuant to Sec. 195.50
and 195.52 to determine if control room actions contributed to the
event and, if so, correct, where necessary, deficiencies related to:
(i) Controller fatigue;
(ii) Field equipment;
(iii) The operation of any relief device;
(iv) Procedures;
(v) SCADA system configuration; and
(vi) SCADA system performance.
(2) Include lessons learned from the operator's experience in the
training program required by this section.
(h) Training. Each operator must establish a controller training
program and review the training program content to identify potential
improvements at least once each calendar year, but at intervals not to
exceed 15 months. An operator's program must provide for training each
controller to carry out the roles and responsibilities defined by the
operator. In addition, the training program must include the following
elements:
(1) Responding to abnormal operating conditions likely to occur
simultaneously or in sequence;
(2) Use of a computerized simulator or non-computerized (tabletop)
method for training controllers to recognize abnormal operating
conditions;
(3) Training controllers on their responsibilities for
communication under the operator's emergency response procedures;
(4) Training that will provide a controller a working knowledge of
the pipeline system, especially during the development of abnormal
operating conditions; and
(5) For pipeline operating setups that are periodically, but
infrequently used, providing an opportunity for controllers to review
relevant procedures in advance of their application.
(i) Compliance validation. Upon request, operators must submit
their procedures to PHMSA or, in the case of an intrastate pipeline
facility regulated by a State, to the appropriate State agency.
(j) Compliance and deviations. An operator must maintain for review
during inspection:
(1) Records that demonstrate compliance with the requirements of
this section; and
(2) Documentation to demonstrate that any deviation from the
procedures required by this section was necessary for the safe
operation of the pipeline facility.
Issued in Washington, DC, on November 20, 2009 under authority
delegated in 49 CFR part 1.
Cynthia L. Quarterman,
Administrator.
[FR Doc. E9-28469 Filed 12-2-09; 8:45 am]
BILLING CODE 4910-60-P