ARCHIVED - TransCanada Pipelines Limited - TransCanada Pipelines Limited - Audit Report OF-Surv-OpAud-T211-2012-2013 01 - Appendix II - Integrity Management Program Audit Assessment

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Appendix II

TransCanada Pipelines Limited and NEB-regulated Subsidiaries (TransCanada)

Integrity Management Program Audit Assessment

Introduction
Audit Objectives and Scope
1.0 Policy and Commitment
- 1.1 Policy and Commitment Statements
2.0 Planning
3.0 Implementation
4.0 Checking and Correction Action
5.0 Management Review
- 5.1 Management Review
- Endnotes

Introduction:

TransCanada has three Integrity Management Programs (IMPs), which are:

Canadian Gas Pipeline Integrity Management Program (CND-GAS-IMP);
Canadian Liquid Integrity Management Program (CDN-LIQ-IMP); and
Plant Integrity Management Program (Plant IMP).

These IMPs are referred to throughout this Audit Evaluation Table as the Gas Pipeline IMP, Liquid Pipeline IMP, and Plant IMP, respectively.

The TransCanada subsidiaries included in this audit included specifically:

TransCanada PipeLines Limited;
TransCanada Keystone Pipeline GP Ltd.;
Trans Québec & Maritimes Pipeline Inc.;
Foothills Pipe Lines Ltd.; and
NOVA Gas Transmission Ltd.

Audit Objectives and Scope:

The scope of the audit included an assessment of whether TransCanada was fulfilling the requirements of:

the NEB Act;
the OPR-99;
CSA Z662-11, Oil and Gas Pipeline Systems; and
TransCanada’s policies, practices and procedures.

More specifically, the audit examined nine sub-elements of the NEB management system requirements as they relate to TransCanada’s integrity management programs. These sub-elements were selected using the Board’s risk-informed approach to focus the scope of the audit on areas that have previously been shown to have the highest rates of non-compliance among NEB-regulated companies and to expedite and focus the assessment of the IMP technical programs in light of the allegations.

1.0 Policy and Commitment

1.1 Policy and Commitment Statements

Expectations:

The Company shall have a policy approved and endorsed by senior management (the Policy). It should include goals and objectives and commit to improving the performance of the Company.

References:

OPR-99 section 4

CSA Z662-11, Clauses 3.1.2 and 3.2

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

2.0 Planning

2.1 Hazard Identification, Risk Assessment and Control^[1]

Expectations:

The company shall be able to demonstrate a procedure to identify all possible hazards. The company shall assess the degree of risk associated with these hazards. The company should be able to support the rationale for including or excluding possible risks in regard to its environment, safety, integrity, crossings and awareness and emergency management and protection programs (management and protection programs). The company shall be able to implement control measures to minimize or eliminate the risk.

References:

OPR-99 sections 4(2), 39, 40 and 41

CSA Z662-11, Clauses 3.1.2(f), 3.2(a), 3.2(b), 10.5.1.1(d) and 16.2

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that it has developed procedures to identify threats (hazards), assess the degree of risk associated with those threats, and implement control measures to mitigate or eliminate the risk of the threats. TransCanada explained that its Engineering and Asset Reliability (E&AR) department is accountable for managing the operational performance, cost and risks of TransCanada’s pipeline and facility assets. This includes developing and implementing asset strategies and integrity management systems to manage operating and maintenance risk. Within the E&AR department, subject matter experts in the Pipe Integrity and Facilities Integrity departments are responsible for developing Integrity Management Programs (IMPs). Pipe Integrity is grouped into threat-specific teams, and Facilities Integrity is grouped into equipment-specific teams. These teams are accountable for assessing risks and developing annual maintenance and assessment work plans.

Hazard Identification Process

Processes for threat^[2] identification and risk assessment and control are documented in TransCanada’s three IMPs, which are:

Canadian Gas Pipeline Integrity Management Program (CND-GAS-IMP);
Canadian Liquid Integrity Management Program (CDN-LIQ-IMP); and
Plant Integrity Management Program (Plant IMP).

Threat Identification Process

TransCanada’s threat identification process is meant to verify conditions that may exist that would make a line segment susceptible to a threat. The determination of these conditions varies with each threat category. TransCanada considers threats according to the following:

Time Dependent
- External corrosion
- Internal corrosion
- Environmental cracking (e.g. stress corrosion cracking)
Time Independent
- Mechanical damage
- Incorrect operations
- Weather-related and outside forces
Static or Resident
- Manufacturing related defects
- Welding or fabrication related defects
- Equipment failures

TransCanada’s process for threat identification was reviewed for all threats and, except where noted for the threat to high pressure station piping in gas facilities, was assessed to be compliant with the requirements. An example of one of the threat assessments for mechanical damage (dents) is provided to illustrate TransCanada’s process.

Individual Threat Assessment: Dents

TransCanada’s dent program is managed according to TEP-ILI-DEF-CDN Analysis of Deformation In-Line Inspection (ILI) Data for CDN Pipelines (EDMS No. 006980190) and TEP-ITM-Mechanical Damage Threat Management Program (TEP-ITM-MECH, EDMS No. 006786487). TransCanada uses data from the ILI program to characterize dents in its pipeline system and TransCanada continues to develop this technology with the tool vendors. The detection and characterization of geometric anomalies undergoes further processing to develop prioritized remediation activities in specific areas, based on previous excavation reports from other programs and in areas where dents have been previously mitigated. When dents are excavated, TransCanada applies the methodologies of CSA Z662-11, ASME B31.8 and its own modified B31.8 formula to determine which remediation or mitigation techniques may be applied. TransCanada considers the threat of mechanical damage from external sources as low, due to its Public Awareness Program and the Right of Way (ROW) patrols that it conducts. Additional measures are applied to areas determined to have a threat of mechanical damage that is higher than low (e.g., population density, history of damage, increased construction activity).

Pipelines

For pipelines, TransCanada has detailed nine potential threat categories that are considered during its threat identification process (Gas Pipeline IMP, Section 9.7, and Liquid Pipeline IMP, Section 3.1.2). The threat categories also include sub-threats derived from consideration of CSA Z662-11, Annex H, Clause H.2.6 and ASME B31.8S.

TransCanada’s Threat Management Programs for the nine threat categories referred to above are as follows:

Mechanical Damage Threat Management Program (TEP-ITM-MECH, EDMS No. 006786487);
External Corrosion Threat Management Program (CDN) (TEP-ITM-ECOR, EDMS No. 006570955);
Internal Corrosion Threat Management Program (TEP-ITM-IC, EDMS No. 006786402);
Stress Corrosion Cracking Threat Management Program (TEP-ITM-SCC-CDN, EDMS No. 005767613);
Equipment Failure Threat Management Program (TEP-ITM-EQUIP, EDMS No. 006786449);
Incorrect Operations Threat Management Program (TEP-ITM-IOPS, EDMS No. 006810297);
Construction and Manufacturing Threat Management Program (TEP-ITM-MANUF, EDMS No. 006786458);
Weather and Outside Forces Threat Management Program (TEP-ITM-WOF, EDMS No. 005767611); and
Facility Pipe Threat Management Program (CDN) (TEP-ITM-FPIPE-CDN, EDMS No. 007379193).

Section 9 of the Gas Pipeline IMP specifies how each threat management program has a consistent approach whereby threat identification is one step in an overall threat management process. Pipe segments susceptible to a threat are identified and the rationale for including or excluding threats is documented within each threat management program. Risk analyses are completed and the results of the analyses are used to prioritize and plan activities to reduce or eliminate the probability of failure, the consequences of failure, or both. Selected activities for the upcoming budget cycle are captured annually in TransCanada’s Pipeline Maintenance Plan. Results obtained from the execution of the Pipeline Maintenance Plan are assessed and used as additional inputs into the next planning cycle.

Facilities

The TransCanada Facility Group is divided into several areas of expertise, which include Mechanical, Field SCADA, Civil Engineering, Design Engineering Support, Measurement Engineering, Controls, and Electrical. As per Section 2.5.5 of the Plant IMP, new construction is completed in compliance with the applicable codes, which address the associated hazards and corresponding risks. In addition, many of the potential operating hazards are identified and mitigated during the early design stage through Hazard Identification Studies (HAZID) and Hazard and Operability Studies (HAZOP) analyses. With the Project Turnover Memorandum, residual risks are identified and documented for the facility integrity group. To address ongoing reliability, applicable existing plans are used, or new integrity plans are created, to maintain the equipment functionality so that the identified hazards, associated designs and codes are managed throughout the lifecycle of the equipment.

High Pressure Station Piping in Gas Facilities

TransCanada developed a new management program in December 2012 for high pressure piping in gas facilities (e.g., meter and compressor stations, valves sites). This is documented in the Facility Pipe Threat Management Program (TEP-ITM-FPIPE-CDN, EDMS No. 007379193). Before this new program was developed, the station piping was managed under TransCanada’s Integrity Management Process for Pipelines - Revision 2 process. The new program includes a documented process for identifying the hazard and assessing the risk of high pressure station piping. The new program was assessed as adequate in terms of its content, but it has not yet been fully implemented throughout TransCanada’s facilities. TransCanada indicated in its response to an Audit Information Request that "the risk assessment and selection of mitigation plans is planned for completion in November of 2013". Given that the new program has not yet been fully implemented, TransCanada is non-compliant with the requirements of this audit sub-element and with CSA Z662-11, Clauses 3.1.2(f) and 3.2.

Risk Assessment

TransCanada has implemented its Asset Management System (AMS) to manage its operating and maintenance risk. The risk management element of the AMS outlines a requirement for Operations and Engineering to develop and maintain a risk register to capture risk events for all assets that TransCanada operates. The Asset Management System & Governance (AMS&G) team oversees the development of the register, but inputs are collected from engineering, field operations, commercial operations, corporate health and safety, and compliance departments. Risks are calculated by aligning the probability of events and the potential magnitude of consequences. The risk register is currently entered and maintained within a Microsoft Access database and is controlled by the AMS&G team during its developmental stages to maintain integrity of the data. An assessment of the establishment and implementation of the risk assessment processes follows, based on facility categorizations.

Pipelines

Risk Assessment and Management methodologies are documented in Section 10 of the Gas Pipeline IMP and Section 4 of the Liquid Pipeline IMP. As noted previously under Threat Identification, the processes used to assess risk are threat-specific, and process details are provided in the Risk Assessment and Prioritization of TransCanada’s Integrity Threat Management Programs.

TransCanada’s risk assessment and risk management are achieved using either of the following two approaches:

For pipelines where assessment or direct examination anomalies have been detected, or similar conditions are inferred, the specific anomalies are assessed, and control or mitigation activities are planned.
For pipelines where assessment data has not been collected, risk assessment is performed by integrating information from various sources, including: subject matter expertise; applied learnings from other similar segments of pipe across the TransCanada system, including historical performance; the TransCanada risk algorithm Risk Assessment Using PRIME (TEP-INT-PRIME, EDMS No. 003972569), for External Corrosion and SCC threat; and, the tracking of leading indicators, such as an elevation in communication to stakeholders in response to a spike in the frequency of unauthorized encroachments on the ROW or relevant information from industry associations.

Where assessment data is available, a pre-screening is performed to look for urgent repair conditions. This is followed by a reliability based assessment to evaluate the probability of failure and account for measurement uncertainties. The technical details of the model are included in the document Risk Models for Corrosion Using ILI Data (TER-COR-RSK, EDMS No. 005767603). With the assessment data, near-term and future remediation is planned, and priority is assigned according to population density. Additionally, ongoing safety is addressed through a temporary pressure restriction. The criteria for determining when a pressure restriction is required are outlined in Analysis of MFL In-Line Inspection for CDN Pipelines (CDN) (TEP-INT-ILI-CDN EDMS No. 006570876). The procedure for implementing the pressure restriction is outlined in the TOP Pipeline Restriction Procedure. Pressure control is addressed per the System Design & Commercial Operations Pipeline MAOP De-rate Procedure (EDMS No. 006837355).

When assessment data has not been collected, a risk assessment is performed by executing the TransCanada risk algorithm Risk Assessment Using PRIME (TEP-INT-PRIME, EDMS No. 003972569). Subject matter experts integrate the PRIME data results with other relevant information to prioritize the pipeline inspection schedules.

An example of risk assessment and management is provided for the Weather and Outside Forces (WOF) threat. This threat is managed according to the Weather and Outside Forces Threat Management Program (TEP-ITM-WOF, EDMS No. 005767611). The approach is to conduct a Phase 1 geotechnical study along all of the company pipeline assets. Areas of elevated concern are identified and then reviewed further with Phase 2 and Phase 3 studies. The collected information is used to determine the actual risk to the pipeline asset, and then mitigation, control or monitoring programs are planned, based on the results. TransCanada’s risk assessment and risk management process for the threat of WOF was assessed to be adequate.

Facilities

Integrity management of facilities at TransCanada comprises four risk-assessed components:

Integrity Planning, including System Assessment, Facilities Assessment, and Integrity Programs;
Project Integrity, including Project Risk Analysis, Business Value Analysis, and Project Ranking;
Design Integrity, including Inter Disciplinary Design Check Meetings, and Reliability and Maintainability; and
Maintenance Integrity, including Facility Criticality.

In managing the integrity of non-pipe facilities, TransCanada identified a number of potential integrity threats, including equipment failure, inability to operate as expected, obsolescence, and environmental and safety concerns. Consequences of facility threats and potential failures include public safety impact, loss of life, customer/business impact, regulatory impact, and environmental impact. Risk assessments are performed on the potential threats and consequences to identify potential impacts as well as corrective and preventive actions. When activities are required to manage the risk, the details on conducting these activities are then documented in TransCanada’s equipment-specific integrity plans. Each equipment-specific integrity plan is developed with input from the regions, equipment manufacturers, Issue and Incident Tracking (IIT), other operators, Pipeline System Operations, and the previous year’s integrity plans. The equipment-specific integrity plans reference the relevant TransCanada Operating Procedures (TOPs) that were developed to manage threats and mitigate risks to the reliable operation of facility equipment.

Specific equipment integrity plans that address the risk requirements have been written for many equipment types. Examples are provided in the following documents:

The Mainline Field SCADA Engineering Integrity Plan (EDMS No. 004782175) contains a section on Risk Assessment (Section 4), and identifies issues of concern, the resulting impact, and an action plan to address the issue. Additionally, Section 3 of the document contains the operating and maintenance strategy that includes planned, predictive and reactive maintenance.
The Pressure Vessels Integrity Plan (EDMS No. 003763099) contains a section on Risk Assessment (Section 4). Pressure vessel inspection is addressed and reference is made to the TOP Pressure Vessel External and Internal Inspection (EDMS No. 003694710).

Recent Threat Identification or Risk Assessments

Threat identification and risk assessment activities are aggregated annually as part of the pipeline and facilities maintenance program budget approval process. The Pipeline and Facilities Maintenance Programs (PMP) for 2013, which are the output of the aggregated threat identification risk assessment, were finalized in September 2012.

Records indicated that for pipelines and facilities, work is planned and risk assessments are conducted with consideration given to the consequences of safety, health, the environment and individual risk. Consequences are considered during prioritization of remediation, prevention, control and mitigation activities, and also in repair criteria.

For gas pipelines, mitigation and repair activities requiring excavation of pipeline assets are conducted under the TOP Excavation Procedure (EDMS No. 003672343). The procedure references consultation with a TransCanada Environmental Specialist, and requires all work to be performed in compliance with the Environmental Field Procedures Guide (EDMS No. 003671954).

For liquid pipelines, risk assessments take into consideration the consequences of a potential release. For example, potential consequences that are considered are oil releases into what TransCanada refers to as "highly sensitive receptors". These are defined by TransCanada as specific areas where a release from a pipeline could have significant consequences on public health, the environment or the economy.

For the risk associated with third party damage, TransCanada has pipeline class location and urban development programs to evaluate the issue relating to protecting the public and the pipeline as population growth encroaches on pipelines (Pipeline Crossing and Encroachment Procedure Canada TOP, (EDMS No. 003674617), Pipeline Right-Of-Way Procedures Canada TOP (EDMS No. 003672613), and TEP-INT-CLA Class Analysis and Remediation (CDN) (EDMS No. 005766974). TransCanada stated that its Public Awareness Program (TOP Pipeline Public Awareness Program Plan, EDMS No. 003860909) educates and increases awareness of pipeline safety.

Upon completion of a threat identification and risk assessment, the individual threat teams develop a threat-specific Pipeline Maintenance Plan (PMP). Asset-based program planners assemble the threat specific sections of the PMP into a single, asset specific, PMP. During audit interviews and through documents reviewed, the Board confirmed that threat identification for the liquid pipeline has been performed primarily by the liquid integrity team, with adequate support from the threat-specific subject matter experts as required.

Risk control measures are identified through several avenues, including the following:

The remediation and mitigation measures required to address specific defects are identified in the Threat Management Programs.
The Corrosion Prevention team is accountable for corrosion control through inspection, maintenance and remediation of the cathodic protection system.
TransCanada Operating Procedures (TOPs) are built, where applicable, to manage a particular threat or risk (e.g., the TOP Keystone Pressure Control Valve Vibration Evaluation Procedure (EDMS No. 006811833)).
TOPs are also developed to ensure that routine, consistent inspection and maintenance is performed (e.g., the TOP Relief Valve Inspection and Overhaul Program (EDMS No. 003694631) and the TOP Valve and Valve Operator Inspection and Servicing (EDMS No. 003849601)).

Low Strength Steel Pipe and Fittings

In 2008, the NEB became aware that certain steel pipe and fittings procured and installed on the Keystone Pipeline had the potential to exhibit lower that specified yield strengths. The NEB subsequently initiated an investigation. This investigation preceded the audit and is ongoing. The low yield issue was confirmed during the audit, and documents were reviewed and interviews conducted with TransCanada personnel related to the issue. However, as the issue continues to be under investigation by the NEB, resolution of the investigation and any required remedial actions will be determined outside of the audit.

Summary: Hazard Identification, Risk Assessment and Control

The Management System Audit Element 2.1, Hazard Identification, Risk Assessment and Control, requires a company to have a procedure to identify all possible hazards, to assess the degree of risk associated with these hazards, and to implement control measures to minimize or eliminate the risk.

TransCanada has implemented a system to identify and manage its operating and maintenance risk. Risks are calculated by incorporating the probability of events and the potential magnitude of the consequences. Records indicate that for pipelines and facilities, work is planned and risk-assessments are conducted with consideration given to safety, health, and the environment. TransCanada’s process for threat identification was reviewed for all threats and was assessed to be compliant with the requirements.

The audit identified only one area of non-compliance in the sub-element of hazard identification, risk assessment and gas control. TransCanada developed a new management program for high pressure piping in facilities. This new program has been assessed and is adequate in terms of its content, but has not yet been fully implemented throughout all of TransCanada’s facilities.

Management System Audit Sub-Element Finding: Based on the incomplete implementation of the required high pressure station piping program for its gas facilities, TransCanada is assessed to be non-compliant with the requirements of the OPR-99 and CSA Z662-11, and is therefore non-compliant with this audit sub-element.

Compliance Status:

Non-Compliant

2.2 Legal Requirements

Expectations:

The Company shall have a verifiable process for the identification and integration of legal requirements into its management and protection programs. The Company should have a documented procedure to identify and resolve non-compliances as they relate to legal requirements which includes updating the management and protection programs as required.

References:

OPR-99 sections 4, 6, 40 and 41(1)

CSA Z662-11, Clause 3.2

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

2.3 Goals, Objectives and Targets

Expectations:

The Company shall have goals, objectives and quantifiable targets relevant to the risks and hazards associated with the Company’s facilities and activities (i.e. construction, operations and maintenance). The objectives and targets should be measurable and consistent with the Policy and legal requirements and ideally include continual improvement and prevention initiatives, where appropriate.

References:

OPR-99 section 40

CSA Z662-11, Clauses 3.1.2(h)(ii) and 3.2

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

3.0 Implementation

3.1 Organizational Structure, Roles and Responsibilities

Expectations:

The company shall have an organizational structure that allows its management and protection programs to effectively function. The company shall have clear roles and responsibilities, which may include responsibilities for the implementation of the management and protection programs.

