ARCHIVED - Compliance Verification under the National Energy Board Act In the Matter of Enbridge Pipelines Inc. - Edmonton Control Room Inspection and Assessment - OF-Surv-Gen 07

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Compliance Verification under the National Energy Board Act In the Matter of Enbridge Pipelines Inc. - Edmonton Control Room Inspection and Assessment - OF-Surv-Gen 07 [PDF 19391 KB]

May 2013

Executive Summary

The safety of Canadians and protection of the environment is paramount for the National Energy Board (Board or NEB) when considering the performance of its regulated companies. The NEB requires regulated companies to anticipate, prevent, mitigate and manage any incidents associated with their operations. The Board holds these companies accountable for safety and environmental outcomes in the public interest.

This report documents the Board’s assessment of Enbridge’s operations and initiatives in pipeline integrity, emergency response management, and control center operations. Details of the Board’s assessment are provided in Appendix I.

In July 2012, Enbridge publicly announced a variety of improvements it was making to its pipeline control and control center operations. These improvements were initiated both prior to and as a result of the pipeline rupture near Marshall, Michigan in July 2010 (the Marshall incident). In August and September 2012, the NEB inspected Enbridge’s Control Room operations in order to assess Enbridge’s compliance with the relevant requirements of the Onshore Pipeline Regulations, 1999 (OPR-99). The Board’s inspection and assessment included a review of Enbridge’s:

  • Pipeline Control and Leak Detection System;
  • Pipeline Integrity Management Program;
  • Emergency Procedures Program and Public Awareness;
  • Management system processes, as required under the OPR-99 and CSA-Z662,[1] to provide for the protection of people, property and the environment; and
  • Safety Culture.

Through its review, the Board found that issues related to management systems, human factors[2]  and team performance in the Enbridge control room directly contributed to the severity of the Marshall incident. Had the rupture been identified and acted upon earlier, the volume of the release and resulting impacts would have been greatly reduced.

During the course of its inspection, the Board did not identify non-compliances with its regulations that would pose an immediate hazard to public safety or the environment. The Board notes that Enbridge has initiated a broad range of improvement actions. Enbridge’s leadership has undertaken efforts to improve its safety culture starting with a commitment from the top of the organization, which is an important part of safety culture advancement. Enbridge has also begun implementing an integrated management system. This is consistent with the Board’s expectations for an effective management system.

Many of Enbridge’s reported improvements are multi-year initiatives that had not been fully implemented at the time of the verification. The Board will continue to monitor and assess all of Enbridge’s reported improvements until they are fully implemented.

Concurrently with the release of this report the Board is issuing an Order SO-E101-003 -2013 to address the outstanding issues identified in the Board’s inspection. The Board will continue to monitor the implementation and effectiveness of Enbridge’s programs and management system through targeted compliance verification activities.

Introduction and Background

Enbridge Energy, Limited Partnership (“EELP”), a United States (US) entity, sustained a rupture on its pipeline, identified as Line 6B, in Marshall, Michigan, US, on 25 July 2010 at 15:58 PM MST. The rupture resulted in the release of approximately 3.2 million litres of crude oil products. The product saturated the surrounding wetlands and flowed into the Talmadge Creek and eventually into the Kalamazoo River. At the time, EELP’s Line 6B was operated by its Canadian affiliate, Enbridge Pipelines Inc. (“Enbridge”).

The Enbridge control center, located in Edmonton, Alberta, received a series of alarms and observed an unusual pressure drop during the shutdown phase. Enbridge incorrectly attributed the alarms to column separation.[3] Over the course of the next 17 hours, Enbridge repeatedly misinterpreted a series of alarms, did not follow approved procedures, and attempted to re-start the line twice while still unaware of the rupture.

Enbridge continued its attempt to resolve the suspected column separation on Line 6B when, at 11:17 AM EDT on 26 July 2010, the control room center was notified of the rupture via a telephone call to their emergency line. Enbridge then isolated the rupture site from the remainder of the pipeline at 11:18 AM MST.

These actions and the ineffectiveness of the initial containment efforts resulted in a large volume of oil escaping the rupture.

On 10 July 2012, the US National Transportation Safety Board (NTSB) released its Pipeline Accident Report regarding the Enbridge rupture at Marshall. According to the NTSB report, the rupture and prolonged release was attributed to “pervasive organizational failures” at Enbridge that included deficient pipeline integrity management procedures, inadequate training of control center personnel, insufficient public awareness and education programs, and an ineffective emergency response.

Prior to the completion of the NTSB investigation, Enbridge publically disclosed that it implemented operational and procedural changes in 2010 and 2011, based on its own internal investigation into the Marshall incident. These changes involved pipeline and facility integrity, leak and pipeline control, control center operations, public awareness and emergency response, and safety culture.

The Board notified Enbridge by way of letter dated 26 July 2012 that an inspection of its Edmonton control center operations would be conducted on 8 and 9 August 2012 to assess its compliance with the OPR-99. Further to the August inspection, a supplementary inspection of Enbridge’s control room was conducted on 12 September 2012. The principal purpose of the supplementary inspection was to observe the practical aspects of Enbridge’s control room operations.

Pipeline Control and Leak Detection

Enbridge has implemented various operational and procedural changes based on its own internal investigation and in direct response to the Marshall incident. The NEB’s review of Enbridge’s pipeline control and leak detection area was designed to assess if the many improvements reported by Enbridge regarding control room management and leak detection are effective. This was done to confirm whether Enbridge can operate its pipeline systems safely and avoid a Marshall-type incident in the future.

