Material Balance System General Manual - Redacted

Transcription

1 Enbridge Pipelines Inc. Material Balance System General Manual (Redacted for Security and Proprietary Reasons) Filed pursuant to Condition 12 of National Energy Board Order XO-E July 15, 2014

2 TABLE OF CONTENTS NOMENCLATURE... IV PREFACE... V ENBRIDGE S POLICY AND COMMITMENT TO LEAK DETECTION... VI LEAK DETECTION SYSTEM REGULATORY REQUIREMENTS... VIII 1 INTRODUCTION MBS OVERVIEW FIXED MODEL DATA MEASUREMENT DATA STATE ESTIMATION SOFTWARE Repeatability, Diagnostic Flows, and PDFs LEAK ANALYSIS METHODOLOGY Purpose of Multiple Time Windows Impact of Thresholds on Performance Dual Thresholds Alarms DISPLAYS MBS ARCHITECTURE Server Layout Model File Layout THE SCADA SYSTEM SCADA SYSTEM STRUCTURE INSTRUMENTATION FLOW METERS PRESSURE TRANSMITTERS TEMPERATURE TRANSMITTERS DENSITOMETERS VISCOMETERS VALVE INSTRUMENTATION PUMP INSTRUMENTATION CRITICAL AND IMPORTANT EQUIPMENT MBS DEGRADATION SOURCES OF ERROR TYPES OF DEGRADATION MBS PERFORMANCE i

3 6.1 SENSITIVITY ACCURACY RELIABILITY ROBUSTNESS SPECIFICATION AND PRIORITIZATION OF PERFORMANCE METRICS EVALUATION OF MBS PERFORMANCE STAFF ROLES AND RESPONSIBILITIES LEAK DETECTION PROCEDURES ANALYST PROCEDURES ANALYST TESTING AND TRAINING PHASE 1: ORIENTATION PHASE 2: TASK-BASED LEARNING PHASE 3: ANALYSIS TRAINING READINESS ASSESSMENT MAINTENANCE PREVENTATIVE MAINTENANCE REPAIR/REPLACEMENT MODEL IMPROVEMENT PLANS RECORD KEEPING RETENTION OF RECORDS HISTORICAL RETENTION PERIODS APPENDIX A: FLUID CHARACTERISTICS APPENDIX B: MBS FUNCTIONALITY FOR SPECIFIC OPERATING CONDITIONS APPENDIX C: REFERENCED DOCUMENT LIST APPENDIX D: ROLES, RESPONSIBILITIES AND AUTHORITIES OF PERSONNEL IN THE EVENT OF A SUSPECTED LEAK GLOSSARY ii

4 List of Figures Figure 1: Geographic overview of Enbridge s liquid pipelines... 1 Figure 2: Overview of the MBS structure... 3 Figure 3: Schematic of a simple pipeline model... 5 Figure 4: Measurement data used in the model... 6 Figure 5:... 7 Figure 6: Pipeline with multiple volume balance sections... 9 Figure 7: The "Barrel Analogy" Illustrative Example Figure 8: Distance plot showing head, flow, and elevation profile Figure 9: Time plot showing a section s diagnostic volumes and thresholds Figure 10: Text display showing pressures, flows, and other useful values Figure 11: SCADA Environment to MBS Host Mapping Figure 12: MBS Server Organizational Map Figure 13: MBS Model Directories Figure 14: High level SCADA system schematic Figure 15: Various sources of error in the MBS system Figure 16: Targets demonstrating accuracy (left) and repeatability (right) Figure 17: Quantization error from analog to digital conversion Figure 18: Accuracy plot for multiple pipeline sections LIST OF TABLES Table 1: Descriptions of MBS Model Directories Table 2: Prioritization of the four performance metrics iii

5 Nomenclature Alternate Leak Detection Canadian Standards Association Computational Pipeline Monitoring Control Centre Operations Control Room Management Custody Transfer Drag Reducing Agent Fluid Withdrawal Test Lower Explosive Limit Material Balance System Pipeline Control Systems and Leak Detection Pipeline Inspection Gauge Pressure Transmitter Programmable Logic Controller Real Time Transient Model Remote Terminal Unit Simulated Leak Test Supervisory Control and Data Acquisition Temperature Transmitter Volume Balance ALD CSA CPM CCO CRM CT DRA FWT LEL MBS PCSLD PIG PT PLC RTTM RTU SLT SCADA TT VB iv

6 This document applies to all Enbridge pipelines that are controlled from the Edmonton Control Centre. Enbridge pipelines that are not controlled by the Edmonton Control Centre may not be in alignment with the content of this document. Preface This manual is the first in a series of manuals that describe Enbridge s Material Balance System ( MBS ). It provides a detailed explanation of MBS aspects that are common to the entire Enbridge system. All MBS information applicable to individual pipelines can be accessed in their corresponding manuals: Material Balance System Manual: The Line XX Model. These supplemental manuals make up the rest of the series, providing detailed routing, operational, and modeling information for each pipeline. Together, this series of manuals is designed to meet the requirements of Canadian Standards Association ( CSA ) Z Annex E (Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection) and API RP-1130 (Computational Pipeline Monitoring for Liquids). This manual is intended to be a resource for all Enbridge staff who work with the MBS. Note: Starting in section 1: Introduction, the bolded words in this document are defined in the glossary. Only the first instance of a word is bolded. v