References:

OPR-99 sections 40, 47 and 48

CSA Z662-11, Clauses 3.1.1, 3.1.2(b) and 3.2

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that it has an organizational structure that allows it’s Integrity Management Programs (IMPs) to function effectively and efficiently across its gas and liquids pipelines and facilities assets.

TransCanada stated that the employees (primarily engineers and technologists) managing its Canadian IMPs are primarily based in Calgary. Approximately 160 staff performs work related to the Gas and Liquid Pipeline IMPs and approximately 150 staff performs work related to the Plant IMP. In addition, approximately 80 integrity specialists are located in regional offices across the Canadian pipeline system. These individuals are complemented by Field Technicians who execute integrity related activities.

The hierarchy of authority for the IMPs within TransCanada extends from an Executive Vice President, to Vice President, to Director, to Manager, to Program Lead/Manager levels. Under the Vice President of Engineering and Asset Reliability, one Director is responsible for pipe integrity and another Director is responsible for facilities (plant) integrity. The authorities and associated responsibilities are detailed in the respective IMP documents, specifically:

Gas Pipeline IMP, Section 3 and Appendix A;
Liquid Pipeline IMP, Section 2 and Appendix A; and
Plant IMP, Section 2 and Appendix C.

The audit determined that, for the Gas and Liquid Pipeline IMPs, roles and responsibilities are defined and documented for the key positions. These two IMPs also describe the accountabilities and responsibilities of the relevant TransCanada organizational units, arranged by Threats. The roles and responsibilities for each organizational unit are further detailed in the TransCanada Engineering Procedures (TEPs) for each Threat, as follows:

IMP Management Review: TEP-INT-MREV Pipe Integrity Management Review Process;
External Corrosion: TEP-ITM-ECOR-CDN External Corrosion Threat Management Program;
Internal Corrosion: TEP-ITM-IC Internal Corrosion Threat Management Program;
Equipment Failure: TEP-ITM-EQUIP Equipment Failure Threat Management Program;
Incorrect Operations: TEP-ITM-IOPS Incorrect Operations Threat Management Program;
Manufacturing: TEP-ITM-MANUF-CDN Manufacturing, Fabrication and Construction Threat Management Program;
Mechanical Damage: TEP-ITM-MECH Mechanical Damage Threat Management Program;
Stress Corrosion Cracking: TEP-ITM-SCC-CDN Stress Corrosion Cracking Threat Management Program; and
Geotechnical: TEP-ITM-WOF Weather and Outside Forces (Geotechnical) Threat Management Process.

Based on documentation reviewed and interviews with personnel, TransCanada’s organizational structure, roles and responsibilities for the Gas and Liquid Pipeline IMPs are compliant with the requirements for this sub-element. The organizational structures relevant to these two IMPs are well defined, with adequate dedicated resources.

The audit determined that the roles and responsibilities for the Plant IMP are not as well defined. In Section 2.2 of the Plant IMP (Lines of Responsibility and Development of IMP/Risk Mitigation Process), only high level positions (e.g., Executive Vice President, Vice President, Director) are identified with respect to the Plant IMP. The functional key positions for the Plant IMP are not specified. The organizational chart in Appendix C of the Plant IMP is considerably less detailed than the organizational charts provided in Appendix A of both the Gas Pipeline IMP and the Liquid Pipeline IMP.

During the audit, TransCanada was in the process of revising its Plant IMP. The Facility Integrity and Reliability Management Program (FIRM) (EDMS No. 007803540) were approved by TransCanada management in July 2013. Section 2.2 (Roles and Responsibilities) of the FIRM more explicitly details the functions and processes of the FIRM Program, departmental interactions and the organizational structure. The roles and responsibilities for pressure vessels, over-pressure protection, relief valves and tanks were referenced in the appropriate TEPs, TransCanada Engineering Specifications (TESs), TransCanada Operating Procedures (TOPs) and TransCanada Engineering Directives (TEDs). The FIRM references Section 6 of TransCanada’s Quality Assurance Manual (QMS) (EDMS No. 003722000) that identifies the roles and responsibilities for pressure vessels, heating boilers and ASME pressure relief vessels across the organization. TransCanada’s revised FIRM addresses the requirements of roles and responsibilities that were lacking in the Plant IMP.

In addition to the organizational structure related to TransCanada’s IMPs, the audit assessed the roles and responsibilities of integrity personnel as they relate to construction projects. This information was required because the IMPs are under the main organizational structure of Operations and Engineering (O&E), while construction activities are under the main organizational structure of Major Projects. In light of this separate organizational structure, the audit assessed whether sharing of information on integrity related issues, incidents and learnings identified is occurring. Sharing of information related to issues identified during the operational life of pipelines and facilities (by the IMP personnel) is important because it could require changes to the design and/or construction of future pipelines and facilities (by the Major Projects personnel). Conversely, sharing of information related to issues identified during construction is important because it could have an impact on the subsequent IMPs for both pipelines and facilities.

During audit interviews, TransCanada explained how its Capital Projects Management System requires that functional engagement and support between O&E and Major Projects occur, and that the O&E Functional Engagement and Support document describes the engagement accountabilities for the Project Manager, Project Engineering Manager and the Integration Manager. The documents and records examined confirmed adequate communication between the O&E integrity personnel and Major Projects personnel.

Summary: Organizational Structure, Roles and Responsibilities

The Management System Audit Element 3.1, Organizational Structure, Roles and Responsibilities, requires a company to have an organizational structure that allows its management and protection programs to effectively function. It also requires companies to have clear roles and responsibilities, which may include responsibilities for the implementation of these programs.

TransCanada has approximately 310 employees performing work related to its integrity management programs across its Canadian pipeline system. This is complemented by approximately 80 field technicians who execute integrity-related activities.

The audit determined that for gas and liquid pipeline IMPs, roles and responsibilities are well-defined and have adequate, dedicated resources. The audit also assessed TransCanada’s revised plant IMP, now known as the Facility, Integrity and Reliability Management Program (FIRM), and found that it addresses the roles and responsibilities that were lacking in the previous version.

Management System Audit Sub-Element Finding: Based on documents reviewed and interviews with personnel, TransCanada was able to demonstrate that it was in compliance with the requirements of the OPR-99 and CSA Z662-11, and is therefore compliant with the requirements of this audit sub-element.

Compliance Status:

Compliant

3.2 Management of Change

Expectations:

The Company shall have a management of change program. The program should include:

identification of changes that could affect the management and protection programs;
documentation of the changes; and
analysis of implications and effects of the changes, including introduction of new risks or hazards or legal requirements.

References:

OPR-99 section 6

CSA Z662-11, Clause 3.1.2(g)

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

3.3 Training, Competence and Evaluation

Expectations:

The company shall have a documented training program for employees and contractors related to the company’s management and protection programs. The company shall inform visitors to company maintenance sites of the practices and procedures to be followed. Training requirements should include information about program-specific policies. Training should include emergency preparedness and environmental response requirements as well as the potential consequences of not following the requirements. The company shall determine the required levels of competency for employees and contractors. Training shall evaluate competency to ensure desired knowledge requirements have been met. Training programs should include record management procedures. The training program should include methods to ensure staff remains current in their required training. The program should include requirements and standards for addressing any identified non-compliances to the training requirement.

References:

OPR-99 sections 4, 18, 29 and 46

CSA Z662-11, Clauses 3.1.2(c), 3.2 and 10.2.1

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that it has a documented training program for employees and internal contractors related to its Integrity Management Programs (IMPs). TransCanada indicated that training requirements for external contractors are specified within its service contracts that are verified through inspections and supervision by TransCanada personnel.

TransCanada uses the following methods to manage the training and qualification of employees, and in some instances internal contractors:

Learning Management System (LMS);
Active Management;
Practice of Engineering (POE); and

Performance Management Process.

Learning Management System

The LMS is a web-based tool used to manage the training and competency evaluation for TransCanada employees and internal contractors. LMS is also used to document the results of technical tasks evaluated through three competency evaluation methods (Manager Review, Discuss and Describe, and Jobsite Observation), which are discussed below. Any worker who has not been deemed competent or qualified for a particular task is prohibited from independently performing that task.

Field Role Technical Competency

In 2011, TransCanada introduced its Field Role Task Evaluation Project to improve the quality of the learning, development and competency evaluation programs related to field-based work. The competency evaluation method and training requirements for field technical tasks utilizes a model developed by the Canadian Gas Association and has been adapted for TransCanada’s use. For field role evaluations, interviews or jobsite task observations or simulations are required to demonstrate competency. TransCanada uses three methods of competency evaluation:

Manager Review - Applies to low risk level task evaluations. Under this method of evaluation, the manager, in consultation with a Qualified Technician, will approve task competency of the employee.
Discuss and Describe - Applies to medium risk level task evaluations. Under this method of evaluation, the manager will approve task competency of an employee based on a successful interview evaluation conducted by a qualified evaluator.
Jobsite Observation - Applies to high risk level task evaluations. Under this method of evaluation, the manager will approve task competency of the employee based on successful jobsite task simulation or performance in the presence of a qualified evaluator.

Active Management

TransCanada’s leadership is responsible for ensuring that its employees and internal contractors are properly trained and competent to perform their assigned tasks. Managers complete this by actively assigning and monitoring work, providing feedback and reviewing staff competency on an ongoing basis.

Practice of Engineering

TransCanada’s POE specification, TES-ENG-POE (EDMS No. 003672108), defines the required professional member jurisdictional registration for engineering staff and defines scope of practice. APEGA (Association of Professional Engineers and Geoscientists of Alberta) registration is a hiring requirement for engineering positions located in Alberta. The POE specifies qualifications for Engineer-in-Charge, Responsible Engineers and design discipline checkers. The Engineer-in-Charge is accountable for ensuring that personnel carrying out engineering work are qualified and competent to do so for the jurisdiction in which the engineering and construction are occurring.

Performance Management Process

During the audit interviews and document review, TransCanada stated that it monitors and manages employee development and training through its Performance Management Process (PMP), which is used to establish annual performance expectations and document the development and training plan of each employee. The PMP identifies employee development requirements, including training. Adjustments are made to an employee’s development plan to meet evolving job requirements, as required. Performance management, specifically related to pipe integrity, is documented in TEP-INT-COMP Pipe Integrity Hiring, Training and Competency Evaluation Procedure (EDMS No. 007379172), that outlines the methodology used to identify and communicate training requirements and evaluation of competency. Records of training and competency, which were reviewed during the audit, are provided in Element 4.1 Inspection, Measurement and Monitoring, as they applied to TransCanada’s programs.

Summary: Training, Competence and Evaluation

The Management System Audit Element 3.3, Training, Competence and Evaluation, requires a company to have a documented training program for employees and contractors related to the company’s management and protection programs. Training program should include program-specific policies, emergency preparedness, environmental response and information on the potential consequences of not responding appropriately. Training must also evaluate the competency to ensure knowledge requirements have been met.

Based on documents and records reviewed, the audit determined that TransCanada has developed effective methods to manage the training and qualification of its employees and contractors as follows:

Learning Management System (LMS), a web-based tool to document competency evaluation methods and track whether employees and contractors have been deemed qualified for a particular task;

Active Management, a leadership tool to actively assign and monitor work, provide feedback, and provide ongoing review of staff competency;
Practice of Engineering (POE), which defines the required professional registration for engineering staff, defines scope of practice and specifies qualifications for the Engineer-in-Charge; and

Performance Management Process, used to establish annual performance expectations and document the development and training plan of each employee.

Compliance Status:

Compliant

3.4 Communication

Expectations:

The Company shall have an adequate, effective and documented communication process(es):

to inform all persons associated with the Company’s facilities and activities (interested persons) of its management and protection programs policies, goals, objectives and commitments;
to inform and consult with interested persons about issues associated with its operations;
to address communication from external stakeholders;
for communicating the legal and other related requirements pertaining to the management and protection programs to interested persons;
to communicate the program’s roles and responsibilities to interested persons.

References:

OPR-99 sections 4, 18, 28, 29, 40, 47 and 48

CSA Z662-11 Clauses 3.1.2(d) and 3.2

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

3.5 Documentation and Document Control

Expectations:

The Company shall have documentation to describe the elements of its management and protection programs - where warranted. The documentation should be reviewed and revised at regular and planned intervals. Documents should be revised immediately where changes are required as a result of legal requirements or where failure to make immediate changes may result in negative consequences. The Company should have procedures within its management and protection programs to control documentation and data as it relates to the risks identified in element 2.0.

References:

OPR-99 sections 4, 27, 47 and 48

CSA Z662-11, Clauses 3.1.2(e)(f), 3.2 and 10.5.1.1(d)

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

3.6 Operational Control-Normal Operations

Expectations:

The company shall establish and maintain a process to develop, implement and communicate mitigative, preventive and protective measures to address the risks and hazards identified in elements 2.0 and 3.0. The process shall include measures to reduce or eliminate risks and hazards at their source.

References:

OPR-99 sections 4, 27, 36, 37, 39 and 40

CSA Z662-11, Clause 3.1.2(f), 3.2 and 10

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that it establishes and maintains processes to develop, implement and communicate surveillance and condition monitoring, and preventive, protective, mitigative, and remedial measures to address identified risks and threats.

Once TransCanada has completed its risk analysis and threat identification, integrity actions are selected to control and manage identified and potential threats. The selected actions are documented in TransCanada’s annual Pipe and Facility Maintenance Plans (Maintenance Plans). Following implementation of the Maintenance Plans, the results are analyzed as part of TransCanada’s improvement cycle. The audit confirmed that the processes for the development of the Maintenance Plans are documented in TransCanada’s Integrity Management Programs (IMPs). The relevant sections of the IMPs are:

Gas Pipeline IMP, Sections 11 and 12;
Liquid Pipeline IMP, Sections 6 and 9; and
Plant IMP, Sections 4 and 5.

TransCanada’s Pipe Integrity Threat Management Programs (Threat Management Programs) provide a listing of appropriate integrity measures employed for managing specific types of threats. The Threat Management Programs are as follows:

Mechanical Damage Threat Management Program (TEP-ITM-MECH, EDMS No. 006786487);
External Corrosion Threat Management Program (CDN) (TEP-ITM-ECOR, EDMS No. 006570955);
Internal Corrosion Threat Management Program (TEP-ITM-IC, EDMS No. 006786402);
Stress Corrosion Cracking Threat Management Program (TEP-ITM-SCC-CDN, EDMS No. 005767613);
Equipment Failure Threat Management Program (TEP-ITM-EQUIP, EDMS No. 006786449);
Incorrect Operations Threat Management Program (TEP-ITM-IOPS, EDMS No. 006810297);
Construction and Manufacturing Threat Management Program (TEP-ITM-MANUF, EDMS No. 006786458);
Weather and Outside Forces Management Program (TEP-ITM-WOF, EDMS No. 005767611); and
Facility Pipe Threat Management Program (CDN) (TEP-ITM-FPIPE-CDN, EDMS No. 007379193).

The reviewed threat control and risk reduction activities employed by TransCanada can be divided into the following five categories (discussed in more detail below): surveillance and condition monitoring; proactive measures; preventive measures; mitigative measures; and remedial measures. These threat control and risk reduction activities are addressed within the Gas Pipeline IMP, Liquid Pipeline IMP, and the Plant IMP, as well as within the individual Threat Management Programs.

Surveillance and Condition Monitoring

Surveillance and condition monitoring is used to detect the presence of threats and monitor threat progression. TransCanada’s activities associated with surveillance and condition monitoring include:

Pipeline patrols (TOP Pipeline Right of Way Procedures Canada (EDMS No. 003672613), TOP Aerial Pipeline Patrol (EDMS No. 003672387) and Pipeline Ground Based Patrols (EDMS No. 003875137));
Leak detection surveys (Natural Gas Leak Detection Procedure Canada (EDMS No. 003676669));
Cathodic protection surveys (TEP-CP-PRGM Corrosion Prevention Program (EDMS No. 006786483) and TES-CP-SS Cathodic Protection Survey Specification (EDMS No. 003670956));
Geotechnical and water crossing surveys (Phase I Geologic Hazards Assessment Canadian Portion of the Keystone Oil Pipeline Alberta, Saskatchewan, Manitoba, Canada (103-93179), TEP-ITM-WOF Weather and Outside Forces Management Program (EDMS No. 007773954) and TOP Pipeline Underwater Inspections (EDMS No. 003671756)); and
Various types of facilities and equipment inspections, with some examples of these being the TransCanada Engineering Procedures (TEP) or TransCanada Operating Procedures (TOP) as follows: TEP-ITM-FPIPE-CDN Facilities Piping Integrity Management Program (EDMS No. 007379193), TEP-ITM-EQUIP Equipment Failure Threat Management Program (EDMS No. 006786449), TOP Critical Gas Pressure Regulator Inspection and Maintenance (DEMS No. 007585439), TOP Valve and Valve Operator Inspection and Servicing (EDMS No. 003849601), TOP Control Valve Inspection Canada and Mexico (EDMS No. 003832589) and TOP Pipeline Pressure Relief Valve Blow Off Valve Inspection (EDMS No. 003866831).

Preventive Measures

Preventive measures are intended to eliminate or prevent the presence of a threat and may include improved manufacturing and construction practices, improved material selection, increased security, public awareness activities and signage. The Board reviewed several TransCanada Operating Procedures (TOPs) that describe and direct TransCanada’s Public Awareness Program (PAP). TransCanada’s PAP is intended to eliminate or reduce potential third-party damage through communications with the public, excavators and contractors, emergency officials and local public officials. The Public Awareness Program is documented in the TOP Pipeline Public Awareness Program Plan (EDMS No. 003860909). The TOP One Call and Locating and Marking Procedures Canada (EDMS No. 003671859) details the necessary steps to complete prior to undertaking activities such as any ground disturbance, heavy equipment travel, excavating, blasting, or construction within 30 meters of facilities. The TOP TransCanada Signage Procedure (EDMS No. 003676680) provides information on sign types, sizes, content and posting areas, depending on the intent of the sign. While documents were received with respect to TransCanada’s PAP, it was not assessed in detail in this IMP audit.

Protective Measures

Physical protective measures are intended to guard the pipeline and facilities equipment against damage and failure. Coatings are an example of protective measures, as they are intended to separate the pipe from sources of corrosion. The consensus in industry is that corrosion prevention is most effective when a high integrity coating is used in conjunction with cathodic protection. The Board reviewed TransCanada’s Corrosion Prevention Program (TEP-CP-PRGM, EDMS No. 006786483, TES-CP-CR Cathodic Protection Criteria Specification EDMS No. 00378793, and TES-CP-SS Cathodic Protection Survey Specification EDMS No. 003670956) detailing the characteristics of its program to mitigate corrosion on protected structures using cathodic protection and assessed it to be adequate.

Mitigative Measures

Mitigation methods are intended to reduce failure probability or failure consequences, and include methods such as pressure reduction, pipe material upgrades, slabbing over pipelines, increased backfill, equipment upgrades, pipeline rerouting, corrosion inhibitor injection, secondary containment and pig cleaning runs. The methods considered for risk reduction and threat control depend on the threat type. During the audit, the Board noted that TransCanada’s IMPs, as well as the Threat Management Programs, included adequate mitigative options to address potential threats and risks. For example, preventive and mitigative measures are detailed in Section 9 of the Liquid Pipeline IMP.

Remedial Measures

Remediation is completed to correct known issues, such as pipeline defects and excessive stresses due to geotechnical concerns (e.g. ground movement). Data inputs, such as defect assessments, hydrostatic testing, monitoring measurements, and indirect examination results are analyzed to identify areas requiring further investigation and/or repairs. During the audit, the Board noted that TransCanada’s Threat Management Programs and IMPs reference specific procedures for gathering additional data, analyzing monitoring and assessment results, and assessed them as being adequate.

The audit examined examples of TransCanada’s procedures for analyzing in-line inspection results, where imperfections are evaluated to determine threats to the integrity of the pipeline. Special consideration is given to features such as dents, girth welds or seam welds that might be associated with other conditions. The following TransCanada procedures detail the approaches to analyze in-line inspection results:

Analysis of Deformation In-Line Inspection Data for Canadian Pipelines (TEP-ILI-DEF-CDN, EDMS No. 006980190);
Analysis of EMAT Crack Detection In-Line Inspection Data for Gas Pipelines (TEP-ILI-EMAT, EDMS No. 006980178);
Analysis of Hard Spots in In-Line Inspection Data (TEP-ILI-HS, EDMS No. 006980212); and
Analysis of In-Line Inspection Data (TEP-INT-ILI-CDN, EDMS No. 006570876).