Since the Marshall incident, two Enbridge pipelines regulated by other jurisdictional authorities have experienced large leaks. In both cases, these leaks were detected by control room staff within an acceptable timeframe and resulted in the lines being shut down immediately. In addition, demonstrations of a simulated abnormal operation observed by the Board were dealt with in accordance with Enbridge’s procedures. Based on improvements made and observations by the NEB of simulations, it is the Board’s view that Enbridge control center staff now have the tools necessary to avoid previous mistakes related to pipeline incidents.

The NEB also conducted an analysis and review of reported over-pressure incidents occurring on low pressure piping within Enbridge facilities. The Board sought to determine if any aspects of control room operations contributed to the incidents or if the incidents could have been prevented by enhancing control room operations. The assessment determined that control room operations were not a direct contributing factor to the incidents.

The Board finds that Enbridge is in compliance with the requirements of the OPR-99. In order to promote continual improvement, Enbridge should also consider making improvements to enhance pipeline system control and leak detection capabilities, while reducing the time for diagnosing the leak or column separation and responding to a rupture. These improvements would include, but are not limited to:

  • Establishing processes and procedures that would treat a pipeline rupture (defined as an abrupt and uncontrollable release) differently than a leak (defined as a gradual and controllable release);
  • Evaluating shutdown procedures to minimize column separation and automating the announcement and analysis process if a column separation is detected; and
  • Utilizing some SCADA[4] screens to display the high consequence areas or critical locations along the pipeline route, so that operators are able to pay particular attention to them in the event of a rupture or a leak.

Pipeline Integrity Management Program

Pipeline companies under the Board’s regulation are required to incorporate integrity management programs into their day-to-day operations. These programs include the tools, technologies and actions needed to ensure that pipelines are safe and remain that way over time. Integrity management programs help pipeline companies predict and prevent failures before they happen.

Following the Control Room inspection of 8 and 9 August 2012, the Board is satisfied with the incremental improvements and initiatives Enbridge has made to its integrity management program, both prior to and after the Marshall incident. These improvements are reflected in changes made to Enbridge’s organizational structure, setting performance goals, increasing condition monitoring and associated spending, and various integrity verification processes.

Enbridge has already completed some improvements, such as sharing information amongst its asset management teams to better understand how integrity and operating conditions can impact safety and reliability. Other improvements, such as seeking to improve in-line inspection (ILI) performance with industry participants and vendors, will be an ongoing endeavour. Additional improvements, such as assessing the condition of individual pipelines based on a holistic approach to multiple integrity threats, are still being implemented.

The Board will conduct further verification activities to confirm that Enbridge’s improvements are being proactively implemented in an expedient manner on a system-wide basis. The Board will also verify whether these improvements were being periodically reviewed by Enbridge to assess their effectiveness.

As further verification of the implementation of these various initiatives is required, the Board has ordered Enbridge to file a table that clearly identifies all the integrity management system and program changes undertaken since July 2010. In this table, Enbridge must describe how each change will lead to improvements in safety and integrity, identify the performance metrics, and indicate the current stage of completion for each improvement. If not yet fully implemented, Enbridge must provide the expected date(s) of full implementation.

The Board has also ordered Enbridge to file its management review of its Pipeline Integrity Management Program with the Board. This review must demonstrate senior management’s leadership and engagement in assessing opportunities for improvement, and assess the need for changes to the Program in order to achieve its objectives.

Emergency Management Program

The Board requires pipeline companies to anticipate, prevent, manage and mitigate potentially dangerous conditions associated with their facilities. As part of this requirement, each regulated company must provide up-to-date emergency response plans for the Board’s review and which outline the company emergency management procedures to be followed during an incident. The procedures must address emergency management, worker and public safety, and environmental protection. In addition, companies are required to develop a training program and conduct exercises to verify their capabilities in responding to incidents.

As a result of the control room inspections conducted in August and September 2012, the NEB has confirmed Enbridge’s intent and commitment to improve its emergency response and public awareness programs. Enbridge has begun taking actions to redevelop its Emergency Management Program as a result of the Marshall incident. This includes a third-party assessment of its emergency response capability, state of readiness to respond to an emergency, and its ability to successfully contain potential spills. Actions being implemented as a result of the capability assessment, completed in December 2012, will not be in place until a review of the findings is conducted and corrective actions are determined by Enbridge.

During the Board’s inspections, no non-compliances were identified related to Enbridge’s emergency management program. The Board notes that Enbridge Control Center Operations staff are trained in emergency management procedures and participate in emergency management exercises. Many of Enbridge’s completion targets are set for 2013. As a result, the Board will continue to monitor and evaluate the adequacy of Enbridge’s improvements related to its emergency response program until they are fully implemented. An assessment of the adequacy and implementation of Enbridge’s revised emergency response program will occur during Board compliance verification activities planned for 2013, including an assessment of Enbridge’s emergency response exercises.

The Board has ordered Enbridge to notify the Board at least 60 days prior to conducting an emergency response exercise in 2013-2014. In the notification, Enbridge must describe the exercise scenario, the participants to be invited, and the elements of the company’s emergency response program to be tested, along with the date, time and location of the exercise.

The Board has also ordered Enbridge to file with the Board, in accordance with Section 32 of the OPR-99, any reference material that will be used by Enbridge’s staff during an emergency response. This includes any guidebooks that may be used that are not otherwise found in Enbridge’s Emergency Procedures Manual (Book 7). This also includes any on-call procedures that may be used to initiate an emergency response that are not found in Book 7.

