TC OIL PIPELINE OPERATIONS INC — Notice of Amendment

420165013M_Notice of Amendment_04262016_text.pdf, page 1Official PDFNOTICE OF AMENDMENT CERTIFIED MAIL - RETURN RECEIPT REQUESTED April 26, 2016 Mr. Paul Miller Executive-Vice President/President, Liquids Pipelines TC Oil Pipeline Operations Inc. 450-1 Street SW Calgary, Alberta, Canada T2P 5H1 CPF 4-2016-5013M Dear Mr. Miller: On March 3, 2015 – May 14, 2015, a representative of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code inspected TC Oil Pipeline Operations Inc. (TransCanada) procedures and records for the pipeline facilities of the Keystone XL – Gulf Coast Pipeline. On the basis of the inspection, PHMSA has identified the apparent inadequacies found within TransCanada’s plans or procedures, as described below: 1. § 195.402 Procedural manual for operations, maintenance, and emergencies. (c) Maintenance and normal operations. The manual required by paragraph (a) of this section must include procedures for the following to provide safety during maintenance and normal operations: (14) Taking adequate precautions in excavated trenches to protect personnel from the hazards of unsafe accumulations of vapor or gas, and making available when needed at the excavation, emergency rescue equipment, including a breathing apparatus and, a rescue harness and line. TransCanada’s operating procedure (Procedure), “Oil Pipelines Pressure Restriction Implementation Procedure”, section 5.0; page 5 of 8, revision 00, dated 2013/02/07 did not include adequate requirements for documenting the pressure restrictions specified by the procedures.#

420165013M_Notice of Amendment_04262016_text.pdf, page 2TransCanada’s operating procedure (Form), “Excavation Procedure Checklist”; revision 8, dated 2012/07/05 does not include an item requiring documentation of the pressure restriction at the excavation location. TransCanada must revise the Excavation Procedure Checklist to include documentation of the pressure restriction. 2. § 195.432 Inspection of in-service breakout tanks. (b) Each operator must inspect the physical integrity of in-service atmospheric and low- pressure steel aboveground breakout tanks according to API Standard 653 (incorporated by reference, see § 195.3). However, if structural conditions prevent access to the tank bottom, the bottom integrity may be assessed according to a plan included in the operations and maintenance manual under § 195.402(c)(3). TransCanada's Procedure 195.432, “Inspection of In-Service Breakout Tanks”, revision 8, dated 2015/02/16, section 3 references API 653, Section 4 for the inspection requirements of aboveground breakout tanks references the wrong section of API 653. The correct reference is API 653 Standards which deals with inspection of in-service breakout tanks. TransCanada must amend their procedures to require breakout tank inspections be performed in accordance to the requirements of API 653 Standard and reference the version of API Standard 653 incorporated in Part 195. 3. § 195.430 Firefighting equipment. Each operator shall maintain adequate firefighting equipment at each pump station and breakout tank area. The equipment must be— (a) In proper operating condition at all times; TransCanada’s procedure 195.430, “Firefighting Equipment”, revision 8, dated 2015/02/16, section 4.0, “General” does not include the requirement that firefighting equipment be, “in proper operating condition at all times”. TransCanada must revise their procedure to specify how and when maintenance will be performed on the firefighting equipment at each pump station and breakout tank area. 4. § 195.405 Protection against ignitions and safe access/egress involving floating roofs. (a) After October 2, 2000, protection provided against ignitions arising out of static electricity, lightning, and stray currents during operation and maintenance activities involving aboveground breakout tanks must be in accordance with API Recommended Practice 2003, unless the operator notes in the procedural manual (§ 195.402(c)) why#

420165013M_Notice of Amendment_04262016_text.pdf, page 3compliance with all or certain provisions of API Recommended Practice 2003 is not necessary for the safety of a particular breakout tank. TransCanada’s O&M procedure 195.405, – “Protection Against Ignitions…”, 3.0 Reference, does not indicate which edition (7th edition, January 2008) of API 2003 as the referenced standard incorporated by 49 CFR 195.3. TransCanada must amend their procedures to reference the version of API RP 2003 incorporated in Part 195. 5. § 195.405 Protection against ignitions and safe access/egress involving floating roofs. (b) The hazards associated with access/egress onto floating roofs of in-service aboveground breakout tanks to perform inspection, service, maintenance or repair activities (other than specified general considerations, specified routine tasks or entering tanks removed from service for cleaning) are addressed in API Publication 2026. After October 2, 2000, the operator must review and consider the potentially hazardous conditions, safety practices and procedures in API Publication 2026 for inclusion in the procedure manual (§ 195.402(c)). TransCanada’s O&M procedure 195.405, – “Protection Against Ignitions…”, 3.0 Reference, does not indicate which edition (2nd edition, April 1998, reaffirmed June 2006) of API 2026 as the most current referenced standard as incorporated by 49 CFR 195.3. TransCanada must amend their procedures to reference the version of API RP 2026 incorporated in Part 195. 6. § 195.54 Accident reports. (a) Each operator that experiences an accident that is required to be reported under § 195.50 must, as soon as practicable, but not later than 30 days after discovery of the accident, file an accident report on DOT Form 7000-1. TransCanada's Procedure 195.50 and 195.54 Reporting Accidents, does not meet the requirements of 105.54(a) which states that an operator must, as soon as practicable, but not later than 30 days after discovery of the accident, file an accident report on DOT Form 7000-1. TransCanada's procedure does not require the filing of an accident report not later than 30 days after discovery of the accident. TransCanada must revise their procedures to require a DOT Form 7000-1 be filed not later than 30 days after discovery of the accident.#