Activities such as direct evaluation and hydrostatic testing may be required to further characterize suspected and identified features. Methods of defect repair include recoating, pipe cut-outs and strain reliefs, as well as installation of sleeves, composite reinforcement wraps and clamps. Assessments and anticipated remedial measures are then included in TransCanada’s Maintenance Plans.

Defect Assessment and Repair Procedures

For investigation of known or suspected features, non-destructive testing methods may be used, and might require pipeline exposure. A temporary reduction in operating pressure or other safety measures may be implemented to ensure that safety is maintained. Analysis of the data gathered in consideration of the design, material, construction, operating and maintenance history and expected operating conditions of the pipeline determines appropriate remediation and repair methods necessary to return the pipeline to full service. During the audit, the Board reviewed TransCanada’s procedures that are relevant to these activities:

TOP Pipeline Restriction Procedure (EDMS No. 003820831);
TOP Pipeline Defect Assessment and Repair Procedures (EDMS No. 003674615);
TOP Maximum Pressure for Pipelines With Known or Suspected Integrity Concerns (EDMS No. 003671945); and
Assessment of Features in Pipelines (TEP-INT-FASS, EDMS No. 004214235).

The Board also reviewed records of TransCanada’s voluntary pressure restrictions that were in place during pipe exposure, defect assessment and repair and noted that TransCanada had followed its required procedures.

Hydrotest Procedures for Defect Testing

Pressure testing is a method that produces a pass/fail result for defects contained in the pipeline test segment. Defects detected through pressure test failures are remediated by removal/replacement of the affected pipe segment. Hydrostatic Test Specification for Integrity Testing of Existing Pipelines (TES-HYDRO-HT4, EDMS No. 003697288) describes the procedure for pressure testing an existing pipeline to validate its suitability for continued operation at a previously qualified maximum operating pressure. During the audit, the Board reviewed TransCanada’s hydrotest procedure and assessed it as being adequate.

Approving, Documenting and Communicating the Maintenance Plans

Maintenance Plans for the remedial activities described previously are presented to TransCanada management for review and approval. For Pipe Integrity, information on the Maintenance Plan is communicated as per Pipe Integrity Communication Procedure (TEP-INT-COMM, EDMS No. 006980248). The Vice President of Engineering and Asset Reliability approves the Maintenance Plans for Pipe Integrity and Facilities Integrity. Preventive maintenance work is communicated, documented and tracked in Avantis, which is a maintenance management system that is used by TransCanada.

Maintenance Plan Implementation

Maintenance Plans are implemented by integrity personnel, central planning personnel, regional staff, and project managers of Pipeline Maintenance Projects, as appropriate. A program schedule is developed based on the urgency of risk reduction, operational efficiencies, resource and material availability and access. Repair or mitigation of known conditions may be scheduled independently of other activities if an urgent action is required. If a planned activity cannot be completed within the established timeframe, justification for the deferral and an explanation of why the change will not jeopardize integrity are documented through either a variance (System Improvement Decision Summary Variance Approval, EDMS No. 003909431) or a management of change (TEP-INT-MOC Pipe Integrity Management of Change Procedure, EDMS No. 006425143), as appropriate. A temporary reduction in operating pressure or other appropriate actions may be required. Section 12 of the Gas Pipeline IMP, Section 7 of the Liquid Pipeline IMP, and Sections 4 and 5 of the Plant IMP address implementation of the Maintenance Plans.

Conducting Maintenance Plans

TransCanada stated that all surveillance and condition monitoring, as well as preventive, protective, mitigative and remedial activities, are conducted, managed and monitored in a manner that is intended to minimize environmental and safety risks. The Health, Safety and Environment (HS&E) Management System (EDMS No. 003721961) contains more specific information on how these risks are managed. HS&E was not in the scope of the audit and was therefore not assessed during this IMP audit.

Maintenance Plan Evaluation and Communication

Evaluations of the effectiveness of Maintenance Plans are completed periodically by TransCanada’s Integrity Program Managers, Threat Program Managers, and Integrity Plan owners in consideration of the following:

past and current assessment results;
data integration and risk assessments;
remediation results;
performance of new technology or applications;
non-conformances/non-compliances;
performance measures; and
incident investigations.

The maintenance plan evaluation results may be used to modify the programs, if required. For Pipe Integrity, the evaluations are documented in threat-specific Pipeline Maintenance Annual Reports and in the Assessment Plan for hazardous liquids. The Pipeline Maintenance Plan Annual Reports are communicated to management as per the Pipe Integrity Communication Procedure (TEP-INT-COMM, EDMS No. 006980248). For Facilities Integrity, Maintenance Plan results are communicated to management through performance measure reports, activity reports and integrity plans.

Summary: Operational Control - Normal Operations

The Management System Audit Element 3.6, Operational Control - Normal Operations, requires a company to establish and maintain a process to develop, implement and communicate measures meant to mitigate, prevent and protect against the hazards identified in sub-sections 2.0 and 3.0. This includes measures to proactively reduce or eliminate risks and hazards at their source.

The audit determined that TransCanada’s threat management programs provide a listing of appropriate integrity measures for managing identified risks and threats. Some of these threats include but are not limited to: pipeline corrosion; construction and manufacturing; weather and outside forces; and mechanical damage.

TransCanada was found to manage these risk and threats through in the following ways:

Surveillance and condition monitoring used to detect the presence of threats and monitor threat progression;
Preventative measures intended to eliminate or prevent the presence of threats such as improved material selection, public awareness activities and signage;
Physical protective measures intended to protect infrastructure from damage and failure such as pipeline coating to prevent corrosion;
Mitigation measures to reduce the probability of failure and related consequences such as pipeline rerouting, pressure reductions and equipment upgrades;
Remediation to correct known issues (including maintenance plan development, implementation evaluation and communication);
Non-destructive testing methods to investigate known or suspected anomalies; and
Hydrotesting that produces a pass/fail result for defect identification.

Compliance Status:

Compliant

3.7 Operational Control - Upset or Abnormal Operating Conditions

Expectations:

The company shall establish and maintain plans and procedures to identify the potential for upset or abnormal operating conditions, accidental releases, incidents and emergency situations. The company shall also define proposed responses to these events and prevent and mitigate the likely consequence and/or impacts of these events. The procedures must be periodically tested and reviewed and revised where appropriate (for example, after emergency events).

References:

OPR-99 sections 4, 32, 37, 40 and 52

CSA Z662-11, Clauses 3.1, 3.2, 4.18, 10.9.5

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that it has the operational controls and procedures that are to be followed to identify the potential for operational upset or abnormal operating conditions, and it has developed the plans and procedures to prevent and mitigate the impacts of these upset or abnormal operating events. TransCanada also submitted procedures that would be implemented in response to pipeline and facilities upset or abnormal operating conditions, including accidental releases, incidents or emergency situations. TransCanada’s emergency response plan (ERP) was not within the scope of this audit and was therefore not assessed during this IMP audit.

Pipelines - SCADA

Oil Control Operations

The Keystone Pipeline is remotely monitored and controlled from TransCanada’s Calgary based Oil Control Centre (OCC). Pipeline controllers at the OCC are responsible for the overall operation of the pipeline 24 hours a day, 365 days a year. Pipeline controllers monitor critical data points along the pipeline and are able to issue supervisory commands such as pump start/stop and valve open/close commands using a computerized Supervisory Control and Data Acquisition (SCADA) system. To address service reliability, the OCC has fully redundant SCADA and leak detection systems. In the event of a SCADA or leak detection system failure, a hot standby system will immediately take over. If both the OCC primary and standby systems become unavailable due to a catastrophic event, a secondary Back-Up Control Centre contains full duplicate primary and secondary SCADA and leak detection systems. CSA Z662-11, Annex M (Informative), Guidance for System Control, Monitoring and Protection of Liquid Pipelines, provides non-mandatory guidance for the use of SCADA. TransCanada’s use of a SCADA system for the Keystone Pipeline conforms to this non-mandatory guidance.

The Keystone Pipeline is operated in accordance with its written operating procedures for normal, abnormal and emergency operations. TransCanada stated that the procedures comply with CSA Z662-11, Clause 10.5.2, Pipeline Emergencies. OCC procedures are documented and available to the OCC controllers via an internal OCC website. The OCC procedures include normal operations, abnormal/emergency operations, leak detection operations and incident management. The OCC emergency procedures were outside the scope of this IMP audit and were not formally assessed.

Examples of TransCanada's Operating Procedures (TOPs) provided to support operational control are: TOP Emergency Shutdown System Inspection (EDMS NO. 003830466), TransCanada Commissioning Procedures, Station Control System and Commissioning Check Sheet - Station Control System (both documents have an effective date of 2012/05/01 but have no document ID numbers), and SCADA Mainline Unit speed Control Commissioning Guide (Document ID N/A, but the internal TransCanada Website address is given as http://wscada).

Gas Control Operations

TransCanada’s gas pipeline operations are remotely monitored and controlled from the Calgary Gas Control (GC) Centre. Pipeline controllers are responsible for the overall operation of the pipeline 24 hours a day, 365 days a year. The pipeline controllers monitor critical data points along the pipeline and are able to issue supervisory commands such as compressor start/stop and valve open/close commands using a computerized SCADA system. To address service reliability, the Gas Control SCADA systems are fully redundant. If the primary SCADA system fails, a hot standby system will immediately take over. If both the Gas Control primary and standby systems become unavailable due to a catastrophic event, a secondary Back-Up Control Centre contains a full duplicate primary and secondary Gas Control SCADA system. CSA Z662-11, Annex M (Informative), Guidance for System Control, Monitoring and Protection of Liquid Pipelines, provides non-mandatory guidance for the use of SCADA for liquids pipelines only. TransCanada’s use of a SCADA system for its gas pipeline operations is voluntary and conforms to the intent this non-mandatory guidance.

TransCanada’s gas pipeline system is operated in accordance with written operating procedures for normal, abnormal and emergency operations. TransCanada stated that the procedures comply with CSA Z662-11, Clause 10.5.2, Pipeline Emergencies. Gas Control consists of two processes, the Monitor and Control Process (EDMS No. 003835728) and the Emergency Preparedness and Response Process (EDMS No. 003835729). The Monitor and Control Process describes the methodology used to ensure that the 24-hour operation of the pipeline system is carried out under controlled conditions. The Emergency Preparedness and Response (ERP) Process describes the methodology used to ensure programs, processes and plans are in place to ensure controlled responses to emergency situations. While TransCanada provided information on its emergency preparedness and response program, its ERP program was not formally assessed in this IMP audit.

Facility Automation

Oil Operations

During the audit interviews, TransCanada stated its compressor stations are equipped with fully automated control systems. These control systems monitor critical parameters, such as pressures and temperatures, 24 hours a day, 365 days a year, and will automatically regulate these parameters as required. If any parameter exceeds normal operating limits, the local control system will automatically shut down the facility. Key elements of the gas facility control systems, as related to abnormal or emergency operations, are: facility ESD and isolation; pressure control and overpressure protection; and fire and gas detection.

Gas Operations

CSA Z662-11, Clause 10.9.1.1, Compressor and Pump Units, states that "Gas compressor and pump units shall be started, operated, and shut down in accordance with procedures established by the operating company". TransCanada’s facility automation for both its oil and gas operations is in compliance with the requirements of CSA Z662-11.

Station ESD and Isolation

Oil Operations

During the audit interviews, TransCanada stated that its pump stations are equipped with an ESD system that is designed to automatically isolate the station from the pipeline upon the occurrence of abnormal conditions. An ESD event will result in the immediate shutdown of all pumps, both the mainline pumps as well as sump re-injection pumps. Once the pumps have shut down, the station mainline bypass valve opens and station suction and discharge side valves close. The station valves are interlocked so that the station suction and discharge side valves do not close until the station mainline bypass valve is fully open. Once a pump station is in emergency shutdown, it is locked out to the OCC until the incident is investigated and cleared by a facility technician. An "Isolate" command is also available to the OCC and is intended for non-emergency isolation at the pump station. This will result in the station bypass valve opening and the side valves closing, but will not lock out the facility to the OCC. Similar ESD systems are in place at oil receipt facilities.

CSA Z662-11, Clause 4.14.3.3(a) states that "Pump stations shall have emergency shutdown systems that meet the following requirements: (a) Such systems shall provide a means to block liquids out of the station." TransCanada is assessed to be compliant with this requirement. The OPR-99, section 12(a) states that "A compressor station or pump station shall be equipped with an alternate source of power capable of (a) operating the station’s emergency shut-down system". On 6-9 June, 2011, NEB staff conducted an inspection of Keystone’s Portage La Prairie, Rapid City, Moosomin and Richardson pump stations located in Manitoba and Saskatchewan. The inspection revealed that the pump stations on the Keystone system are not equipped with an alternate source of power capable of operating each station’s ESD system and NEB staff identified this as a non-compliance with subsection 12(a) of the OPR-99.

On 17 August 2012, the Board issued Order SO-T241-002-2012 directing TransCanada to provide a corrective action plan to address a non-compliance to the OPR-99 sub-section 12(a). TransCanada had been found non-complaint with the OPR-99 sub-section 12(a) because it did not have an alternate source of power capable of operating its pump station’s ESD systems. The Board accepted TransCanada’s corrective action plan with Amending Order AO-001-SO-T241-002-2012 on 15 October 2012. The corrective action plan is being implemented and all corrective actions are to be completed by 31 March 2014.

Gas Operations

If the facility programmable logic controller (PLC) detects a fire or high gas concentration, or an over-pressure condition, it automatically initiates a plant ESD. The ESD will isolate the affected plant by closing all adjacent yard valves and opening blow-off valves to vent yard piping. A fire condition will also cause plant fire suppression systems to activate, where installed.

Pressure Control and Over-Pressure Protection

Oil Operations

TransCanada stated that its oil pressure control and over-pressure protection systems are designed in accordance with CSA Z662-11, Clause 4.18.2: General Design Requirements for Systems for Pressure Control and Over-pressure Protection, to ensure that the failure of either system will not cause the other to become inoperative.

Pump station suction and discharge pressures are controlled via a combination of pump speed control and pressure control valve modulation. The majority of pump stations are fitted with variable frequency drives to control pump speed, and all pump stations are fitted with a pressure control valve on the discharge side of the pump station. Upon loss of the control system, all pumps at that station will trip and SCADA will drive the upstream pump station to safe discharge pressure settings.

Pump station suction and discharge pressures are monitored by the local facility control system and the SCADA system for over-pressure conditions. If suction pressures exceed safe limits, all pumps at all stations upstream of the station with the high suction pressure will be immediately shut down. If discharge pressures exceed safe limits, all pumps at that station will be immediately shut down. If the SCADA system detects a blocked flow path (such as a valve closure) anywhere on the pipeline, then all pumps at all stations upstream of the facility with the blocked flow will be immediately shut down.

Gas Operations

TransCanada’s Gas Control Over-Pressure Procedure (EDMS No. 003723302) references six levels of protection to prevent pipeline over-pressure. Four levels of protection take place at compressor station locations and protect against over-pressure conditions that are initiated by the compressor station only. The fifth and sixth levels of protection, which augment the compressor station controls, protect against other sources of pipeline over-pressure. If an over-pressure condition occurs, a station’s programmable logic controllers (PLCs) has the ability to slow down the operating parameters of the unit, shut down the unit completely, or relieve the pressure via unit or station relief valves. TransCanada stated that typically, over-pressure protection is also provided at upstream producer facilities. Requirements for these protection systems are directed under the Gas Tariff.

Over-Pressure Hazard

The Board identified a non-compliance with this audit element related to the management of the over-pressure hazard on the NOVA Gas Transmission Ltd. (NGTL) system receipt meter stations. The Board determined that NGTL is not conducting sufficient inspections or audits of its customer’s installations to ensure that the NGTL system is operated in compliance with CSA Z662-11, Clauses 4.18.1.1, 4.18.1.2 and 4.18.2, and as required by the OPR-99 sections 4 and 53(1).^[3]

CSA Z662-11, Clause 4.18.1.2 states that "where failure of the pressure-control system, or other causes, can result in the maximum operating pressure of the piping being exceeded, overpressure protection shall be installed to ensure that the maximum operating pressure is not exceeded by more than 10% or by 35 kPa, whichever is greater."

The CSA Z662-11 design requirements for over-pressure protection (OPP) are specified in sub-clause 4.18.2 as:

"Systems for pressure control and over-pressure protection shall:

(a) be designed such that a failure in either system cannot cause the other system to become inoperative;
(b) be designed with sufficient capacity and sensitivity for the intended service;
(c) be designed for the intended service environment;
(d) be designed and installed so that they can be readily tested, inspected, and calibrated;
(e) be designed and installed to prevent unauthorized operation of valves or equipment that would make these systems inoperative;
(f) be designed to minimize the risk of being physically damaged; and
(g) where practicable, be designed such that a failure will not result in an over-pressure condition of the piping".

The NEB has reviewed TransCanada’s past incident history and identified over-pressure incidents on the NGTL system. Through an Audit Information Request and audit interviews with TransCanada, TransCanada was asked to demonstrate how the NGTL approach of relying on its customers and NGTL’s General Terms and Agreement (GTA) meets the requirements of CSA Z662-11, Clause 4.18 and the OPR-99 sections 4 and 53(1). In addition, NGTL was asked whether it had implemented the preventative actions highlighted in the NEB’s Safety Advisory (NEB SA99-1), which referenced the requirements of CSA Z662-11, Clause 4.18.1.2, on OPP at Receipt Points, issued in September 1999.

TransCanada stated that, as a result of its over-pressure incidents, it had initiated a review of how its customers meet the GTA. TransCanada stated that in December 2010 it implemented a procedure for new meter stations that verifies that the customer’s OPP meets CSA Z662-11 requirements. TransCanada stated that it has reviewed its customers’ philosophies concerning how they meet the GTA for 30 receipt meter stations and that it is currently developing a plan to verify compliance to OPP requirements on approximately 1100 additional receipt meter stations.

Further, TransCanada indicated that in February 2012, it had communicated the following OPP Plan of Action to its customers:

TransCanada will re-initiate verification of its OPP requirements with NGTL customers in April 2013.
NGTL stakeholders (including customers) will be informed at that time that in order to be compliant with CSA Z662-11, the OPR-99 and NEB Safety Advisories, NGTL will require information from all Interconnecting Operators at receipt meter stations regarding the status of their OPP Systems.
Failure to provide adequate information regarding the status of the Interconnecting Operator’s OPP System may ultimately result in either the shut-in of the receipt stations, or installation at the customer’s cost of OPP systems at the NGTL receipt stations.
A risk-based methodology is used to determine the meter station information required to allow both TransCanada and its customers to prioritize the meter stations under initial review in 2013. The balance of the meter station information will be required and reviewed by the end of 2014.
Currently, meter stations with one or more of the following characteristics are prioritized to provide OPP information:
- The meter station has an automated block valve;
- The meter station has had a prior over-pressure event; and
- The meter station has one or more producer tie-ins where there are a number of unclear areas on how to ensure OPP. In such cases OPP information will be required from all of the applicable upstream operators.

Based on the history of over-pressure incidents on the NGTL system, the fact that TransCanada only recently initiated a Plan of Action to verify compliance with the OPP requirements of CSA Z662-11, Clause 4.18, and the fact that the Plan of Action has not been fully implemented, TransCanada is not in compliance with this audit sub-element.

Pressure-Limiting and Pressure-Relieving Systems

Oil Operations

Relief valves on the Keystone Pipeline are tested annually, as directed under TransCanada’s Relief Valve Inspection and Overhaul Maintenance for Oil Pipelines Procedure (EDMS No. 007603025), and in accordance with CSA Z662-11, Clause 10.9.5.3. TransCanada is currently assembling the supporting evidentiary data as required by CSA Z662-11, Clause 10.9.5.3(b) to assess and justify an appropriate alternate pressure-relief system inspection and maintenance interval for these facilities.

Gas Operations

The audit identified that settings for mechanical relief valves, as well as pressure relief set-points coded into the control system, are managed according to TransCanada’s document Compressor Station Limits Canada (EDMS No. 003671820).