Management System Processes

Management systems set out policies, processes and procedures for the planning and execution of an organization’s core business to manage the safety of people and protection of the environment throughout the lifecycle of a pipeline system. The Board expects a pipeline company’s approach to operations to be systematic, comprehensive and proactive in managing risks. This approach should be integrated into a company’s overall management system. The safety component of the management system should articulate the organization’s commitment and approach to safe operations throughout all aspects of its business.

The Board found that a number of management system shortcomings contributed to the ineffective response by control room staff to the Marshall incident. The use of an unapproved, draft procedure indicated weaknesses in Enbridge’s document management process. Also, the control room’s organizational structure, roles and responsibilities, and lines of authority for decision-making were unclear. There was also evidence of insufficient training related to various positions within the control room at the time of the Marshall Incident.

Since the Marshall Incident, Enbridge has placed significant emphasis on organizational restructuring, new control room infrastructure, procedures, training, and communication with stakeholders. During the inspection activities in the fall of 2012, the Board noted that Enbridge has moved to an integrated management system (EIMS) to provide cohesion and standardization to 14 management systems. Enbridge has subsequently informed the Board that they have added two management systems within the EIMS for a total of 16. Although the EIMS is still being implemented, its content is consistent with NEB expectations for an effective management system.

The Enbridge Pipeline Integrity Group has been restructured to include a Vice President of Integrity, an integrity reliability section, and a Quality Management System position. The Integrity Management Program (IMP) also now includes a continual improvement review step. The Board expects that the review step will include senior management involvement and feedback to the CEO. Alignment of the IMP with other programs should be as much of a priority as aligning the IMP with the EIMS.

Enbridge also advised the Board that it is currently incorporating processes identified in the NEB Proposed Regulatory Change on Management Systems to create a Pipeline Control Management System (PCMS). The PCMS has the potential to provide long-term stability and continual improvement for the Control Center. Once the PCMS is fully implemented, the NEB will evaluate its integration with Enbridge’s Control Room Management Plan in a future compliance activity.

The Board finds there are no immediate areas of concern with regards to Enbridge’s management system. In order to promote continual improvement, Enbridge should review the observations and conclusions made by the Board in this report regarding management systems and incorporate those findings into its own internal processes and programs that relate to management systems. The Board will continue to monitor Enbridge’s progress in these areas until it is satisfied that the changes are fully implemented.

Safety Culture

The NEB requires its regulated companies to promote a positive safety culture in order to effectively manage threats to safety. Overall, safety management is made up of several different strategies and activities designed to eliminate or reduce risk to the public, workers, the environment and assets. Safety culture initiatives identify and manage cultural influences that have the ability to either support or detract from this outcome. An effective safety culture also includes but is not limited to: 

  • leadership commitment and adequate resourcing;
  • effective communication between employees and management about potential hazards in the workplace;
  • employee involvement in safety-related activities; and
  • processes and procedures to ensure continual improvement and learning from previous occurrences.

The Board expects safety culture programs within its regulated companies to apply to both worker health and safety, and process safety. Process safety focusses on preventing catastrophic incidents associated with the use of chemicals and petroleum products.

As part of its inspection and assessment, the NEB sought to obtain information regarding the current culture of safety of Enbridge, with specific focus on the Control Center Operations. To gather information, the NEB conducted meetings with Enbridge management and staff, and reviewed documents related to Enbridge’s internal safety perception surveys and related follow-up action items.

Several safety-related gap analyses, workshops, and work plans were completed by Enbridge following the Marshall incident. In several instances, action items have been or are in the process of being implemented. Enbridge’s leadership is also undertaking efforts to improve its culture of safety, including the creation of a director-level position directly responsible for safety culture. This level of commitment is a critical part of any safety culture advancement. The senior managers, managers, and staff that met with the NEB during the August inspections consistently demonstrated a high level of commitment to operational safety over other competing pressures, such as production.

Employee safety culture perception surveys focussing on leadership, structure, processes and actions, have been conducted and the results have informed future action plans. These surveys are designed to measure employee perception of several indicators, which may be related to safety culture. They may also identify gaps in perception across levels of personnel (i.e., senior managers and frontline staff). While these perception surveys can be useful, they may not provide accurate intelligence about system, process, or cultural deficiencies.

While the Board notes Enbridge is still at the early stages of implementation, it is encouraged by the initiatives taken by the company in the area of safety culture. The Board’s review of documentation including presentations and safety action plans, found that Enbridge did not always interpret the term “safety culture” to include process safety outcomes. Process safety management has already received some heightened attention in the Liquid Pipelines Group, however the Board found that its relationship to safety culture may not be consistently understood or applied across all departments in the business unit.

The Board has ordered Enbridge to conduct a safety culture assessment based on a validated tool designed for that purpose.

Conclusions

The Board expects regulated companies to promote a positive safety culture as part of their management systems. As a part of this, companies must demonstrate a proactive commitment to continual improvement in safety, security, and environmental protection.

Over the course of the Board’s August and September inspections, the Board did not identify any non-compliances with its regulations that would pose an immediate hazard to public safety or the environment. The Board notes the role of human factors in the sequence of events in the Enbridge control room on 25 and 26 July 2010.

Since the Marshall incident, Enbridge initiated a broad range of actions to improve the operation of its control room. Some of these have come as a direct result of Enbridge’s and the NTSB’s investigations into the Marshall incident, while the initiation of other improvements preceded the rupture. Enbridge is in the midst of implementing all of its corrective actions, with full implementation of most changes expected in 2013. When these improvements have been implemented, the Board will assess their effectiveness.

