Material Balance System General Manual - Redacted

Enbridge Pipelines Inc. Material Balance System General Manual (Redacted for Security and Proprietary Reasons) Filed pursuant to Condition 12 of National Energy Board Order XO-E101-003-2014 July 15, 2014

TABLE OF CONTENTS NOMENCLATURE... IV PREFACE... V ENBRIDGE S POLICY AND COMMITMENT TO LEAK DETECTION... VI LEAK DETECTION SYSTEM REGULATORY REQUIREMENTS... VIII 1 INTRODUCTION... 1 2 MBS OVERVIEW... 3 2.1 FIXED MODEL DATA... 5 2.2 MEASUREMENT DATA... 6 2.3 STATE ESTIMATION SOFTWARE... 7 2.3.1... 7 2.3.2 Repeatability, Diagnostic Flows, and PDFs... 8 2.4 LEAK ANALYSIS METHODOLOGY... 9 2.4.1 Purpose of Multiple Time Windows... 10 2.4.2 Impact of Thresholds on Performance... 12 2.4.3 Dual Thresholds... 12 2.4.4 Alarms... 12 2.5 DISPLAYS... 13 2.6 MBS ARCHITECTURE... 15 2.6.1 Server Layout... 17 2.6.2 Model File Layout... 18 3 THE SCADA SYSTEM... 20 3.1 SCADA SYSTEM STRUCTURE... 20 4 INSTRUMENTATION... 22 4.1 FLOW METERS... 22 4.2 PRESSURE TRANSMITTERS... 22 4.3 TEMPERATURE TRANSMITTERS... 22 4.4 DENSITOMETERS... 23 4.5 VISCOMETERS... 23 4.6... 23 4.7 VALVE INSTRUMENTATION... 23 4.8 PUMP INSTRUMENTATION... 24 4.9 CRITICAL AND IMPORTANT EQUIPMENT... 24 5 MBS DEGRADATION... 25 5.1 SOURCES OF ERROR... 25 5.2 TYPES OF DEGRADATION... 28 6 MBS PERFORMANCE... 30 i

6.1 SENSITIVITY... 30 6.2 ACCURACY... 31 6.3 RELIABILITY... 32 6.4 ROBUSTNESS... 33 6.5 SPECIFICATION AND PRIORITIZATION OF PERFORMANCE METRICS... 34 7 EVALUATION OF MBS PERFORMANCE... 35 8 STAFF ROLES AND RESPONSIBILITIES... 37 9 LEAK DETECTION PROCEDURES... 38 9.1 ANALYST PROCEDURES... 38 10 ANALYST TESTING AND TRAINING... 39 10.1 PHASE 1: ORIENTATION... 39 10.2 PHASE 2: TASK-BASED LEARNING... 39 10.3 PHASE 3: ANALYSIS TRAINING... 40 10.4 READINESS ASSESSMENT... 40 11 MAINTENANCE... 41 11.1 PREVENTATIVE MAINTENANCE... 41 11.2 REPAIR/REPLACEMENT... 42 11.3 MODEL IMPROVEMENT PLANS... 42 12 RECORD KEEPING... 44 12.1 RETENTION OF RECORDS... 44 12.2 HISTORICAL RETENTION PERIODS... 44 APPENDIX A: FLUID CHARACTERISTICS... 46 APPENDIX B: MBS FUNCTIONALITY FOR SPECIFIC OPERATING CONDITIONS... 50 APPENDIX C: REFERENCED DOCUMENT LIST... 52 APPENDIX D: ROLES, RESPONSIBILITIES AND AUTHORITIES OF PERSONNEL IN THE EVENT OF A SUSPECTED LEAK... 53 GLOSSARY... 56 ii

List of Figures Figure 1: Geographic overview of Enbridge s liquid pipelines... 1 Figure 2: Overview of the MBS structure... 3 Figure 3: Schematic of a simple pipeline model... 5 Figure 4: Measurement data used in the model... 6 Figure 5:... 7 Figure 6: Pipeline with multiple volume balance sections... 9 Figure 7: The "Barrel Analogy" Illustrative Example... 11 Figure 8: Distance plot showing head, flow, and elevation profile... 13 Figure 9: Time plot showing a section s diagnostic volumes and thresholds... 14 Figure 10: Text display showing pressures, flows, and other useful values... 14 Figure 11: SCADA Environment to MBS Host Mapping... 16 Figure 12: MBS Server Organizational Map... 17 Figure 13: MBS Model Directories... 18 Figure 14: High level SCADA system schematic... 21 Figure 15: Various sources of error in the MBS system... 25 Figure 16: Targets demonstrating accuracy (left) and repeatability (right)... 26 Figure 17: Quantization error from analog to digital conversion... 26 Figure 18: Accuracy plot for multiple pipeline sections... 31 LIST OF TABLES Table 1: Descriptions of MBS Model Directories... 19 Table 2: Prioritization of the four performance metrics... 34 iii

Nomenclature Alternate Leak Detection Canadian Standards Association Computational Pipeline Monitoring Control Centre Operations Control Room Management Custody Transfer Drag Reducing Agent Fluid Withdrawal Test Lower Explosive Limit Material Balance System Pipeline Control Systems and Leak Detection Pipeline Inspection Gauge Pressure Transmitter Programmable Logic Controller Real Time Transient Model Remote Terminal Unit Simulated Leak Test Supervisory Control and Data Acquisition Temperature Transmitter Volume Balance ALD CSA CPM CCO CRM CT DRA FWT LEL MBS PCSLD PIG PT PLC RTTM RTU SLT SCADA TT VB iv

This document applies to all Enbridge pipelines that are controlled from the Edmonton Control Centre. Enbridge pipelines that are not controlled by the Edmonton Control Centre may not be in alignment with the content of this document. Preface This manual is the first in a series of manuals that describe Enbridge s Material Balance System ( MBS ). It provides a detailed explanation of MBS aspects that are common to the entire Enbridge system. All MBS information applicable to individual pipelines can be accessed in their corresponding manuals: Material Balance System Manual: The Line XX Model. These supplemental manuals make up the rest of the series, providing detailed routing, operational, and modeling information for each pipeline. Together, this series of manuals is designed to meet the requirements of Canadian Standards Association ( CSA ) Z662-11 Annex E (Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection) and API RP-1130 (Computational Pipeline Monitoring for Liquids). This manual is intended to be a resource for all Enbridge staff who work with the MBS. Note: Starting in section 1: Introduction, the bolded words in this document are defined in the glossary. Only the first instance of a word is bolded. v

Line 9B Reversal and Line 9 Capacity Expansion Project Enbridge s Policy and Commitment to Leak Detection Company Leak Detection Commitment Enbridge Pipelines Inc. ( Enbridge ) is committed to employing industry leading leak detection methodologies. This is achieved by meeting or exceeding all applicable engineering standards and regulatory requirements, and by employing the most suitable technologies. Regulatory Compliance Enbridge is committed to adhering to all applicable regulatory requirements for leak detection and will implement the applicable standards on all of its pipeline systems. The Enbridge liquids pipeline network stretches across North America and is required to meet varying engineering standards and regulatory requirements. In all cases, Enbridge strives to employ the appropriate leak detection criteria on all pipelines to ensure it meets or exceeds expectations. Industry Leadership, Approach & Best Practices Enbridge is committed to applying industry best practises and developing leak detection technologies. This will be achieved through employing the best technologies, developed processes, and skilled personnel. Enbridge is also committed to continuous improvement of its leak detection strategy which is a comprehensive, multi-layered approach for its pipeline network. The strategy encompasses five primary leak monitoring methods, each with a different focus and featuring differing technology, resources and timing. Used together, these methods provide an overlapping and comprehensive leak detection capability. Visual surveillance and reports - These are reports of oil or oil odours from third parties and from Enbridge s aerial and ground line patrols. Enbridge manages thirdparty reports through its emergency telephone line, and communicates with affected public and local emergency officials through our public awareness program. Aerial and ground line patrols are conducted in accordance with regulatory requirements and risk based approaches. Scheduled line balance calculations - These calculations are sometimes referred to as over/short reports in the pipeline industry and are calculations of oil inventory that are performed at fixed intervals, typically every two and 24 hours. A rolling 24-hour calculation is also maintained, based on calculations completed at a set time each day. The purpose of these calculations is to identify unexpected losses of pipeline inventory that may indicate a possible leak. Enbridge utilizes line balance calculations within its Commodity Movement Tracking system. vi

Line 9B Reversal and Line 9 Capacity Expansion Project Controller monitoring - Enbridge s Pipeline Controller monitors pipeline conditions (such as pipeline pressure) through the Supervisory Control And Data Acquisition ( SCADA ) system, which is designed to identify unexpected operational changes, such as pressure drops, that may indicate a leak. Additional sensors monitored through SCADA, such as concentrations of explosive vapour, pump seal failures, equipment vibration levels and sump levels, can also be used by the controller to identify potential leaks. Computational Pipeline Monitoring ( CPM ) - Computer-based pipeline monitoring systems utilize measurements and pipeline data to detect anomalies that could indicate possible leaks. The pipeline monitoring system that Enbridge uses provides a sophisticated computer model of our pipelines, and continuously monitors changes in their calculated volume of liquids. Acoustic Emission In-line Inspection In addition to a comprehensive integrity management plan, the use of acoustic-based inline tool technology will detect anomalous acoustic activity associated with leaks or pockets of trapped gas in pressurized pipes. In essence, the tools are tuned to 'listen' for leaks. This noncontinuous method relies on technology that is designed to detect very small leaks. New Technology Deployment Enbridge is committed to continuous research and testing of new technologies. Enbridge will evaluate new leak detection technologies and deploy them if they substantively improve leak detection capabilities. Specific commitments Enbridge commits to performing the following on all pipeline systems: The Enbridge pipeline system will not be operated without a functioning Leak Detection System, for all modes of operation. All leak alarms will be acknowledged, analysed, and evaluated. Qualified personnel will be trained in accordance with industry standards and applicable regulations. Personnel will be specifically trained to use and operate Enbridge's Leak Detection Systems to evaluate pipeline hydraulics in connection with analysis of pipeline leaks. The Pipeline Controllers will be provided a support structure to assist with leak analysis and support of the software systems. vii