7 Line 9B Reversal and Line 9 Capacity Expansion Project Enbridge s Policy and Commitment to Leak Detection Company Leak Detection Commitment Enbridge Pipelines Inc. ( Enbridge ) is committed to employing industry leading leak detection methodologies. This is achieved by meeting or exceeding all applicable engineering standards and regulatory requirements, and by employing the most suitable technologies. Regulatory Compliance Enbridge is committed to adhering to all applicable regulatory requirements for leak detection and will implement the applicable standards on all of its pipeline systems. The Enbridge liquids pipeline network stretches across North America and is required to meet varying engineering standards and regulatory requirements. In all cases, Enbridge strives to employ the appropriate leak detection criteria on all pipelines to ensure it meets or exceeds expectations. Industry Leadership, Approach & Best Practices Enbridge is committed to applying industry best practises and developing leak detection technologies. This will be achieved through employing the best technologies, developed processes, and skilled personnel. Enbridge is also committed to continuous improvement of its leak detection strategy which is a comprehensive, multi-layered approach for its pipeline network. The strategy encompasses five primary leak monitoring methods, each with a different focus and featuring differing technology, resources and timing. Used together, these methods provide an overlapping and comprehensive leak detection capability. Visual surveillance and reports - These are reports of oil or oil odours from third parties and from Enbridge s aerial and ground line patrols. Enbridge manages thirdparty reports through its emergency telephone line, and communicates with affected public and local emergency officials through our public awareness program. Aerial and ground line patrols are conducted in accordance with regulatory requirements and risk based approaches. Scheduled line balance calculations - These calculations are sometimes referred to as over/short reports in the pipeline industry and are calculations of oil inventory that are performed at fixed intervals, typically every two and 24 hours. A rolling 24-hour calculation is also maintained, based on calculations completed at a set time each day. The purpose of these calculations is to identify unexpected losses of pipeline inventory that may indicate a possible leak. Enbridge utilizes line balance calculations within its Commodity Movement Tracking system. vi

8 Line 9B Reversal and Line 9 Capacity Expansion Project Controller monitoring - Enbridge s Pipeline Controller monitors pipeline conditions (such as pipeline pressure) through the Supervisory Control And Data Acquisition ( SCADA ) system, which is designed to identify unexpected operational changes, such as pressure drops, that may indicate a leak. Additional sensors monitored through SCADA, such as concentrations of explosive vapour, pump seal failures, equipment vibration levels and sump levels, can also be used by the controller to identify potential leaks. Computational Pipeline Monitoring ( CPM ) - Computer-based pipeline monitoring systems utilize measurements and pipeline data to detect anomalies that could indicate possible leaks. The pipeline monitoring system that Enbridge uses provides a sophisticated computer model of our pipelines, and continuously monitors changes in their calculated volume of liquids. Acoustic Emission In-line Inspection In addition to a comprehensive integrity management plan, the use of acoustic-based inline tool technology will detect anomalous acoustic activity associated with leaks or pockets of trapped gas in pressurized pipes. In essence, the tools are tuned to 'listen' for leaks. This noncontinuous method relies on technology that is designed to detect very small leaks. New Technology Deployment Enbridge is committed to continuous research and testing of new technologies. Enbridge will evaluate new leak detection technologies and deploy them if they substantively improve leak detection capabilities. Specific commitments Enbridge commits to performing the following on all pipeline systems: The Enbridge pipeline system will not be operated without a functioning Leak Detection System, for all modes of operation. All leak alarms will be acknowledged, analysed, and evaluated. Qualified personnel will be trained in accordance with industry standards and applicable regulations. Personnel will be specifically trained to use and operate Enbridge's Leak Detection Systems to evaluate pipeline hydraulics in connection with analysis of pipeline leaks. The Pipeline Controllers will be provided a support structure to assist with leak analysis and support of the software systems. vii

9 Line 9B Reversal and Line 9 Capacity Expansion Project Leak Detection System Regulatory Requirements The Enbridge pipeline system operates in both Canada and the United States of America. Various government and public agencies dictate regulations and practices, as well as monitor activities related to the transportation of liquid hydrocarbons. Enbridge is committed to meeting all applicable regulations. Listed below are regulatory and industry standards for computational pipeline monitoring systems and leak detection. These are the principle references, but the list may not be exhaustive. The Enbridge MBS system is designed to comply with the requirements of these standards. Canada Federal National Energy Board Act, National Energy Board Onshore Pipeline Regulations 1999 (SOR/99-294): section 37. Alberta Alberta Regulation 91/2005, Pipeline Act, Pipeline Rules: Part 2, Materials and Design, subsection 9(4), Part 4, Inspection and Record, sections 47, 48, 49. United States of America Code of Federal Regulations, Title 49: Transportation, Part 195: Transportation of Hazardous Liquids by Pipeline, 2008 rev: o Sec CPM leak detection (design requirements); o Sec CPM leak detection; and o Sec Pipeline integrity management in high consequence areas (Operations and Maintenance). Industry Standards CSA Z662 (latest version), Oil and Gas Pipeline Systems, Annex E: Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection. API Publication 1130: Computational Pipeline Monitoring for Liquids Pipelines. 42 pp viii