This compliance activity was not an audit, and while many programs were reviewed, an assessment of each element of Enbridge’s management system was not conducted. As a result, and in order to evaluate the effectiveness of Enbridge’s plans, the Board is also ordering Enbridge to undertake a third-party audit to fully examine the company’s management system, any human factors associated with control room operation, and the safety culture of the organization as a whole. The NEB will set the parameters of the audit and the third-party auditor will report directly and be fully accountable to the Board.

Enbridge Announced Improvements and Initiatives Since the Marshall Incident
Enbridge Announced
Improvements and Initiatives
Since the Marshall Incident
Information Obtained by NEB, 8 - 9 August and 12 September 2012

Leak Detection

1. Enbridge established the Pipeline Control Systems and Leak Detection department, doubling the number of employees and contractors dedicated to leak detection and pipeline control.

The Pipeline Control Systems and Leak Detection (PCSLD) department is now under a single director, to whom the Pipeline Control System manager and Leak Detection manager report. The new organization elevates the importance of leak detection capabilities and creates a single point of accountability in relation to pipeline control system capabilities and leak detection. Additional control centre staff have been hired and trained in their respective subjects, using the new draft control room management procedures.

Significant improvements have been made by Enbridge in organization structure, procedures, training, infrastructure upgrades, infrastructure, information management support and system effectiveness. Enbridge has implemented a Quality Management System for leak detection activities to meet the leak detection program’s objectives. This is also intended to provide better information for annual management review.

2. Enbridge enhanced procedures for leak detection analysis.

Enbridge has implemented a new leak detection escalation process, shift change transitions, analysis and communication procedures, as well as a quality management system to ensure that critical work activities meet pre-defined quality objectives. Enbridge revised its leak detection escalation process so that any confirmed column separation is treated as a leak trigger. When the number of leak triggers reaches three (3), the control room operator is required to shut down the pipeline. Enbridge’s leak detection analysis training program has been improved through on-the-job and additional simulator-based training. The improved training program includes common root causes of MBS alarms, a staff readiness assessment, and improved communications with Control Centre Operations (CCO) personnel. Some of these revised procedures had not yet received management approval.

In addition, Enbridge’s Leak Detection Department is developing tools using advanced computer systems to help its control room operations staff reliably analyze abnormal operating conditions such as column separation and potential leaks.

The Mass Balance System (MBS) is computer program that estimates the pipeline imbalance using pressures and flow rates. It estimates the sectional imbalance using the measured flow rates and calculated line pack changes in a section of the pipeline using the pipeline pressure and liquid properties. The line pack calculations are based on a transient modeling technique using pressure and commodity movement data received from the host SCADA on a real-time basis.

An MBS analyst is required because the MBS system is very complex, requires extensive training, and the operators are already busy performing other operational tasks. The real-time data and model results can be displayed in various formats; distance plots, time plots and tabular (reports) format as well as custom displays. An MBS analyst can access multiple displays, including but not limited to:

  • Pressure/flow profile plot - the operators can also access these profiles;
  • Section imbalance trend plots;
  • Flow trend plot;
  • Pressure trend plot; and
  • Pump station suction and discharge pressure trend plot.

When an operator reports an MBS alarm, the MBS analyst first accesses multiple data and information sources during comprehensive analysis following detailed documented procedures. The analyst has to finish assessing the alarm within 10 minutes in order to satisfy the 10-minute pipeline shut-down rule. The analyst checks the imbalance plot of the suspected section, and then reviews the flow trend plot to determine the start time of the imbalance. Subsequently, the analyst checks the pressure and station pressure trends, among other displays, to determine if the alarm is valid.

Enbridge’s leak statistics indicated that the number of false alarms for Line 2 are much larger than that for Line 4, even though both lines transport similar crudes and their pipeline configurations are similar, with the exception of the drag reducing agent (DRA) operation in Line 2. Enbridge indicated that the false alarm rate has dropped since July 2012, with the improved hydraulic calculations using a new DRA correlation.

A leak within a pump station can be detected by looking at disparity alarms caused by sudden pressure drops, throttling change, and/or change in control. Two suction and discharge pressure transmitters are installed at all mainline pump stations and holding pressure points:  Each of the suction and discharge pressure transmitters are installed closer to the pipeline side, and another set of suction and discharge pressure transmitters are also installed closer to the pump units. The two main purposes of such a setup are to make the station pressures available at all times and to detect potential abnormal conditions, such as leaks within the pump stations.

The Board observed that the above plots are displayed separately and reviewed sequentially. If the four trend plots are displayed on one large screen, the review process could be faster and the relationships between trend plots could be analyzed more accurately.

3. Enbridge implemented a Leak Detection Instrumentation Improvement Program to add and upgrade instrumentation across its system.

Enbridge has established a leak detection equipment design standard to ensure that leak detection performance standards are met. The equipment standard specifies flow, pressure and temperature measurements in terms of meter types and installation locations. Assessments for instrumentation additions and upgrades have been completed to improve the performance of the leak detection system. For example, flow and pressure measurement devices have been classified as critical, and therefore flow measurement will be installed at every pump station. Two redundant pressure transmitters are already installed at most pump stations. The leak detection maintenance management program has also been internally reviewed and improved.