Line 9B Reversal and Line 9 Capacity Expansion Project Leak Detection System Regulatory Requirements The Enbridge pipeline system operates in both Canada and the United States of America. Various government and public agencies dictate regulations and practices, as well as monitor activities related to the transportation of liquid hydrocarbons. Enbridge is committed to meeting all applicable regulations. Listed below are regulatory and industry standards for computational pipeline monitoring systems and leak detection. These are the principle references, but the list may not be exhaustive. The Enbridge MBS system is designed to comply with the requirements of these standards. Canada Federal National Energy Board Act, National Energy Board Onshore Pipeline Regulations 1999 (SOR/99-294): section 37. Alberta Alberta Regulation 91/2005, Pipeline Act, Pipeline Rules: Part 2, Materials and Design, subsection 9(4), Part 4, Inspection and Record, sections 47, 48, 49. United States of America Code of Federal Regulations, Title 49: Transportation, Part 195: Transportation of Hazardous Liquids by Pipeline, 2008 rev: o Sec. 195.134 CPM leak detection (design requirements); o Sec. 195.444 CPM leak detection; and o Sec. 195.452 Pipeline integrity management in high consequence areas (Operations and Maintenance). Industry Standards CSA Z662 (latest version), Oil and Gas Pipeline Systems, Annex E: Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection. API Publication 1130: Computational Pipeline Monitoring for Liquids Pipelines. 42 pp. 2007. viii

1 Introduction Enbridge owns and operates over 26 000 km (15 000 mi) of liquids pipelines throughout Canada and the United States of America, shipping crude oil and refined liquids in quantities of over 2.2 million barrels per day. The majority of those pipelines are controlled remotely from a Control Centre in Edmonton, Alberta. The Edmonton-controlled pipelines are shown in Figure 1 as numbered lines. Figure 1: Geographic overview of Enbridge s liquid pipelines 1

Line 9B Reversal and Line 9 Capacity Expansion Project Enbridge uses multiple approaches for leak detection on its pipelines. These approaches are designed to provide comprehensive and overlapping leak detection capabilities. The five primary approaches include the following: 1. Visual surveillance and reports. These are from Enbridge line patrols (aerial and ground) and by third-party reports of oil or oil odours. 2. Scheduled line balance calculations. These are sometimes called over/short reports in the industry. They are calculations of oil inventory done at fixed intervals. 3. Controller monitoring. This is the continuous monitoring of pipeline conditions (e.g. pipeline pressure) by the Pipeline Controller. 4. Computational Pipeline Monitoring. This is computer-based monitoring using continuous measurements of pipeline conditions. 5. Acoustic Emission Inline Inspection. This is an acoustic-based inline tool technology that will detect anomalous acoustic activity associated with leaks or pockets of trapped gas in pressurized pipes. These approaches are used together to identify possible leak conditions. The Enbridge MBS is the Enbridge implementation of a CPM real-time leak detection system for liquids pipelines. It is designed to meet or exceed the leak detection requirements as identified by the CSA Recommended Practice for Oil Pipeline System Leak Detection ( Recommended Practice ) and to be compliant with API RP-1130 Computational Pipeline Monitoring. If the MBS detects a potential leak it will send a leak alarm to the pipeline operator. The operator will then initiate an investigation procedure, calling an on-shift 24/7 leak detection analyst, who will determine if the alarm is valid or invalid. Enbridge employs leak detection analysts to determine the cause of all leak alarms. This exceeds all government and industry regulatory requirements, and is the result of Enbridge s commitment to pipeline safety. The analysis of alarms is necessary because many situations may mimic a leak, including issues related to instrumentation, communications, and modeling. In these cases leak alarms are deemed invalid. 2

2 MBS Overview The MBS is the CPM system that Enbridge uses to provide leak detection on liquid pipelines. The MBS uses a Real Time Transient Model ( RTTM ), which simulates the hydraulic state of the pipeline in real time, including transient conditions. An overview of the MBS is shown in Figure 2. Field Dedicated Server Fixed Pipeline Model Fixed Model Data MBS User s Computer Pipeline Instrumentation Measurement Data Real Time Transient Model (SPS Statefinder) Estimated Pipeline State Leak Analysis Software (Enbridge) Alarms, reports, trends, etc. User Interface (MBS Displays) Figure 2: Overview of the MBS structure For each pipeline, a computer model is created that replicates the pipeline s unchanging (fixed) physical properties. Any information that affects the pipeline hydraulics, but is unaffected by the pipelines operation, is contained in the fixed pipeline model. Measurement data from field instrumentation is required to calculate the pipeline hydraulics. Pressure and flow rate measurements are critical to the model, but other measurements such as temperature or fluid properties are also used. The RTTM calculates an estimate of the hydraulic state for the entire pipeline. This software uses the measurement data and the fixed pipeline model data to compute the estimate. 3

Differences between the estimated pipeline state and the measured values are reconciled with diagnostic flows ( DF ). Leak detection is performed by leak analysis software that examines the calculated pipeline state. The results of the leak analysis can be accessed through a user interface on the MBS user s computer, in the form of leak alarms, time plots, distance plots, and text displays. 4

Line 9B Reversal and Line 9 Capacity Expansion Project 2.1 Fixed Model Data The pipeline model is composed of data which describes the physical characteristics of the pipeline. The data contained in the model is fixed during the operation of the pipeline, and therefore does not change when the RTTM is running. All of the information in the model is used to calculate the pipeline hydraulics, and is required by the RTTM. Typical fixed data includes: elevation profile; pipe data: length; diameter; wall thickness; and roughness; station location: accurate kilometre post / mile post of station location; station facilities: hydraulically significant instrumentation (pressure, flow, etc.); valve site location: accurate kilometre/milepost of valve site location; valve site facilities: hydraulically significant instrumentation; and fluid properties. A schematic of a simple pipeline model is shown in Figure 3. From left to right, there is a station where fluid is injected and has a discharge pressure, some piping, a mainline block valve, more piping, and a final station which has a suction pressure and a delivery. The black dots (nodes) are connection points for the model elements. Note that certain information, such as elevation profile and pipe length, is not depicted in the schematic. Figure 3: Schematic of a simple pipeline model It is not necessary to model every physical aspect of a pipeline; only those that impact the pipeline hydraulics are required. For example, in reality there would be a pump at Station 1 to move the fluid through the pipeline. There is no pump in the model because only the discharge pressure and flow is required to model the pipeline s hydraulic state. 5

Line 9B Reversal and Line 9 Capacity Expansion Project 2.2 Measurement Data Measurement data from field instrumentation must be added to the static model in order to create a real time transient model and operate the MBS. The digital model shown in Figure 3 has placeholders for measurement data. For example, the pressure monitors in the model receive data from pressure transmitters on the actual pipeline. Likewise, the amount of fluid being injected and delivered is driven by real-time measurements from flow meters. Even the model block valve is set to open and close with information from a physical block valve. Figure 4 shows the same model as Figure 3, but highlights where certain measurements are used to drive the model. Figure 4: Measurement data used in the model With the live measurement data being fed into the model, the RTTM can create a state estimation. The types of measurements fed into the model include the following. Injection and delivery flows Mainline flows Pressures Fluid temperature Ground temperature Fluid viscosity Fluid density Sonic velocity in the fluid Valve status Pump status Measured fluid properties may override values in the static model data. Note that the model may collect and display information that does not directly control model elements. For example, measurements from redundant pressure transmitters can still be read by MBS users. 6

2.3 State Estimation Software There are two major components of the MBS software: the pipeline state estimation software and the leak analysis software. This section discusses the state estimation software. Enbridge s MBS uses a commercial software product called Statefinder, which is developed by DNV GL. Statefinder simulates the hydraulic state for the entire pipeline in real time, making it a RTTM. At every scan cycle, current measurement data (see section 2.2) is passed to Statefinder, and integrated with fixed pipeline data (see section 2.1). Pressure and flow data is used as boundary conditions to calculate an estimate of the pipeline state. The computed pipeline state is an accurate representation of the current pipeline state when the given boundary conditions are accurate. 2.3.1 Figure 5: 7

2.3.2 Repeatability, Diagnostic Flows, and PDFs All values used by Statefinder to calculate the pipeline state have some level of uncertainty. To reflect these uncertainties, measured values in the model can be assigned a repeatability value. Repeatability is the maximum amount that a model value can deviate from its measured value. For example, if a flow meter is reading 100 m 3 /hr, and has a repeatability of ±1 m 3 /hr, the model may use any value between 99 m 3 /hr and 101 m 3 /hr. The value the model uses is determined, which takes into account all other measurements and their weightings. If the model solution does not match a measured value, and the repeatability is not large enough to make up the difference, Statefinder can add or subtract flows to reconcile the difference. These flows are called DFs As an example, suppose a pressure transmitter is reading 550 kpa and is modeled with a repeatability of 20 kpa. Now, suppose that Statefinder has determined that the model pressure at that point is 500 kpa. The model could adjust the pressure to 530 kpa, maxing out the repeatability to get as close to the model value as possible. However, there is still a 30 kpa gap between the model value and the measured value, after adjustment. There are a number of reasons why DFs are necessary. In the previous example, it may have been that the pressure transmitter was reading incorrectly, or that the model was erroneous and not reflecting reality. In this way DFs can indicate problems with a model. However, these corrections do not only occur due to modeling errors; DFs are required to model and identify a pipeline leak. If a leak occurs, Statefinder will need to remove fluid from the model in the form of diagnostic flows to account for the unmetered fluid exiting the pipeline. For example, if a 30% leak occurred on a 100 m 3 /hr pipeline, the model would have diagnostic flows that add up to -30 m 3 /hr in the vicinity of the leak. (Note that in practice, the diagnostic flows would not perfectly match the actual leak rate due to uncertainties in the model). 8