10 1 Introduction Enbridge owns and operates over km ( mi) of liquids pipelines throughout Canada and the United States of America, shipping crude oil and refined liquids in quantities of over 2.2 million barrels per day. The majority of those pipelines are controlled remotely from a Control Centre in Edmonton, Alberta. The Edmonton-controlled pipelines are shown in Figure 1 as numbered lines. Figure 1: Geographic overview of Enbridge s liquid pipelines 1

11 Line 9B Reversal and Line 9 Capacity Expansion Project Enbridge uses multiple approaches for leak detection on its pipelines. These approaches are designed to provide comprehensive and overlapping leak detection capabilities. The five primary approaches include the following: 1. Visual surveillance and reports. These are from Enbridge line patrols (aerial and ground) and by third-party reports of oil or oil odours. 2. Scheduled line balance calculations. These are sometimes called over/short reports in the industry. They are calculations of oil inventory done at fixed intervals. 3. Controller monitoring. This is the continuous monitoring of pipeline conditions (e.g. pipeline pressure) by the Pipeline Controller. 4. Computational Pipeline Monitoring. This is computer-based monitoring using continuous measurements of pipeline conditions. 5. Acoustic Emission Inline Inspection. This is an acoustic-based inline tool technology that will detect anomalous acoustic activity associated with leaks or pockets of trapped gas in pressurized pipes. These approaches are used together to identify possible leak conditions. The Enbridge MBS is the Enbridge implementation of a CPM real-time leak detection system for liquids pipelines. It is designed to meet or exceed the leak detection requirements as identified by the CSA Recommended Practice for Oil Pipeline System Leak Detection ( Recommended Practice ) and to be compliant with API RP-1130 Computational Pipeline Monitoring. If the MBS detects a potential leak it will send a leak alarm to the pipeline operator. The operator will then initiate an investigation procedure, calling an on-shift 24/7 leak detection analyst, who will determine if the alarm is valid or invalid. Enbridge employs leak detection analysts to determine the cause of all leak alarms. This exceeds all government and industry regulatory requirements, and is the result of Enbridge s commitment to pipeline safety. The analysis of alarms is necessary because many situations may mimic a leak, including issues related to instrumentation, communications, and modeling. In these cases leak alarms are deemed invalid. 2

12 2 MBS Overview The MBS is the CPM system that Enbridge uses to provide leak detection on liquid pipelines. The MBS uses a Real Time Transient Model ( RTTM ), which simulates the hydraulic state of the pipeline in real time, including transient conditions. An overview of the MBS is shown in Figure 2. Field Dedicated Server Fixed Pipeline Model Fixed Model Data MBS User s Computer Pipeline Instrumentation Measurement Data Real Time Transient Model (SPS Statefinder) Estimated Pipeline State Leak Analysis Software (Enbridge) Alarms, reports, trends, etc. User Interface (MBS Displays) Figure 2: Overview of the MBS structure For each pipeline, a computer model is created that replicates the pipeline s unchanging (fixed) physical properties. Any information that affects the pipeline hydraulics, but is unaffected by the pipelines operation, is contained in the fixed pipeline model. Measurement data from field instrumentation is required to calculate the pipeline hydraulics. Pressure and flow rate measurements are critical to the model, but other measurements such as temperature or fluid properties are also used. The RTTM calculates an estimate of the hydraulic state for the entire pipeline. This software uses the measurement data and the fixed pipeline model data to compute the estimate. 3

13 Differences between the estimated pipeline state and the measured values are reconciled with diagnostic flows ( DF ). Leak detection is performed by leak analysis software that examines the calculated pipeline state. The results of the leak analysis can be accessed through a user interface on the MBS user s computer, in the form of leak alarms, time plots, distance plots, and text displays. 4

14 Line 9B Reversal and Line 9 Capacity Expansion Project 2.1 Fixed Model Data The pipeline model is composed of data which describes the physical characteristics of the pipeline. The data contained in the model is fixed during the operation of the pipeline, and therefore does not change when the RTTM is running. All of the information in the model is used to calculate the pipeline hydraulics, and is required by the RTTM. Typical fixed data includes: elevation profile; pipe data: length; diameter; wall thickness; and roughness; station location: accurate kilometre post / mile post of station location; station facilities: hydraulically significant instrumentation (pressure, flow, etc.); valve site location: accurate kilometre/milepost of valve site location; valve site facilities: hydraulically significant instrumentation; and fluid properties. A schematic of a simple pipeline model is shown in Figure 3. From left to right, there is a station where fluid is injected and has a discharge pressure, some piping, a mainline block valve, more piping, and a final station which has a suction pressure and a delivery. The black dots (nodes) are connection points for the model elements. Note that certain information, such as elevation profile and pipe length, is not depicted in the schematic. Figure 3: Schematic of a simple pipeline model It is not necessary to model every physical aspect of a pipeline; only those that impact the pipeline hydraulics are required. For example, in reality there would be a pump at Station 1 to move the fluid through the pipeline. There is no pump in the model because only the discharge pressure and flow is required to model the pipeline s hydraulic state. 5