In addition, Enbridge has made several improvements to its MBS. Enbridge is implementing dynamic alarm thresholds to reduce false alarms during transient conditions and to improve leak sensitivity during steady state conditions. Enbridge’s Leak Detection Department has developed system effectiveness metrics, which include improvements to leak detection systems as a scorecard, applications of API 1130 testing and API 1149 leak sensitivity analysis. The API 1130 testing program covers on-going simulated and/or actual fluid withdrawal tests.

Enbridge has initiated several projects to assess if further improvements to leak detection performance can be achieved through new technologies such as acoustic wave and in-line technology.

Pipeline Control and CCO

4. Enbridge developed a Control Room Management plan (CRM Plan) based on the U.S. Code of Federal Regulations and implemented a number of the sections 1 October 2011, with remaining sections implemented by 1 August 2012.

The US Pipeline Hazardous Material Safety Administration (PHMSA) audited Enbridge’s control room management in December 2011 and January 2012. Enbridge stated that it has enhanced the CCO CRM Plan and associated processes. The CRM plan clearly defines roles and responsibilities of the pipeline operator, shift supervisor, senior technical advisor, leak detection analyst and technical support staff during normal, abnormal and emergency operations. Also, the CRM plan defines the actions that these control room staff are prohibited from taking. PHMSA issued a Notification of Amendment (NOA) on July 06, 2012. Enbridge submitted its response addressing the issues identified by PHMSA on August 08, 2012.

The CCO CRM Plan was written to meet the US regulator’s requirements. It has some basic management system elements, but is not a complete management system.

Enbridge advised the Board that it is currently incorporating processes identified in the NEB Proposed Regulatory Change on Management Systems (PRC-2011-01) to create a Pipeline Control Management System (PCMS) program. The PCMS has all expected management system elements identified and linked to Enbridge’s Integrated Management System. However, the program development is in progress with a completion targeted for the end of 2012.

5. Enbridge revised and enhanced all procedures pertaining to decision-making, handling pipeline startups and shutdowns, leak detection system alarms, communication protocols, and suspected column separations. 

Enbridge has reviewed its existing CCO procedures and identified issues and opportunities, conducted benchmarking and best practices research, and revised or otherwise developed procedures in response.

The outgoing operators are required to fill out a new shift change form, and the form should be signed by both the outgoing and incoming operators. A review of random samples of the shift change logs revealed the following:

  • The time for shift changes range from 5 minutes to 31 minutes, depending on the number of operational changes in the pipeline.
  • All forms that were reviewed were signed off by the outgoing and incoming operators.

Most operators reviewed the documentation and checked it off, but some did not. The supervisor did not seem to realize that some of the documentation was not checked off, so it was not clear if the operator did not review the documentation or whether they had reviewed it but forgot to check it off. The Board will further assess the implementation effectiveness of shift change procedures.

Enbridge complies with the following standards with respect to Pipeline Control, Leak Detection, and Control Room Management:

  • American Petroleum Institute Recommended Procedure (API RP) 775 Fatigue Risk Management Systems for Personnel in the Refining and Petrochemical Industries:  This standard provides guidance to employers, employees, and medical professionals to help them better manage workplace fatigue.
  • API RP 1165 Displays: This standard focuses on the design and implementation of displays used for the monitoring and control of information on SCADA. The Enbridge existing SCADA screen displays did not consistently use color as specified in API 1165 to provide information to the controller. Should the SCADA system be expanded or replaced or another SCADA system added, Enbridge stated they would then implement the API RP 1165 requirements.
  • API RP 1167 Pipeline SCADA Alarm Management: This standard provides guidance on industry practices that include alarm definition and determination, alarm philosophy, alarm functionality and design, alarm handling, alarm documentation, alarm audit and performance monitoring, roles and responsibilities, and management of change. Enbridge has its own alarm management plan. Some API 1167 requirements are consistent with those of Enbridge, while some are not. However, PHMSA’s Notice of Amendment did not explicitly require Enbridge to make its plan fully compliant with this standard.
  • API RP 1168 Pipeline Control Room Management: This standard addresses pipeline control room personnel roles, guidelines for shift turnover, pipeline control room fatigue management, and pipeline control room management (CRM) of change. Change management describes Enbridge’s liquid pipelines management of change process, major projects, CCO management of change process, CCO standards and procedures quality management system, operations and maintenance procedures quality management system, field work request and approval system, and SCADA change analysis report. Enbridge’s new CRM Plan complies with API 1168, except for a few clauses in Section 7.3 and 7.4 which are currently being implemented.
  • API 1130 Computational Pipeline Monitoring for Liquids:  This standard addresses the design, implementation, testing and operation of Computational Pipeline Monitoring (CPM) systems. It is intended as a reference for pipeline operating companies and other service companies. Enbridge fully complies with this standard.
  • API 1149 Pipeline Variable Uncertainties and Their Effects on Leak Detectability:  This standard describes a method of estimating a minimum detectable leak size theoretically using physical parameters of the pipeline. Enbridge uses this standard for benchmarking its future leak detection system.
  • CSA Z662 Annex E Recommended Practice for Liquid Hydrocarbon Pipeline System Leak Detection:  This is Annex E of CSA Z662-11, Oil and Gas Pipeline Systems: 6th Edition, a Canadian standard that provides comprehensive standards for the design, operation and maintenance of oil and gas pipeline systems. Annex E describes recommended practices for liquid hydrocarbon leak detection. Enbridge complies with both API 1130 and CSA Z662 Annex E.

6. Enbridge enhanced the organizational structures to better support its operators and to manage span of control and workloads.