2.4 Leak Analysis Methodology The leak analysis software applies leak detection algorithms to the RTTM. Unlike the state estimation software, the leak analysis software is developed and maintained by Enbridge. Enbridge has created algorithms that examine the size and distribution of the diagnostic flows to determine if a leak is occurring. The model is divided into one or more sections called volume balance sections. All of the diagnostic flows that occur within a section are added together and integrated over three time periods: 5 minutes; 20 minutes; and 2 hours. The results of these integrations are diagnostic volumes, which are sometimes referred to as volume imbalances. In an ideal model, the diagnostic flows, and therefore the diagnostic volume, would only be non-zero in the event of a leak. In reality, there are a number of sources of error which may lead to non-zero diagnostic volumes. To help discern between diagnostic volumes caused by leaks and those caused by errors, diagnostic volume thresholds are set for each time period in each volume balance section. If the diagnostic volume exceeds the threshold a leak alarm is generated. Note that an alarm does not mean that the MBS has detected a leak; it only notifies the Pipeline Controller that a leak may exist and further investigation is required. Volume balance sections are typically created for each flow meter to flow meter section. For lines with multiple flow meters, an additional layer of overlapping sections may be used, as shown in Figure 6. The overlapping sections make the system more robust and may provide better leak sensitivity. For lines with complex operations, it may be necessary to create additional Volume Balance ( VB ) sections and/or disable and enable sections for different modes of operation. Volume balance sections are configured such that there is always at least one section enabled over any given portion of the pipeline, and the sections are bounded by either a flow meter or closed valve. Figure 6: Pipeline with multiple volume balance sections 9

2.4.1 Purpose of Multiple Time Windows As mentioned in the previous section, the MBS calculates diagnostic imbalances over multiple time intervals or time windows. There are three time windows that are typically used on Enbridge s pipelines: 5-minute; 20-minute; and 2-hour windows. By evaluating material balances for three different time periods, the MBS is capable of detecting leaks of different sizes in a timely manner. The following example illustrates the usefulness of each time window. Suppose that a small leak exists in the barrel illustrated in Figure 7. The diagnostic volume is monitored over 5-minute, 1-hour, and 24-hour time windows. Over a short period of time (e.g. 5 minutes), the level of the liquid in the barrel drops very slowly, and makes the detection of a small leak very difficult. In such a short time span, it is very difficult to distinguish an actual leak from a volume discrepancy due to a measurement inaccuracy. Over a longer period of time however, the leak becomes noticeable and distinguishable because the dripped volume increases steadily, while the effect of an imbalance due to a measurement inaccuracy decreases. Let us assume that over a 5-minute window, the leak causes a drop in one unit of height from the full barrel. However, the measurement inaccuracy is also one unit (plus or minus). Thus it is very difficult over a 5-minute window to distinguish if the loss of fluid is caused by a leak or by a data inaccuracy. Over longer windows, the total amount of the imbalance increases steadily. Nevertheless, the data inaccuracy over the time periods still remains the same (plus or minus one unit). For the 1-hour case, the total imbalance is now 12 units (12 times 5-minute loss of one unit). With the same total inaccuracy, the possible true imbalance is now at least 10 units. The 24-hour leak case shows an even higher detectable capability. Over 24 hours, the total leak is now 288 units (24 times hourly loss of 12 units). As the measurement inaccuracy remains unchanged, the possible total imbalance is now at least 286 units. It can be concluded that monitoring the diagnostic volumes over different time windows improves the performance of the MBS, allowing large leaks to be detected quickly in the shorter windows and smaller leaks to be detected by the longer time windows. 10

Figure 7: The "Barrel Analogy" Illustrative Example 11

Line 9B Reversal and Line 9 Capacity Expansion Project 2.4.2 Impact of Thresholds on Performance The MBS alarm thresholds are adjusted to achieve a balance between the system reliability and sensitivity. Relaxing thresholds reduces false leak alarms caused by data inaccuracies (better reliability), but increases the minimum detectable leak size and the time it takes to detect it (reduced sensitivity). Tightening the thresholds allows smaller leaks to be detected faster (better sensitivity), but may result in more false alarms (reduced reliability). 2.4.3 Dual Thresholds During rapid changes (transients) the uncertainty in the model is increased. Recognizing this fact, dual thresholds are used to increase the thresholds during transient conditions. When the pipeline is operating at steady-state conditions and uncertainties are lowest, the thresholds will tighten, providing higher sensitivity. When the system is transient, the thresholds will relax, improving reliability. 2.4.4 Alarms If a diagnostic volume reaches its leak alarm threshold, the MBS will trigger a leak alarm for that time window. There is a distinct alarm for each time window. The MBS can also trigger a MBS fail alarm. There are two causes for a MBS Fail Alarm; the first is that the process which sends MBS data to the operator has not communicated in over four minutes. Effectively, this means that the process is no longer running. The second is when the process timestamp falls more than four minutes behind real time. This typically means that the MBS model is running more than four minutes behind real time. In summary, the four types of alarms are: 5 minute leak alarm; 20 minute leak alarm; 2 hour leak alarm; and MBS fail alarm. The alarms are sent to the pipeline operator, and it is the responsibility of the operator to contact a leak detection analyst to investigate the cause of the alarm. Alarms are sent directly to the operator because it allows the operator to respond immediately in the event the operational data shows obvious signs of a leak. Alarms are also immediately presented to the leak detection analyst via the LD Alarm Viewer application. This allows the analyst to start the root cause alarm analysis activities in a proactive manner. 12

Example MBS Leak Alarm: Example MBS Fail Alarm: 2.5 Displays MBS displays are the user interface for the MBS system. Statefinder allows custom time plots, distance plots, and text displays to be created. Detailed information on Enbridge s MBS displays can be found in the MBS Display Standard document, which outlines all the MBS standard displays. Examples of commonly used displays are shown in Figure 8, Figure 9, and Figure 10. Figure 8: Distance plot showing head, flow, and elevation profile 13

Figure 9: Time plot showing a section s diagnostic volumes and thresholds Figure 10: Text display showing pressures, flows, and other useful values 14

2.6 MBS Architecture The MBS has many components, so a consistent organizational structure is required to make maintaining the system manageable. Figure 11 maps all of the pipelines, pipeline models, servers, and SCADA environments. All of the MBS models are hosted on three different servers: the primary production server; backup production server; and the development server. The primary production server is used to host the active MBS model that runs in real time and sends alarms to the operator. The backup production server is in place to take over in the event of an issue with the primary server. The development server is used to test model modifications and upgrades prior to implementation. Note that sometimes more than two lines are grouped into the same model. 15

Figure 11: SCADA Environment to MBS Host Mapping 16

2.6.1 Server Layout Each of the servers has the same structure. There are multiple drives that are used for different types of files, as outlined in Figure 12. The production drive is used to run the MBS system. The test drive is a duplicate of the production drive, and can be used in the event of an issue with the production drive models. This system is in place to act as a failsafe, similar to the redundant pairing of the primary and back-up production servers. Figure 12: MBS Server Organizational Map 17

2.6.2 Model File Layout LXX Model Archives dspmenu dsptune inexpt inprep intran log model review rtudata Figure 13: MBS Model Directories Similar to the servers, the models all have a common organizational structure. Each model may have unique files, but the types of file are grouped into the directories shown in Figure 13. Table 1 describes each of the model directories. 18

Table 1: Descriptions of MBS Model Directories Directory archives dspmenu dsptune inexpt inprep intran log model review rtudata Description Contains files that archive the calculated model hydraulics. The archive files can be used to quickly start a model during any period that has already been calculated. Contains display files which contain information required for user displays. Some display files also stored in dsptune. Contains display files which contain information required for user displays. Some display files also stored in dspmenu. Contains the INEXPT file, used for exporting model data. Stores files that contain all the static model data. Elevation profile, pipe properties, and device connectivity are all stored here. Stores some simulation files and the leak analysis files. Simulation files handle tasks like opening/closing of valves, while leak analysis files contain information on items such as thresholds and alarms. An archive of the alarm log file, which contains a log of all the MBS alarms produced by the model, is stored in this directory. Contains various files that the model reads from and writes to when the MBS is running. Contains the REVIEW file which stores data for the time and distance plots. Stores SCADA data files that are updated in real-time. 19

Line 9B Reversal and Line 9 Capacity Expansion Project 3 The SCADA System The data from all the instrumentation that spans Enbridge s 26 000 km of liquid pipelines is collected, organized, and made available by a type of monitor and control system known as a Supervisory Control and Data Acquisition System ( SCADA ). The primary role of the SCADA system is to allow the pipelines to be operated remotely. Pipeline operators can monitor and control Enbridge s entire pipeline network from a single building, called the Control Centre. Information from the pipelines is sent to the Control Centre and displayed for pipeline operators, and commands from the operators can be sent back through SCADA to operate devices such as valves and pumps. The MBS uses the SCADA system as well. The models read instrument data from SCADA, and when necessary the MBS can send leak alarms to the pipeline operator in the Control Centre through SCADA. Note that SCADA systems are not unique to pipelines. Many industrial processes utilize a type of SCADA system. For example, a power generation plant may use a SCADA system to control certain processes. Enbridge s SCADA system has been developed by, and is maintained by, Enbridge. 3.1 SCADA System Structure The SCADA system is comprised of a hierarchy of sub-systems. The major components are as follows: SCADA servers; Remote Terminal Unit ( RTU ); Programmable Logic Controller ( PLC ); and Instrumentation. All data, whether it is a start pump command sent from the Control Centre, or a measured value from a remote pressure transmitter, must pass through each of the above components in turn. For example, a measured valve status will travel from the valve PLC RTU SCADA server. The MBS and Control Centre could then read the status from a file on the server. 20

Line 9B Reversal and Line 9 Capacity Expansion Project Figure 14 shows a high-level schematic of the SCADA system. 1. Instrument data is read and scaled by the PLC s. 2. The RTU gathers all the data for each site by polling all the PLC s every 5 seconds (this may be longer for terminals with many PLC s). 3. On a separate 5 second loop, the RTU sends data to the SCADA servers on exception, meaning it only sends values that are different from the last 5 second scan. 4. The SCADA server timestamps the data when it is received, and writes it to an RTUdata file. Every 5 seconds the RTUdata file is written to on a report by exception basis, and every 60 seconds all values being written to the file are re-written. 5. The Control Centre and the MBS can read the RTUdata file to access the instrument data. 5. SCADA Server MBS Server RTUdata file 4. Control Centre Data Timestamped 3. On Site: RTU 2. PLC PLC 1. P P TANK Figure 14: High level SCADA system schematic 21