During the audit, TransCanada stated that it overhauls conventional and pilot-operated pressure relief valves at three or five-year intervals, in accordance with CSA Z662-11, Clause 10.9.5 Pressure-control, pressure-limiting and pressure-relieving systems and/or API 576, Inspection of Pressure Relieving Devices. CSA Z662-11, Clause 10.9.5.3(b) states that "pressure-relieving systems (or devices), except for rupture disks, shall be inspected, assessed, and tested, at least once per calendar year with a maximum interval of 18 months (Clause 10.9.5.3(a)) or at intervals appropriate to their application and operation, as determined by the operating company, as specified in API 576, and in accordance with supporting evidentiary data and documentation (Clause 10.9.5.3(b))."

The audit determined that TransCanada is moving to a five-year inspection and maintenance interval for its pressure-relief inspection and maintenance program, as it assesses the requirements for each site under its internal audit process according to the TOP Pressure Relief Valve Audit Procedure (EDMS No. 003954090). TransCanada’s Pressure Equipment Quality Management System (QMS) and CSA Z662-11, Clause 10.9.5.3(b) both require TransCanada to review the equipment to justify extension of inspection intervals. TransCanada stated that, to date, no incidents have listed the longer pressure-relief inspection and maintenance interval as a contributing factor, and no increase in relief valve incidents have occurred since the move to the longer interval was initiated. Based on the evidentiary data and documentation as required by CSA Z662-11, Clause 10.9.5.3(b), TransCanada’s rationale for the increased inspection interval is in compliance with requirements for pressure-relief valve inspection and maintenance.

Leak Detection

Oil Operations

The audit identified that TransCanada’s leak detection methodology on oil systems is performed via a computerized Leak Detection system that alerts the Oil Control Centre (OCC) controller of any suspected leak event, so that the controller can take appropriate action to shut down and isolate the pipeline system. In addition, aerial patrols are performed 26 times a year (TOP Aerial Pipeline Patrol, EDMS No. 003672387). If a leak is identified during an aerial patrol, the OCC is notified to immediately shut down and isolate the system. CSA Z662-11, Clause 11.18, Leak Detection, requires that "Where appropriate, pipelines shall have leak detection systems. Leak detection devices and procedures, where used, shall be capable of providing early detection of leaks. Where appropriate, line balance methods may be used." TransCanada’s leak detection system for its oil operations is in compliance with the CSA Z662-11 requirements.

Gas Operations

During the audit, TransCanada stated that if a leak is detected or suspected on a gas pipeline, the guidance provided under the Pressure Control of Leaking Pipelines (EDMS No. 003841207) is followed to manage the confirmed or suspected leak. Leak detection on gas pipeline systems is also performed via regularly scheduled aerial and ground based patrols in accordance with the Natural Gas Leak Detection Procedure (EDMS No. 003676669) and the Pipeline Integrity Leak Detection and Evaluation Procedure (TEP-INT-LEAK, EDMS No. 007379105). These procedures describe the requirements to perform natural gas leak detection activities. CSA Z662-11, Clause 11.18, Leak Detection, requires that "Where appropriate, pipelines shall have leak detection systems. Leak detection devices and procedures, where used, shall be capable of providing early detection of leaks. Where appropriate, line balance methods may be used." TransCanada’s leak detection system for its gas operations is in compliance with the CSA Z662-11 requirements.

Gas Quality

As mentioned in the audit sub-element 4.1 Inspection, Measurement and Monitoring, TransCanada has identified key personnel, such as field technicians and gas controllers, who are trained to identify and manage gas quality off-specification Tariff conditions. The governance and systematic approach to managing gas quality are outlined in the Gas Quality Procedure (EDMS No. 003671916) and the H₂S Risk Mitigation Procedure (EDMS No. 003999947). At locations where sour potential or other contaminants are of concern, additional instrumentation and automated equipment is employed with shut-in capability. In the event that a sour gas slug is introduced to the pipeline system, the Alberta and Foothills System H₂S Contamination Procedure (EDMS No. 003723279) provides procedures and guidelines for Gas Control to manage the H₂S contamination event. Records of TransCanada’s gas quality monitoring program were examined in conjunction with the assessment of the Internal Corrosion Threat Management Program (Ref_2_2012 IC Susceptible Lines.xlsx). The programs that TransCanada has developed and implemented to manage gas quality are in compliance with the requirements of the OPR-99, section 6.5(1)(e) and (f).

Fire and High Gas Concentration Detection

During the audit, TransCanada stated that all stations are equipped with sensors to continuously monitor for both fire (gas and oil facilities) and high gas concentrations (gas facilities only), as per CSA Z662-11. Clause 4.14.2.7 states that "compressor buildings shall have suitable systems for the detection of fire and hazardous atmospheres" and Clause 4.14.3.5 states that "pump buildings shall have suitable systems for the detection of fire and hazardous atmosphere". TransCanada stated that, as directed by its Fire Detection Equipment Inspection Procedure (EDMS No. 005018693), the fire and gas detection equipment are tested and calibrated on prescribed maintenance schedules, typically annually or bi-annually, depending on the type of detection equipment. Fire and gas detection equipment are on an annual inspection and maintenance interval. Catalytic gas detectors have a known susceptibility to gas "poisoning" over time, which may reduce their ability to detect gas. Although catalytic gas detectors are not typically exposed to gas during normal operations, bi-annual inspections are prescribed by TransCanada as a preventive measure.

In terms of the applicable regulatory requirements for an inspection schedule, CSA Z662-11 remains silent on the inspection and maintenance interval requirements as does the American Petroleum Institute (API) and the National Research Council Canada (National Fire Code of Canada, 2010). In general terms, the OPR-99 section 36(b), states that "A company shall periodically test instruments and equipment at the pipeline stations to verify their proper and safe operation."^[4] TransCanada’s inspection and maintenance program frequencies for its fire and gas monitoring equipment are therefore assessed to be compliant with these requirements.

Alarm Call-Out System

During the audit, TransCanada identified its gas control and oil control personnel who monitor the pipeline system and acknowledge all alarms that come in through the SCADA system. The alarms are grouped in "bundles" that allow the operator to identify from which sub-system the alarm originates. The operator then notifies the appropriate field personnel to respond to and investigate the alarm. Gas Control direction is provided under the Alarm and Event Management Procedure (EDMS No. 003821127). Oil Control direction is provided via various procedures available on the OCC web page. TransCanada’s alarm call-out system relates to its emergency preparedness and response program, which was not included in the scope of this audit and therefore not formally assessed.

Shutdown Devices and Systems

During the audit, TransCanada stated that each compressor and pump station contains instrumentation and controls which include pressure transmitters, pressure switches, mainline valve pressure switches, blow-off valve high-pressure switches, level switches and mainline pressure and temperature transmitters. To ensure the equipment is configured and functions correctly, guidance is provided under the Control and Monitoring Inspection Procedure (EDMS No. 003834760). CSA Z662-11, Clause 10.9, Operation and Maintenance of Facilities and Equipment, and more specifically, sub-clause 10.9.1, Compressor and Pump Stations, states that "gas compressor and pump units shall be started, operated, and shut down in accordance with procedures established by the operating company". TransCanada’s shutdown devices and systems are in compliance with the requirements of CSA Z662-11.

Valve Operation

TransCanada stated that remotely located mainline valves on gas pipelines are equipped with low-pressure shut-off devices which, when a low-pressure condition is observed, will automatically close the valve isolating the pipeline section. Remote mainline valves on the Keystone Pipeline are electrically actuated and can be closed and opened, as required, via remote command from the OCC.

The following procedures provide guidance to ensure that pipeline valves (oil and gas) operate as required during normal, abnormal and emergency conditions:

Control Valve Inspection (EDMS No. 003832589);
Gate Valve Position Inspection (EDMS No. 006493970);
Oil Pipeline Valve and Valve Operator Inspection (EDMS No. 005505594);
Control Valve Inspection Canada and Mexico (EDMS No. 0038332589);
Valve and Valve Operator Leak and Cycle Test (EDMS No. 003864109); and
Valve and Valve Operator Inspection and Servicing (EDMS No. 003849601).

CSA Z662-11, Clause 10.9, Operation and Maintenance of Facilities and Equipment, and more specifically, sub-clause 10.9.6.2, Valves, states that "Pipeline valves that can be necessary during an emergency shall be inspected and partially operated at least once per calendar year, with a maximum interval of 18 months between such inspections and operations" TransCanada’s procedure, Valve and Valve Operator Inspection and Servicing (EDMS No. 003849601), Section 3.0 Frequency, specifies that "inspection shall be conducted once per calendar year with a minimum interval between inspections of 18 months" TransCanada’s task package Control Valve Inspection Canada and Mexico (EDMS No. 0038332589), Section 3.0 Frequency, specifies "the standard frequency for performing the inspection is M12 (12 months)" Valve inspection records were reviewed during the audit (Control Valve Inspection Track WO No. 741331 and Slam Shut Inspection Track WO No. 725105) to confirm implementation of the inspection and maintenance procedures. TransCanada’s procedures for its valve maintenance and inspection are assessed to be in compliance with the requirements of CSA Z662-11.

Emergency Preparedness and Response Procedure

TransCanada’s emergency preparedness and response program (EMP) was not included in the scope of this IMP audit and was therefore not formally assessed.

Summary: Operational Control - Upset or Abnormal Operating Conditions

The Management System Audit Element 3.7, Operational Control - Upset or Abnormal Operating Conditions, requires a company to establish and maintain procedures to identify potential upset or abnormal operating conditions, accidental releases, incidents and emergency situations.

TransCanada has implemented a number of processes and procedures to identify potential upset or abnormal operating conditions. TransCanada’s pipeline infrastructure is monitored remotely 24 hours a day, 365 days a year using a Supervisory Control and Data Acquisition (SCADA) system and is backed up by an onsite standby system. In the event that both of these systems fail due to a catastrophic event, a secondary control centre at a different location contains full duplicate primary and secondary back-up systems.

This audit also found that TransCanada’s pressure-limiting and relieving systems, leak detection, gas quality, alarm call-out, shutdown devices and valve operation systems were all adequate and compliant with the OPR-99 and CSA Z662-11 requirements.

While over-pressure protection for TransCanada’s oil pipeline systems was found to be adequate, the Board has determined the NOVA Gas Transmission Ltd (NGTL) system is not conducting sufficient inspections or audits of its customer installations to ensure that the system is operated in compliance with the OPR-99 and CSA-Z662-11 requirements. Based on that system’s history of over-pressure incidents and the fact that TransCanada has not fully implemented its plan of action to verify compliance with requirements, the company is not in compliance with the OPR-99 and CSA-Z662-11 requirements and is therefore not in compliance with this audit sub-element.

Management System Audit Sub-Element Finding: Based on the documents assessed and interviews with personnel for programs related to over-pressure protection systems on the Alberta (NGTL) System, TransCanada is assessed to be non-compliant with the requirements of the OPR-99 and CSA Z662-11, and is therefore non-compliant with this audit sub-element.

Compliance Status:

Non-Compliant

4.0 Checking and Correction Action

4.1 Inspection, Measurement and Monitoring

Expectations:

The company shall develop and implement surveillance and monitoring programs. These programs should address contract work being performed on behalf of the company. These programs should include qualitative and quantitative measures for evaluating the management and protection programs and should, at a minimum, address legal requirements as well as the risks identified as significant in elements 2.0 and 3.0. The company should integrate the surveillance and monitoring results with other data in risk assessments and performance measures, including proactive trend analyses. The company shall have documentation and records of its surveillance and monitoring programs.

References:

OPR-99 sections 4, 27, 28, 36, 37, 39, 47, 48, 53(1) and 54(1)

CSA Z662-11, Clauses 3.1.2(h)(i), 3.2, 9 and 10

Audit Assessment:

General

During interviews and in documents submitted, TransCanada indicated that it has developed and implemented surveillance and monitoring programs to address the hazards and risks to its pipeline systems. TransCanada’s Engineering and Asset Reliability (E&AR) department is accountable for identifying the relevant programs and for ensuring adherence of these programs to applicable regulations. Subsequent trending and evaluation of the programs provide input to ensure continued effectiveness of the Integrity Management Programs (IMPs).

It was noted that TransCanada’s processes for monitoring and analyzing hazards are identified within the Quality Management, Quality Assurance and Management Review sections of TransCanada’s IMPs.

Surveillance and Condition Monitoring Programs

Gas Quality Monitoring

During the audit, TransCanada identified personnel, such as field technicians and gas controllers, who are trained to identify and manage gas quality off-specification conditions. The governance and systematic approach to managing gas quality are outlined in the Gas Quality Procedure (EDMS No. 003671916). At locations where sour potential is of concern, additional instrumentation, sour bottles and automated equipment are employed to ensure that off-specification gas (>16 ppm H₂S) does not enter the mainline or reach a sales location.

Testing methods used to manage the gas quality can include:

manual water and hydrocarbon dew points;
gas samples (carbon dioxide, oxygen, and heating value);
hydrogen sulphide and total sulphur screening via gas samples and on-line instrumentation;
objectionable material detection via dew point monitoring;
orifice plate inspection;
H₂S gas sniffer analysis; and
scrubber and meter run inspections.

There are currently 292 receipt meter stations with H₂S protection on the NOVA Gas Transmission Ltd. (NGTL) system. The TransCanada philosophy for sour meter station design is to monitor, control, contain, and reject a customer’s gas if off-specification gas is detected. In addition, all receipt and delivery meter stations are screened monthly via gas samples for H₂S and total sulphur levels, and sweet stations are tested monthly through H₂S gas sniffer tubes. Several mainline H₂S analyzers are also installed throughout the NGTL system to detect potential H₂S slugs that may have entered the system.

The audit identified that all TransCanada meter stations and compressor stations contain gas scrubber equipment. Any recovered liquids are measured on a regular basis. Excessive liquid recovery prompts the applicable customer to rectify the problem.

Non-sour off-specification conditions are managed directly with the customers and may include shutting in the customer until the off-specification condition is rectified. As outlined in the TransCanada Operating Procedure (TOP) Meter Station General Maintenance Gas Transmission (EDMS No. 003834481), the typical visitation schedule at TransCanada meter stations is monthly unless otherwise specified. TransCanada stated that the program is considered to be effective as there are no known internal corrosion defects caused by off-specification gas conditions. The absence of significant defects caused by internal corrosion was confirmed during the audit of the Internal Corrosion Threat Management Program.

With respect to specific requirements for gas quality specifications and monitoring, CSA Z661-11 remains silent. The requirements for gas quality fall under identification of hazards and subsequent development and implementation of monitoring programs for the identified hazards. CSA Z662-11, Clause 3.1, Safety and Loss Management System and specifically Clause 3.1.2 states "The safety and loss management system shall include the following elements: (f) operational controls, including the development of procedures for hazard identification and risk management, design and material selection, construction, operations and maintenance, pipeline system integrity management, and security management." TransCanada was assessed to be in compliance with the requirements for control and monitoring of gas quality for its gas pipeline operations.

Table 4.1 summarizes the gas quality indices in the general terms and conditions section of each tariff.

Gas Quality Specifications	NGTL	Canadian Mainline	Foothills (SK) Zone 9	Foothills (BC) Zone 8	TQM
Hydrogen sulphide	23 mg/m³	23 mg/m³	23 mg/m³	23 mg/m³	23 mg/m³
Total sulphur	115 mg/m³	115 mg/m³	230 mg/m³	230 mg/m³	115 mg/m³
Carbon dioxide	Max 2%	Max 2%	Max 2%	Max 2%	Max 2%
Oxygen	Max 0.4%	Max 0.4%	Max 0.4%	Max 0.4%	Max 0.4%
Temperature	49ºC	50ºC	49ºC	43.3ºC	50ºC
Heating value	Min 36 MJ/m³	Min 36 MJ/m³, Max 41.34 MJ/m³	Min 36 MJ/m³	Min 36 MJ/m³	Min 36 MJ/m³
Water	Max 65 mg/m³ or min -10°C @ >8,275 kPa	Max 65 mg/m³	Max 65 mg/m³ or min -10°C @ >,8275 kPa	Max 65 mg/m³ or min -10°C @ >8,275 kPa	Max 65 mg/m³
Hydrocarbon Dew Point	Min -10°C @ operating pressure	Min -10°C @ 5,500 kPa absolute	Min -10°C @ operating pressure	Min -10°C @ operating pressure	Not specified

Sediment and Water Monitoring

Sediment and water (S&W) is a measure of the residual unwanted impurities (water and particulate matter) that are contained in crude oil, which is applicable to the Keystone Pipeline. TransCanada stated that every oil batch is tested for compliance with an S&W maximum of 0.5% of volume as per Article 4.2(ii) of the Keystone Petroleum Tariff agreements. In addition to the manual testing used for custody transfer, the Hardisty terminal is equipped with an online water cut analyzer to continuously measure the receipt water cut, to ensure that off-spec product does not enter the pipeline undetected. Beyond efforts to minimize S&W within the product stream, samples of crude and sediment (sludge) were collected from early cleaning runs across the Keystone Pipeline system in order to assess its corrosivity. TransCanada identified that the exposure tests using these samples validated that, in the absence of sludge, and exposed to pipeline crude only, the corrosion rate was negligible.

Information reviewed identified that the Keystone Pipeline system was designed to minimize the potential for sediment accumulation by having a nominal flow rate that generates a turbulent flow regime (maintains water and sediment suspended and entrained in the crude). Typically, sediment deposition is unavoidable during situations such as line fill and initial start-up. Accordingly, cleaning tools were run the entire length of the system twice after initial start-up. As well, a cleaning tool is also run prior to each in-line inspection (ILI) run. By early 2013 all ILI metal loss runs on the Keystone Pipeline system in Canada will be completed. Re-inspection is currently scheduled on a five-year interval. The ILI data is specifically reviewed for indicators of the initiation and presence of internal corrosion. TransCanada stated that none of the ILI data to date has exhibited evidence of internal, under-sediment corrosion. This was confirmed during the audit of the Internal Corrosion Threat Management Program.

Another consideration in the design of the Keystone Pipeline was the minimization of dead legs, with normal flow through the barrels as one manifestation of this approach. Corrosion monitoring will be performed to confirm ongoing applicability of initial exposure tests during scheduled facility inspections, as per Keystone Facility Piping Non Destructive Inspection (EDMS No. 006790574).

CSA Z662-11, Clause 4.14.3.8(b) states "The designer shall avoid dead-ended piping unless corrosion is mitigated in such piping sections. Consideration shall be given to sizing piping to maintain a flow velocity sufficient to minimize the accumulation of water and sediment." TransCanada’s was assessed to be in compliance with the requirements to design to control and to monitor sediment and water in its oil pipeline operations.

H₂S Content in Crude Oil Monitoring

CSA Z662-11, Clause 16.2.1(b) defines sour service for pipeline systems not containing a gas phase (gas-free liquid pipeline systems), such as the Keystone Pipeline, as "service in which the effective hydrogen sulphide partial pressure exceeds 0.3 kPa at the bubble point absolute pressure".

In its February 2013 response to an Audit Information Request, TransCanada indicated that the crude oil it carries in the Keystone Pipeline does not constitute sour service. During the audit, TransCanada could not demonstrate that the crude oil it carries in the Keystone Pipeline did not constitute sour service (as defined by CSA Z662-11), since it had not conducted any testing to verify the partial pressure of the H₂S at the bubble point absolute pressure.

Subsequently, in April 2013, TransCanada committed to implement a sampling program to verify the H₂S content of all the products it carries on the Keystone Pipeline. In June 2013, TransCanada indicated that it had tested all of its regularly shipped commodities using the standard method Universal Oil Products (UOP) 163-10, which is a potentiometric titration method, to verify the H₂S content of the crude oil. All of the commodity tests produced a modeled partial H₂S pressure less than 0.3 kPa and therefore confirmed the non-sour nature of these products. TransCanada’s report stated that given the conservative nature of the test, additional testing of these products is not intended at this time.

Based on the fact that TransCanada has not monitored the H₂S content of the different batches of products it carries on the Keystone Pipeline, and based on the fact that TransCanada’s planned practice is not to monitor the H₂S content of the different batches of products it carries, or will carry in the future, on the Keystone Pipeline, TransCanada is not in compliance with the requirements of this audit sub-element and CSA Z662-11, Clause 3.2.