420165013M_Notice of Amendment_04262016_text.pdf, page 47. Per PHMSA Recommended Conditions for Keystone XL State Department Presidential Permit, Condition 50 states, Reporting – Immediate: Keystone must provide immediate notification of all reportable incidents in accordance with 49 CFR 195, and shall notify the appropriate PHMSA regional office within twenty-four (24) hours of any non-reportable leaks occurring on the pipeline. TransCanada's Procedure 195.52 – “Immediate Notice of Certain Accidents”, Section 4.0 General, #3, and does not meet the requirements of Special Permit Item #50. The permit states that TransCanada must provide immediate notification of all reportable incidents in accordance with 49 CFR 195, and non-reportable leaks within 24 hours. TransCanada's procedure does not require the immediate notification of incidents that meet the requirements per 195.50, 195.54, 195.55, and 195.56. Procedure requires only the immediate notification of incidents meeting the criteria of 195. 52. TransCanada must revise their procedures to require immediate notification of all reportable incidents as defined by Part 195 and the occurrence of any non-reportable leaks within 24 hours. 8. § 195.567 Which pipelines must have test leads and what must I do to install and maintain the leads? (c) Maintenance. You must maintain the test lead wires in a condition that enables you to obtain electrical measurements to determine whether cathodic protection complies with § 195.571. § 195.571 What criteria must I use to determine the adequacy of cathodic protection? Cathodic protection required by this Subpart must comply with one or more of the applicable criteria and other considerations for cathodic protection contained in paragraphs 6.2 and 6.3 of NACE SP 0169 (incorporated by reference, see § 195.3). TransCanada’s O&M procedure 195.567 – “Test Leads” does not specify a process for taking cathodic protection readings when a test lead is found to be broken. Additionally, procedure does not require broken test leads to be repaired before the next monitoring cycle. TransCanada must revise their procedures to specify the actions for taking cathodic protection readings when a test lead is broken, and requires repairs be made to that test lead prior to the next required monitoring cycle. 9. § 195.583 What must I do to monitor atmospheric corrosion control? (a) You must inspect each pipeline or portion of pipeline that is exposed to the atmosphere for evidence of atmospheric corrosion, as follows:#

420165013M_Notice of Amendment_04262016_text.pdf, page 5If the pipeline is located: Then the frequency of inspection is: Onshore At least once every 3 calendar years, but with intervals not exceeding 39 months. Offshore At least once each calendar year, but with intervals not exceeding 15 months. (b) During inspections you must give particular attention to pipe at soil-to-air interfaces, under thermal insulation, under disbonded coatings, at pipe supports, in splash zones, at deck penetrations, and in spans over water. TransCanada’s O&M procedure 195.583 – “Atmospheric Corrosion Monitoring” does not specifically include requirements for the inspection of piping under thermal insulation once every three calendar years, but with intervals not exceeding 39 months. A significant portion of TransCanada’s above ground piping on the Gulf Coast is insulated manifold piping. Due to the increase in viscosity the temperature of the commodity drops. TransCanada made no provisions for atmospheric corrosion inspections of this piping that is subject to a specialized type of atmospheric corrosion termed corrosion under insulation or CUI. TransCanada must provide procedures to inspect the insulated piping for atmospheric corrosion as required by 195.583. 10. § 195.579 What must I do to mitigate internal corrosion? (c) Removing pipe. Whenever you remove pipe from a pipeline, you must inspect the internal surface of the pipe for evidence of corrosion. If you find internal corrosion requiring corrective action under § 195.585, you must investigate circumferentially and longitudinally beyond the removed pipe (by visual examination, indirect method, or both) to determine whether additional corrosion requiring remedial action exists in the vicinity of the removed pipe. TransCanada’s O&M procedure 195.579 – “Internal Corrosion Control” does not require removed pipe found with internal corrosion to be investigated circumferentially and longitudinally beyond the removed the pipe. TransCanada must revise their procedures to include requirements to investigate circumferentially and longitudinally remove pipe remove pipe from a pipeline for evidence of corrosion. The operator must take appropriate corrective action if corrosion is found.#