Line 9B Reversal and Line 9 Capacity Expansion Project 4 Instrumentation This section provides a brief overview of the field instruments utilized by Enbridge s MBS for leak detection purposes. Further details, such as instrument locations and applicable regulations, are available in Enbridge s standard D12-105: Mainline Leak Detection Equipment and Instrumentation Requirements. The MBS uses the following types of instrumentation: flow meters; pressure transmitters; temperature transmitters; densitometers; viscometers; Redacted - Proprietary Information valve instrumentation; and pump instrumentation. 4.1 Flow Meters Flow meters are used to measure injection and delivery flows, mainline flows, and Drag Reducing Agent ( DRA ) flows. Enbridge uses positive displacement flow meters, turbine flow meters, segmental wedge flow meters, and ultrasonic flow meters. Ultrasonic flow meters may be a spool piece or a strap-on meter, and may also be capable of measuring the sonic velocity. Custody Transfer ( CT ) meters are preferred when available. Any type of flow meter may be a CT meter as long as it meets certain performance criteria, such as having a maximum uncertainty of 0.25%. CT meters are typically more accurate than mainline flow meters, which have a suggested uncertainty of 1%. 4.2 Pressure Transmitters Pressure Transmitters ( PTs ) are used to measure station suction, discharge, and case pressures, as well as valve site pressures and differential pressures for segmental flow meters. PTs have a typical suggested measurement accuracy of 0.25%. 4.3 Temperature Transmitters Temperature Transmitters ( TTs ) are used to measure the fluid temperature at station inlets and outlets, and also the fluid temperature at some valve sites. 22

Enbridge uses thermowell TTs where possible, but not all locations are suitable because thermowell TTs penetrate into the pipeline s interior and will be sheared off by passing Pipeline Inspection Gauges ( PIGs ). Skin-type TTs that wrap onto the pipeline s exterior are used in locations unsuitable for thermowell TTs. The ground temperature at stations is also measured. Ground temperature measurements are required for an advanced thermal modeling mode called transthermal modeling. 4.4 Densitometers Densitometers are used to measure the fluid density at injection locations. Densitometers may also be used at intermediate pump Enbridge uses both vibrating tube densitometers and nuclear densitometers. Densitometers used at Enbridge are recommended to be accurate to ±0.5 kg/m 3. 4.5 Viscometers Viscometers are used to measure the fluid viscosity at injection locations. Viscometers used at Enbridge are recommended to be accurate to ± 1 cst. 4.6 4.7 Valve Instrumentation Enbridge uses many different types of valves on its pipelines, including check valves, sectionalizing valves, and pressure control valves. Valves have instrumentation in place to transmit the valve status (example: open or closed). The MBS uses the valve status to set the model valve s status. Some hand-operated valves may not be connected to the SCADA system.. 23

4.8 Pump Instrumentation Other than the obvious mainline pumps, there are also pumps for injecting DRA. Pumps have instrumentation to report the pump status (example: on or off). Pump status may be used to drive pumps in the MBS model. 4.9 Critical and Important Equipment There are two different classes of field equipment that play a significant role in a leak detection system. Critical equipment is any instrument or sensor that provides real-time input into a leak detection system that can impact leak detection system performance. Important equipment is any instrument or sensor that provides real-time input into a leak detection system that does not impact leak detection system performance. This information may be used for analytical purposes. 24

5 MBS Degradation The MBS system is considered to be degraded if there are conditions present that degrade the MBS performance. This section will discuss the various ways that errors are introduced into the system and the different ways the MBS may become degraded. 5.1 Sources of Error The measurement, transmission, and processing of the data has the potential to introduce error into the MBS system. Under normal operating conditions, the individual sources of error are usually negligible. However, their combined effect may have a noticeable impact on the MBS system s performance. Figure 15 shows where different types of error may be introduced into the system. Field Dedicated Server MBS User s Computer Fixed Pipeline Model Modeling Errors Instrument Error Fixed Model Data Real Time Transient Model Error in Theory Pipeline Instrumentation Measurement Data (SPS Statefinder) Estimated Pipeline State Logic and Coding Error Transmission and SCADA Error Leak Analysis Software (Enbridge) Alarms, reports, trends, etc. UI MBS Displays Figure 15: Various sources of error in the MBS system 25

Instrument Error Measurement device performance is characterized by accuracy and repeatability. Accuracy is how close a measurement is to the true value; whereas repeatability is how consistently a measurement is made. This is shown conceptually by comparing the targets in Figure 16. Figure 16: Targets demonstrating accuracy (left) and repeatability (right) Transmission/SCADA Error The transmission of instrument data can add error into the system. Measured values have quantization error from being converted from an analog to a digital signal. This is demonstrated in Figure 17; the linear analog signal (blue line) is converted into the stepped digital signal (red line). Signals may be further truncated at various steps of transmission. Figure 17: Quantization error from analog to digital conversion Another important source of error is propagation delay. Due to RTU polling times, the time between when a measurement is taken, to when it is time stamped, may be inconsistent. Further details on transmission of instrumentation data and the associated errors can be found in Section 3: The SCADA System. 26

Modeling Errors Any deviation between the model and the physical pipeline characteristics will cause inaccuracies. Similarly, inaccuracies in fluid properties will also introduce errors. Every detail, such as those outlined in section 2.1: Fixed Model Data, must be modeled carefully to avoid an excessive accumulation of error. Error in Theory The mathematical model used by Statefinder to compute the pipeline hydraulics is not a perfect representation of a physical system. Under steady-state conditions this type of error is negligible, but it may affect the model performance during transient conditions, where the hydraulic theory is less robust. Logic/Coding Error Leak detection engineers are responsible for creating and maintaining accurate and reliable MBS models. Simple errors in code and MBS logic can be easy to make, but are often difficult to find. MBS models must be validated before they are put into production, and they must be verified annually. 27

5.2 Types of Degradation There are three major modes of degradation: non steady-state hydraulics; communication failures; and instrument failures. 1. Non-Steady State Hydraulics and Column Separation/Slack Line Flow Transients and column separation increase uncertainty. This is due to the more complex physics involved with these conditions. Column separation may degrade the system sensitivity and reliability, as well as increase the difficulty in alarm analysis. For this reason, all leak alarms associated with column separation are presumed valid and communicated to the Control Centre in that manner. 2. Communication failures Communication failures occur when there is a failure with a service provider or a component of the SCADA system fails and stops communication to the measurement devices. It can occur anywhere in the system with varying degrees of severity. For example, a SCADA server crash would cause a loss of communications to an entire pipeline, whereas a PLC failure would only cause a loss of communications with a few instruments. 3. Instrument failures If an instrument stops providing measurement data to the MBS, or provides data that is incorrect, the MBS performance will be degraded. Instrument failures are usually not resolved until the instrument is repaired. This can be a lengthy period and would necessitate changes in a MBS model, i.e. data point remapping that is usually performed by a leak detection engineer. The severity of degradation depends on the type of instrument and its location, as outlined by the following: Flow Meters: A failed flow meter will degrade any Volume Balance section using that meter. If there is an overlapping VB section to cover the degraded VB sections, the model sensitivity is only slightly reduced. However, if there is no overlapping VB section, the degradation is severe enough to consider the model unreliable and Alternate Leak Detection ( ALD ) is performed. The loss of any injection or delivery flow meter is critical and requires ALD. Pressure Transmitters: Failed pressure transmitters impact the accuracy of the model, potentially leading to incorrect pressures and calculated flows. However, if the MBS model recognizes that the pressure transmitters have failed, it can adjust accordingly to significantly reduce the degradation. Inlet Fluid Property Instruments: Loss of fluid property measurement at an inlet can degrade model performance. If the fluid being injected into a line has incorrect properties, the system 28

will be degraded until that fluid leaves the model. For example, if a densitometer reads high for 10 minutes, the fluid injected in that period will have the incorrect density. The model will be degraded until that fluid is delivered, which may take days depending on the length of the pipeline. Temperature Transmitters: If the temperature is not modeled correctly it will impact the modeled fluid s viscosity and vapour pressure. Incorrect viscosity will affect the pressure drop in the model, affecting the hydraulics of the model. Incorrect vapour pressure may affect the formation of column separation in the model. 29

Line 9B Reversal and Line 9 Capacity Expansion Project 6 MBS Performance To characterize the performance of a leak detection system, one should assess its ability to identify leak conditions rapidly and without failure, so as to minimize fluid loss, property damage, and the risk of personal injury. API 1130 groups the system performance into four categories. These categories, or metrics, are the system's reliability, sensitivity, accuracy, and robustness. Together they characterize leak detection performance. For the Enbridge MBS, a definition and discussion of each of these performance metrics follows. 6.1 Sensitivity API 1130 s Definition Sensitivity is defined as a composite measure of the size of leak that a system is capable of detecting, and the time required for the system to issue an alarm in the event that a leak of that size should occur. Quantification The following measures are used to quantify the MBS sensitivity: minimum detectable leak rate in the 5 minute time window; minimum detectable leak rate in the 20 minute time window; and minimum detectable leak rate in the 2 hour time window. Notes Each of the time windows will have a different sensitivity. The longer the time window is, the more sensitive it is. Enbridge has target sensitivity levels of 30%, 15%, and 5% of the line flow rate in the 5 minute, 20 minute, and 2 hour windows, respectively. Many factors, such as flow rate and uncertainties, may impact the sensitivities. As a result, different pipelines have different sensitivities. Any system degradation will reduce the sensitivity. The MBS model s sensitivity is determined through systematic testing. See section 7, Evaluation of MBS Performance, for more information on testing the MBS. 30