Monitoring of Corrosion on Un-Piggable Pipelines

TransCanada’s documentation indicated that the risk assessment and risk management of the external corrosion threat are achieved using either of the following two approaches:

For pipelines where an in-line inspection (ILI) has been completed, the specific anomalies are assessed, and control or mitigation activities are planned based on a defect management approach.
For pipelines where ILI has not been completed, risk mitigation activities are determined based on TransCanada’s risk assessment results (PRIME), subject matter expertise, and applied learnings from other similar segments of pipe across the TransCanada system, including historical performance.

In terms of the NOVA Gas Transmission Ltd. (NGTL) system, it is mostly un-piggable (approximately 25% of the NGTL system has been in-line inspected). TransCanada’s 2013 results from PRIME for the NGTL System indicated that 234 pipeline segments exceeded TransCanada’s stated risk tolerance. The PRIME technical documentation, Section 4, Consequence Models, contains TransCanada’s Societal Risk Acceptance Curve (FN). The Unacceptable Region of the FN curve is where the Societal Risk does not meet TransCanada’s Individual or Societal Risk criteria and these segments are prioritized for risk-reduction activities in the current year’s program.

For NGTL’s un-piggable segments, mitigation programs should normally be applied to reduce the risk to an acceptable level. Documentation submitted by TransCanada indicated that not all of the pipeline segments in the NGTL system exceeding TransCanada’s risk tolerance had mitigation plans for 2013. According to documents reviewed, 160 of the 234 pipeline segments of the NGTL system exceeding TransCanada’s risk tolerances and had no mitigation plans for 2013.

During the audit, TransCanada was asked to justify the absence of mitigation plans for these 160 pipeline segments. In response, TransCanada provided modified risk assessment results indicating that these segments were now acceptable to TransCanada’s risk criteria. TransCanada explained that its modified risk assessment process includes information gathered after inspecting (ILI or direct examination) nearby pipelines in similar condition. The nearby pipeline conditions are now factored in the probability component of the risk assessment, with the result being that all but one of the 160 pipeline segments had acceptable risk results. TransCanada indicated that there are no further mitigation plans for any of the 160 segments, except for the one segment that still exceeded TransCanada’s risk tolerance with the new risk assessment process and for which TransCanada had added a mitigation plan for 2013.

TransCanada did not provide evidence proving the validity of its new risk assessment methodology of using nearby or parallel pipeline information as an adequate way to monitor the integrity of its pipeline segments. The Board notes that this methodology is not an industry recognized method for determining the integrity of a pipeline, as opposed to recognized methods such as ILI, hydrotesting or the NACE External Corrosion Direct Assessment (ECDA) Process. Whether corrosion occurs or not, or is severe or not corrosive, is specific to the local conditions of the pipeline and the pipeline’s interaction with its surrounding environment. Several factors such as manufacturing process, construction practices, cathodic protection (CP) levels, soil type and composition, moisture levels, mechanical damage (1^st, 2^nd, 3^rd parties or pipe/soil movements) could affect the condition of the pipe coating, all of which could affect the susceptibility of the segments to external corrosion. Nearby pipeline conditions can give an indication of the potential corrosivity of an area and conditions of a pipeline, but it is not information that can be relied on to effectively demonstrate the integrity of a pipeline. As such, the Board is of the opinion that nearby or parallel pipeline information cannot be used directly in the risk assessment process.

TransCanada’s monitoring programs for external corrosion on these un-piggable pipeline segments is limited to the Corrosion Control Surveys section covered later in this section. While these programs are common industry practices, monitoring CP systems alone is not a recognized practice for thoroughly assessing the effectiveness of the CP system, which is typically done with pipe-to-soil close interval surveys. Also, for pipelines coated with shielding coatings such as PE Tape, which is the coating on many of TransCanada’s un-piggable segments, CP can be ineffective at preventing corrosion under a disbonded coating condition.

Relying on nearby or parallel pipeline information and CP monitoring as described in the Corrosion Control Surveys section below is not an adequate monitoring method of the external corrosion threat of the un-piggable or non-hydrotested pipelines on the NGTL system. Therefore, TransCanada is assessed to be in non-compliance with this audit element and CSA Z662-11, Clause 3.2.

Overall, the NGTL un-piggable pipeline systems have been characterized by TransCanada as follows:

For small diameter pipelines (<20"):
- Low societal and environmental consequence;
- Probable failure mechanism is leak versus rupture;
- Low probability of ignition; and
- Approximately 56% FBE or extruded polyethylene.
For large diameter pipelines (>20"):
- Low societal and environmental consequence;
- Probable failure mechanism is leak versus rupture;
- Low probability of ignition;
- Approximately 89% FBE or extruded polyethylene; and
- Low performance coated (Ptape) pipes have been 75%-88% hydrotested.

In terms of its current activities and forward plans to address un-piggable pipelines, the Board notes that TransCanada has provided the following information:

Installation of 5 sets of launchers and receivers on the Canadian mainline in 2013;
Completion of CP close interval surveys on un-piggable segments in TQM in 2012 and subsequent ILI and investigative dig inspections in 2013;
Scheduling of 2 ILI runs and 15 investigative digs on the Foothills System in 2013;
Scheduling 21 sets of launchers and receivers and 7 tethered ILI runs for the Alberta System in 2013;
Inclusion in the 2014-2017 budgets plans to install 8 to 10 sets of new launchers and receivers per year in its un-piggable pipeline systems;
Scheduling direct assessment, ILI or hydrotests within the next 7 years for 58 segments that have high consequence, but have high performance coatings;
Scheduling direct assessment, ILI or hydrotests within the next 5 years for 19 segments that are have consequence, but have low performance coatings;
Scheduling ILI by prioritization of 35 segments that have polyethylene tape (Ptape) coatings and pipe diameters greater than 12"; and
Scheduling ILI in 2013/2014 of 8 segments that have high societal risk.

Corrosion Control Surveys

During the audit, TransCanada’s information indicated that the TransCanada Pipe Integrity group is responsible for managing and administering the corrosion control programs for pipeline, pump station and terminal facilities. CP readings are performed by Regional field personnel either at site or via remote monitoring. The requirement for corrosion control monitoring, as outlined in CSA Z662-11, Clause 9, is detailed in TransCanada Operating Procedures (TOPs) Cathodic Protection Rectifier Inspection (EDMS No. 004258831), Cathodic Protection Survey Inspection (EDMS No. 004258833), and Cathodic Protection Rectifier and Bond Reading Inspection (EDMS No. 004258832).

To ensure the proper operation of its CP system, TransCanada inspects all impressed current facilities twelve times in a calendar year, not to exceed an interval of 6 weeks. Annual rectifier inspections are conducted, which involves reading AC inputs, calculating rectifier efficiency, conducting visual inspections and performing maintenance cleaning. Test lead surveys are performed annually to ensure all facilities are receiving adequate cathodic protection levels. In addition to monitoring CP facilities, CP isolation surveys are also undertaken on an annual basis to ensure the applicable facilities are not interfering with the normal operation of the CP system.

When in-line inspection (ILI) data is unavailable, or to further monitor areas of potential concern, close interval surveys (CIS) are used to investigate performance of the cathodic protection system and to assess for external corrosion concerns. CIS surveys augment the annual test lead surveys by investigating CP protection levels between test leads. The requirement for these surveys is based on an engineering evaluation of the area in question. The criteria used to prioritize CIS requirements include previous CP history, Magnetic Flux Leakage (MFL) ILI results, type of coating, stress corrosion cracking (SCC) and corrosion risk assessment results. TransCanada’s corrosion control survey methodology with respect to CP is assessed as compliant with the requirements of this audit sub-element.

Aerial Patrols, Aerial Leak Detection and Ground Based Leak Detection

Regulatory Requirements for Pipeline Patrols

CSA Z662-11, Clause 10.6.1.1 states that "Operating companies shall periodically patrol their pipelines in order to observe conditions and activities on and adjacent to their rights-of-way that can affect the safety and operation of the pipelines. Particular attention shall be given to the following:

construction activity;
dredging operations;
erosion; ice effects;
scour;
seismic activity;
soil slides;
subsidence;
loss of cover; and
evidence of leaks."

CSA Z662-11, Clause 10.6.1.2 states "The frequency of pipeline patrolling shall be determined by considering such factors as

operating pressure activity;
pipeline size;
population density;
service fluid;
terrain;
weather; and
agricultural and other land use".

The OPR-99, section 39 states that "A company shall develop a surveillance and monitoring program for the protection of the pipeline, the public and the environment." Section 53(1) of the OPR-99 states that "A company shall conduct inspections on a regular basis".

In the Unites States, the US Department of Transportation Pipeline and Hazardous Materials Safety Administration (PHMSA) sets out the pipeline patrol requirements in the Code of Federal Regulations (CFR), Part 192 - Transportation of Natural and Other Gas by Pipeline: Minimum Federal Safety Standards (49 CFR 192) in section 192.705 and Part 195 - Transportation of Hazardous Liquids by Pipeline (49 CFR 195) in section 195.412. The United States regulations are mentioned because TransCanada has developed its pipeline patrol program to meet the most prescriptive requirements, which in terms of ROW patrol frequencies, are those set out in the 49 CFR 192 and 195.

During the audit, TransCanada indicated that it implements its pipeline patrols to meet at in accordance with the requirements of CSA Z662-11, Clause 10.6.1.1 Pipeline Patrolling. Aerial patrols are completed to look for construction activity, vegetation, signage, erosion, geotechnical concerns, encroachments, leaks, and water crossings. Patrol frequencies are outlined in the TOPs Aerial Pipeline Patrol (EDMS No. 003672387) and Pipeline Ground Based Patrols (EDMS No. 003875137). All natural gas pipelines are to be patrolled a minimum of two times per year. Liquid pipelines are to be patrolled 26 times per year. Additional patrols are to be completed at increased frequencies as warranted, based on a review of historic observations, levels of activity along the ROW, known integrity concerns, or as may be directed by the applicable regulator. Aerial patrols are to be executed with the use of helicopter or fixed wing aircraft as per the aircraft operating company assigned to complete the patrol. Aerial leak detection for natural gas pipeline systems is a component of the overall leak detection strategy, as are observations from landowners, contractors and employees working near the pipeline. Aerial leak detection is to be performed at least annually on natural gas pipeline systems, as described in Pipe Integrity Leak Detection and Evaluation (TEP-LEAK-INT, EDMS No. 007379105). Aerial leak detection on gas pipeline systems is to be performed with the use of helicopters. Supplemental ground based leak patrols are to be initiated as per the TOP Pipeline Ground Based Patrols (EDMS No. 003875137) either when aerial patrol frequency does not meet the minimum regulatory requirements, or where anomalies identified during aerial leak detection require ground based confirmation.

Both the TransCanada’s TOP Aerial Pipeline Patrol (EDMS No. 003672387), Section 4.2 - Frequency and the TOP Pipeline Ground Based Patrols (EDMS No. 003875137), Section 3.0 - Frequency, address the patrol frequency requirements based on, for example, class location, highway and railroad crossings, levels of activity, integrity concerns and pipeline commodity. While CSA Z662-11, Clause 10.6.1.1 uses the term "periodically" and the OPR-99, section 39 remains silent on the patrol frequency, TransCanada’s patrol frequencies are assessed to be in compliance with the intent of the standard and the regulation with respect to pipeline patrol frequency.

TransCanada’s Aerial and Ground Patrol TOPs, sections 4.4 - ROW Monitoring and 4.6 - Reporting in the former and section 4.1 -Pipeline Ground Based Patrols in the latter, address the pipeline patrol requirements for monitoring and reporting conditions and activities as required by CSA Z662-11, Clauses 10.6.1.1 and 10.6.1.2. The Board examined a random aerial patrol record requested for an incident (OB9_Aerial Patrol Reported_DOC_IIT#233782) related to a sink hole at 10-27-34-5W4 (Keystone Pipeline ROW) reported 23 April 2012 and noted that the record met the requirements for monitoring and reporting. TransCanada’s pipeline patrol TOPs have been developed to address the most stringent, prescriptive pipeline patrol requirements and have been assessed to be in compliance with the standard and regulation.

Facilities Integrity Inspections

During the audit, TransCanada indicated that its Facilities Integrity Inspections procedure (EDMS No. 003857228) for gas transmission facilities and Keystone Facilities Integrity Inspections procedure (EDMS No. 006787339) for liquid facilities are designed to ensure that critical equipment is functioning as intended. Mechanical, electrical, civil and environmental components are to be inspected at intervals as described in these documents.

At liquid facilities, the Keystone Facility Piping Non Destructive Inspection (EDMS No. 006790574) Task Package is used. The purpose of this Non Destructive inspection package is to determine the condition of pressure piping and associated fittings, including the coating and insulation, and is designed to ensure fitness for service and proactively identify applicable maintenance requirements. TransCanada was assessed to be in compliance for its inspection program of its liquid facilities.

As described in the following evaluation of TransCanada’s inspection program for high pressure station piping for its gas facilities, TransCanada’s previous facility pipe integrity program was managed under the Integrity Management Process for Pipelines (EDMS No. 003892900). Chapter 7 of this document, Facility Pipe Integrity, contained sections which described, in general terms, the background descriptions for:

corrosion control (section 7.1.1);
overpressure protection (section 7.1.2);
mechanical damage (section 7.1.3);
operating/maintenance procedures (section 7.1.4);
employee/contractor training (section 7.1.5);
localized attack mechanisms (section 7.2);
soil-to-air interface (section 7.2.1);
contact corrosion (section 7.2.2);
corrosion under insulation (section 7.2.3); and
erosion and corrosion/erosion (section 7.2.4).

The Board is of the view that these generic background descriptions do not provide the level of specificity required for the implementation of an adequate and effective gas facility pipe inspection program. Therefore, as the following evaluation has concluded, TransCanada’s gas facility inspection program is not in compliance with the requirements of this audit element and with CSA Z662-11, Clause 3.2.

High Pressure Station Piping (Gas Facilities)

The audit identified that TransCanada utilizes different methods to monitor its facility piping integrity. The methods include regular site visits, annual CP surveys, visual inspection, and preventative maintenance activities such as valve and valve operator inspections. Visual inspection is performed at facilities during planned facility inspections, facility pipeline projects, and regular site visits. Hazardous or abnormal conditions, such as leaks or frost heaved piping, are to be checked for during site visits. Issues identified are to be communicated through the company Incident and Issue Tracking (IIT) system for follow-up. In regions where atmospheric corrosion is more of a concern due to a more humid environment, such as the Eastern region, a riser assessment program was recently implemented to assess external corrosion on the risers at the air-to-soil interfaces and other locations where atmospheric corrosion also could be present, such as between supports the piping. As part of the audit verification process, NEB staff conducted an inspection on 6 June 2013 of the riser assessment program in Quebec that demonstrated the implementation of this program and no non-compliances were identified during the inspection.

TransCanada indicated that only a limited number of excavations with the primary purpose of performing a direct examination of the integrity of the station piping have been done so far, but that some opportunistic excavations (due to maintenance or modifications for example) have been used to assess the condition of the buried station piping at some locations. TransCanada provided records of these opportunistic facility piping inspections, which included:

Field Lake Compressor Station (NGTL) for external corrosion, 7 May 2011;
Mainline Rideau Riser Assessment and Recoat Project for atmospheric corrosion, September 2012;
Mainline Quebec Riser Assessment and Recoat Project for atmospheric corrosion, September 2012;
TQM Riser Assessment and Recoat Project for atmospheric corrosion, September 2012;
Mainline Maple and Niagara Riser Assessment and Recoat Project, September 2012; and
Torrington Compressor Station / Storage Facility for external corrosion, September 2012.

TransCanada stated that it has assessed the risk of external corrosion as being low for its station piping, taking into consideration the fact that the station piping is operating at a lower stress level than the main line pipe, that there are no unresolved CP issues at its stations, and because it has never had a rupture and was not aware of any leak on the pipe body at any of its stations.

As previously described, TransCanada’s station piping was managed under the Integrity Management Process for Pipelines - Revision 2 process. Review of Sections 7.3 and 7.4 of this process indicates that the integrity monitoring program was focused on the above ground piping and limited to CP monitoring, leak surveys and opportunistic excavations for standard monitoring of the below ground piping. Review of these sections also indicated that only if issues with CP or external corrosion were identified would inspection techniques such as ILI, direct assessment or leak testing be used. Therefore, a proactive or adequate monitoring program was not in place for the integrity of the station piping prior to the new Facility Pipe Threat Management Program, which was approved by TransCanada management for use in December 2012, has not yet been fully implemented throughout TransCanada’s gas facilities.

The audit identified that, at the time of the audit activities, TransCanada has not conducted adequate direct assessments, hydrotests or ILI programs to assess the potential for external corrosion of its below-ground station piping. With the exception of the riser assessment program in the Eastern region, where the station risers are exposed for approximately 50 cm, there has not been a formal system-wide assessment for potential external corrosion of its below-ground or air-to-soil interface station piping. Where there is no riser program in place, the integrity monitoring for the below-ground or air-to-soil interface station piping is limited to CP pipe-to-soil potential and rectifier monitoring and a limited number of opportunistic excavations.

Although TransCanada stated that, to its knowledge, it has not yet identified any external corrosion issues on its below-ground station piping, the methods used by TransCanada are not adequate to demonstrate the appropriate integrity management of the station piping and TransCanada is therefore determined to be non-compliant with the requirements of this audit element and with CSA Z662-11, Clause 3.2.

Tank Inspections

TransCanada operates oil storage tanks as part of its Keystone Pipeline system at Hardisty, Alberta. Storage tanks are to be inspected as per CSA Z662-11, Clause 10.9, Operation and Maintenance of Facilities and Equipment. Specifically, CSA Z662-11, Clause 10.9.2, Aboveground Tanks and Pressure Vessels and sub-clause 10.9.2.1 states that "the inspection, repair, alteration, and reconstruction of aboveground atmospheric steel tanks shall be as specified in API 653".

API 653, Tank Inspection, Repair, Alteration and Reconstruction, Section 4 - Inspection, details the requirements for internal and external inspections as well as for the requirement that the inspections be carried out by an Authorized Inspector. Intervals are specified in Sections 4.2.2 for external inspection and 4.4.2 for internal inspection. Section 4.4.3 provides for an alternative to the procedures in 4.4.2 where an owner-operator may establish the internal inspection interval using a risk-based inspection (RBI) procedure.

TransCanada has developed the TOP API 653 Aboveground Storage Tank Inspections (EDMS No. 007167240) for inspection of its aboveground storage tanks. Section 3.0 Frequency, of this procedure specifies the standard inspection intervals (expressed as months, for example M12 is every 12 months) as follows:

Routine In-service Inspections: M01;
Internal/External Floating Roof Tanks Secondary Seal Inspection: M12;
External Visual Inspection: M60 (Adjust inspection interval based on the condition of the Tank);
External Ultrasonic Thickness Inspection: M60;
Internal/External Floating Roof Tank Primary Seal Inspection: M60; and
Internal Inspection M120.

Section 4.0 Procedures, details the requirements for the following:

routine in-service inspections;
internal floating roof tanks secondary seal inspection;
external floating roof tanks secondary seal inspection;
external visual inspection;
external ultrasonic thickness inspection;
internal/external floating roof tank primary seal inspection;
internal inspection;
inspection locations; and
documentation / reporting requirements.

TransCanada requires that its inspectors are certified to API 653 (i.e. Authorized Inspectors) and that the inspection reports are reviewed by TransCanada engineers who are competent in aboveground storage tank design, operation and maintenance. TransCanada provided records of aboveground storage tank inspections at the Hardisty terminal indicating that the frequency and extent of inspections met the requirements of API 653. TransCanada also provided records of its aboveground storage tank inspector qualifications which included API 653 certified storage tank inspector.

The Board has determined that TransCanada’s procedures for inspection of its aboveground storage tanks are in compliance with the requirements of CSA Z662-11 and API 653.

TransCanada’s facilities also have underground tanks, commonly referred to as "drip tanks". CSA Z662-11, Clause 10.9.3 Underground Storage and specifically Clause 10.9.3.1 states "underground tanks shall be inspected periodically and maintained as necessary. The inspection program shall include the periodic monitoring of any leak detection systems".