420165013M_Notice of Amendment_04262016_text.pdf, page 6Response to this Notice This Notice is provided pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.237. Enclosed as part of this Notice is a document entitled Response Options for Pipeline Operators in Compliance Proceedings. Please refer to this document and note the response options. Be advised that all material you submit in response to this enforcement action is subject to being made publicly available. If you believe that any portion of your responsive material qualifies for confidential treatment under 5 U.S.C. 552(b), along with the complete original document you must provide a second copy of the document with the portions you believe qualify for confidential treatment redacted and an explanation of why you believe the redacted information qualifies for confidential treatment under 5 U.S.C. 552(b). If you do not respond within 30 days of receipt of this Notice, this constitutes a waiver of your right to contest the allegations in this Notice and authorizes the Associate Administrator for Pipeline Safety to find facts as alleged in this Notice without further notice to you and to issue a Final Order. If, after opportunity for a hearing, your plans or procedures are found inadequate as alleged in this Notice, you may be ordered to amend your plans or procedures to correct the inadequacies (49 C.F.R. § 190.237). If you are not contesting this Notice, we propose that you submit your amended procedures to my office within 45 days of receipt of this Notice. This period may be extended by written request for good cause. Once the inadequacies identified herein have been addressed in your amended procedures, this enforcement action will be closed. It is requested (not mandated) that TC Oil Pipeline Operations Inc. maintain documentation of the safety improvement costs associated with fulfilling this Notice of Amendment (preparation/revision of plans, procedures) and submit the total to R. M. Seeley, Director, Southwest Region, Pipeline and Hazardous Materials Safety Administration. In correspondence concerning this matter, please refer to CPF 4-2016-5013M and, for each document you submit, please provide a copy in electronic format whenever possible. Sincerely, R. M. Seeley Director, Southwest Region Pipeline and Hazardous Materials Safety Administration Enclosure: Response Options for Pipeline Operators in Compliance Proceedings#

420165013M_Closure Letter_07092019_text.pdf, page 1Official PDFCERTIFIED MAIL - RETURN RECEIPT REQUESTED July 9, 2019 Paul Miller Executive Vice-President and President, Liquids Pipelines TC Oil Pipeline Operations, Inc. 450 1st Street S.W. Calgary, Alberta, Canada T2P5H1 CPF 4-2016-5013M Dear Mr. Miller: From March 3, 2015 to May 14, 2015, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA) pursuant to Chapter 601 of 49 United States Code, conducted an inspection of TC Oil Pipeline Operations, Inc., a subsidiary of TransCanada Corporation (TransCanada), including its written procedures and records for the pipeline facilities of the Gulf Coast Pipeline. TransCanada owns and operates the Keystone Pipeline System, including the Gulf Coast Pipeline. As a result of the inspection, TransCanada was issued a Notice of Amendment on April 26, 2016. TransCanada responded to the Notice by letters dated June 8, 2016 and August 26, 2016 with procedural revisions. Following further discussion to resolve the remaining issues on October 12, 2016 and February 8, 2017 PHMSA issued an Ordering of Directing Amendment on February 4, 2019. TransCanada submitted its amended procedures on February 27, 2019. My staff reviewed the amended procedures, and it appears that the inadequacies outlined in this Order of Directing Amendment have been corrected. This letter is to inform you no further action is necessary and this case is now closed. Thank you for your cooperation. Sincerely, Mary L. McDaniel, P.E. Director, Southwest Region Pipeline and Hazardous Materials Safety Administration#

420165013M_Order Directing Amendment_02042019_text.pdf, page 1Official PDFFebruary 4, 2019 Mr. Russell K. Girling President and Chief Executive Officer TransCanada Corporation 450-1 Street SW Calgary, Alberta, Canada T2P 5H1 Re: CPF No. 4-2016-5013M Dear Mr. Girling: Enclosed please find the Order Directing Amendment issued in the above-referenced case. It makes findings of inadequate procedures and requires that TC Oil Pipeline Operations, Inc., a subsidiary of TransCanada Corporation, amend certain of its operating and maintenance procedures. When the amendment of procedures has been completed, as determined by the Director, Southwest Region, this enforcement action will be closed. Service of the Order Directing Amendment by certified mail is deemed effective upon the date of mailing, or as otherwise provided under 49 C.F.R. § 190.5. Thank you for your cooperation in this matter. Sincerely, Alan K. Mayberry Associate Administrator for Pipeline Safety Enclosure cc: Ms. Mary McDaniel, Director, Southwest Region, Office of Pipeline Safety, PHMSA Mr. Paul Miller, Executive Vice President and President, Liquids Pipelines, TC Oil Pipeline Operations, Inc., 700 Louisiana Street, Suite 700, Houston, TX 77002-2700 Mr. Lee Romack, Manager, U.S. Regulatory Compliance, TransCanada Corporation, lee_romack@transcanada.com CERTIFIED MAIL - RETURN RECEIPT REQUESTED#

