TC OIL PIPELINE OPERATIONS INC — Warning Letter

420165012W_Warning Letter_04272016_text.pdf, page 1Official PDFWARNING LETTER CERTIFIED MAIL - RETURN RECEIPT REQUESTED April 27, 2016 Mr. Paul Miller Executive-Vice President/President, Liquids Pipelines TC Oil Pipeline Operations Inc. 450-1 Street SW Calgary, Alberta, Canada T2P 5H1 CPF 4-2016-5012W Dear Mr. Miller: On March 3, 2015 – May 14, 2015, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code inspected your procedures, records, and pipeline facilities for the Keystone XL – Gulf Coast Pipeline. As a result of the inspection, it appears that you have committed § 195.420(c) of the Pipeline Safety Regulations, Title 49, Code of Federal Regulations. The items inspected and the probable violation(s) are: 1. § 195.402 Procedural manual for operations, maintenance, and emergencies. (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs: (9) Providing for a post-accident review of employee activities to determine whether the procedures were effective in each emergency and taking corrective action where deficiencies are found. TransCanada did not perform a timely post-accident review of its procedures to determine their effectiveness in each emergency. During the review of TransCanada’s Incident Investigation#

420165012W_Warning Letter_04272016_text.pdf, page 2Report, issued on 8/29/14, an incident occurred on 7/29/14 at the Bryan Pump Station when oil backed up on the sump drain piping and released 20 gallons of oil onto the surrounding area. Post- accident, TransCanada completed a review of its procedures on 8/26/14, and those procedures were modified and recommended for approval on 9/3/14. The revised procedures were implemented almost three months after accident on 11/14/14. TransCanada needs to evaluate its corrective action process when deficiencies are found in order to expedite the time for implementing recommended procedural changes. 2. § 195.420 Valve maintenance. (c) Each operator shall provide protection for each valve from unauthorized operation and from vandalism. TransCanada did not adequately secure each valve from unauthorized operation. TransCanada’s pipeline facilities had a fence with locked gates to prevent entry, and main line valves were chained with locks at the time of the inspection. Valve controls that disable the remote operation of the valve and valve operation that were not locked at the time of the inspection are as follows: Bryan 1A, Bryan 1B, Delta 4A, WNSBR 2A, LIBRT 4A, LUFKN 2A and LKTLR 2A. PHMSA brought this to the attention of the company representative on site, and they agreed to lock all control boxes. 3. § 195.446 Control room management. (f) Change management. Each operator must assure that changes that could affect control room operations are coordinated with the control room personnel by performing each of the following: (1) Implement section 7 of API RP 1168 (incorporated by reference, see § 195.3) for control room management change and require coordination between control room representatives, operator's management, and associated field personnel when planning and implementing physical changes to pipeline equipment or configuration; and… TransCanada did not perform an adequate review of a control room management change that could affect control room operations. Based on TransCanada’s “Record of Change Review by Oil Control Centre” document, the controller Douglas Robertson reviewed and approved a CRM change on the same date and time. The record indicates that the change was reviewed on 5/28/14 at 08:11:13, and approved on 5/28/14 at 08:11:13. This indicates the controller did not review the change before approving or the system utilized to document the process did not accurately record#

420165012W_Warning Letter_04272016_text.pdf, page 3the time between reviewing and approving the change. TransCanada must ensure proper review of any changes that could affect control room operations. 4. § 195.565 How do I install cathodic protection on breakout tanks? After October 2, 2000, when you install cathodic protection under § 195.563(a) to protect the bottom of an aboveground breakout tank of more than 500 barrels (79.5m3 ) capacity built to API Specification 12F, API Standard 620, or API Standard 650 (or its predecessor Standard 12C), you must install the system in accordance with API Recommended Practice 651. However, installation of the system need not comply with API Recommended Practice 651 on any tank for which you note in the corrosion control procedures established under § 195.402(c)(3) why compliance with all or certain provisions of API Recommended Practice 651 is not necessary for the safety of the tank. TransCanada did not adequately design its cathodic protection system for newly constructed breakout tanks on the Keystone Gulf Coast Pipeline North system. During the inspection of the cathodic protection potentials for Tanks #5 and #7, there were issues identified with the cp readings varying between the 850 mV and 100 mV polarization criteria. Once the operator has established cp criteria as specified by API 651, he cannot arbitrarily switch from one criteria (850 mV) to another (100 mV polarization) during a survey cycle. Furthermore, the 2015 native surveys document cp potentials between 237 mV to 669 mV for both tanks which would be considered considerably low for a new tank bottom. Based on these findings TransCanada needs to evaluate the tank bottoms of these tanks for corrosion; determine if there is possible stray current near the tank facility; determine if grounding for the electrical equipment has been installed correctly at the site; and re-evaluate the design of the cathodic protection system for the breakout tanks. Under 49 United States Code, § 60122, you are subject to a civil penalty not to exceed $200,000 per violation per day the violation persists up to a maximum of $2,000,000 for a related series of violations. For violations occurring prior to January 4, 2012, the maximum penalty may not exceed $100,000 per violation per day, with a maximum penalty not to exceed $1,000,000 for a related series of violations. We have reviewed the circumstances and supporting documents involved in this case, and have decided not to conduct additional enforcement action or penalty assessment proceedings at this time. We advise you to correct the item(s) identified in this letter. Failure to do so will result in TC Oil Pipeline Operations Inc. being subject to additional enforcement action.#

420165012W_Warning Letter_04272016_text.pdf, page 4No reply to this letter is required. If you choose to reply, in your correspondence please refer to CPF 4-2016-5012W. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). Sincerely, R. M. Seeley Director, Southwest Region Pipeline and Hazardous Materials Safety Administration#