TransCanada has developed two TOPs for underground drip tank inspections: Underground Drip Tank Inspection (EDMS No. 003719673) and Underground Drip Tank Inspection Task Package (EDMS No. 003719218) to comply with CSA Z662-11, Clause 10.9.3. The Underground Drip Tank Inspection procedure, Section 3.0 - Frequency, prescribes a frequency of M36 (36 month inspection interval) for its drip tank inspections. TransCanada provided a list of stations containing underground drip tanks that are to be included in its M36 inspection procedure and samples of records of past underground drip tank inspections.

The Board has determined that TransCanada’s procedure for inspection of its underground drip tanks is in compliance with the requirements of CSA Z662-11, Clause 10.9.3.1.

Boiler and Pressure Vessel Inspections

During the audit, TransCanada indicated that its boiler and pressure vessel inspections are carried out in accordance with the Quality Assurance Manual (QAM) for the Integrity Management of Pressure Equipment Including Repairs and Alterations (EDMS No. 003722000). This procedure is based on the API 510 Pressure Vessel Inspection Code, Alberta inspection standards and industry practice. The inspection of pressure vessels follows the TOP Pressure Vessel External and Internal Inspection (EDMS No. 003694710), under the direction of TransCanada’s Chief Inspector for pressure equipment. Pressure vessel inspections are documented and the vessels are certified for continued service by the Chief Inspector. The Pressure Vessel Integrity Plan (EDMS No. 003763099) is reviewed periodically by Facilities Engineering to review risks and to direct future inspection programs. Heating boiler inspections are carried out in accordance with Part 5 of the Canada Occupational Health and Safety Regulations by the provincial jurisdictional authority or by an insurance company authorized by the provincial jurisdictional authority. Occasionally in Alberta (only), heating boiler inspections are carried out by the Chief Inspector, as authorized by the provincial jurisdictional authority.

TransCanada provided a sample of the qualification records for its Chief Inspectors, who are employees of TransCanada, which included:

ABSA In-Service Boiler and Pressure Vessel Inspector;
National Board Commissioned Inspector;
API 510 Pressure Vessel Inspector;
API 570 Pressure Piping Inspector;
API 653 Storage Tank Inspector;
API 580 Risk-Based Inspection;
ABSA Welding Examiner;
CSA W47.1/CWB Welding Supervisor;
IIW International Welding Engineer; and
CSA W178.2/CWB Welding Inspector Level 3.

Additionally, the Chief Inspector qualifications included membership in the following:

Professional Engineer of APEGA
Technical Committee Member of CSA B51 Boiler, Pressure Vessel and Piping Code
Member of Upstream Chief Inspector Association
Member of American Society of Non-destructive Testing

TransCanada’s QAM applies to approximately 2500 vessels and boilers registered in the province of Alberta in a quality management system registered with ABSA, the Pressure Equipment Safety Authority in Alberta. Section 11 of the QAM specifies the inspection intervals for pressure equipment, including pressure vessels, boilers, pressure relief valves based on the requirements of API 510 and API 572 (pressure vessels), API 570 (pressure piping), API 574 (piping system components) and API 576 (pressure relieving devices) as well as the inspection requirements of the National Board Inspection Code (NB23) and ABSA’s Inspection and Servicing Requirements for In-Service Pressure Equipment (ABSA AB-506).

At the Board’s request, TransCanada provided samples of inspection records for its pressure equipment; a 2012 internal audit of its QAM; a 2011 audit by ABSA of TransCanada’s Pressure Equipment Integrity Management System; a 2011 internal audit report at CrossAlta Gas Storage Facility for the Owner-User Pressure Equipment Integrity Management System; and a 2010 internal audit for the QAM Owner-User Program for the Integrity Management of Pressure Equipment Including Repairs and Alterations.

The Board has determined that TransCanada’s procedures for inspection of its pressure equipment are in compliance with the requirements of the applicable codes and standards.

Geotechnical Monitoring

Regulatory Requirements for Geotechnical Monitoring

CSA Z662 clause 10.6.1.1(f), (g) and (h) address the requirements for pipeline monitoring for geotechnical issues. This clause states that "Operating companies shall periodically patrol their pipelines in order to observe conditions and activities on and adjacent to their rights-of-way that can affect the safety and operation of the pipelines. Particular attention shall be given to the following:

f. seismic activity;
g. soil slides; and
h. subsidence".

In terms of the required frequency of the pipeline monitoring activities, CSA Z662-11, Clause 10.6.1.2 states "The frequency of pipeline patrolling shall be determined by considering such factors as

operating pressure activity;
pipeline size;
population density;
service fluid;
terrain;
weather; and
agricultural and other land use".

The OPR-99, section 39 states that "A company shall develop a surveillance and monitoring program for the protection of the pipeline, the public and the environment" Section 53(1) of the OPR-99 states that "A company shall conduct inspections on a regular basis".

Based on audit interviews and documents reviewed, the Board noted that geotechnical hazards, such as susceptible landslide locations, are identified in a Phase 1 Geo-Hazards Assessment, as described in the Weather and Outside Forces (WOF) Threat Management Program (TEP-ITM-WOF, EDMS No. 005767611). As per Section 5, Roles, Responsibilities and Qualifications of the WOF procedure, higher risk sites are further assessed by TransCanada senior geotechnical engineers (E4-5 classification and evidenced by records requested during the audit and provided by TransCanada). Appropriate actions (e.g., regular inspection and monitoring, slope remediation) are taken based on the results of the assessment. Geotechnical and river crossing monitoring activities are supplemented by TransCanada’s Aerial Pipeline Patrol program and by field personnel observations. TransCanada’s IIT system is used to track issues related to geotechnical remediation and monitoring programs for follow-up and resolution.

TransCanada’s Weather and Outside Forces Threat Management Program (WOF) (TEP-ITM-WOF, EDMS No. 005767611), contains Section 6 Background, which describes the threat types that are to be evaluated during the execution of the geotechnical monitoring program. These include:

6.1.1 Landslides;
6.1.2 Seismic events;
6.1.3 Fault planes;
6.1.4 Subsidence and heave;
6.1.5 Water flow; and
6.1.6 Meteorological events.

Appendix A of TransCanada’s WOF provides a Geological Hazards Classification Summary for the above threats, with quantitative descriptions of the threat classifications of low, medium and high. The threat classifications guide the risk assessment process and subsequent remediation, mitigation and monitoring programs as per the WOF Management Procedure illustrated in Figure 7-1 of the WOF TEP and the procedural steps detailed in Section 8 of the WOF.

During the audit interviews, TransCanada stated that it has performed a Phase 1 survey for all of its pipeline systems. At the Board’s request, TransCanada provided samples of the following documents and records of its Phase I Geo-Hazards Assessments:

Phase I Implementation of Rainfall Ground Movement Models (September 1999);
Visual Inspection of Slopes: Summary of Observations for 11 Slopes in Northern Alberta (11 October 2001);
Unnamed Creek Cranberry Lake Lateral Geotechnical Instrumentation Installation Report (20 January 2003);
Pembina River Slope Stability (20 October 2001); and
Keystone Canada Phase I Geohazard Assessment (2010).

The Board also requested that TransCanada provide examples of its Phase II and Phase III surveys. TransCanada provided an example of the TQM Phase I, followed by a Phase II survey for TQM and well as examples of Phase III surveys with the following descriptions:

"Cranberry Lake Lateral, Unnamed Creek SW-22-85-20-W5 site was identified in the 1999 Phase 1 report as having a medium potential for ground movement. A subsequent Phase II study was completed in 2001, and findings documented in a 2001 report titled "Summary of Observations for 11 Slopes in Northern Alberta". In order to mitigate the risk to the pipeline, a Phase III investigation, which resulted in the installation of slope monitoring equipment, was completed in 2003".
"Edson Mainline, Pembina River SW-28-48-15-5 site was identified in the 1999 Phase I report as having a high potential for ground movement. A subsequent Phase II study was completed in May 2000 to assess the site conditions. The findings were documented in a technical memorandum titled "Assessment of Slope Movement Potential, Site Visit Report". The Phase III assessment, which included a ground survey, was completed in 2001".

During the audit, it was observed that TransCanada’s WOF program did identify areas of geological sensitivity, but this information did not appear to influence the scope and/or frequency of the geological hazard patrol program. TransCanada responded to this audit observation by stating that "TransCanada determines the scope and typical frequency of ROW patrol based on class locations, history of the lines, and other factors. Additional patrols are initiated in response to unforeseen geotechnical and meteorological events. TEP-ITM-WOF Section 8.4 Step 35 specifies that an aerial or ground survey shall be performed when investigating significant meteorological events; Section 8.4 Step 27 specifies that an aerial or ground survey shall be performed to investigate areas where earthquake magnitudes exceed 0.2 g peak ground acceleration. Identifying geotechnical threats is a part of the ROW patrol, but usually not a main factor that dictates the frequency of the patrol, because geotechnical threats, once identified, are dealt with separately in its own systematic way. Once an area of geological sensitivity is identified and verified through ground investigation, we install monitoring equipment and perform regular ground inspections. There are sites of active ground movement (Simonette River crossing for instance) where we have inspection and monitoring up to three times a year, in addition to regular aerial ROW patrol. Our experience so far has demonstrated that the regular scheduled aerial patrols supplemented by additional ground inspections/monitoring at sensitive areas have been effective in identifying WOF related hazards before they become threats to the integrity of our pipelines."

The Board has determined that TransCanada’s program for geotechnical monitoring is in compliance with the requirements of CSA Z662 clause 10.6.1.1(f), (g) and (h), clause 10.6.1.2 and the OPR-99 sections 39 and 53(1).

Water Crossing Surveys

Regulatory Requirements for Water Crossing Surveys

CSA Z662-11, Clauses 10.6.4.1 and 10.6.4.2 detail the requirements for pipeline crossings of water bodies.

Clause 10.6.4.1: "Special consideration shall be given to the inspection and maintenance of pipeline crossings of (a) major utilities; (b) other pipelines; (c) railways; (d) roads; and (e) water".

Clause 10.6.4.2: "Underwater crossings shall be inspected periodically for adequacy of cover, accumulation of debris, and other conditions that can affect the safety or integrity of the crossing".

TransCanada’s pipeline systems have numerous water crossings that require inspection and monitoring programs. During the audit interviews, TransCanada indicated that periodic inspections are conducted at stream crossing locations of concern for adequacy of cover, accumulation of debris, and other conditions that may affect the safety or integrity of the crossing. Underwater depth of cover surveys are performed at selected stream crossing locations based on size of stream bed, visibility during aerial patrols, results of previous surveys, potential for mechanical damage, and severity of identified consequences. Minimum stream crossing cover specifications and stream crossing survey procedures are found in the TOP Pipeline Underwater Inspections (EDMS No. 003671756).

During the audit interviews, the Board noted that TransCanada’s geological hazards classification summary refers to geotechnical threats and erosion threats, but the WOF program does not cover soil erosion and/or flooding threats. The Board requested that TransCanada address this concern. TransCanada’s response was as follows:

"The Geological Hazards Classification Summary in the TQM Phase I Geo-hazard Assessment reports refers to slope stability and erosion as two main geotechnical threats that could impact pipelines on the TQM system. They are addressed in the TEP-ITM-WOF Weather and Outside Forces Management Program somewhat differently due to nature of the threats with respect to integrity. Slope stability impacts pipe integrity in a direct way, so actions dealing with slope movement are clearly defined in the TEP. Soil erosion itself is not an integrity threat, until it leads to pipe exposure. As such, TransCanada does not address soil erosion in the TEP-ITM-WOF. Rather the procedures in dealing with pipe exposure are outlined and documented in Steps 40 to 49 (page 20 to 22) of the TEP-ITM-WOF.

The document, TEP-ITM-WOF Weather and Outside Forces Management Program contains the following references to flooding:

The definition of a "weather and outside force integrity event", (page 9), defines floods as among the events that may impact the integrity of the pipeline.
Section 6.1.5 describes water flow events, including floods that could lead to pipe exposures and therefore increase the potential for mechanical damage.
Section 8.2, step 8 instructs the reader to identify areas of exposed pipe or having the potential to become exposed. Flooding is directly mentioned in that step.
Section 8.4, steps 28 to 33 are applied "when investigating significant flooding.
Section 8.4 Step 35 instructs the reader to perform and aerial or ground survey when investigating significant meteorological events.

The potential threat of stream erosion, which could lead to pipe exposure, is managed through regular underwater survey in major stream crossings. The TEP-ITM-WOF Section 8.2, step 8 states "Identify exposed pipe locations and areas of potential exposure from underwater surveys. The underwater surveys are performed as described in TOP Pipeline Underwater Inspections, (EDMS 003671756). During the audit, the Board reviewed TransCanada’s water crossing monitoring procedures and assessed them to be in compliance with the requirements.

Summary: Inspection, Measurement and Monitoring

The Management System Audit Element 4.1, Inspection, Measurement and Monitoring, requires a company to develop and implement surveillance and monitoring programs including contract work being performed on behalf of the company. These programs are expected to include measures for evaluating the management and protection programs.

Based on documents and records reviewed, the audit determined that TransCanada has developed and implemented a number of effective inspection, measurement and monitoring programs. This includes but is not limited to:

Sediment and water monitoring and mitigation programs to prevent and reduce internal corrosion on the Keystone pipeline system;
Conducting both aerial and ground-based pipeline patrols in accordance with CSA Z662-11 requirements with additional patrols as warranted or as directed by the regulator;
Development of monitoring programs to evaluate specific geotechnical hazards in each operating region; and
Regular inspection and monitoring of sensitive areas including river crossings and susceptible landslide locations.

Other sections of this sub-element were identified as non-complaint with regulatory requirements due to inadequate or incomplete program implementation. This included:

TransCanada’s position that ongoing monitoring of all shipped commodities for sour crude on the Keystone pipeline is not required since recent testing confirmed the current non-sour nature of these products;
TransCanada’s inability to produce sufficient evidence proving the adequacy of its ongoing integrity management programs for corrosion on unpiggable sections of the NGTL system; and
background descriptions for the facility pipe inspection program that were too generic and did not provide the level of specificity required for adequate, effective and consistent implementation.

Management System Audit Element Finding: Based on the documents assessed and interviews with personnel as it relates to: monitoring of Hydrogen Sulfide (H₂S) in crude oil in the Keystone Pipeline; monitoring of external corrosion on the Alberta (NGTL) System’s unpiggable pipelines; and the integrity monitoring of below-ground station piping on all of TransCanada’s facilities, TransCanada is assessed to be non-compliant with the requirements of the OPR-99 and CSA Z662-11, and is therefore non-compliant with this audit sub-element.

Compliance Status:

Non-Compliant

4.2 Corrective and Preventive Actions

Expectations:

The company shall have a process to investigate incidents or any non-compliance that may occur. The company shall have a process to mitigate any potential or actual issues arising from such incidents or non-compliances. Such mitigation may include appropriate timing and actions for addressing the issues that arise. The company shall demonstrate that it has established a documented procedure to:

set criteria for non-compliance;
identify the occurrence of any non-compliances;
investigate the cause(s) of any non-compliances;
develop corrective and/or preventative actions; and
ffectively implement the required corrective and/or preventative actions.

The company shall develop procedures to analyze incident data in order to identify deficiencies and opportunities for improvement in its management and protection programs and procedures.

References:

OPR-99 sections 4, 6 and 52

CSA Z662-11, Clauses 3.1.2(g) and 3.1.2(h)(i), 3.2, 10.3.6, 10.4.4 and 10.5

Audit Assessment:

Incident Management System

During interviews and in documents submitted, TransCanada indicated that it has an Incident Management System (InMS), which is a set of management tools and processes used to investigate incidents or any non-compliance. Within the InMS, TransCanada has the Incident and Issue Management Program (InMP), which utilizes the following tools:

An Incident and Issue Tracking (IIT) system, which is an electronic database tool used to report and track the investigation of an incident, a near-hit or an identified non-compliance. The criteria for incidents, near-hits and non-compliances are listed on the company’s IIT incident summary sheet.
A Classification Guide, which is a document defining the incident and issue event types reportable in the IIT system. These are a detailed breakdown of the event types into four levels of severity (Minor, Serious, Major and Critical).
An InMP website, which is the TransCanada internal website that provides reference material, investigation templates, documentation, and manual forms.

TransCanada’s Incident Management System, with its criteria for incident classification and investigation were assessed to be in compliance with the requirements of CSA Z662-11, Clause 10.3.6, Pipeline system incident investigations.

Issue Management Program

TransCanada provided information on the six main steps in its InMP, as follows:

Response: All TransCanada employees and its contractors are expected to participate in the InMP. They are responsible for recognizing that an incident or issue has occurred and for alerting the appropriate personnel in the event of an incident occurrence.
Notification: Once the response has taken place, an employee is to enter the incident into the IIT system, which is responsible for the notification of applicable personnel and regulatory agencies.
Investigation: All incidents and issues are to be reviewed. The level of rigor of investigation of each incident is dependent on the severity of the incident. Once investigation findings have been determined, appropriate corrective and preventive actions are to be identified and implemented to minimize or avoid future incidents.
Documentation and Implementation: Documented recommendations are updated into IIT and/or incorporated into TransCanada’s Integrity Management Programs (IMPs), as appropriate.
Follow-up: Once the recommendations have been implemented, follow-up is to take place to ensure the recommendations were successful in addressing the incident or issue.
Sharing of Learnings: The final step of the InMP is to share the learnings with TransCanada’s employees, contractors and external parties, with the goal of preventing a future undesirable consequence from occurring.

CSA Z662-11, Clause 3.1, Safety and Loss Management System, and specifically Clause 3.1.2h)(i) states "The safety and loss management system shall include the following elements: (h) a continual improvement process, including performance monitoring for the ongoing assessment of conformance with the requirements of the safety and loss management system, and the mechanisms for taking corrective and preventive measures in the event of nonconformance". In addition, CSA Z662-11, Clause 10.3.6, Pipeline system incident investigations, states "Operating companies shall investigate damage incidents related to external interference and failure incidents to determine their causes. Measures to prevent the occurrence of incidents due to similar causes shall be identified and implemented". TransCanada’s procedures for incident management were assessed to be in compliance with the requirements, but as discussed under the topic of Incident Reporting, TransCanada’s incident reports lack detail with respect to preventive actions, follow-up and sharing of learnings. TransCanada has committed to working with the Board to improve the level of detail in its DIRs.

Incident and Issue Tracking (IIT)

During the course of this audit and in response to an Audit Information Request, TransCanada provided evidence of its analysis of six incident types:

overpressure of pipelines and/or facilities piping;
pump station leaks;
other station releases;
pipe body leaks and pipe body ruptures; and
uninterruptable power supply (UPS) battery incidents.

The purpose of the interviews and document reviews relating to these incident types was to assess whether TransCanada had effectively implemented its IMS processes and procedures to identify the incident root cause(s), implement adequate and effective corrective and preventive action(s), and adequately and effectively followed its InMP processes and procedures for follow-up and sharing of learnings from the incidents, particularly for incidents related to TransCanada’s IMPs. As discussed under the topic of Incident Reporting, TransCanada’s incident reports lack detail with respect to preventive actions, follow-up and sharing of learnings. TransCanada has committed to working with the Board to improve the level of detail in its DIRs.

Integrity Threat Management Scorecards

TransCanada also submitted documents (Integrity Threat Management Scorecards) to demonstrate that it had compiled and analyzed key performance indicator (KPI) and incident data. The Scorecards submitted and reviewed were:

Internal Corrosion;
External Corrosion;
Mechanical Damage;
Construction Defects;
Weather and Outside Forces;
Manufacturing Defects;
Equipment;
Stress Corrosion Cracking (SCC);
Leaks and Ruptures;
Engineering and Asset Reliability IIT; and
Customer Perfect Days.

In addition, TransCanada submitted the document "Gas Release-Leak (Canada) 2007-2012 Chart Q4r1.xls" that compiled the gas releases reportable to the Board from 2007 to 2012. TransCanada presented these figures as evidence of its process to analyze and trend incidents and their root causes. The document submitted contained histogram representations of the trends and/or causal factors relating to the gas releases as follows:

Figure 1: Gas Leak and Release Trends;
Figure 2: Gas Leak Breakdown, (Causal Factors);
Figure 3: Electrical / Instrument / PLC Failures;
Figure 4: Gaskets / Packing / O-ring / Etc.; and
Figure 5: Piping / Tubing / Fittings.