Line 9B Reversal and Line 9 Capacity Expansion Project 6.2 Accuracy API 1130 s Definition The validity of the leak parameter estimates (e.g. leak flow-rate, total volume lost, type of fluid lost, and leak location within the pipeline network at certain pipeline conditions) constitutes a third measure of performance referred to as accuracy. Quantification Leak location: Anywhere within the alarming section Type of fluid lost: Any fluid within the leaking section Leak size: Plot of the percentage of the leak detected vs. the leak rate, as shown in Figure 18 Redacted - Proprietary Information Figure 18: Accuracy plot for multiple pipeline sections Notes The leak rates and sizes are typically underestimated, due to uncertainties and inaccuracies in the model such as flow meter error and fluid properties. The MBS is not designed to determine the leak location. If the MBS detects a leak, the location could be anywhere within the alarming section. However, analysts may be able to better estimate leak location if the leak is bracketed by pressure monitors within a section. 31

Line 9B Reversal and Line 9 Capacity Expansion Project 6.3 Reliability API 1130 s Definition Reliability is defined as a measure of the ability of a leak detection system to render accurate decisions about the possible existence of a leak on the pipeline, while operating within an envelope established by the leak detection system design. It follows that reliability is directly related to the probability of detecting a leak, given that a leak does in fact exist, and the probability of incorrectly declaring a leak, given that no leak has occurred. A system is considered to be more reliable if it consistently detects actual leaks without generating incorrect declarations. Conversely, a system which tends to incorrectly declare leaks is often considered to be less reliable. This is particularly true in cases where it is difficult for the Pipeline Controller to distinguish between actual leaks and incorrect declarations. On the other hand, a high rate of incorrect leak declarations might be considered less significant if the pipeline operators have access to additional information that can be used to verify or disqualify a leak alarm. Quantification Number of false leak alarms Number and duration of line shutdowns due to false alarms Number of actual leaks not detected by the system Notes A reliable system will have few false alarms when the line is operating normally. The occurrence of false alarms is expected to increase if the system is degraded in any way. The measures listed above are tracked by MBS event reports. The personnel who analyze the alarms follow defined procedures to reduce variance in analysis methods and increase the system reliability. If additional information is available (e.g. data independent from the leak detection system that is alarming), then reliability may be better managed. The dual thresholds feature of the MBS models improves the sensitivity of leak detection during steady-state operations and improves the reliability during transient operations. 32

Line 9B Reversal and Line 9 Capacity Expansion Project 6.4 Robustness API 1130 s Definition Robustness is defined herein as a measure of the leak detection system's ability to continue to function and provide useful information, even under changing conditions of pipeline operation, or in conditions where data is lost or suspect. A system is considered to be robust if it continues to function under such less than ideal conditions. On the other hand, if the system disables certain functions, it might then achieve better reliability, but would be considered less robust. Quantification Number of times ALD is required Number of MBS Fail Alarms Inoperability reports Occurrence of blind spots Notes ALD is performed any time the MBS is unavailable or severely degraded. This may be due to the MBS system not being active, or may be due to severe degradation such as the loss of a flow meter. The number of occurrences of ALD is therefore a direct measure of robustness. If the MBS system is not functioning for more than four minutes, an MBS Fail Alarm will be triggered. If the MBS can be started again quickly, ALD may not be required. Therefore the number of MBS Fail Alarms provides a second measure of robustness. Inoperability reports are created any time the MBS system is non-operational for 60 minutes or more. To accurately track robustness, it is important to track these rare events. A blind spot is anywhere the MBS cannot see the model hydraulics. For example, a sectionalized pipe segment that contains no pressure transmitters cannot be seen by the MBS. Blind spots are extremely rare in flowing conditions but may develop when a pipeline is shutdown and mainline sectionalizing valves closed. A table of detailed operational conditions and their impact on the MBS functionality is provided in APPENDIX B: MBS Functionality for Specific Operating Conditions. 33

6.5 Specification and Prioritization of Performance Metrics The four performance metrics (sensitivity, accuracy, reliability, and robustness) are ranked in order of importance. This prioritization is used to guide the maintenance and design of Enbridge s MBS system. Table 2 shows each metric and its ranking. Table 2: Prioritization of the four performance metrics Priority Ranking Metric 1 (top priority) Robustness 2 Reliability 3 Sensitivity 4 Accuracy Robustness is the top priority because it is a measure of the MBS s ability to function, and ensuring that the MBS is always functioning is of paramount importance. The other metrics are meaningless if the MBS is not functioning. Reliability is ranked second because it is essential that a true leak event is discernible from a false alarm. Sensitivity is ranked third. The ability to detect small leaks quickly is a key indicator of MBS performance. However, it ranks behind reliability because detecting a leak provides no benefit if it is mistaken for a false alarm. Accuracy, or the leak size and location, is ranked fourth. Accuracy is the lowest priority metric because the greatest benefit comes from simply identifying a leak, so the pipeline can be shut down and sectionalized. The other metrics contribute to identifying a leak, whereas accuracy provides useful, but less critical, information. 34

Line 9B Reversal and Line 9 Capacity Expansion Project 7 Evaluation of MBS Performance Regulatory documents CSA Z662-11 Annex E and API 1130 recommend various types of leak tests to prove that leak detection systems work as expected. The following testing of Enbridge s MBS is performed: 1 Initial evaluation when an LDS system first goes into service; Re-evaluation of the MBS performance when significant changes are made to the LDS system or the physical pipeline during upgrades or maintenance; Periodic evaluations on a predetermined time basis for reconfirmation of the MBS performance2. Several leak testing methods are used to measure MBS sensitivity: API 1130 (Parameter manipulation) Tests, Simulated Leak Tests ( SLTs ) and Fluid Withdrawal Testing ( FWT ). In addition, there is an industry methodology outlined in API 1149 Pipeline Variable Uncertainties and Their Effects on Leak Detectability which is used to provide a theoretical prediction of sensitivity for mass balance systems. The method prescribed by API 1149 is a prediction that is useful for design decisions, such as lines that do not yet exist, or evaluating the impact on sensitivity of potential instrumentation upgrades. It is a comparatively easy and inexpensive method, but also the most inaccurate and theoretical. API 1130 tests provide a measure of sensitivity. These tests are slightly more time consuming than API 1149 but are also straightforward to perform. SLTs provide a more accurate measurement of sensitivity but they are expensive, time consuming, and labour intensive. They can be used to measure sensitivity at any location along a pipeline and during all pipeline operating modes. A FWT provides the most realistic snapshot of the MBS sensitivity. However, there are inherent disadvantages to FWTs that must be overcome: 1. FWTs are performed in one instant of time, at one location, and for one operating mode. In other words, even with successive fluid withdrawal tests on the same pipeline, on the same 1 Initial tests on the new pipeline are necessary to confirm that the MBS will alarm at the set thresholds. 2 The MBS is tested at least annually using API-1130 techniques to confirm its continued effectiveness. 35

Line 9B Reversal and Line 9 Capacity Expansion Project day, with the same line rate and leak rate, the sensitivity of the MBS may vary. This is due to pumps starting or stopping on the line, different batches moving through the line, and other factors that affect the state of the pipeline at the given instant. 2. The large amount of fluid to be removed, especially at smaller leak rates (to be detected in longer time windows), poses a logistical issue regarding the fluid s storage and transport. Ideally FWTs are performed at more than one location, but this can be constrained by cost and logistics. It is also recommended that some tests be unannounced, so that the Control Centre is not advised that a leak test is occurring. This allows the Controller s and Leak Detection Analyst s response to alarms to be tested as well. Other tests such as critical process failover and tests of the critical process software MBS Fail monitoring will be considered as a part of SCADA. The decision to test and retest the MBS is made by engineering and management. 36

8 Staff Roles and Responsibilities Performing leak detection on Enbridge s pipelines is a collaborative effort between the CCO group and the Pipeline Control Systems and Leak Detection ( PCSLD ) group. Appendix D specifies the roles and responsibilities of both CCO and PCSLD personnel in the event of suspected leak. 37

9 Leak Detection Procedures 9.1 Analyst Procedures Analysts receive support calls from operators whenever the CCO receives an alarm or notices a model anomaly. For alarms, the analyst must determine if it is valid or invalid, and then notify the operator (although the operator may shut down in the event of an obvious line rupture or pipeline operational anomaly). Whether it is an alarm or anomaly, the root cause must be determined so corrective action can be taken. To minimize the impacts of a release on human health, the environment, property, and equipment, leak detection analysts must ensure that their method provides a quick and correct resolution to the observed model issue. To aid the analysts in their duties, Enbridge uses procedures and guidelines to make certain that all leak alarms and model abnormalities are investigated correctly and consistently. Analysis Procedures These procedures outline the steps involved when responding to a support call, from identifying the type of call (alarm vs. anomaly) to the suggested analysis for specific events, such as an instrument error or column separation during shutdown. Task Guidelines The task guidelines cover a wide variety of tasks that leak detection analysts may perform. There are guidelines for routine model and equipment maintenance tasks, such as starting/stopping models, synchronizing servers, and creating MBS reports. Emergency tasks, such as evacuating the building or whom to notify in the event of a leak, also have guidelines. Reference Material In addition to the procedures and guidelines, reference material available to the leak detection analysts further aids them. Information such as important contact phone numbers, lists of critical leak detection equipment or DRA flow rates are available in the reference material. 38

Line 9B Reversal and Line 9 Capacity Expansion Project 10 Analyst Testing and Training A three-phase program has been designed to ensure that new leak detection analysts (trainees) are properly trained and are able to fulfil their duties. The phases are (1) orientation, (2) taskbased learning, and (3) analysis training. At the end of the third phase the trainee must successfully complete a readiness assessment before becoming an independent leak detection analyst, at which point they will be able to handle calls without direct supervision. 10.1 Phase 1: Orientation The goal of orientation is to familiarize the trainee with Enbridge s policies, procedures, and practices. Some of the main components of this phase include: Enbridge s onboarding process; Introduction to the MBS; and Introduction to CCO. At the conclusion of Phase 1 the trainee will be ready to start the on-shift phases of the Leak Detection Analyst Training Program (Phases 2 & 3). 10.2 Phase 2: Task-Based Learning During Phase 2, trainees will become more familiar with the MBS. Trainees will job-shadow a mentor during this phase. Mentors will demonstrate and explain all of the essential tasks the trainee will be required to perform, such as MBS-related tasks and documentation. Additional written material will be used to reinforce learning objectives. Additional material includes: roles and responsibilities of analysts and other leak detection staff; fundamentals of pipeline hydraulics; critical equipment and its role in leak detection; review of the four types of MBS alarms; MBS system components, directories, and displays; and regulations and standards that govern leak detection systems used in liquid pipelines. The trainee will move onto Phase 3 when they are able to perform the required tasks. 39