Pipeline Control is now a department of its own, instead of a group in a department, in order to align it with the operating function. A vice president is responsible for the department. The Pipeline Control Department covers both the Control Centre Operations and Pipeline Control Systems & Leak detection.

7. Enbridge augmented Control Centre Operations staff, adding training, technical support, engineering and operator positions.

In addition to the CCO base training and operator qualification program, control centre staff have received enhanced training in pipeline hydraulics and abnormal operating conditions, including column separation, the MBS and related procedures, the 10-minute rule for pipeline shutdown and compliance with the procedures, roles and responsibilities, enhanced emergency response and other subjects.

As part of its new organizational structure, the roles and responsibilities of the CCO personnel are as follows:

  • Pipeline Operator - qualified to perform monitoring and controlling liquid pipeline pressures and/or flows, monitoring the leak detection system, operation of remote pumps and operation of remote valves.
  • Terminal Operator - qualified for monitoring and controlling liquid terminal pressures and/or flows, monitoring tank levels, operation of remote pumps, and operation of remote valves.
  • Leak Detection Analyst - qualified to analyze an MBS alarm and determine if it is valid. This position was previously called the “MBS Analyst”.
  • Senior Technical Advisor - technically qualified to assess normal and abnormal operating conditions. This position was newly created to help the Shift Supervisor on technical and other matters.
  • Shift Supervisor - this position was previously called “Shift Lead”, but now the Shift Supervisor does not have any technical roles or responsibilities. The roles and responsibilities of the Shift Lead have been reallocated between the Shift supervisor and the Senior Technical Advisor.
  • Technical Support Staff - individuals including CCO Technical Services Coordinators and Advisors, CCO Projects Specialists, Coordinators and Advisors. Under the new roles, these positions should not be directly involved in operations.

On each shift, one shift supervisor and one senior technical advisor are assigned as a pair to each of pipeline operation and terminal operation. The pipeline operator and terminal operator share certain data such as pump order, but the pipeline operator does not have the authority to control terminals and the terminal operator does not have the authority to control the pipeline.

Before the Marshall incident, staff’s roles and responsibilities in the CCO were not well-defined. Now, they are documented in the CRM Plan, and all staff must be trained and aware of them. Staff members were involved in developing the new roles and responsibilities as well as the revised procedures. During the inspection, Enbridge operations staff commented that their roles and responsibilities are now more specific and clear and that formalizing procedures and clarifying roles/responsibilities help them operate the pipeline more effectively.

New staff must complete five (5) phases of training, each of which consists of multiple module training sessions. The modes of training include classroom training, a written module-based self-training, simulator-based training, and on-the-job training. The training simulations are realistic. For example, pump station and unit simulation training includes the PLC logic and pump curves in order to simulate the station operation realistically. From Phase 2 training and onward, each trainee begins to work with a mentor on a live pipeline system. The terminal operators receive different console training than the pipeline operators.

Since the Marshall incident, the training curricula has been enhanced, particularly in the area of abnormal operating conditions. Pipeline rupture scenarios related specifically to pipeline shutdowns were not part of standard training previously, but now they are included in the standard training curricula.

Trainees have to undertake a written examination at the completion of each module, and their proficiency and competency are evaluated at the completion of each phase. The trainees in Phase 5 are expected to take both written and oral tests. At a minimum, the operators are required to be re-certified in every three years.

To promote communication, cross-training is also provided for those who work together. One example is the operator and senior technical advisor. The cross-training can be on an individual or team basis. The operators are cross-trained on up to three (3) consoles. Since the Marshall incident, the staff work load has been measured and rebalanced.

8. Prior to the incident, Enbridge had embarked on the design and construction of a new Control Centre in Edmonton, Alberta.  The new Centre was opened in December 2011 and enhances the work environment for its operators and allows greater interaction and support for 24x7 hour operations.

Special features of the control centre include noise suppression, indirect lighting that changes the brightness according to the circadian cycle, and adjustable consoles to allow for both sitting and standing positions. A working group was implemented to improve fatigue management for the control centre staff. To manage fatigue, particularly from 2:00am to 6:00am, gym and exercise facilities are made available. A kitchen facility is also stocked with food. In addition, first aid kits and fire extinguishers were visible at several locations.

The consoles used by the operators are situated on the right and left hand sides of the center row. The pipeline operator consoles and terminal operator consoles are arranged side by side for clear communication via sharing certain common information such as pump orders. The senior technical advisors work in the center row, in order to be easily accessed by the operators. The shift supervisors, leak detection analysts, CCO engineers, and other support staff are situated on the outer sides of the control center. The offices of both the pipeline and terminal control centre managers are located adjacent to the operator consoles.

The operators usually operate two pipeline systems. In order to minimize the impact of a power outage, two geographically-separated pipelines are paired for one operator. Enbridge has also added operators in order to balance the workload.

Pipeline and Facility Integrity Management

9. Enbridge heightened the importance and goal of its pipeline and facility integration program.

Enbridge’s stated goal is “zero failures and leaks”. An objective of this goal is to prevent leaks and if an incident occurs it is to be detected and responded to quickly. A set of lagging and leading performance measures were provided by Enbridge to support this objective.

Enbridge has shared information amongst its asset management teams to better understand how integrity and operating conditions can impact safety and reliability. Other improvements, such as seeking to improve in-line inspection (ILI) performance with industry participants and vendors, will be an ongoing endeavor. Additional improvements, such as assessing the condition of individual pipelines based on a holistic approach to multiple integrity threats, are still being implemented.