TransCanada’s Scorecards contained information on the individual threat management programs, including: goals and objectives; failure statistics (incident rates x 10³ per km.yr) due to each threat; in-service leaks and ruptures; and histograms and pie charts of threat related data. The Scorecards were assessed to be in compliance with CSA Z662-11, Clause 10.3.6, Pipeline system incident investigations.

Non-Compliance Process

TransCanada stated that it has a systematic approach to addressing non-compliances. Non-compliances at the IMP level, and non-compliances with regulations and codes, are addressed and tracked through its IIT system. Corrective actions, including completion dates and follow-up, are assigned to specific individuals in the IIT system. The status of IIT incidents and issues, and action items, are reviewed by management monthly. In addition to day-to-day monitoring, non-conformances are identified through the following: audit findings (external and internal); process reviews, including TransCanada’s Operating Procedures (TOPs); and incident investigations (failures, near-hits).

Pipelines (Oil and Gas)

For its pipeline systems (gas and liquids), TransCanada stated that corrective and preventive actions identified through internal audit findings are consolidated in an action log. The audit log lists identified actions to address the deficiencies, responsible individuals, completion dates and status. The status of corrective or preventative actions is included in the CDN-LIQ-IMP Annual Review and Improvement Report. Process Reviews of procedures are conducted annually, as described in the Pipe Integrity Process Review Procedure.

Facilities

For its facilities, TransCanada stated that corrective actions are also identified, investigated, evaluated and prioritized, based on the engineering discipline and equipment type, using other systems such as the TransCanada Operating Procedures (TOPs), Avantis (TransCanada’s work management system) and health monitoring motor trending. Other tools, such as a Decision Support System (DSS), health monitoring, and pressure vessel and tank investigations, are used to complete trending analyses to determine if further actions are required for systemic issues and if these actions need to be tracked in a corrective log with monthly review by all stakeholders. Actions are then implemented in the General Plan Maintenance Capital (GPMC) program or the Preventive Maintenance (PM) program, which determines whether the risk is tolerated, terminated or transferred.

TransCanada stated that it ensures that corrective actions are implemented and followed up as part of the management review process. Management review includes monitoring the status of corrective and preventive actions in IIT monthly, and reviewing program performance measures to determine the effectiveness of the overall program.

Assessment of TransCanada’s InMS and InMP determined that within its internal processes and procedures, TransCanada has demonstrated compliance with the requirements of this audit element for its facilities. As discussed in the following text, TransCanada’s incident reporting, in the form of Detailed Incident Reports (DIRs) submitted to the Board, lacks detail with respect to preventive actions, follow-up and sharing of learnings.

Incident Reporting

In a meeting held 7 March 2013 to discuss TransCanada’s DIRs, it was communicated to TransCanada that: the DIR corrective actions were assessed to be generally adequate; preventive actions tended to address local issues only; and incident follow-up and sharing of learnings were generally inadequate. TransCanada stated that the timeframe of submitting its DIRs to the Board and its internal incident investigation processes accounted for the discrepancies in the level of detail. That is, its DIRs are written and submitted more immediately following an incident, whereas its internal incident processes are generally conducted in detail some months later. To address the issue, TransCanada committed to working with the Board to improve the level of detail in its DIRs, and both the Board and TransCanada have committed to improving their communications with respect to TransCanada meeting the Board’s expectations for incidents investigation and reporting.

Reporting of Non-Compliances

TransCanada was asked to provide its policies and procedures for the internal reporting of non-compliances. TransCanada stated that there are many available outlets for employees to bring concerns forward to TransCanada’s management. These included the Incident and Issue Tracking (IIT) system; Ethics Help line; informal and formal reports to technical managers, non-conformance reports (NCRs); and the TransCanada Code of Business Ethics policy and procedures. TransCanada stated that employees are trained on these procedures during the onboarding process and through the annual employee Code of Business Ethics policy training and certification. TransCanada’s internal Human Resources website provides employees with a list of the Compliance Coordinators for different areas of the company and a link to this document was, and continues to be, accessible to employees in the "Raise the Concern" section of the website. TransCanada stated that its management encourages open and honest discussion of all areas of concern and promotes an environment where safety is the paramount goal. TransCanada provided the following documentation to support its internal reporting of non-compliances:

TransCanada Code of Business Ethics (TRP901-a77en);
Code of Business Ethics Policy (EMDS No. 003721479);
Ethics and Compliance (website printout);
Ethics and Compliance organization (website printout);
Ethics Help Line (website printout);
List of Compliance Coordinators by Department (3 page document containing 12 coordinators for pipelines);
Raising a Concern (website print out); and
Frequently Asked Questions (website printout).

Summary: Corrective and Preventive Actions

The Management System Audit Element 4.2, Corrective and Preventive Actions, requires a company to have a process to investigate incidents or any non-compliance that may occur, including a process to mitigate any potential or actual impacts arising from the non-compliances. The company is also required to develop procedures to analyze incident data in order to identify deficiencies and opportunities for proactive improvement.

During the course of this audit, TransCanada provided evidence of its analysis of possible incident types. The company also demonstrated it had compiled and analyzed key performance indicator data in order to assess trends and establish root causes of incidents.

The Board noted that TransCanada’s internal non-compliance and incident reporting processes were adequate but could be more detailed in the areas of preventative action and information sharing across the company. TransCanada has committed to improving the level of detail in these items.

Compliance Status:

Compliant

4.3 Records Management

Expectations:

The Company shall establish and implement procedures to ensure that the records supporting the management and protection programs are retained, accessible and maintained. The Company shall, as a minimum, retain all records for the minimum lengths of time as required by the applicable legislation, regulation and standards incorporated by reference into the regulation.

References:

OPR-99 sections 4, 41 and 56

CSA Z662-11 Clauses 3.1, 3.2, 9.11, 10.4 and 10.5

Audit Assessment:

This Management System sub-element was not formally assessed during the Integrity Management Program audit.

Compliance Status:

Not Assessed

4.4 Internal Audit

Expectations:

The company shall develop and implement a documented process to undertake audits of its management and protection programs and procedures. The audit process should identify and manage the training and competency requirements for staff carrying out the audits. These audits shall be conducted on a regular basis.

References:

OPR-99 sections 4, 53 and 55

CSA Z662-11, Clauses 3.1.2(c) and 3.1.2(h)(iii)

Audit Assessment:

General

During interviews and in documents submitted, TransCanada stated that the mandate of TransCanada’s internal audit department (Internal Audit) is to act as an independent assessor, reporting on the company’s system of internal controls, governance and risk management processes. Internal Audit reports functionally to the Audit Committee of the Board of Directors and administratively to the Chief Compliance Officer. Internal Audit is authorized to perform internal audits, including those involving Integrity Management Programs (IMPs). For TransCanada’s IMPs, Internal Audit follows a maximum interval between audits of three years.

The following IMP documents state the requirements of TransCanada’s internal audit program:

Gas Pipeline IMP, Section 4.10;
Liquid Pipeline IMP, Section 11.3.5; and
Plant IMP, Section 2.5.2.

On a one to three-year basis, all procedural documents are reviewed for effectiveness by document owners and other shareholders. With respect to the IMPs, the engineering procedures are reviewed annually following the Pipe Integrity Process Review Procedure (TEP-INT-PR, EDMS No. 006522487). The effectiveness of the process and management system elements within each document is reviewed to identify non-compliances/non-conformances and/or areas requiring improvement.

Internal audits are conducted by TransCanada personnel that are independent of the areas to be audited, consistent with Annex N "Guidelines for pipeline system integrity management programs" of CSA Z662-11, specifically Clause N.15.4(d). In this respect, IMP audits are completed by the Quality Management and Engineering Standards group or a third-party auditor. The Quality Manager is responsible for ensuring that employees are competent to complete internal office audits through documented skills, certifications, training or education. As a minimum, the Lead Auditor is qualified to the ISO Internal Auditor training, CSA Internal Auditor training or equivalent. The competency of third-party auditors is managed through the vendor qualification process, which includes requirements for documentation addressing the third-party auditor training and certification.

On a quarterly basis, TransCanada conducts field-based Targeted Compliance Audits that are performed at multiple locations within the Canadian Pipeline Operations Regions. The results are consolidated in a single report, which identifies systemic issues related to the topic assessed during the audit. Field-based audits are conducted by Canadian Pipeline Operations Compliance (CPO Compliance) team members comprised of a Senior Compliance Specialist and three Field Compliance Specialists. All team members attend internal training courses and receive certification from a training course conducted by an external third party. It is the responsibility of the CPO Compliance Manager to ensure employees are competent to complete field-based audits through documented skills, certifications, training or education. The process for completing audits is documented in TransCanada Operating Procedure (TOP) Compliance Assurance Program (EDMS No. 005364423) and the associated TOP Targeted Audit (EDMS No. 006281982).

The Quality Management and Engineering Standards internal audit processes and procedures requires the person accountable for the program that has been audited to resolve all findings. Audit findings are tracked in action logs or the Incident and Issue Tracking (IITs) database. Issues related to each audit are identified, and corrective and preventive actions, accountabilities, and timelines are recommended by the CPO Compliance audit team. Site-specific findings that are not considered to be systemic in nature are provided to the specific area manager to address. The finalized audit report is provided to the Vice President, Canadian Pipeline Operations, the regional leadership teams (Directors and Managers) and leaders of other departments who have been assigned specific actions to address identified deficiencies, and on whom the audit may have an impact. The Senior Compliance Specialist is responsible for monitoring the progress of audit resolutions and for escalating issues when deemed necessary. The status of completion of the actions is also tracked in the monthly CPO Compliance Scorecard, which is issued to and reviewed by the Vice President, Canadian Pipeline Operations, and the Directors.

NEB’s Investigation of TransCanada’s Response to a complainant’s Allegations

TransCanada’s Internal Audit Department conducted an audit of a complainant’s allegations. The focus of the audit was as follows:

Independent Third Party Non-Destructive Examination
Independent Visual Surveillance of Welders
Non-Destructive Examination of Pressure Vessels
Qualification of Welders on the Keystone Pipeline
Practice of Engineering within TransCanada
Joining Pipe of Different Wall Thicknesses
Use of Automatic Ultrasonic Testing
Submission to the NEB of TransCanada’s Joining Program
TransCanada’s Formal Audit Program

The findings of TransCanada’s internal audit and the resulting remediation measures taken by TransCanada were submitted to the Board on 18 July 2012. In addition, NEB audit interviews were held with TransCanada with respect to the resolution of a complainant’s allegations on 18 March 2013. TransCanada was directed to provide additional information and supporting documents to substantiate the responses given during the interviews.

Each of the issues investigated in TransCanada’s internal audit, as well as the NEB’s assessment of the ongoing and completed remediation measures identified by TransCanada in response to the audit findings, are described below.

1. Independent Third Party Non-Destructive Examination

TransCanada’s internal audit concluded that there had been instances where TransCanada did not ensure that qualified, third party non-destructive examination (NDE) vendors were hired under the direct supervision of TransCanada (and not by the pipeline, facility or fabrication contractor), resulting in a lack of independence. This was a non-compliance with the OPR-99, section 54(1), which states: "When a company constructs a pipeline, the company or an agent independent of any construction contractor retained by the company shall inspect the construction to ensure that it meets the requirements of these Regulations and complies with the terms and conditions of any certificate or order issued by the Board."

TransCanada’s internal audit noted that a process was being implemented to ensure independent NDE inspections. During the NEB audit interviews, TransCanada confirmed that new processes were in place to ensure that NDE vendors were hired by TransCanada directly. NEB auditors requested that TransCanada demonstrate that it had a plan in place to examine past NDE results in order to validate whether these non-independent inspections would constitute a future integrity hazard. TransCanada responded as follows:

"For fabrication of piping assemblies between May 2004 and August 2011, TransCanada used fabrication shops with certified Quality Management Systems. The fabrication facilities were responsible for hiring qualified third party NDE contractors to complete the inspections. TransCanada hired a third party inspector to oversee the work produced by the fabrication shop and the NDE contractor. The TransCanada inspector was responsible for ensuring the fabrication shops met the specification and procedure requirements for materials, welding, non-destructive examination, pressure testing and coating. The inspector was responsible for checking the radiographic film to ensure the level of quality was met and that all welds were inspected. The fabrication of piping assemblies was completed in accordance with the requirements of CSA Z662 and the piping assemblies were completed using TransCanada’s welding specification (TEP-NDT-ADT, EDMS No. 003797402), which requires 100% NDE of welds. The TransCanada specifications for NDE required that all radiographic film interpretation be completed by a Canadian Government Standards Board (CGSB) Level II technician. TransCanada stated that the fabricated assemblies in question were all subjected to a high pressure hydrostatic test before going into service and are not considered an integrity hazard."

TransCanada completed a review of the projects on which fabrication of piping assemblies was completed for the time frame of 2004 to 2011 and determined that there are approximately 50 meter stations and 7 pipeline projects where fabricated pipeline assemblies were installed under NEB jurisdiction without independent third party NDE. To address the issue, TransCanada proposed an audit of the projects using its NDE procedure TEP-NDT-ADT, Clauses 7.2.2 to 7.2.4 (inclusive), which specifies a 15% progressive audit of the radiographs involved. The Board reviewed TransCanada’s proposed audit criteria to determine whether it would provide adequate examination of the welds that had occurred in the past projects. The Board determined that TransCanada’s proposed audit procedure (15% of the welds) did not meet the requirements of the OPR-99, section 17.^[5] TransCanada subsequently revised its audit criteria to include 100% of the subject welds and is therefore now in compliance with the OPR-99, section 17 requirements.

To ensure that TransCanada will provide qualified, third party non-destructive examination (NDE) contractors that are hired under the direct supervision of TransCanada, and not by the pipeline, facility or fabrication contractor, TransCanada stated that it has developed new Master Service Agreement (MSA) contracts with its approved NDE contractors, under which TransCanada is solely responsible for hiring the NDE personnel. TransCanada stated that it had also developed revised Work Authorization contract documents for work not covered by the MSAs, which specifically state that the NDE contractors will be hired directly by TransCanada. As a result of its internal audit, TransCanada also developed a procedure (TEP-NDE-INSP-SHOP, Fabrication Shop Non-Destructive Examination Inspection Procedure, EDMS No. 006684544) outlining the requirements for conducting NDE in fabrication shops. This procedure had an effective date of October 15, 2011 and the procedure stated under Clause 1 that: "TransCanada will hire: (1) A Fabricator to construct assemblies; (2) An NDE contractor to conduct non-destructive examinations of the welds; and (3) A Fabrication Inspector to inspect the results prepared by the NDE contractor."

Summary: Independent Third Party Non-Destructive Examination

The Board noted that had been instances where TransCanada did not ensure that qualified, third party non-destructive examination (NDE) vendors were hired under its direct supervision. Therefore, TransCanada had been non-compliant with the OPR-99, section 54(1). However, the Board also concluded that the measures taken by TransCanada to ensure independent third-party NDE inspections, as well as TransCanada’s commitment to undertake an audit of 100% of the previously affected welds, adequately addresses the issue of independent third-party NDE.

2. Independent Visual Surveillance of Welders

TransCanada’s internal audit concluded that, in the past, TransCanada was non-compliant with CSA Z662-11, Clause 7.10.2 (Visual Inspection), and specifically sub-clause 7.10.2.1, which states that: "The completed welds on the outside surface of the piping shall be visually inspected for 100% of the weld length for any imperfections that are not detectable by non-destructive inspection, in accordance with documented procedures approved by the company. Such procedures shall include requirements for extent and frequency of visual inspection, personnel qualification and visual acuity, maximum viewing distance and angle, lighting conditions, evaluation tools, and reporting."

TransCanada’s internal audit noted that TransCanada’s management agreed to follow up on this issue. TransCanada’s Materials Engineering met with Construction Services management, welders and foremen to discuss the issue of inspection/audit procedures for maintenance welding to ensure compliance with the requirements of CSA Z662-11, Clause 7.10.2.1. TransCanada stated that its personnel completed a full review of the welding and NDE specifications and procedures applicable to their responsibilities. A qualified technical specialist provided welder training and witnessed the qualification test welds. In addition, a revised method for tracking welder qualifications was implemented. TransCanada’s Construction Services department created and filled the position of a Construction Services Manager responsible for Equipment, Quality Assurance/Quality Control, Welding and Fabrication. The Materials Engineering Department met with the Construction Services Manager to discuss the actions that had been implemented up to the date of the internal audit, as well as the implementation of further recommendations on training and the overall inspection requirements with respect to welder supervision and inspection.

As a result of the NEB audit interviews, TransCanada provided its engineering procedure, TEP-NDT-VT Visual Examination (EDMS No. 007381161) and examples of welder inspection reports as supporting documentation that TransCanada meets the requirements set out in CSA Z662 Clause 7.10.2.1. The TEP-NDT-VT engineering procedure is based on CSA Z662-11 Oil and Gas Pipeline Systems; ASME Section V, Article 9, Guidelines; and API 1104, Welding of Pipelines and Related Facilities. The engineering procedure applies to visual examination that is to be conducted to determine the condition of the part, component or surface examined including such conditions as weld quality, alignment of mating surfaces, crack, wear, corrosion, erosion, evidence of leakage, or physical damage. The records of visual weld examinations requested by NEB auditors for a specific project (36" Edson Extension Hydro Test Project, ED-120 to ED-130, 2012) included a weld tally with visual inspection and weld parameter confirmation records, all visual inspection reports for the project, welding inspector’s daily reports for the project, and the Company Representative and Welder Inspector’s Check List.

Summary: Independent Visual Surveillance of Welders

The Board concluded that TransCanada was non-compliant with CSA Z662-11, Clause 7.10.2 (Visual Inspection) and specifically sub-clause 7.10.2.1. The Board also concluded that TransCanada has the processes and procedures in place to meet the requirements of CSA Z662-11, Clause 7.10.2.1 and that those processes and procedures adequately address the issue of independent visual surveillance of welders.

3. Non-Destructive Examination of Pressure Vessels

TransCanada’s internal audit concluded that a variance to the American Society of Mechanical Engineers (ASME), Section V - Non-destructive Examination had occurred in that, in one instance, the NDE of a pressure vessel was known to be insufficient due to the NDE inspector being unable to inspect the full weld beneath a plate attached to a nozzle. The NDE inspection report did not meet code as it incorrectly indicated full inspection had occurred. Had the NDE inspection report indicated that the complete weld inspection had not occurred due to restricted access, the report would have met the requirements of the code.

TransCanada’s response to the internal audit finding was that the pressure vessel in question was for the NGTL Gold Creek Compressor Station project. This project was taken out of service by TransCanada’s Engineering Department in September 2011. A complete review of the design drawings, fabrication welding procedures and NDE inspection procedures was completed by TransCanada through September, October and November 2011. An internal report was competed on this review and, in particular, the questions raised regarding the NDE for the nozzle weld. The review determined the NDE of the small diameter nozzles was completed, but the NDE technician referenced the incorrect procedure and did not indicate the restricted inspection area in the report. This was addressed with the third party NDE company and resolved. The pressure vessel was released for installation in November 2011 and the pressure vessel was included in the field pressure testing program for the station piping at the Gold Creek Compressor Station. The report also recommended changes to the process for procurement and third party inspection of pressure vessels. TransCanada’s Materials Engineering department has revised the third party surveillance checklist used for pressure vessels and has worked directly with the third party inspection company to provide the third party inspectors with training on the specification requirements and expectations on reporting.

Summary: Non-Destructive Examination of Pressure Vessels

The Board concluded that a variance to the American Society of Mechanical Engineers (ASME), Section V - Non-destructive Examination had occurred in TransCanada’s NGTL Gold Creek Compressor Station project. The Board also concluded that TransCanada has the processes and procedures in place to ensure that NDE inspections of pressure vessels meet the ASME code requirements and that reporting of NDE results accurately reflects the NDE procedures. The measures taken by TransCanada adequately address the issue of NDE of pressure vessels.