Line 9B Reversal and Line 9 Capacity Expansion Project 10.3 Phase 3: Analysis Training During the last phase of the training program, trainees will begin assuming the duties of an Analyst. Trainees will job-shadow a mentor during this phase. Mentors will demonstrate and explain all of the analytical tasks and the trainee will be required to perform them. Analytical content covered in this phase includes: leak detection and analyst procedures, such as responding to a support call; displays and trending SCADA and MBS data for alarm evaluation; alarm evaluation procedures, in applications such as column separation, batch misalignment, and instrumentation error; and interpretation, validation, and resolution of alarms in a timely manner. 10.4 Readiness Assessment The analyst readiness assessment is designed to provide a benchmark assessment of the skills and knowledge of a trainee analyst and ensure consistent qualifications and level of support. The readiness assessment consists of three parts: a written exam; table-top exercises; and analysis exercises. A trainee is deemed proficient as an analyst if they complete the written portion of the assessment with a score of 90% or higher, demonstrate understanding of the analyst role through table-top exercises, and demonstrate proficiency in carrying out analysis. The exercise must be authenticated by an individual who possesses sufficient knowledge and expertise to ascertain whether the root cause analysis is correctly followed. 40

Line 9B Reversal and Line 9 Capacity Expansion Project 11 Maintenance Prompt, ongoing maintenance and support is necessary to keep the MBS operating with high performance. Enbridge standard maintenance and calibration procedures are followed for both preventative maintenance and repair. Detailed information on maintenance procedures is located in the Operations and Maintenance Manuals, Book 6: Equipment Maintenance. 11.1 Preventative Maintenance Preventative maintenance will usually consist of scheduled calibration of sensors and instruments. By broader definition, preventative maintenance may also include software upgrades or new versions that fix software bugs or provide enhanced performance. Considerations with respect to preventative maintenance of the MBS critical instruments include, but are not limited to, the following. Software upgrades or new versions of the LDS software will be implemented as necessary based upon engineering decisions on an individual instance basis. It may be necessary to re-test the software after an upgrade or new version is installed. The need for re-testing must be determined on an individual basis by PCSLD staff. Preventative maintenance for pressure sensors is specified in regulations wherein pressure sensors must be checked twice yearly. The checking is normally done by recalibration of the pressure instrument. Generally the temperature sensors should be re-calibrated annually. Instrumentation should be calibrated in accordance with manufacturer s recommendations and calibrations should be traceable to the National Institute for Standards and Testing. The preventative maintenance plan for the critical instruments may also be determined from operational experience. A notification procedure for field maintenance that may affect the MBS is implemented. The leak detection analysts should be informed whenever an LDS instrument is inhibited and/or disabled which causes the system to operate in a degraded mode. However, it should not be assumed that alarms are caused by the maintenance work, and all alarms are presumed valid and investigated. Most maintenance activities are performed allowing for MBS adjustments. 41

Line 9B Reversal and Line 9 Capacity Expansion Project 11.2 Repair/Replacement Repair and replacement of the MBS critical instruments or critical processes must be done on a high priority basis. The quality of instrumentation and measurement data can affect the performance of the LDS. Both availability and accuracy of the measurements produced by the critical instruments are essential to achieve the desired leak detectability performance of the MBS. Considerations to be taken for repair of critical instruments or restart/repair of critical applications include, but are not limited to, the following. The MBS may identify suspicious data and, consequently, suspicious instruments by use of basic SCADA quality flags. This indication can be evaluated and a decision can be made on having the instrument repaired or re-calibrated. Repair or re-calibration of critical instruments needs to be done on a high priority basis especially if the bad data is causing alarms or significant degradation of the capability of the LDS. Trend monitoring can be a useful tool to evaluate the state of a questionable instrument. The MBS trending displays are designed to meet historical analysis requirements. The leak detection analyst must communicate with field staff to register a call for instrument repair and to know when the repair is complete. Ongoing communication is vital. The field staff must contact the CCO if instrument calibration is scheduled. They must contact the CCO both before and after the work. The leak detection analyst must contact software support staff immediately if software MBS Fail monitoring indicates a critical process problem or if there is an application that has ceased functioning. Any need for calibration or repair should be recorded in e-logs. If possible, switch to another sensor during work or set the instrument to bad while maintenance is underway. 11.3 Model Improvement Plans The Enbridge philosophy is to both maintain and improve the performance of MBS on Enbridge pipelines. The main goals of the improvement plan are: to improve the LDS on an ongoing basis; to reduce LDS false alarms; 42

to modify LDS to detect smaller leaks, faster; to keep up to date with pipeline, instrumentation and operation changes; and to implement results of any risk assessments. In order to achieve these goals, various techniques are used to assess effectiveness of the MBS system. These may include the following. 1. Testing of the current performance of the MBS by: a. Use of fluid withdrawal sensitivity measurement; b. Simulated leak test sensitivity measurement; c. API 1130 leak test sensitivity measurement; d. Sensitivity prediction using API 1149 calculations, which are a theoretical, best-case approximation of sensitivity, to determine what type of additional instrumentation would be required to bring the Line X MBS up to Enbridge standards for leak detectability; and e. Tracking and evaluation of all false alarms. 2. Review of regulatory commitments: a. Perform an API 1130 assessment; and b. Review regulatory commitments made in project submissions. 3. Review of current status of MBS system. 4. Qualitative assessment of the MBS system. 5. Performance of a gap analysis. 6. Use of scenario analysis. 7. Monitoring industrial research outcomes, review of conference papers, and evaluation of new or alternate technologies employed for leak detection purposes. 8. Review of the training materials on a regular basis to ensure current pipeline operations and special features are covered. 9. Issue recommendations. 43

Line 9B Reversal and Line 9 Capacity Expansion Project 12 Record Keeping The retention of data and reports from the MBS is governed by several factors such as: regulatory requirements; Enbridge policy and/or practices; engineering and operation requirements; and training purposes. Careful consideration of what should be retained over and above that required by regulations is recommended. The considerations should also include what types of data and information may be useful or helpful in the future, for example a data-set from a leak or leak test that can be used to verify CPM performance after changes have been made to the system. 12.1 Retention of Records The following records should be historically documented to meet the requirements of the API1130: all occurrences of a leak declaration; E-log information from leak detection analysts; test records (for both initial tests and retests) detailing the reasons for the tests, the test parameters and methodology and the test results; records on the results of alarm analysis particularly for training purposes; details of all system alarms; details of the instance and duration when the leak detection system becomes nonfunctional or severely degraded; version control of software so all versions of LDS software used can be recreated; over/short information; and records on the leak detection analysts training and retraining. 12.2 Historical Retention Periods Records on system leaks must be kept for the life of the pipeline. Records pertaining to leak detection system maintenance, auditing, and leak testing must be retained for five years. 44

E-log information must be kept for minimum six months. Version control of software version must be kept for the life of the software. Over/short information must be kept for minimum one year. Manuals of any sort related to leak detection must be kept for the life of the pipeline. All records shall be readily accessible to operating personnel and shall be reviewed at appropriate intervals. 45

APPENDIX A: Fluid Characteristics * Results from 2010 Crude Characteristics. ** Results from 2009 Crude Characteristics. *** Commodity not moved. Results are prior to 2009 Crude Characteristics. n/a = Test was not done. Total Reid Product Sulphur Pour Point Vapour Density Viscosity (cst) at Specified Temperature (degree Celsius) Crude Type (Long Name) Identifier (% by (deg C) Pressure (kg/m 3 ) weight) (kpa) 10.00 20.00 30.00 40.00 45.00 AHS ALBIAN HEAVY SYNTHETIC 2.52 <-30 56.3 934.2 253 127 70.8 43.0 34.2 AMH ALBIAN MUSKEG RIVER HEAVY 3.87 <-30 49.0 924.0 272 142 81.8 50.7 40.8 ARB ALBIAN RESIDUAL BLEND 2.87 <-30 29.0 923.9 302 156 88.6 54.4 43.6 AWB ACCESS WESTERN BLEND 3.92 <-30 52.0 923.0 293 152 87.2 53.9 43.3 BG BONNIE GLEN 0.32 <-30 63.0 804.3 2.65 2.20 1.86 1.61 1.50 BHB BOREALIS HEAVY BLEND 3.48 <-30* 41.0* 925.6 265* 140* 80.8* 50.3* 40.5* BR BOW RIVER 2.80 <-30 36.3 923.3 175 94.8 56.2 35.8 29.2 BSH BP SYN HVY BLEND 3.10 n/a n/a 931.0 n/a n/a n/a n/a n/a BSO BP CAVERN SWEET/SOUR 1.03 n/a 44.0 844.4 10.7 7.57 5.55 4.30 3.86 CAL CENTRAL ALBERTA PIPELINE 1.08-15 77.0 853.6 12.8 8.66 6.39 4.92 4.40 CAM AMOCO CONDENSATE 0.03 <-30 69.8 708.7 0.770 0.660 0.610 0.560 0.580 CCA CAROLINE CONDENSATE 0.38 <-30 40.3 742.0 0.660 0.590 0.540 0.490 0.470 CDB CHRISTINA LAKE DIL-BIT BLEND 3.85 n/a n/a 926.6 n/a n/a n/a n/a n/a CFD FEDERATED CONDENSATE 0.06 <-30 74.3 711.1 0.600 0.550 0.500 0.460 Boiled FORT SASKATCHEWAN CFT 0.04 <-30 86.3 678.2 0.550 0.500 0.460 0.440 0.420 CONDENSATE CGB GIBSON CONDENSATE 0.23 <-30 78.3 741.1 0.710 0.660 0.610 0.560 0.520 CGY GIBSON CONDENSATE HARDISTY n/a n/a n/a 728.0 n/a n/a n/a n/a n/a CL COLD LAKE 3.58 <-30 53.0 925.7 288 151 86.7 54.4 44.8 46