10. Enbridge reorganized the functional areas that are responsible for pipeline and facility integrity.

The Pipeline Integrity Group has been restructured to establish a Vice-President of Integrity, an Integrity Reliability Section where the focus is on continuous improvement, and a Quality Management Program position under the Integrity Services Manager.

11. Enbridge increased pipeline integrity management spending from $150m to over $450 m in each of 2011 and 2012 and has performed more than 175 ILIs and nearly 3000 pipeline excavations during that time.

NEB Order SO-E101-04-2010 has resulted in Enbridge improving its ILI crack detection technology. As a result of the Marshall incident, a revised integrity management hazard assessment has led to reduced intervals for pipeline inspections by Enbridge. A substantial increase in inspections has occurred, and a five-fold increase in spending has occurred in Canada over the past 2 years.

12. Enbridge placed a renewed emphasis on the safety of its overall system.

The Integrity Management System Framework is relatively complete, but the inspection could not verify all relevant details. Enbridge committed to align its Integrity Management System Framework with the Enbridge Integrated Management System, which is the newly developed management system that will integrate all of Enbridge’s other management systems.

Public Awareness

13. Enbridge reviewed and strengthened Public Awareness Programs across operational areas in both the U.S and Canada.

Enbridge has created permanent roles to fulfill public awareness needs. Enbridge has developed a Public Awareness Committee to share best practices with their US counterparts. A database has been developed to track stakeholder meetings and events. Enbridge’s Landowner Information Database (LOID) has been expanded and updated.

New awareness documents are being distributed to landowners. For example, brochures and screening tools to provide guidance regarding crossings with large equipment have been provided. Surveys have been conducted with landowners to determine their knowledge of the pipeline in their area, their awareness of actions to be taken during an emergency, and the emergency number to be used. Enbridge has also updated their web site to include important emergency and safety information as well as damage prevention information.

Enbridge expects to develop information packages for excavators regarding safe digging practices and “Call Before You Dig” messages in addition to its current ongoing safety meetings in 2013.

14. Enbridge is developing a new online and in-person training tool to provide Enbridge-specific information to emergency responders.

In the U.S, Enbridge:

  • Formalized the U.S. Public Awareness Committee.
  • Improved the Program Effectiveness Evaluation process.
  • Provided annual employee training for field employees across the company’s U.S. operations.
  • Created a Public Awareness Hotline.

In Canada, Enbridge:

  • Formalized the Canadian Public Awareness Committee.
  • Are creating a Canadian Public Awareness Database.
  • Improved the landowner/tenant database.
  • Developed a landowner newsletter.
  • Established Community Relations positions in each region.

Enbridge has surveyed first responders in Canada and the US to improve training. New publications have been developed and distributed to emergency responders. Enbridge is also in the process of developing various formats of training to be provided to first responders. Training methods include interactive on-line training and in-person training. Training will be implemented in the US in late 2012 and in Canada by early 2013. Enbridge is also providing funding to various local emergency responders for training activities and equipment purchases.

Enbridge has begun structuring a First Responder Awareness Training Program. Enbridge’s Training and Emergency Response department will coordinate with the Public Affairs department to develop the program. The focus will be on content and delivery of training, such as on-line training modules. The current tactical response training that is being delivered across all regions is also under review. Upon assessment, a consistent tactical training plan will be implemented across all regions. Tactical training includes notification, ice slotting, boat handling, HAZWOPER, inland oil spill response and boom deployment.

Emergency Response

15. An incremental $50 million will be spent between 2012 and 2013 (projected) to improve equipment, training and overall response capabilities.

Enbridge is currently recruiting Emergency Response Coordinators for its geographical areas. Enbridge expects to have these positions filled in 2013.

Enbridge has determined that additional/enhanced emergency response training is needed to ensure a state of readiness to respond. Enbridge staff has already begun training in various areas that support emergency response. Enbridge has committed to training staff that are expected to respond to emergencies with appropriate and adequate Incident Command Systems (ICS) training. At a minimum, all response staff will have ICS 100/200 training, followed by ICS 300 training. Currently, more than 600 Enbridge staff have ICS 100/200 training and more than 200 have additional ICS 300 training. Future training will be enhanced with additional role-specific training, ICS 320 and Incident Action Plan (IAP) software training. Other training available for response staff is Exercise Design and Environmental Unit Lead Training.

Enbridge has developed an initiative to create job aids that will assist and support staff during an emergency response. These include:

  • The Incident Management Handbook, which has been completed;
  • The Exercise Design Guide, which is currently in draft form;
  • The Tactical Response Guide, which is currently under development; and
  • The ICS Role Specific Guides, which will be distributed as part of the specific role training.

IAP software has been purchased from The Response Group (TRG) to assist in the management of incident response. The software has real-time information capability and supports Enbridge’s emergency response plan specifics. The IAP software supports the ICS. In the event that the software or internet access needed to use the software is unavailable, “go kits” with hard copies are available for deployment.

Through a consultation process with emergency responders and others, Enbridge has re-evaluated its emergency response equipment needs. Enbridge plans to purchase additional emergency response equipment across the system. The equipment will be compatible across all regions to ensure continuity. This will also ensure that staff who respond to emergencies are familiar with response equipment. Enbridge filed its updated Emergency Procedures manual (Book 7) with the Board at end of November 2012.

Enbridge’s Operating and Maintenance Procedures (“OMPs”) contain most elements expected in a Management System. Enbridge has engaged an independent third party to conduct a review of the OMPs and to assist with refinements and development of all of its 16 management systems. As part of that process the adequacy and effectiveness of the emergency preparedness and response capabilities will be conducted as part of the Emergency Readiness and Response System.