4. Qualification of Welders on the Keystone Pipeline

TransCanada’s internal audit confirmed that a number of welds on the Keystone Pipeline did not comply with CSA Z662-11, Clause 7.8, Arc and Gas welding - Qualification of Welders, due to welding being performed by an unqualified welder. TransCanada stated that the lack of welder qualification was discovered by a TransCanada inspection and documents coordinator, who ordered corrective action to be taken, which consisted of removal of the welds in question. TransCanada required that all of the welds in question be redone by a qualified welder. To ensure that no other pipeline welds performed on the Keystone Pipeline were out of compliance due to welder qualifications, a review was conducted of all of the Keystone Pipeline welder qualification records. TransCanada reinforced the requirement that no work should be started on a project without the inspector present at the contractor’s fabrication facility and completion of assurance of welder qualifications.

Summary: Qualification of Welders on the Keystone Pipeline

The Board concluded that TransCanada’s Keystone Pipeline project contained a number of welds that were not in compliance with CSA Z662-11, Clause 7.8, Arc and Gas welding - Qualification of Welders. The Board also concluded that the measures taken by TransCanada adequately address the issue of qualification of welders on the Keystone Pipeline and that TransCanada has the processes and procedures in place to ensure appropriate welder qualifications on TransCanada’s future projects.

5. Practice of Engineering within TransCanada

TransCanada’s internal audit concluded that the final review and signing of designs completed by an external engineering company was done under TransCanada’s permit to practice and by professional engineers registered in Alberta. To ensure TransCanada engineers and technologists were clear in their roles and responsibilities, TransCanada management implemented a review of the Engineering requirements in the Practice of Engineering specification (TES-ENG-POE, TransCanada Practice of Engineering (POE) EMDS # 003672108, revised in Nov. 2011). The Practice of Engineering specification includes guidance on the requirements for both internal TransCanada and third party engineering (Sections 5.1 and 5.2 respectively).

In 2012, TransCanada management also implemented mandatory training on TransCanada’s Practice of Engineering and TransCanada’s Professional Engineering Management Plan for engineers and technologists within the company. This training is currently being added into the TransCanada Learning Management System (LMS) as a requirement for Engineers to take every 3 years. TransCanada’s Practice of Engineering outlines authentication requirements for engineering documents produced by or for TransCanada. TransCanada’s Professional Engineering Management Plan outlines principle information regarding the management of engineering within TransCanada. TransCanada procedures related to projects have design reviews by technical and engineering resources that are designed to occur at the 30%, 60% and 90% design stages. When the work is completed by external engineering companies, the final designs are authenticated or signed by professional engineers based on the requirements of the jurisdiction in which the work and/or construction is taking place. For designs completed by internal TransCanada resources, the company’s permit to practice stamp is applied.

Summary: Practice of Engineering within TransCanada

The Board concluded that TransCanada is in compliance with its internal Practice of Engineering specification governing the practice of its professional engineers. The Board also concluded that the measures taken by TransCanada adequately address the issue of practice of engineering within TransCanada and for its external engineering contractors.

6. Joining Pipe of Different Wall Thicknesses

TransCanada’s internal audit investigated an allegation that using back-beveled transition welds is prone to higher incidence of failure than using counter-bore and taper welds.

The internal audit concluded that the failure incident reference was made to historical welding practices that were acceptable at that time. TransCanada stated that the use of taper (back beveling) is a common practice within the pipeline industry. Clause 7, Joining, of CSA Z662-11, provides guidance on the recommended designs of unequal wall thickness weld joints. Figure 7.1, Examples of end preparations and combinations of end preparations, and specifically Figure 7.1(a) with its guidance note states that for internal diameters unequal "where the nominal internal offset is 2.4 mm or less, no special treatment is necessary, provided that full penetration and bond is accomplished in welding." Figures 7.1(b) through 7.1(g) and the corresponding guidance notes detail the requirements cases of internal offset greater than 2.4 mm, external diameters unequal and internal, and unequal external diameters.

The joining requirements in CSA Z662-11 were compared to TransCanada’s specification for transitioning of weld joints with unequal wall thickness pipe (TEP-MECH-TRAN, Selection of Transition Pieces and Joining Methods, EDMS No. 000006256). This internal specification provides guidance on determining when to use the back bevel design or the counter-bored and taper design. TransCanada currently implements this specification when the wall thickness difference of two adjoining pieces of pipeline is greater than 1.0 mm (TEP-MECH-TRAN, Figure 2(a) through Figure 2(d) of Section 4.0). TransCanada’s joining specification meets the requirements of Clause 7 of CSA Z662-11. TransCanada also manages the risk of weld joint cracking through control of welding parameters such as preheat, welding heat input and pipe movement during welding and, in addition, Section 2.0.3 of the TransCanada specification states that "the transition weld shall not be located in the immediate region of high bending moments (such as may be generated by filed overbends, sidebends or sagbends). The transition weld shall be located at a minimum distance of 3D from the end of the bend to the transition. Unless it can be demonstrated that a lesser distance will not adversely affect the structural integrity of the pipeline."

Summary: Joining Pipe of Different Wall Thicknesses

The Board concluded that TransCanada’s joining specification meets the requirements of CSA Z662-11, Clause 7, Joining. The Board also concluded that TransCanada has the processes and procedures in place to address the issue of joining pipe of different wall thicknesses that could affect the weld joints and the integrity of the pipeline.

7. Use of Automatic Ultrasonic Testing

TransCanada’s internal audit investigated an allegation that the use of Automatic Ultrasonic Testing (AUT) is more sensitive in picking up defects than radiographic inspection. TransCanada’s internal audit stated that CSA Z662-11 and the OPR-99 allow for the use of radiography or ultrasonic methods to examine girth welds. TransCanada uses either AUT or radiography (RT) for the non-destructive examination of butt welds on pipeline construction. Both of these non-destructive techniques have been used in pipeline construction for many years and the requirements for their use are included in CSA Z662-11, Clause 7.10.4 Non-destructive inspection. TransCanada uses radiography for butt welds on Nominal Pipe Size (NPS) 2" to NPS 48" pipe to pipe joints or pipe to component joints. The AUT method is applied to NPS 20" to NPS 48" pipe to pipe mainline and tie-in welds on pipelines projects where the wall thickness is 6.4 mm and greater. The minimum diameter limit is applied to the projects due to the wall thicknesses being less than 6.4 mm and the inspection system’s physical size as it sits on the pipe. TransCanada’s specification used for automatic ultrasonic inspection is TES-NDT-UT1, Mechanized Ultrasonic Examination of Pipeline Girth Welds (EDMS No. 00367096) that contains within the scope of the document the wall thickness limits for UT weld inspection.

Summary: Use of Automated Ultrasonic Testing

The Board concluded that TransCanada is in compliance with CSA Z662-11, Clause 7.10.4 Non-Destructive Inspection and the OPR-99 with respect to the use of radiographic and ultrasonic inspection methods. The Board also concluded that TransCanada has the processes and procedures in place to address the issue of weld inspections and that these processes and procedures meet the requirements of CSA Z662-11 and the OPR-99.

8. Submission to the NEB of TransCanada’s Joining Program

TransCanada internal audit investigated an allegation that TransCanada submitted a joining program for the Cutbank River Lateral Loop Project to the NEB that had not been fully customized and updated for the Project as required by the OPR-99, section 16, which states that "A company shall develop a joining program in respect of the joining of pipe and the components to be used in the pipeline and shall submit it to the Board when required to do so".

TransCanada’s internal audit confirmed that the allegation was valid. An updated version of the joining program was subsequently submitted to the Board. The internal audit further noted that the learnings from the Cutbank River Lateral Loop Project led to a complete review of the standard shielded metal arc welding (SMAW) procedures to confirm that the welding datasheets were accurate and correct, to ensure the supporting documents referenced (Procedure Qualification Record (PQR) and Welding Procedure Specification (WPS)) were part of the submission to the NEB, and to ensure each datasheet was properly supported by PQRs. TransCanada stated that, going forward, all welding procedures submitted for its projects will be reviewed for compliance prior to their issuance.

Summary: Submission to the NEB of TransCanada’s Joining Program

The Board concluded that TransCanada was not in compliance with the OPR-99, section 16 with respect to submitting a customized and updated joining program for the Cutbank River Lateral Loop Project. The Board also concluded that TransCanada has the processes and procedures in place to address the issue of submission of complete, accurate and updated welding procedures to the NEB.

9. TransCanada’s Formal Audit Program

TransCanada’s internal audit investigated an allegation that the audit and inspection process required by the OPR-99 did not exist within TransCanada. TransCanada’s internal audit confirmed that there was an audit and investigation process within TransCanada, but that there were opportunities for continuous improvement. As noted above in the Board’s assessment of this audit for sub-element 4.4 Internal Audit, TransCanada has demonstrated that it has a formal audit process for its Integrity Management Programs.

Summary: TransCanada’s Formal Audit Program

The Board concluded that TransCanada is in compliance with the requirements of the OPR-99, section 55(1)(b) and CSA Z662-11, Clause 3.1.2(h)(iii). The Board also concluded that TransCanada has the processes and procedures in place to address the requirements of a formal audit and inspection program.

Summary: Internal Audit

The Management System Audit Element 4.4, Internal Audit, requires a company to develop and implement a documented process for auditing its management and protection programs and procedures. The audit process is expected to include and manage training and competency requirements for staff carrying out the audits and be conducted on a regular basis.

Internal audits of TransCanada’s IMPs are conducted by personnel that are independent of the areas to be audited or by a contracted third party. Quarterly field-based compliance audits are conducted at multiple locations across Canada. All audit findings are tracked and are required to be resolved. Findings are also categorized as either site-specific or systemic and responsibility for these is assigned accordingly. The progress of resolving audit findings is monitored and escalated where necessary.

With regards to the internal audit of TransCanada’s investigation stemming for concerns raised by a complainant, the Board finds the company’s internal audit procedures effectively identified and assigned resolution of any regulatory non-compliances.

Compliance Status:

Compliant

5.0 Management Review

5.1 Management Review

Expectations:

The company shall formally review the management and protection programs for continuing suitability, adequacy and effectiveness. The review should be based on appropriate documentation and records including the results of the surveillance, monitoring and audit programs. This review should be formal and documented and should occur on a regular basis. The management review should include a review of any decisions, actions and commitments that relate to the improvement of the programs and the company’s overall performance.

References:

OPR-99 sections 4, 40 and 55

CSA Z662-11, Clauses 3.1.2(h)(iii) and 3.2

Audit Assessment:

General

During interviews and in documents submitted, TransCanada described its management review processes and procedures.

At quarterly meetings of the Board of Directors’ Health, Safety and Environment (HSE) Committee, TransCanada leadership present and discuss a scorecard on Operational Safety, which includes the Integrity Management Program (IMP) elements.

TransCanada’s Senior Vice President of Operations and Engineering leads the Senior Governance Committee (SGC), which includes the Vice Presidents of Engineering and Asset Reliability, Canadian Pipeline Operations and Operations and Pipeline Services. The SGC provides the highest level of management governance, overseeing strategic aspects such as the policy and direction of the Asset Management System (AMS), which governs TransCanada’s IMPs. The following sections of the IMPs provide the processes and procedures that are necessary to meet the requirements of the AMS:

Gas Pipeline IMP, Section 8.0;
Liquid Pipeline IMP, Section 2.1; and
Plant IMP, Section 2.2.

TransCanada Threat Management Scorecards

TransCanada submitted documents (Integrity Threat Management Scorecards) to demonstrate that it had compiled and analyzed key performance indicator (KPI) and incident data. The TransCanada Integrity Threat Management Scorecards submitted and reviewed were:

Internal Corrosion;
External Corrosion;
Mechanical Damage;
Construction Defects;
Weather and Outside Forces;
Manufacturing Defects;
Equipment;
Stress Corrosion Cracking;
Leaks and Ruptures;
Engineering and Asset Reliability Incident and Issue Tracking (IIT); and
Customer Perfect Days.

Key Performance Indicators

At the beginning of each year, the SGC sets direction through goals and objectives, along with overall KPIs for the IMPs. These common goals and objectives cascade down through the organization from the SGC to the individual employee. At each successive level of the organization, more specific goals, objectives and KPIs are monitored and reviewed to evaluate TransCanada’s various programs, including the IMPs, for continued suitability, adequacy and effectiveness. At the SGC level, monthly management review meetings are held to discuss the KPI areas of asset reliability, safety, compliance, risk and cost. Regular updates through the chain of command are provided though weekly reporting and a monthly review of all outstanding incidents and issues.

Management Review System for the IMPs

Responsibility for review and revision of the IMPs extends from the IMP program manager up through the respective leadership team to the Vice President of Engineering and Asset Reliability. The IMPs and supporting documentation are revised on a regular basis to capture any significant improvement opportunities. Modification to the IMPs and their associated supporting procedures and processes is typically driven by lessons learned, and include the following inputs:

IIT;
Review of goals and objectives through KPIs;
Audit findings and follow-up actions;
IMP Reviews; and
Industry learnings.

Incident and Issue Tracking (IIT)

IIT is the primary mechanism by which TransCanada identifies and takes actions on incidents and issues, including those related to the IMP. Automated notifications facilitate management oversight and governance. Resolution of action items is tracked within the IIT system and is to be reviewed monthly by the appropriate leadership within TransCanada.

Review of Goals and Objectives through Key Performance Indicators

To evaluate the IMPs for continued suitability, adequacy and effectiveness, common goals and objectives used to monitor progress cascade down through each level of the organization and are reflected in the specific KPIs. At the Vice President level, more detailed KPIs are part of the Engineering and Asset Reliability Leadership Team management review. At the Director and Manager level, more detailed KPIs are tracked for the IMP and associated procedures as part of the IMPs. During the audit, TransCanada provided documentation (TransCanada KPIs - Performance Measures, December 2012) on its IMP related KPIs. In general, in the 500+ KPIs provided, there were numerous listings of what are considered to be pipeline attributes rather than KPIs. For example, pipeline system length, outer diameter, wall thickness, material grade, design class, coating type and pipe manufacturer. These are simply fixed attributes of the pipeline system and provide no useful information for tracking performance. Additionally, of the extensive list of KPIs provided, only a few have provided direct input into the individual threat management scorecards.

Integrity Management Program Reviews

Specific IMP review activities are conducted, including:

Management Business Reviews: Semi-annually, a meeting between the Pipe Integrity leadership team and individual subject matter experts is held to review the status of their individual programs. At the end of the year, Facilities Integrity conducts a business review that includes a Strengths, Weakness, Opportunities and Threats (SWOT) Analysis, to align key strategies with the facilities’ objectives. The objectives are then linked to success of the integrity programs and plans being implemented in the following year.
Annual Maintenance Plan Review: Integrity threat groups develop annual maintenance plans, which form the work plan to be completed in the following year. On an annual basis, leadership up to the Senior Vice President of Engineering and Operations is provided an overview of the previous year’s maintenance plan and the proposed next year’s maintenance plan.
Process Reviews: The outcome of the reviews of IMP supporting documents (e.g., integrity plans, procedures) is reported to management. The TEP-INT-PR Pipe Integrity Process Review Procedure (EDMS No. 006522487) outlines Pipe Integrity’s process review methodology. The TEP-INT-MREV Pipe Integrity Management Review Procedure (EDMS No. 006980169) details the management review process of Pipe Integrity’s natural gas integrity management programs. During the audit, TransCanada provided the Integrity Management Program Review (January 26 - February 12, 2010) as an example of its IMP review report. Essentially, the 16 page document, of which 6 pages contained the actual review, was a high level process review rather than a zero-based compliance and effectiveness review of TransCanada’s IMPs. Within the document, TransCanada stated that a technical review of the data and reports generated by the various activities, assessments and plans was not included in the scope. Appendix 2 - Integrity Management Program Checklist contained 25 questions meant to cover 12 management sections (with 4 missing sections in the numbering system). Appendix 2 in the report was blank. No information was contained in the report on the answers to the questions or references to documentation examined. This Integrity Management Program Review document was assessed to be inadequate for the purpose stated and inadequate as evidence of TransCanada’s management review process.

Industry Learnings

TransCanada stated that it also tracks its performance relative to industry by participating in industry associations, such as the Canadian Energy Pipeline Association (CEPA). For the past ten years, CEPA has tracked approximately 30 KPIs, TransCanada to compare itself to industry using detailed measures such as failure causation, in-line inspections and site investigations. During the audit, TransCanada provided documentation (excerpts from the Annual Performance Indicator Report 2012 (EDMS No. 008029673) to illustrate a comparison of its KIPs to those of other regulatory agencies and of industry associations.

Summary: Management Review

The Management System Audit Element 5.1, Management Review, requires a company to formally review its management and protection programs for continuing suitability, adequacy and effectiveness. Reviews are expected to be based on appropriate documentation and records, be formal and documented, and occur on a regular basis.

The audit concluded TransCanada has undertaken several initiatives aimed at reviewing its IMPs. These include:

Having appropriate levels of responsibility and accountability at each level of the organization; and
Participation in industry associations in order to share learnings and best practices.

Some of the non-compliances identified during the audit, such as insufficient overpressure protection and management of hazards associated with external corrosion, illustrate the results of a management review process that was not effective. This element of the audit also included a review of the allegations presented by the complainant along with the corroborating internal review by TransCanada resulting from that complaint.

Management System Audit Element Finding: Based on the documents assessed and interviews with personnel as related to Management Review, TransCanada is assessed to be non-compliant with the requirements of the OPR-99 and CSA Z662-11, and is therefore non-compliant with this audit sub-element.

Compliance Status:

Non-Compliant

Endnotes

[1] Hazard: Source or situation with a potential for harm in terms of injury of ill health, damage to property, damage to workplace environment, or a combination of these. Risk: Combination of the likelihood and consequence(s) of a specified hazardous event occurring.

[2] TransCanada uses the term "threat" for "hazard" in its documents.

[3] See the amended and re-named National Energy Board Onshore Pipeline Regulations, sections 4 and 53(1), for the corresponding provisions.

[4] See the amended and re-named National Energy Board Onshore Pipeline Regulations, section 36(b), for the corresponding provision.

[5] See the amended and re-named National Energy Board Onshore Pipeline Regulations, section 17, for the corresponding provision.

Date modified:: 2020-09-29

ARCHIVED - TransCanada Pipelines Limited - TransCanada Pipelines Limited - Audit Report OF-Surv-OpAud-T211-2012-2013 01 - Appendix II - Integrity Management Program Audit Assessment

This page has been archived on the Web

Table of Contents

Introduction:

Audit Objectives and Scope:

1.0 Policy and Commitment

1.1 Policy and Commitment Statements

Expectations:

References:

Audit Assessment:

Compliance Status:

2.0 Planning

2.1 Hazard Identification, Risk Assessment and Control[1]

Expectations:

References:

Audit Assessment:

General

Hazard Identification Process

Threat Identification Process

Individual Threat Assessment: Dents

Pipelines

Facilities

Risk Assessment

Pipelines

Facilities

Recent Threat Identification or Risk Assessments

Low Strength Steel Pipe and Fittings

Summary: Hazard Identification, Risk Assessment and Control

Compliance Status:

2.2 Legal Requirements

Expectations:

References:

Audit Assessment:

Compliance Status:

2.3 Goals, Objectives and Targets

Expectations:

References:

Audit Assessment:

Compliance Status:

3.0 Implementation

3.1 Organizational Structure, Roles and Responsibilities

Expectations:

References:

Audit Assessment:

General

Summary: Organizational Structure, Roles and Responsibilities

Compliance Status:

3.2 Management of Change

Expectations:

References:

Audit Assessment:

Compliance Status:

3.3 Training, Competence and Evaluation

Expectations:

References:

Audit Assessment:

General

Learning Management System

Field Role Technical Competency

Active Management

Practice of Engineering

Performance Management Process

Summary: Training, Competence and Evaluation

Compliance Status:

3.4 Communication

Expectations:

References:

Audit Assessment:

Compliance Status:

3.5 Documentation and Document Control

Expectations:

References:

Audit Assessment:

Compliance Status:

3.6 Operational Control-Normal Operations

Expectations:

References:

Audit Assessment:

General

Surveillance and Condition Monitoring

2.1 Hazard Identification, Risk Assessment and Control^[1]

H₂S Content in Crude Oil Monitoring