CNRL LIGHT SWEET CNS 0.08 <-30 20.0 851.4 5.16 3.93 3.11 2.55 2.31 SYNTHETIC BLEND CPC PETROCANADA CONDENSATE 0.00 <-30 56.3 700.1 0.650 0.540 0.500 0.460 0.450 CPM PEMBINA CONDENSATE 0.14 <-30 69.0 760.1 1.60 1.36 1.17 1.04 1.09 CPN PEMBINA NEXUS CONDENSATE 0.15 n/a 80.0 750.1 1.16 1.00 0.860 0.760 0.750 CPR PEACE PIPE CONDENSATE 0.16 <-30 79.5 749.3 1.11 0.990 0.880 0.800 0.770 CRL RANGELAND CONDENSATE 0.30 <-30 80.0 742.8 1.08 0.960 0.830 0.760 Boiled CRW CONDENSATE BLEND 0.10 <-30 76.7 709.5 0.610 0.550 0.490 0.470 0.430 F FOSTERTON 3.20 <-30 29.0 928.7 245 131 75.3 45.8 36.7 FD FEDERATED 0.38 <-30 76.7 825.7 5.58 4.31 3.38 2.76 2.50 HO APACHE 0.70 0 47.5 821.8 6.77 4.52 3.44 2.78 2.50 HSB HUSKY SYNTHETIC BLEND 0.11 <-30 41.0 859.4 11.9 8.32 6.14 4.69 4.18 ISH ISH 0.68 <-30 37.0 833.8 7.83 5.79 4.47 3.55 3.21 LLB LLOYDMINSTER BLEND 3.53 <-30 50.5 928.1 282 148 85.8 53.3 43.2 LLK LLOYDMINSTER KERROBERT 3.23 <-30 53.0 928.0 296 155 88.3 54.9 44.1 LSB LIGHT SOUR BLEND 0.99 <-30 74.5 838.8 5.66 4.39 3.47 2.79 2.52 M MIDALE BLEND 2.22-3 42.5 876.6 20.4 12.9 8.74 6.48 5.75 MCG ICG LIGHT SOUR 0.68-2 91.3 829.6 11.4 8.62 3.92 3.03 2.80 MGL GIBSON LIGHT 0.44-21 83.0 839.0 7.19 5.38 4.06 3.21 2.91 MGS GIBSON SOUR 2.33 <-30 83.0 862.9 20.1 14.6 10.5 7.82 6.91 MJT MOOSE JAW TOPS 1.66 <-30 44.3 826.8 5.56 3.54 2.84 2.35 2.14 MKH MACKAY RIVER HEAVY 2.88 <-30 15.0 935.7 316* 157* 86.8* 52.4* 41.6* MLN JOARCAM 0.20-6 71.0 830.7 10.5 6.98 5.10 3.92 3.53 MLS TUNDRA LIGHT SOUR 0.55 <-30 85.7 830.3 6.08 4.34 3.34 2.70 2.46 MM MANITOBA MEDIUM 2.11 <-30 40.7 896.3 32.6 21.2 14.3 10.1 8.82 MML MANITOBA LIGHT 1.78-15 74.7 859.0 11.6 8.34 6.13 4.73 4.25 MPR PEACE PIPE LIGHT 0.43-15 66.0 817.5 5.73 4.28 3.36 2.74 2.49 MSM WESPUR MIDALE 2.11-12 42.3 877.6 17.1 10.6 7.32 5.54 4.94 47

MST MANITOBA SWEET - TUNDRA 0.43-21 76.7 824.4 4.74 3.67 2.95 2.43 2.21 MSY LIGHT SMILEY 0.33-3 40.8 851.9 15.2 9.22 6.59 5.10 4.57 NSA PREMIUM NEWGRADE SYNTHETIC 0.09 <-30 59.3 855.4 9.87 7.03 5.27 4.09 3.66 NW NORMAN WELLS 0.31 <-30 88.7 823.0 4.86 3.93 3.19 2.61 2.11 OCC SUNCOR-CRACKED C 3.25 <-30 4.5 924.5 22.3 14.3 9.77 7.03 6.12 OSA SUNCOR - A 0.17 <-30 31.7 857.5 9.38 6.68 5.00 3.88 3.48 OSC SUNCOR - C 0.06 <-30 4.0 870.5 4.31 3.34 2.67 2.21 2.01 OSH SUNCOR-OSH 3.03 <-30 17.7 935.2 141 71.2 40.1 24.7 19.9 OSN SUNCOR - N 0.01 <-30 64.4 723.8 0.750 0.670 0.610 0.560 0.530 P PEMBINA 0.38-15 69.3 825.9 6.27 4.77 3.60 2.85 2.57 PAS PREMIUM ALBIAN SYNTHETIC 0.05 <-30 5.7 859.1 7.99 5.82 4.43 3.50 3.14 PBS PINE BEND SPECIAL 3.48 <-30 19.5 925.3 98.4 53.1 32.8 21.7 18.0 PH PEACE HEAVY 4.82 <-30 53.0 925.4 257 136 78.8 48.2 38.6 PHO PEMBINA HIGH SOUR 2.63 <-30 73.0 864.1 17.3 11.8 8.56 6.46 5.74 PLS PEMBINA LIGHT SOUR FOR SLE 0.76 <-30 70.0 825.8 5.53 4.28 3.35 2.72 2.49 PSB PEMBINA SWEET BLEND 0.42 <-30 64.0 828.1 7.21 5.33 4.07 3.25 2.93 PSC LONG LAKE SWEET SYNTHETIC BLEND 0.07 <-30 23.3 839.1 6.60 4.85 3.73 2.97 2.68 PSH LONG LAKE HEAVY DILSYNBIT BLEND 3.28 <-30 20.5 929.5 469 230 125 74.2 58.6 RA RAINBOW LIGHT 0.38-18 69.7 825.3 6.26 4.43 3.46 2.83 2.57 RSW RANGELAND SWEET 0.38-18 81.3 824.4 6.19 4.68 3.61 2.85 2.49 SC SMILEY COLEVILLE HEAVY 2.94 <-30 42.7 931.1 281 147 84.5 52.3 42.1 SCB STATOIL CHEECHAM BLEND 3.79 <-30 34.5 924.3 135 76.8 47.4 31.0 25.6 SES SOUTH EAST SASK 0.84-18 67.3 830.8 5.46 4.19 3.27 2.66 2.42 SH BLACK ROCK SEAL HEAVY 4.72 <-30 49.3 932.4 246 132 77.4 48.8 39.7 SHB SURMONT HEAVY BLEND 2.89 <-30 21.3 933.6 279 143 80.7 49.4 39.5 SHE EDMONTON HIGH SOUR 2.43 <-30 62.8 860.4 22.5 15.5 11.0 8.16 7.21 SLD SOUTHERN LIGHTS DILUENT 0.03 <-30 81.2 676.7 0.520 0.480 0.430 0.400 Boiled 48

SLE EDMONTON LOW SOUR 0.96 <-30 80.0 839.5 7.67 5.54 4.27 3.41 3.05 SO MIXED BLEND SOUR 1.89 <-30 67.0 858.3 26.9 17.5 12.3 8.91 7.83 SPR PEACE PIPE SOUR 2.70 <-30 59.3 870.0 27.9 18.7 13.1 9.52 8.34 SPX SHELL PREMIUM SYNTHETIC 0.06 <-30 3.0 866.3 11.0 7.65 5.61 4.30 3.82 SSS SARNIA SPECIAL 0.93-15 55.0 899.6 176 94.0 53.9 34.4 27.7 SSX SHELL SYNTHETIC LIGHT 0.13 <-30 21.7 862.8 15.1 10.3 7.41 5.54 4.90 SW MIXED BLEND SWEET 0.41-21 71.6 830.7 6.80 5.04 3.85 3.06 2.75 SYN SYNCRUDE 0.18 <-30 32.0 862.6 7.40 5.44 4.17 3.32 2.98 UHC U.S. HIGH SWEET - CLEARBROOK 0.19-29 77.0 814.9 3.79 3.04 2.47 2.08 1.89 UHL U.S. HIGH SWEET - LEWISTON 0.44-8 59.1 802.3 5.81 3.23 2.45 2.01 1.34 UOC U.S. SOUR - CLEARBROOK 2.20 13 36.5 882.5 49.6 21.4 13.3 9.16 7.83 WCB WESTERN CANADIAN BLEND 3.01 <-30 27.0 929.1 287 149 84.9 52.5 42.3 WCS WESTERN CANADIAN SELECT 3.35 <-30 51.7 928.0 302 157 89.6 55.3 44.4 WH WABASCA HVY 4.30 <-30 44.0 931.9 256 134 77.5 47.5 37.5 ZA ZAMA 0.31 <-30 88.0 821.8 4.71 3.64 2.93 2.43 2.20 49

APPENDIX B: MBS Functionality for Specific Operating Conditions Condition Steady State Flow Transient Conditions Line Shutdown/ Partial Shutdown Column Separation Field Maintenance Loss of Injection/ Delivery Flow Meters Loss of Regional Boundary Flow Meters Loss of other Equipment Functional (Yes/No/NA) Yes Yes Yes Yes/No Yes No No Yes Note Normal sensitivity/reliability and accuracy expected Temporary decrease in sensitivity anticipated in correlation with length/magnitude of transient. Expected during pipeline startup, shutdown and rate change. RTTM is functional on shut down pipelines. Other systems (such as volume balance) may not be. If column separation occurs between two pressure transmitters the MBS is functional; however reliability and sensitivity are potentially negatively impacted. If column separation occurs between a pressure transmitter and a closed valve, the MBS is blind in the region between the valve and the point of column separation. Alarms due to column separation are always treated as valid alarms in the Control Centre. Sensitivity and reliability could be impacted, depending on type and duration of maintenance MBS is considered non-functional and non-compliant with Enbridge standards when injection or delivery meters are broken because sensitivity is known to be seriously degraded. Alternate means of leak detection are required until the meter is repaired. For MBSs without overlapping VB sections across region boundaries, loss of mainline flow meters are treated the same as the loss of injection/delivery meters. Similar to maintenance impact, sensitivity and reliability could be impacted, depending on the type of equipment lost. See L19 SLT report on impact of degradation to the MBS. DRA Yes MBSs are capable of modeling DRA and compensating to a limited degree for errors in DRA modeling. 50