NEB-defined performance measures will be employed as part of Enbridge’s OMPs.

16. Enbridge will develop better tools and techniques for worst case waterborne spills.

Enbridge contracted TRG to conduct a third party capability assessment to determine Enbridge’s emergency response capability, state of readiness to respond to an emergency, and the ability to successfully contain potential spills. Further assessment will be focused on areas of greatest consequence. The review is expected to be completed by the end of 2012. Various methods are being used to conduct the assessment, such as phone interviews and face to face interviews with staff. The results of the assessment will be used to identify areas for improvement, which will then be addressed through corrective action plans.

17. In 2011, a cross-business unit response team was created for large-scale events requiring more resources than a single region could provide.

Enbridge has developed an Emergency Response Advisory Team (ERAT). The focus of this group is to share information on responses, training, exercises and lessons learned regarding emergency response in each region. The team consists of members across Enbridge in Canada and the United States. Enbridge’s goal is to have a monthly call-in meeting and to meet face-to-face each quarter.

Enbridge has developed an Enterprise Emergency Response Team (E3RT). The focus of this team is to receive role-specific training that can be applied to worst-case scenario events. The objective of the E3RT is to be able to respond cohesively across the Enbridge enterprise. This will enhance additional support during an emergency beyond regional boundaries. Members of the team have a minimum of ICS 300 training. A minimum of three Enbridge employees have been trained to fulfill critical roles. This will ensure adequate resources are available in worst-case scenario events.

18. Enbridge will be conducting an Emergency Response preparedness assessment to enhance abilities to more rapidly respond and contain a significant release.

Enbridge’s third party capability assessment is scheduled to be completed by the end of 2012. Actions being implemented as a result of the capability assessment will not be in place until a review of the findings are conducted and corrective actions are determined.

Safety Culture

19. Enbridge reinforced a high level of safety and operational integrity across integrity management, third-party damage avoidance and detection, leak detection, incident response capacity, worker and contractor occupational safety, public safety and environmental protection.

All personnel and leadership representatives who met with the Board demonstrated a high level of commitment to operational safety over other competing pressures, such as production. Leadership commitment is a critical element to a robust safety culture.

A new position, Director, Safety Culture, has been created and staffed, which indicates an awareness of the importance to advance this safety area. The position is based in the US and has responsibility for all of North America. There are no additional resources (departmental team members) dedicated to support the initiative. Deficiencies noted during this review suggest that the organization would benefit from greater collaboration and oversight being provided by more than a single subject matter expert/advocate.

Process safety management is receiving heightened attention in the Liquid Pipelines Group. The relationship of process safety management to safety culture has not been applied consistently across all departments in the business unit. For example, the project charter for the Control Center Safety Culture Improvement Team states that its purpose is to seek an injury and incident-free workplace, with its scope defined as focusing on “safety and health of CCO and field employees engaged in operations of pipeline”.

Enbridge has contracted DuPont to conduct internal safety culture perception surveys designed to measure employee perception of several indicators, which may be related to safety culture (as defined by DuPont). It is important to note that these surveys identify gaps in perception across levels of personnel (i.e., senior managers and frontline staff) and may or may not provide accurate intelligence about actual system, process, or cultural deficiencies.

Several areas requiring improvement were noted when compared to other high performing company scores (identified by DuPont and based upon occupational health and safety performance such as injury frequency rates and other onsite assessments not detailed in the documents provided). However, it should again be noted that these comparisons may or may not be meaningful based on the selection criteria used by DuPont. Action items were identified for each department based on the results of the survey. Implementation plans have been developed for these action items and in many cases, implementation is well underway. The next perception survey is scheduled for 2013 in order to assess any changes post-implementation.

20. Enbridge implemented “Lifesaving Rules” and training for all employees and contractors. The Lifesaving Rules are designed to highlight key processes and rules that, if not followed, could put people’s lives at risk. They have been implemented enterprise-wide.

Documents, action plans, and presentations related to safety culture at Enbridge do not portray a consistent interpretation and application of the term “safety culture”. In many instances, it appears to be viewed in the context of occupational health and safety only. In others cases, it is noted as also including process safety management and contractor safety management. Organizational safety culture initiatives based on hazards and risks associated with Enbridge’s activities would be more effective if they considered  process safety management implications across all departments, job functions and regions.

21. Enbridge introduced new Safety Culture training sessions for all employees. 

Several initiatives had been aimed at improving safety leadership. Following completion of the perception surveys, a Leadership Forum was held for senior managers in which the survey results were communicated and explained. Safety Leadership training has also been provided to all managers, and supervisors are in the process of attending scheduled sessions. This course is designed to help leaders demonstrate their commitment to safety in a better manner. A Safety Culture course has also been provided to operational managers.

22. Enbridge renewed its focus on risk assessment and research and development.

As described in prior sections, Enbridge has increased its investment in the exploration of new technologies and methodologies in integrity management, emergency response and safety culture.

Endnotes

[1] Canadian Standards Association, CSA-Z662, as amended.

[2] Human factors refer to people’s physical and cognitive abilities, characteristics and limitations relative to the design of the equipment that they use, the environment in which they work, and the function that they perform.

[3] Column separation may occur in a pipeline when the product in the pipeline moves from a liquid to a gaseous state during a rapid pressure drop in the pipeline.

[4] Supervisory Controls and Data Acquisition (SCADA) are computer controlled systems that monitor and control industrial processes including pipeline operation.

Date modified: