SUNCOR ENERGY (USA) PIPELINE CO. — Notice of Amendment

32021023NOA_Notice of Amendment_05062021_(20-173060)_text.pdf, page 1Official PDFNOTICE OF AMENDMENT VIA ELECTRONIC MAIL TO: nthonen@suncor.com and jgrothmann@suncor.com May 6, 2021 Ms. Nancy Thonen President Suncor Energy (USA) Pipeline Co. 717 17th Street, Suite 2900 Denver, CO 80202 CPF 3-2021-023-NOA Dear Ms. Thonen, From August 10 through 14, 2020, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code inspected Suncor Energy (USA) Pipeline Company (Suncor) procedures for Control Room Management in Sherwood Park, Alberta, Canada. The procedures inspected include assets for Suncor’s USA interstate hazardous liquid pipelines operated from the control room located in Alberta, Canada. This Notice is in response to PHMSA’s Control Room Management (CRM) Initiative, which is a national level program that includes inspectors from every region. As a result, you may have received this Notice from a different Regional Director than typical because the CRM Initiative inspections are currently separate from the standard inspection program. Notices and correspondence from other types of inspections will remain unchanged. On the basis of the inspection, PHMSA has identified the apparent inadequacies found within Suncor’s plans or procedures, as described below:#

32021023NOA_Notice of Amendment_05062021_(20-173060)_text.pdf, page 21. 2. § 195.446 Control room management. (a) . . . . (b) Each operator must define the roles and responsibilities of a controller during normal, abnormal, and emergency operating conditions. To provide for a controllers’ prompt and appropriate response to operating conditions, an operator must define each of the following: (1) . . . . (4) A method of recording controller shift-changes and any hand-over of responsibility between controllers; Suncor’s CRM Program (PLGOS00001) Section 2 - Roles and Responsibilities Approved April 1, 2020, were inadequate because the procedures did not address how the transition will occur if a controller is unable to continue or assume responsibility for any reason. Section 2.8.8.3 provides a brief statement about the need to conduct a shift turnover/TOR in the event a controller needs to leave due to illness, fatigue or other reasons. During the inspection, Suncor outlined steps that a manager may take to fill the shift that could include shutting down the pipeline, calling an off-shift employee in to work or reallocating a current controller to the console. The procedure did not address any of these choices and the related TOR. The procedure must be amended to include the full process of hand-over of responsibility between controllers and recording the shift changes when a controller needs to leave due to illness, fatigue or other reasons. § 195.446 Control room management. (a) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator had defined by performing each of the following: (1) . . . . (2) Conduct a point-to-point verification between SCADA displays and related field equipment when field equipment is added or moved and when other changes that affect pipeline safety are made to field equipment or SCADA displays; Suncor’s CRM Program (PLGOS00001) Section 3 - Providing Adequate Information Approved April 1, 2020, was inadequate because in section 3.3.7 it stated, "[f]or point-to- point verification, a representative sample is defined as more than fifty percent of screens on which the point appears.” During the inspection, Suncor personnel stated that for point-to-points "they check all displays." Sampling is not permissible for point-to-point verification, with a limited exception for maintenance of a single established point, such as after a like for like replacement of a transmitter. Suncor mistakenly relied on an original inspection protocol C2-3 which states, “[t]he verification procedure must include a requirement to check a representative sampling of 2#

32021023NOA_Notice of Amendment_05062021_(20-173060)_text.pdf, page 33. impacted displays.” This statement references FAQ C.03, which relates to changes made to SCADA screens only. The procedure must be amended to provide a more definitive and limited use of sampling, if at all, when conducting point-to-point verifications between SCADA displays and related field equipment. § 192.446 Control room management. (a) . . . . (c) Provide adequate information. Each operator must provide its controllers with the information, tools, processes and procedures necessary for the controllers to carry out the roles and responsibilities the operator has defined by performing each of the following: (1) . . . . (3) Test and verify an internal communication plan to provide adequate means for manual operation of the pipeline safely, at least once each calendar year, but at intervals not to exceed 15 months; Suncor’s CRM Program (PLGOS00001) Section 3 - Providing Adequate Information Approved April 1, 2020, was inadequate because the procedure did not establish a method for a controller to incorporate the manual field information into the overall SCADA operation. Manually collected information from the field should be aggregated in a format that replaces the information normally provided from the SCADA system. PLOP00015, Emergency Operating Procedure Section 5, provides steps to take in the event of Complete Pipeline Loss of Control - SCADA Failure, SPCC Emergency Evacuation. Step 5.6 states that if SPCC SCADA is not available or has inaccurate data, then, "direct field staff to monitor stations locally and contact SPCC with hourly updates or in the case of abnormal or emergency condition until SCADA is returned to service and /or data is confirmed accurate." This procedure does not direct the controller to log this information and does not provide information for where to log the manual field information. Procedure PLOP00012 Operational Log Tool (OLT) Log Entry, in Section 1, defines when a controller should enter information into the OLT. Step 1.3 requires entries for "calls from field personnel and details of calls"; it does not call out specific requirements for logging manual operation event calls. Additionally, PLOP00012 is not referenced in (PLGOS00001) Section 3 or in PLOP000015. Should the operator choose to manually operate its system, it is critical that information regarding the pipeline operating conditions during this time is readily available for a controller to review and incorporate into the overall operation of the pipeline. The procedure must be amended to provide an adequate process in the manual operation plan to document manual field information and incorporate this into the safe operation of the pipeline. These steps must also be included in the test and verification of the plan that occurs at least once each calendar year, not to exceed 15 months. 3#