15 Line 9B Reversal and Line 9 Capacity Expansion Project 2.2 Measurement Data Measurement data from field instrumentation must be added to the static model in order to create a real time transient model and operate the MBS. The digital model shown in Figure 3 has placeholders for measurement data. For example, the pressure monitors in the model receive data from pressure transmitters on the actual pipeline. Likewise, the amount of fluid being injected and delivered is driven by real-time measurements from flow meters. Even the model block valve is set to open and close with information from a physical block valve. Figure 4 shows the same model as Figure 3, but highlights where certain measurements are used to drive the model. Figure 4: Measurement data used in the model With the live measurement data being fed into the model, the RTTM can create a state estimation. The types of measurements fed into the model include the following. Injection and delivery flows Mainline flows Pressures Fluid temperature Ground temperature Fluid viscosity Fluid density Sonic velocity in the fluid Valve status Pump status Measured fluid properties may override values in the static model data. Note that the model may collect and display information that does not directly control model elements. For example, measurements from redundant pressure transmitters can still be read by MBS users. 6

16 2.3 State Estimation Software There are two major components of the MBS software: the pipeline state estimation software and the leak analysis software. This section discusses the state estimation software. Enbridge s MBS uses a commercial software product called Statefinder, which is developed by DNV GL. Statefinder simulates the hydraulic state for the entire pipeline in real time, making it a RTTM. At every scan cycle, current measurement data (see section 2.2) is passed to Statefinder, and integrated with fixed pipeline data (see section 2.1). Pressure and flow data is used as boundary conditions to calculate an estimate of the pipeline state. The computed pipeline state is an accurate representation of the current pipeline state when the given boundary conditions are accurate Figure 5: 7

17 2.3.2 Repeatability, Diagnostic Flows, and PDFs All values used by Statefinder to calculate the pipeline state have some level of uncertainty. To reflect these uncertainties, measured values in the model can be assigned a repeatability value. Repeatability is the maximum amount that a model value can deviate from its measured value. For example, if a flow meter is reading 100 m 3 /hr, and has a repeatability of ±1 m 3 /hr, the model may use any value between 99 m 3 /hr and 101 m 3 /hr. The value the model uses is determined, which takes into account all other measurements and their weightings. If the model solution does not match a measured value, and the repeatability is not large enough to make up the difference, Statefinder can add or subtract flows to reconcile the difference. These flows are called DFs As an example, suppose a pressure transmitter is reading 550 kpa and is modeled with a repeatability of 20 kpa. Now, suppose that Statefinder has determined that the model pressure at that point is 500 kpa. The model could adjust the pressure to 530 kpa, maxing out the repeatability to get as close to the model value as possible. However, there is still a 30 kpa gap between the model value and the measured value, after adjustment. There are a number of reasons why DFs are necessary. In the previous example, it may have been that the pressure transmitter was reading incorrectly, or that the model was erroneous and not reflecting reality. In this way DFs can indicate problems with a model. However, these corrections do not only occur due to modeling errors; DFs are required to model and identify a pipeline leak. If a leak occurs, Statefinder will need to remove fluid from the model in the form of diagnostic flows to account for the unmetered fluid exiting the pipeline. For example, if a 30% leak occurred on a 100 m 3 /hr pipeline, the model would have diagnostic flows that add up to -30 m 3 /hr in the vicinity of the leak. (Note that in practice, the diagnostic flows would not perfectly match the actual leak rate due to uncertainties in the model). 8

18 2.4 Leak Analysis Methodology The leak analysis software applies leak detection algorithms to the RTTM. Unlike the state estimation software, the leak analysis software is developed and maintained by Enbridge. Enbridge has created algorithms that examine the size and distribution of the diagnostic flows to determine if a leak is occurring. The model is divided into one or more sections called volume balance sections. All of the diagnostic flows that occur within a section are added together and integrated over three time periods: 5 minutes; 20 minutes; and 2 hours. The results of these integrations are diagnostic volumes, which are sometimes referred to as volume imbalances. In an ideal model, the diagnostic flows, and therefore the diagnostic volume, would only be non-zero in the event of a leak. In reality, there are a number of sources of error which may lead to non-zero diagnostic volumes. To help discern between diagnostic volumes caused by leaks and those caused by errors, diagnostic volume thresholds are set for each time period in each volume balance section. If the diagnostic volume exceeds the threshold a leak alarm is generated. Note that an alarm does not mean that the MBS has detected a leak; it only notifies the Pipeline Controller that a leak may exist and further investigation is required. Volume balance sections are typically created for each flow meter to flow meter section. For lines with multiple flow meters, an additional layer of overlapping sections may be used, as shown in Figure 6. The overlapping sections make the system more robust and may provide better leak sensitivity. For lines with complex operations, it may be necessary to create additional Volume Balance ( VB ) sections and/or disable and enable sections for different modes of operation. Volume balance sections are configured such that there is always at least one section enabled over any given portion of the pipeline, and the sections are bounded by either a flow meter or closed valve. Figure 6: Pipeline with multiple volume balance sections 9