Station Isolation RSV closing Loss of all SCADA Yes/No Yes/No No When a station is isolated from the mainline the station piping is no longer protected by the MBS. Station piping must be open to mainline pressure to be protected by the MBS. The rest of the pipeline still has leak detection, although it may be degraded. Segments of mainline piping isolated by closed sectionalizing valves that contain a pressure transmitter are functional in the MBS. Isolated sections that do not contain a pressure transmitter are not monitored by the MBS, creating a blind spot. MBS cannot function without live SCADA data 51

Line 9B Reversal and Line 9 Capacity Expansion Project APPENDIX C: Referenced Document List 1. API 1149 (Pipeline Variable Uncertainties and Their Effects on Leak Detectability) 2. API RP-1130 (Computational Pipeline Monitoring for Liquids) 3. CSA Z662-11 Annex E (Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection) 4. Enbridge Document- Leak Detection Critical Equipment List Operational Definition 5. Enbridge Document- Material Balance System Manual: The Line XX Model 6. Enbridge Document- MBS Display Standard 7. Enbridge Document- The Equipment Maintenance Manual 8. Enbridge Standard- D12-105: Mainline Leak Detection Equipment and Instrumentation Requirements 52

Line 9B Reversal and Line 9 Capacity Expansion Project APPENDIX D: Roles, Responsibilities and Authorities of Personnel in the Event of a Suspected Leak Abnormal Operation Operator Identify, analyze and troubleshoot abnormal operating conditions ( AOCs ) and take appropriate action. Analyze and troubleshoot AOCs first identified by others, or on previous shifts, and take appropriate action. Operator has the authority to perform an emergency system shutdown if it is necessary during abnormal operations without additional authorization or approval. Provide support and assistance to other Control Centre Operators as requested, for example by reviewing historical information, maps and schematics, procedures or monitoring SCADA displays during AOCs. Drive stations to comm-out ( communication outage ) (most conservative) limits when required. Execute CCO procedures in the event of a widespread communication outage. Document field equipment and SCADA issues, and AOCs in accordance with CCO Standards and Procedures. Abnormal Operation Shift Supervisor Complete Incident Analysis and Close Call processes and associated documentation. Complete Incident Receiving Form. Accompany Operators for drug and alcohol testing. Execute necessary procedures and notifications as a result of MBS Alarms. Ensure Enbridge CCO Procedures are followed in all situations. Abnormal Operations Senior Technical Advisor Provide technical data and analysis to Shift Supervisor as required. Support Operators in response to MBS Alarms and notify the Shift Supervisor when necessary. Investigate and support Pipeline and Terminal AOCs. Complete Operator Qualification Re-assessment documentation as part of the Incident Process. Provide Operators with support in dealing with AOCs. Coordinate and document alternate leak detection ( ALD ). Completing/reviewing over pressure analysis. Ensure Critical Equipment Process is followed completely. 53

Engage in clear, direct communication via email or other methods with different departments (Technical Services, Petroleum Quality, Engineering, CCO Compliance, IT, Help Desk, Commodity Movement Tracking ( CMT ) Support) as required to obtain supplemental technical information. Monitor operations to ensure that Enbridge CCO Procedures have been executed and are followed in all situations. Abnormal Operations Leak Detection ( LD ) Analyst Respond to CCO Operator notifications of MBS Alarms. Analyze the MBS for malfunctions and data errors. Advise CCO Operators and Shift Supervisors of MBS status. Abnormal Operation Technical Support Staff Provide guidance and technical support in analyses and investigation of abnormal operations. Emergency Operation Operator Possesses the authority and obligation to execute emergency procedures and notifications upon the witnessing of AOCs as outlined within applicable Control Centre Emergency Procedures. Execute emergency procedures or respond to high-severity multi-console alarms on behalf of another Operator temporarily absent from a console or incapacitated, including executing an emergency pipeline shutdown if required by procedures. Perform column separation analysis and calculations (Pipeline Operators only). Analyze SCADA data and the CMT system for the presence of leak triggers. Analyzes SCADA data for the presence of obstruction and overpressure triggers. Provide operational information to Leak Detection Analysts in the event of an MBS alarm (Pipeline Operators only). Provide support and assistance to other Control Centre Operators as requested, for example by reviewing historical information, maps and schematics, procedures or monitoring SCADA displays during emergency conditions. Perform duties in accordance with CCO Operating Procedures in the event of a control room emergency. Emergency Operations Shift Supervisor Primary point of contact for all emergency situations. Execution of Emergency Notifications as required. Execution of the Executive Management Team Notification Procedure. Co-ordinate emergency response with Regional Management. 54

Complete Incident Analysis and documentation. Complete Incident Receiving Form. Accompany Operators for drug and alcohol testing. Primary contact for Enbridge Emergency Phone. Inform CCO Management when a column separation condition is to exceed ten minutes. Execute necessary procedures and notifications as a result of MBS Alarms. Ensure Enbridge CCO Emergency Procedures are followed in all situations. Performs duties in accordance with CCO Emergency Procedures in the event of a control room emergency. Emergency Operations Senior Technical Advisor Secondary point of contact in all Emergency Situations as required. Collect technical data in relation to emergency response documentation requirements. Provide technical data and analysis to Shift Supervisor as required. May be required to provide coverage for the Operator being tested until relief can be brought in. Secondary contact for Enbridge Emergency Phone. Support the Operators in collecting historical data for column separation conditions. Inform the Shift Supervisors of MBS Alarms when they are deemed valid, incomplete or will exceed ten minutes, and support the necessary technical analysis. Monitor operations to ensure that Enbridge CCO Emergency Procedures have been executed and are followed in all situations and associated documentation is completed. Complete/review over-pressure analysis. Perform assessments of possible pipeline or terminal overpressures. Perform duties in accordance with CCO Operating Procedures in the event of a control room emergency. Emergency Operation Leak Detection Analyst Provide root cause analysis, interpretation, and resolution of MBS Alarms in accordance with established LD procedures. Monitor the MBS for malfunctions and data errors. Execute the Leak Detection Escalation procedure to ensure management is advised when potential leaks occur. Emergency Operations Technical Support Support the Shift Supervisor in the execution of the appropriate actions and procedures when emergencies occur. 55

GLOSSARY Alternate Leak Detection ( ALD ): A form of leak detection that is performed when the MBS is considered unreliable. ALD consists of the operator manually comparing tank volumes at specified intervals of time. Computational Pipeline Monitoring ( CPM ): A term that was developed by the API to refer to software-based algorithmic monitoring tools that are used to enhance the abilities of a Pipeline Controller to recognize hydraulic anomalies on a pipeline. CPM systems are often generically called leak detection systems. However, pipeline leak detection can be accomplished by a variety of techniques such as: aerial/ground patrol; third party reports; inspections by company staff; hydrocarbon detection sensors; SCADA monitoring of pipeline conditions by Pipeline Controllers; and software based monitoring. To provide clear reference, the term CPM was developed specifically to cover leak detection using softwarebased algorithmic tools [Definition taken from API 1130]. Control Volume: A conceptual volume that is used in developing mathematical models, commonly used in the fields of fluid mechanics and thermodynamics. Diagnostic Flow ( DF ): A fictitious flow added to the RTTM to reconcile differences between the measured and calculated pipeline states. Diagnostic Volume ( DV ): An accumulated volume of diagnostic flows obtained by integrating the diagnostic flows in a MBS section over a period of time. DVs are sometimes referred to as a volume imbalance. Diagnostic Volume Threshold: The maximum allowable diagnostic volume allowed before issuing a leak alarm. Drag Reducing Agent ( DRA ): Polymer designed to decrease the amount of friction in a pipeline when added to the transported fluid. Dual Thresholds: Diagnostic volume thresholds that change limits based on the hydraulic state of the pipeline. Transient conditions increase thresholds, accommodating the additional uncertainty and reducing false alarms. Fluid Withdrawal Test ( FWT ): A method of measuring the leak detection sensitivity that involves actual removal of fluid from an operating pipeline. Leak Alarm: An alarm triggered when a diagnostic volume reaches its defined threshold, indicating that the MBS system has identified a potential leak scenario. Leak Detection Analyst ( Analyst ): Personnel responsible for analysing MBS leak alarms and other anomalies. Line Pack: The volume of fluid that exists within a pipeline. 56

Material Balance System ( MBS ): The name of Enbridge s computational pipeline monitoring system. The name is derived from mass balance systems, which use conservation of mass to model physical systems. MBS Fail Alarm: An alarm issued when there is a four minute gap between the MBS model time and the actual time. It may indicate a model failure. Pressure Drop Force ( PDF ): A fictitious pressure drop added to the RTTM to reconcile differences between the measured and calculated pipeline states. Real Time Transient Model ( RTTM ): A mathematical model of a pipeline that uses measured values (such as pressures, flows, and temperatures) to compute the hydraulics of a pipeline in real time. RTTM is the type of CPM used by Enbridge for leak detection, which is referred to as the MBS. Repeatability: In the state estimation software, Statefinder, repeatability is the maximum amount that a measured value is allowed to deviate in order to best match the solution for the pipeline s hydraulic state, as determined by the model. SCADA Environment: Software that exists on the SCADA servers that handles the communications and control of the pipelines. Simulated Leak Test ( SLT ): A method of measuring the leak detection sensitivity that involves artificially removing fluid from a pipeline model, to simulate leak conditions. Supervisory Control and Data Acquisition ( SCADA ) System: A control system that uses computers to remotely monitor and control a process. SCADA systems are used in a variety of industries for various applications. Support Call: A call from the pipeline operator to the leak detection analyst to initiate investigation into a leak alarm or model anomaly. Time Window: A specified period of time for which the diagnostic flows are integrated, yielding an accumulated diagnostic volume. Volume Balance Section: A region in the pipeline model in which diagnostic volumes are calculated. Volume Balance Sections are typically bounded by flow meters. 57