Control Room Management: Building on a Compliant Fatigue Program

Fatigue mitigation requirements in the Control Room Management (CRM) rule trace back to Section 12 of the PIPES Act of 2006, which directed PHMSA to require human factors management plans for pipeline control rooms, including a maximum limit on controller hours of service. The resulting requirements, 49 CFR 195.446(d) for hazardous liquid pipelines and 49 CFR 192.631(d) for gas pipelines, exist because a fatigued controller is an operational risk.

A plan can meet every element of the rule on paper and still leave an operator unable to answer a simple question: is fatigue risk in our control room going down? Recent PHMSA enforcement actions show inspectors asking exactly that.

The Baseline: What the Rule Requires

Paragraph (d) requires operators to:

• Set shift lengths and schedule rotations that give controllers off-duty time sufficient for eight hours of continuous sleep
• Educate controllers and supervisors in fatigue mitigation strategies and how off-duty activities contribute to fatigue
• Train controllers and supervisors to recognize the effects of fatigue
• Establish a maximum limit on hours of service, which may allow an emergency deviation when necessary for safe operation

PHMSA’s CRM FAQs add key details:

• Hours of service include all work for the operator, including overlap, on-call duties, drills, meetings, and training, for anyone who maintains controller qualification (D.02).
• Commute time is off-duty time, but it has to fit inside the off-duty period. Controllers must have the opportunity for eight hours of continuous sleep between shifts, and PHMSA encourages at least ten continuous hours off to allow for commutes and other personal activities (D.01, D.03). A common benchmark for sizing that period is eight hours of sleep, plus one hour of personal time, plus the controller’s actual commute. A longer commute means a longer gap between shifts.
• Reasonable maximum limits for shift work (any schedule outside a traditional 8-to-5, five-day week, which describes most 24/7 control rooms): 65 duty hours in any sliding seven days, 14 in any 24 hours, and a minimum 35-hour off-duty period, often called a reset, when limits are reached (D.07).
• Procedures and records together must demonstrate compliance. Procedures must define the shift lengths, rotations, and hours-of-service limits, and records must show those limits were followed (D.14). Schedules and timesheets alone fall short. They often do not capture actual time worked, and they do not calculate hours of service against limits or show when a reset was required.

Where Compliant Plans Fall Short

None of these looks like a violation until someone goes looking for it:

• Off-duty hours do not guarantee sleep. A rotation can schedule the required gap and still leave a controller short on sleep once commute, family, and household obligations are subtracted, and one hour of personal time does not go far. This is why the rule requires operators to educate controllers on how off-duty activities contribute to fatigue. That education only works if it changes how controllers actually use their time off.
• Emergency deviations become routine. Without tracking, the deviation becomes the fix for chronic understaffing. Paragraph (j)(2) requires documentation that each deviation was necessary, and FAQ D.13 says operators should plan for deviations in advance and treat frequent occurrences of the same type of deviation as a reason to review their policies and procedures. That review should look for repeat, cyclical, and systematic patterns, such as the same console, crew, or time of year. Left unreviewed, those patterns become part of a culture of complacency, where deviating is simply how the schedule works.
• Training goes stale. Fatigue education and training are typically revisited each year as part of an operator’s annual program rigor, but the content often becomes rote: the same material, rarely updated, sometimes missing topics PHMSA recommends in FAQ D.04, or not covering them often enough to be effective. The reviews of training effectiveness are often incomplete as well. Many lack predefined quantitative and qualitative measures of success, and the improvements they identify are not tracked to resolution. The ability to recognize fatigue fades when training stops being meaningful.

What PHMSA Is Finding

Paragraph (i) requires operators to produce their procedures on request, and paragraph (j)(1) requires records that demonstrate compliance. Recent enforcement actions, spanning 2023 through 2026, show where fatigue plans fail that test:

• Records that could not show who worked where. One operator’s schedules did not identify which controller worked which of two cross-trained consoles, so it could not demonstrate that its rotations allowed eight hours of sleep. Spreadsheet scheduling often creates exactly this gap: an entry that says a controller will work a 12-hour shift, with no console or role and no record of when the shift actually started and ended. Letting controllers pick a console without recording it does the same.
• Qualified people outside the rotation. The same operator did not record actual hours for leads and supervisors who do not normally work the console but are qualified and authorized to fill in on it. Another operator’s plan did not address on-call controllers at all. PHMSA noted they are held to the same standards as regular controllers.
• Commutes as an operator-specific risk. An offshore operator was cited for not addressing travel fatigue for controllers commuting to the platform, a trip that can include a one- to two-hour boat ride. The lesson applies onshore too. Where controllers regularly commute roughly an hour or more, commute time should be identified in the plan as an operator-specific fatigue risk.
• Ambiguous limits and resets. Findings cited conflicting maximum consecutive hours, unclear deviation form scope, reset language written as “may be used,” and a timesheet tool that could not show current-week hours when staffing decisions were made.
• An annual review without a method. One plan required an annual fatigue review but did not define who performs it, what metrics apply, how deficiencies are addressed, or how it is documented.

Changing a Schedule: Understand the Impact First

The CRM rule does not prescribe a specific shift rotation type, and PHMSA’s FAQs confirm that schedules such as 7-on/7-off are not excluded. That flexibility comes with two expectations in FAQ D.15. First, every operator needs a scientific basis for the schedules and limits it selects, whatever rotation it uses. Second, an operator that uses limits past those recommended in the FAQs, which PHMSA says includes 7-on/7-off schedules, needs sufficient justification for how its overall program offsets the increased fatigue risk. That justification may require additional countermeasures. In either case, the operator must be able to demonstrate that its limits or countermeasures manage fatigue risk.

That expectation carries more weight when a schedule changes. In one recent case, an operator moved from a DuPont schedule to a four-on, two-off rotation without investigating the fatigue risk the new rotation introduced or documenting a plan to mitigate it. The finding was not about which schedule was better. It was that the operator had no process to identify how fatigue risk would be reduced before the change took effect. That investigation is not paperwork. It is how an operator sets controllers up to succeed on a new rotation and keeps the pipeline operating safely.

Schedule changes, staffing changes, and even single unplanned vacancies have ripple effects. Before a change, operators should be able to answer:

• How does it affect sleep at shift inversions? An inversion is the point where a controller switches between day and night work, day to night or night to day. PHMSA’s investigation criteria (below) treat a recent rotation to or from nights as a fatigue risk factor. Rotation direction matters too: a 2016 study of 4,750 rotating-shift workers associated backward rotation (night to evening to day) with poorer sleep quality than forward rotation (day to evening to night). Continuity, staffing depth, and controller input are other inputs.
• How many consecutive nights does it create? PHMSA has cited fatigue screening that missed the elevated risk after a third consecutive night.
• Who is qualified on each console, and how are their hours affected? Leads, supervisors, and on-call controllers who are qualified and authorized to fill in count too.
• When a controller cannot finish a shift, who fills the seat? PHMSA has cited procedures that did not say how fatigue risk is weighed when choosing a replacement, or how the console is managed while one is found.
• What else does it touch? One operator’s procedures did not say how travel to a backup control room test counted toward hours worked or when the 35-hour reset applied. Travel outside the normal commute, such as a call-in for a shift or training a controller would not normally cover, needs the same clarity.
• How is shift turnover affected? API RP 1168 Third Edition (May 2026) broadens turnover expectations to any event that could directly or indirectly affect operations. The Third Edition is not incorporated by reference into the CFR, but it reflects years of inspection lessons and operator experience. See our summary of the five changes in the Third Edition.

Document the answers and the countermeasures before the change. That record shows the change was a managed decision, not a scheduling convenience. For more on balancing fatigue requirements with operational stability, see our whitepaper, Effective Control Room Scheduling to Maintain Operations.

When Something Goes Wrong, Start With Fatigue

Paragraph (g)(1) requires operators to review reportable accidents for control room contributions, including controller fatigue. Two operators were recently cited because their procedures did not define how a fatigue deficiency would be identified in that review.

Too often, fatigue enters an investigation only if something points to it. We recommend reversing that order: start with the assumption that fatigue may have contributed, and work backward until the evidence definitively rules it out. Apply the same discipline to near misses and deviations. PHMSA’s white paper, Investigating the Possible Contribution of Fatigue to Pipeline Mishaps, offers criteria to work through, including:

• Less than about 21 hours of good-quality sleep in the preceding 72 hours
• An event between about 2:00 and 6:00 a.m. or 1:00 and 3:00 p.m.
• Rotation to or from a night shift (a shift inversion) within the prior three days

Ruling fatigue out takes data: actual hours, commute, shift history, rotation position, and deviations. Without it, investigations default to the factors that are easier to see.

Turning the Plan into a Program

A fatigue mitigation plan that is not reviewed against real data is a document, not a program. An effective review has a defined owner, defined metrics, and a way to track deficiencies to resolution. It looks at:

• Hours-of-service trends against documented limits for every qualified individual, especially how resets are applied and whether commute time fits within scheduled off-duty periods
• The frequency and pattern of emergency deviations, whether each was justified, and whether any are repeating or cyclical
• Schedule changes and unplanned fills, and whether fatigue risk was evaluated first
• Patterns in how fatigue mitigation tactics are used
• Controller feedback on when fatigue peaks, and on how well they understand and use the fatigue mitigation tactics available to them
• The effectiveness of fatigue education and training, measured against predefined quantitative and qualitative metrics, with improvement actions tracked to resolution

Doing this by hand from spreadsheets and timesheets is the kind of work that gets skipped when the control room gets busy. FatigueMgr, part of the POEMS CRM Suite, makes the data-heavy parts of this review sustainable. It tracks hours of service against your limits, identifies and documents deviations in real time, and keeps the fatigue mitigation records and workload data needed for staffing decisions, annual reviews, and investigations.

The Floor, Not the Finish Line

The four required elements of paragraph (d) are the starting point. A fatigue mitigation program is only as good as an operator’s ability to see, month over month, whether it is working, and to show that every schedule change, deviation, and staffing decision was made with fatigue in mind. For many control rooms, the gap between those two things is the record itself. Schedules live in one place, deviation approvals in another, and training history somewhere else entirely. Operators who want to close that gap can see how the fatigue management tools in the POEMS CRM Suite bring those records together in one place. Contact us now to schedule a discovery call.