19 2.4.1 Purpose of Multiple Time Windows As mentioned in the previous section, the MBS calculates diagnostic imbalances over multiple time intervals or time windows. There are three time windows that are typically used on Enbridge s pipelines: 5-minute; 20-minute; and 2-hour windows. By evaluating material balances for three different time periods, the MBS is capable of detecting leaks of different sizes in a timely manner. The following example illustrates the usefulness of each time window. Suppose that a small leak exists in the barrel illustrated in Figure 7. The diagnostic volume is monitored over 5-minute, 1-hour, and 24-hour time windows. Over a short period of time (e.g. 5 minutes), the level of the liquid in the barrel drops very slowly, and makes the detection of a small leak very difficult. In such a short time span, it is very difficult to distinguish an actual leak from a volume discrepancy due to a measurement inaccuracy. Over a longer period of time however, the leak becomes noticeable and distinguishable because the dripped volume increases steadily, while the effect of an imbalance due to a measurement inaccuracy decreases. Let us assume that over a 5-minute window, the leak causes a drop in one unit of height from the full barrel. However, the measurement inaccuracy is also one unit (plus or minus). Thus it is very difficult over a 5-minute window to distinguish if the loss of fluid is caused by a leak or by a data inaccuracy. Over longer windows, the total amount of the imbalance increases steadily. Nevertheless, the data inaccuracy over the time periods still remains the same (plus or minus one unit). For the 1-hour case, the total imbalance is now 12 units (12 times 5-minute loss of one unit). With the same total inaccuracy, the possible true imbalance is now at least 10 units. The 24-hour leak case shows an even higher detectable capability. Over 24 hours, the total leak is now 288 units (24 times hourly loss of 12 units). As the measurement inaccuracy remains unchanged, the possible total imbalance is now at least 286 units. It can be concluded that monitoring the diagnostic volumes over different time windows improves the performance of the MBS, allowing large leaks to be detected quickly in the shorter windows and smaller leaks to be detected by the longer time windows. 10

20 Figure 7: The "Barrel Analogy" Illustrative Example 11

21 Line 9B Reversal and Line 9 Capacity Expansion Project Impact of Thresholds on Performance The MBS alarm thresholds are adjusted to achieve a balance between the system reliability and sensitivity. Relaxing thresholds reduces false leak alarms caused by data inaccuracies (better reliability), but increases the minimum detectable leak size and the time it takes to detect it (reduced sensitivity). Tightening the thresholds allows smaller leaks to be detected faster (better sensitivity), but may result in more false alarms (reduced reliability) Dual Thresholds During rapid changes (transients) the uncertainty in the model is increased. Recognizing this fact, dual thresholds are used to increase the thresholds during transient conditions. When the pipeline is operating at steady-state conditions and uncertainties are lowest, the thresholds will tighten, providing higher sensitivity. When the system is transient, the thresholds will relax, improving reliability Alarms If a diagnostic volume reaches its leak alarm threshold, the MBS will trigger a leak alarm for that time window. There is a distinct alarm for each time window. The MBS can also trigger a MBS fail alarm. There are two causes for a MBS Fail Alarm; the first is that the process which sends MBS data to the operator has not communicated in over four minutes. Effectively, this means that the process is no longer running. The second is when the process timestamp falls more than four minutes behind real time. This typically means that the MBS model is running more than four minutes behind real time. In summary, the four types of alarms are: 5 minute leak alarm; 20 minute leak alarm; 2 hour leak alarm; and MBS fail alarm. The alarms are sent to the pipeline operator, and it is the responsibility of the operator to contact a leak detection analyst to investigate the cause of the alarm. Alarms are sent directly to the operator because it allows the operator to respond immediately in the event the operational data shows obvious signs of a leak. Alarms are also immediately presented to the leak detection analyst via the LD Alarm Viewer application. This allows the analyst to start the root cause alarm analysis activities in a proactive manner. 12

22 Example MBS Leak Alarm: Example MBS Fail Alarm: 2.5 Displays MBS displays are the user interface for the MBS system. Statefinder allows custom time plots, distance plots, and text displays to be created. Detailed information on Enbridge s MBS displays can be found in the MBS Display Standard document, which outlines all the MBS standard displays. Examples of commonly used displays are shown in Figure 8, Figure 9, and Figure 10. Figure 8: Distance plot showing head, flow, and elevation profile 13

23 Figure 9: Time plot showing a section s diagnostic volumes and thresholds Figure 10: Text display showing pressures, flows, and other useful values 14

24 2.6 MBS Architecture The MBS has many components, so a consistent organizational structure is required to make maintaining the system manageable. Figure 11 maps all of the pipelines, pipeline models, servers, and SCADA environments. All of the MBS models are hosted on three different servers: the primary production server; backup production server; and the development server. The primary production server is used to host the active MBS model that runs in real time and sends alarms to the operator. The backup production server is in place to take over in the event of an issue with the primary server. The development server is used to test model modifications and upgrades prior to implementation. Note that sometimes more than two lines are grouped into the same model. 15

25 Figure 11: SCADA Environment to MBS Host Mapping 16

26 2.6.1 Server Layout Each of the servers has the same structure. There are multiple drives that are used for different types of files, as outlined in Figure 12. The production drive is used to run the MBS system. The test drive is a duplicate of the production drive, and can be used in the event of an issue with the production drive models. This system is in place to act as a failsafe, similar to the redundant pairing of the primary and back-up production servers. Figure 12: MBS Server Organizational Map 17

27 2.6.2 Model File Layout LXX Model Archives dspmenu dsptune inexpt inprep intran log model review rtudata Figure 13: MBS Model Directories Similar to the servers, the models all have a common organizational structure. Each model may have unique files, but the types of file are grouped into the directories shown in Figure 13. Table 1 describes each of the model directories. 18

28 Table 1: Descriptions of MBS Model Directories Directory archives dspmenu dsptune inexpt inprep intran log model review rtudata Description Contains files that archive the calculated model hydraulics. The archive files can be used to quickly start a model during any period that has already been calculated. Contains display files which contain information required for user displays. Some display files also stored in dsptune. Contains display files which contain information required for user displays. Some display files also stored in dspmenu. Contains the INEXPT file, used for exporting model data. Stores files that contain all the static model data. Elevation profile, pipe properties, and device connectivity are all stored here. Stores some simulation files and the leak analysis files. Simulation files handle tasks like opening/closing of valves, while leak analysis files contain information on items such as thresholds and alarms. An archive of the alarm log file, which contains a log of all the MBS alarms produced by the model, is stored in this directory. Contains various files that the model reads from and writes to when the MBS is running. Contains the REVIEW file which stores data for the time and distance plots. Stores SCADA data files that are updated in real-time. 19

29 Line 9B Reversal and Line 9 Capacity Expansion Project 3 The SCADA System The data from all the instrumentation that spans Enbridge s km of liquid pipelines is collected, organized, and made available by a type of monitor and control system known as a Supervisory Control and Data Acquisition System ( SCADA ). The primary role of the SCADA system is to allow the pipelines to be operated remotely. Pipeline operators can monitor and control Enbridge s entire pipeline network from a single building, called the Control Centre. Information from the pipelines is sent to the Control Centre and displayed for pipeline operators, and commands from the operators can be sent back through SCADA to operate devices such as valves and pumps. The MBS uses the SCADA system as well. The models read instrument data from SCADA, and when necessary the MBS can send leak alarms to the pipeline operator in the Control Centre through SCADA. Note that SCADA systems are not unique to pipelines. Many industrial processes utilize a type of SCADA system. For example, a power generation plant may use a SCADA system to control certain processes. Enbridge s SCADA system has been developed by, and is maintained by, Enbridge. 3.1 SCADA System Structure The SCADA system is comprised of a hierarchy of sub-systems. The major components are as follows: SCADA servers; Remote Terminal Unit ( RTU ); Programmable Logic Controller ( PLC ); and Instrumentation. All data, whether it is a start pump command sent from the Control Centre, or a measured value from a remote pressure transmitter, must pass through each of the above components in turn. For example, a measured valve status will travel from the valve PLC RTU SCADA server. The MBS and Control Centre could then read the status from a file on the server. 20

30 Line 9B Reversal and Line 9 Capacity Expansion Project Figure 14 shows a high-level schematic of the SCADA system. 1. Instrument data is read and scaled by the PLC s. 2. The RTU gathers all the data for each site by polling all the PLC s every 5 seconds (this may be longer for terminals with many PLC s). 3. On a separate 5 second loop, the RTU sends data to the SCADA servers on exception, meaning it only sends values that are different from the last 5 second scan. 4. The SCADA server timestamps the data when it is received, and writes it to an RTUdata file. Every 5 seconds the RTUdata file is written to on a report by exception basis, and every 60 seconds all values being written to the file are re-written. 5. The Control Centre and the MBS can read the RTUdata file to access the instrument data. 5. SCADA Server MBS Server RTUdata file 4. Control Centre Data Timestamped 3. On Site: RTU 2. PLC PLC 1. P P TANK Figure 14: High level SCADA system schematic 21

31 Line 9B Reversal and Line 9 Capacity Expansion Project 4 Instrumentation This section provides a brief overview of the field instruments utilized by Enbridge s MBS for leak detection purposes. Further details, such as instrument locations and applicable regulations, are available in Enbridge s standard D12-105: Mainline Leak Detection Equipment and Instrumentation Requirements. The MBS uses the following types of instrumentation: flow meters; pressure transmitters; temperature transmitters; densitometers; viscometers; Redacted - Proprietary Information valve instrumentation; and pump instrumentation. 4.1 Flow Meters Flow meters are used to measure injection and delivery flows, mainline flows, and Drag Reducing Agent ( DRA ) flows. Enbridge uses positive displacement flow meters, turbine flow meters, segmental wedge flow meters, and ultrasonic flow meters. Ultrasonic flow meters may be a spool piece or a strap-on meter, and may also be capable of measuring the sonic velocity. Custody Transfer ( CT ) meters are preferred when available. Any type of flow meter may be a CT meter as long as it meets certain performance criteria, such as having a maximum uncertainty of 0.25%. CT meters are typically more accurate than mainline flow meters, which have a suggested uncertainty of 1%. 4.2 Pressure Transmitters Pressure Transmitters ( PTs ) are used to measure station suction, discharge, and case pressures, as well as valve site pressures and differential pressures for segmental flow meters. PTs have a typical suggested measurement accuracy of 0.25%. 4.3 Temperature Transmitters Temperature Transmitters ( TTs ) are used to measure the fluid temperature at station inlets and outlets, and also the fluid temperature at some valve sites. 22