32021023NOA_Notice of Amendment_05062021_(20-173060)_text.pdf, page 44. 5. § 192.446 Control room management. (a) . . . . (d) Fatigue mitigation. Each operator must implement the following methods to reduce the risk associated with controller fatigue that could inhibit a controller’s ability to carry out the roles and responsibilities the operator has defined: Suncor’s CRM Program (PLGOS00001) Section 5 - Fatigue Risk Management System Approved April 9, 2020, was inadequate because it did not identify operator-specific risks. Section 5.2.3.2 identifies "[t]he specific fatigue risks for the Control Centre", and lists fatigue related occurrences related to tasks, but these do not relate to activities, health conditions, or life style choices that can contribute to controller fatigue. Section 5.2.3.3 provides the statement, “[f]atigue management training addresses how off duty activities, personal choices and sleep disorders can contribute to fatigue and represent the type of specific fatigue risks a controller faces.” Suncor has not identified the operator specific fatigue risks. The procedure must be amended to identify risks associated with fatigue (general and operator specific) that could inhibit a controller’s ability to carry out the roles and responsibilities defined by the operator. § 195.446 Control room management. (a) . . . . (e) Alarm management. Each operator using a SCADA system must have a written alarm management plan to provide for effective controller response to alarms. An operator’s plan must include provisions to: Suncor’s CRM Program (PLGOS00001) Approved April 9, 2020, was inadequate because it did not reference API 1130 or the ATMOS LDS system or related procedures. Section § 195.444 requires compliance with API 1130 for computational leak detection monitoring (CPM) leak detection systems (incorporated by reference § 195.3). ATMOS LDS is the primary leak monitoring/detection/alarm tool that is linked to SCADA to provide alarms and alerts related to potential pipeline leaks. Additionally, the controllers are provided a separate screen at the console specifically for ATMOS LDS information that can inform the controller with more information about the ATMOS alarms. This information was not provided in the procedure. The procedure needs to be amended to include the reference to API 1130 as well as the ATMOS LDS system and related procedures. 4#

32021023NOA_Notice of Amendment_05062021_(20-173060)_text.pdf, page 5Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Enforcement Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Following the receipt of this Notice, you have 30 days to submit written comments, revised procedures, or a request for a hearing under §190.211. If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue an Order Directing Amendment. If your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.206). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 30 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that Suncor maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to Gregory A. Ochs, Director, Central, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 3-2021-023-NOA and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, Gregory A. Ochs Director, Central Region, OPS Pipeline and Hazardous Materials Safety Administration cc: James Grothman, Compliance jgrothmann@suncor.com Enclosure: Response Options for Pipeline Operators in Enforcement Proceedings 5#

32021023NOA_Closure Letter_09092021_(20-173060)_text.pdf, page 1Official PDFVIA ELECTRONIC MAIL TO: nthonen@suncor.com and jgrothmann@suncor.com September 9, 2021 Ms. Nancy Thonen President Suncor Energy (USA) Pipeline Co. 717 17th Street, Suite 2900 Denver, CO 80202 Re: CPF 3-2021-023-NOA Dear Ms. Thonen: From August 10 through 14, 2020, a representative from the Pipeline and Hazardous Materials Safety Administration (PHMSA), pursuant to chapter 601 of 49 United States Code, conducted a remote pipeline safety inspection of Suncor Energy (USA) Pipeline Co. (Suncor) procedures in Sherwood Park, Alberta, Canada. As a result of the inspection, Suncor was issued a Notice of Amendment on May 6, 2021, which proposed amendment of your procedures. Suncor submitted its amended procedures on September 3, 2021. My staff reviewed the amended procedures, and it appears that the inadequacies outlined in this Notice of Amendment have been corrected. This letter is to inform you no further action is necessary and this case is now closed. Thank you for your cooperation. Sincerely, Gregory A. Ochs Director, Central Region, Office of Pipeline Safety Pipeline and Hazardous Materials Safety Administration#