32 Enbridge uses thermowell TTs where possible, but not all locations are suitable because thermowell TTs penetrate into the pipeline s interior and will be sheared off by passing Pipeline Inspection Gauges ( PIGs ). Skin-type TTs that wrap onto the pipeline s exterior are used in locations unsuitable for thermowell TTs. The ground temperature at stations is also measured. Ground temperature measurements are required for an advanced thermal modeling mode called transthermal modeling. 4.4 Densitometers Densitometers are used to measure the fluid density at injection locations. Densitometers may also be used at intermediate pump Enbridge uses both vibrating tube densitometers and nuclear densitometers. Densitometers used at Enbridge are recommended to be accurate to ±0.5 kg/m Viscometers Viscometers are used to measure the fluid viscosity at injection locations. Viscometers used at Enbridge are recommended to be accurate to ± 1 cst Valve Instrumentation Enbridge uses many different types of valves on its pipelines, including check valves, sectionalizing valves, and pressure control valves. Valves have instrumentation in place to transmit the valve status (example: open or closed). The MBS uses the valve status to set the model valve s status. Some hand-operated valves may not be connected to the SCADA system.. 23

33 4.8 Pump Instrumentation Other than the obvious mainline pumps, there are also pumps for injecting DRA. Pumps have instrumentation to report the pump status (example: on or off). Pump status may be used to drive pumps in the MBS model. 4.9 Critical and Important Equipment There are two different classes of field equipment that play a significant role in a leak detection system. Critical equipment is any instrument or sensor that provides real-time input into a leak detection system that can impact leak detection system performance. Important equipment is any instrument or sensor that provides real-time input into a leak detection system that does not impact leak detection system performance. This information may be used for analytical purposes. 24

34 5 MBS Degradation The MBS system is considered to be degraded if there are conditions present that degrade the MBS performance. This section will discuss the various ways that errors are introduced into the system and the different ways the MBS may become degraded. 5.1 Sources of Error The measurement, transmission, and processing of the data has the potential to introduce error into the MBS system. Under normal operating conditions, the individual sources of error are usually negligible. However, their combined effect may have a noticeable impact on the MBS system s performance. Figure 15 shows where different types of error may be introduced into the system. Field Dedicated Server MBS User s Computer Fixed Pipeline Model Modeling Errors Instrument Error Fixed Model Data Real Time Transient Model Error in Theory Pipeline Instrumentation Measurement Data (SPS Statefinder) Estimated Pipeline State Logic and Coding Error Transmission and SCADA Error Leak Analysis Software (Enbridge) Alarms, reports, trends, etc. UI MBS Displays Figure 15: Various sources of error in the MBS system 25

35 Instrument Error Measurement device performance is characterized by accuracy and repeatability. Accuracy is how close a measurement is to the true value; whereas repeatability is how consistently a measurement is made. This is shown conceptually by comparing the targets in Figure 16. Figure 16: Targets demonstrating accuracy (left) and repeatability (right) Transmission/SCADA Error The transmission of instrument data can add error into the system. Measured values have quantization error from being converted from an analog to a digital signal. This is demonstrated in Figure 17; the linear analog signal (blue line) is converted into the stepped digital signal (red line). Signals may be further truncated at various steps of transmission. Figure 17: Quantization error from analog to digital conversion Another important source of error is propagation delay. Due to RTU polling times, the time between when a measurement is taken, to when it is time stamped, may be inconsistent. Further details on transmission of instrumentation data and the associated errors can be found in Section 3: The SCADA System. 26

36 Modeling Errors Any deviation between the model and the physical pipeline characteristics will cause inaccuracies. Similarly, inaccuracies in fluid properties will also introduce errors. Every detail, such as those outlined in section 2.1: Fixed Model Data, must be modeled carefully to avoid an excessive accumulation of error. Error in Theory The mathematical model used by Statefinder to compute the pipeline hydraulics is not a perfect representation of a physical system. Under steady-state conditions this type of error is negligible, but it may affect the model performance during transient conditions, where the hydraulic theory is less robust. Logic/Coding Error Leak detection engineers are responsible for creating and maintaining accurate and reliable MBS models. Simple errors in code and MBS logic can be easy to make, but are often difficult to find. MBS models must be validated before they are put into production, and they must be verified annually. 27

37 5.2 Types of Degradation There are three major modes of degradation: non steady-state hydraulics; communication failures; and instrument failures. 1. Non-Steady State Hydraulics and Column Separation/Slack Line Flow Transients and column separation increase uncertainty. This is due to the more complex physics involved with these conditions. Column separation may degrade the system sensitivity and reliability, as well as increase the difficulty in alarm analysis. For this reason, all leak alarms associated with column separation are presumed valid and communicated to the Control Centre in that manner. 2. Communication failures Communication failures occur when there is a failure with a service provider or a component of the SCADA system fails and stops communication to the measurement devices. It can occur anywhere in the system with varying degrees of severity. For example, a SCADA server crash would cause a loss of communications to an entire pipeline, whereas a PLC failure would only cause a loss of communications with a few instruments. 3. Instrument failures If an instrument stops providing measurement data to the MBS, or provides data that is incorrect, the MBS performance will be degraded. Instrument failures are usually not resolved until the instrument is repaired. This can be a lengthy period and would necessitate changes in a MBS model, i.e. data point remapping that is usually performed by a leak detection engineer. The severity of degradation depends on the type of instrument and its location, as outlined by the following: Flow Meters: A failed flow meter will degrade any Volume Balance section using that meter. If there is an overlapping VB section to cover the degraded VB sections, the model sensitivity is only slightly reduced. However, if there is no overlapping VB section, the degradation is severe enough to consider the model unreliable and Alternate Leak Detection ( ALD ) is performed. The loss of any injection or delivery flow meter is critical and requires ALD. Pressure Transmitters: Failed pressure transmitters impact the accuracy of the model, potentially leading to incorrect pressures and calculated flows. However, if the MBS model recognizes that the pressure transmitters have failed, it can adjust accordingly to significantly reduce the degradation. Inlet Fluid Property Instruments: Loss of fluid property measurement at an inlet can degrade model performance. If the fluid being injected into a line has incorrect properties, the system 28

38 will be degraded until that fluid leaves the model. For example, if a densitometer reads high for 10 minutes, the fluid injected in that period will have the incorrect density. The model will be degraded until that fluid is delivered, which may take days depending on the length of the pipeline. Temperature Transmitters: If the temperature is not modeled correctly it will impact the modeled fluid s viscosity and vapour pressure. Incorrect viscosity will affect the pressure drop in the model, affecting the hydraulics of the model. Incorrect vapour pressure may affect the formation of column separation in the model. 29

39 Line 9B Reversal and Line 9 Capacity Expansion Project 6 MBS Performance To characterize the performance of a leak detection system, one should assess its ability to identify leak conditions rapidly and without failure, so as to minimize fluid loss, property damage, and the risk of personal injury. API 1130 groups the system performance into four categories. These categories, or metrics, are the system's reliability, sensitivity, accuracy, and robustness. Together they characterize leak detection performance. For the Enbridge MBS, a definition and discussion of each of these performance metrics follows. 6.1 Sensitivity API 1130 s Definition Sensitivity is defined as a composite measure of the size of leak that a system is capable of detecting, and the time required for the system to issue an alarm in the event that a leak of that size should occur. Quantification The following measures are used to quantify the MBS sensitivity: minimum detectable leak rate in the 5 minute time window; minimum detectable leak rate in the 20 minute time window; and minimum detectable leak rate in the 2 hour time window. Notes Each of the time windows will have a different sensitivity. The longer the time window is, the more sensitive it is. Enbridge has target sensitivity levels of 30%, 15%, and 5% of the line flow rate in the 5 minute, 20 minute, and 2 hour windows, respectively. Many factors, such as flow rate and uncertainties, may impact the sensitivities. As a result, different pipelines have different sensitivities. Any system degradation will reduce the sensitivity. The MBS model s sensitivity is determined through systematic testing. See section 7, Evaluation of MBS Performance, for more information on testing the MBS. 30

40 Line 9B Reversal and Line 9 Capacity Expansion Project 6.2 Accuracy API 1130 s Definition The validity of the leak parameter estimates (e.g. leak flow-rate, total volume lost, type of fluid lost, and leak location within the pipeline network at certain pipeline conditions) constitutes a third measure of performance referred to as accuracy. Quantification Leak location: Anywhere within the alarming section Type of fluid lost: Any fluid within the leaking section Leak size: Plot of the percentage of the leak detected vs. the leak rate, as shown in Figure 18 Redacted - Proprietary Information Figure 18: Accuracy plot for multiple pipeline sections Notes The leak rates and sizes are typically underestimated, due to uncertainties and inaccuracies in the model such as flow meter error and fluid properties. The MBS is not designed to determine the leak location. If the MBS detects a leak, the location could be anywhere within the alarming section. However, analysts may be able to better estimate leak location if the leak is bracketed by pressure monitors within a section. 31

41 Line 9B Reversal and Line 9 Capacity Expansion Project 6.3 Reliability API 1130 s Definition Reliability is defined as a measure of the ability of a leak detection system to render accurate decisions about the possible existence of a leak on the pipeline, while operating within an envelope established by the leak detection system design. It follows that reliability is directly related to the probability of detecting a leak, given that a leak does in fact exist, and the probability of incorrectly declaring a leak, given that no leak has occurred. A system is considered to be more reliable if it consistently detects actual leaks without generating incorrect declarations. Conversely, a system which tends to incorrectly declare leaks is often considered to be less reliable. This is particularly true in cases where it is difficult for the Pipeline Controller to distinguish between actual leaks and incorrect declarations. On the other hand, a high rate of incorrect leak declarations might be considered less significant if the pipeline operators have access to additional information that can be used to verify or disqualify a leak alarm. Quantification Number of false leak alarms Number and duration of line shutdowns due to false alarms Number of actual leaks not detected by the system Notes A reliable system will have few false alarms when the line is operating normally. The occurrence of false alarms is expected to increase if the system is degraded in any way. The measures listed above are tracked by MBS event reports. The personnel who analyze the alarms follow defined procedures to reduce variance in analysis methods and increase the system reliability. If additional information is available (e.g. data independent from the leak detection system that is alarming), then reliability may be better managed. The dual thresholds feature of the MBS models improves the sensitivity of leak detection during steady-state operations and improves the reliability during transient operations. 32