420165013M_Order Directing Amendment_02042019_text.pdf, page 2U.S. DEPARTMENT OF TRANSPORTATION PIPELINE AND HAZARDOUS MATERIALS SAFETY ADMINISTRATION OFFICE OF PIPELINE SAFETY WASHINGTON, D.C. 20590 __________________________________________ In the Matter of ) TC Oil Pipeline Operations, Inc., ) CPF No. 4-2016-5013M a subsidiary of TransCanada Corporation, ) ) ) ) Respondent. ) __________________________________________) ORDER DIRECTING AMENDMENT From March 3, 2015 to March 14, 2015, pursuant to 49 U.S.C. § 60117, representatives of the Pipeline and Hazardous Materials Safety Administration (PHMSA), Office of Pipeline Safety (OPS), conducted an inspection of TC Oil Pipeline Operations, Inc., a subsidiary of TransCanada Corporation (TransCanada or Respondent), including its written procedures and records for the pipeline facilities of the Gulf Coast Pipeline. TransCanada owns and operates the Keystone Pipeline System, including the Gulf Coast Pipeline. As a result of the inspection, the Director, Southwest Region, OPS (Director), issued to Respondent, by letter dated April 26, 2016, a Notice of Amendment (Notice), alleging that TransCanada’s plans and procedures were inadequate to ensure the safe operation of its pipeline facilities and proposing, in accordance with 49 C.F.R. § 190.206, that Respondent amend its procedures. TransCanada responded to the Notice by letter dated June 8, 2016 (Response), and submitted revised procedures. On August 26, 2016, in response to PHMSA identifying certain alleged inadequacies that remained in the procedures, TransCanada submitted a second set of revised procedures to PHMSA, after which Respondent and PHMSA communicated further about the procedures. Respondent did not request a hearing and therefore has waived its right to one. Upon review of the amended procedures submitted by Respondent, I find that Respondent has corrected the identified inadequacies in Items 9 and 10 of the Notice. However, for the reasons discussed below, I find that Respondent still has not adequately addressed Items 1 through 8 of the Notice.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 3CPF No. 4-2016-5013M Page 2 FINDINGS OF INADEQUATE PROCEDURES The Notice alleged certain inadequacies in Respondent’s plans and procedures and proposed requiring TransCanada to amend its procedures to ensure safe operations with regard to the provisions of 49 C.F.R. Part 195. Pursuant to 49 U.S.C. § 60108(a) and 49 C.F.R. § 190.206, I find the following procedures to be inadequate: Item 1: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.402(c)(14), which states: § 195.402 Procedural manual for operations, maintenance, and emergencies. (a) . . . . (c) Maintenance and normal operations. The manual required by paragraph (a) of this section must include procedures for the following to provide safety during maintenance and normal operations: . . . (1) . . . . (14) Taking adequate precautions in excavated trenches to protect personnel from the hazards of unsafe accumulations of vapor or gas, and making available when needed at the excavation, emergency rescue equipment, including a breathing apparatus and, a rescue harness and line. The Notice alleged that Respondent’s procedure regarding the documentation of pressure restrictions in excavated trenches, pursuant to 49 C.F.R. § 195.402(c)(14), was inadequate. Specifically, the Notice alleged that Respondent’s Operating Procedure, titled “Oil Pipelines Pressure Restriction Implementation Procedure,” referenced another TransCanada operating form, titled "Excavation Procedure Checklist"; revision 8, dated 2012/07/05, but did not require documentation of the pressure restriction at the excavation location. In its Response, TransCanada did not contest the allegation and stated that it was “amending the Excavation Procedure Checklist to include documentation of pressure restrictions.” Respondent submitted a revised “Excavation Procedure Checklist” on August 26, 2016, which included the following item in the “Planning” section of the checklist: “21. Is a pressure restriction required for the excavation and if so note the restriction in the comments?” Having reviewed TransCanada’s revised procedure, I find that although Respondent amended its Excavation Procedure Checklist to include a question about whether a pressure restriction was required for excavation, and if so, to note the restriction in the comments, the procedure still does not clearly state that pressure restrictions are to be implemented and documented before the excavation. Accordingly, I find that Respondent’s procedures are still inadequate to assure safe operation of its pipeline system. Respondent is hereby ordered to amend its written procedures as follows. TransCanada must: 1. Revise its operating procedure, titled "Excavation Procedure Checklist," to specifically state that pressure restrictions are to be implemented and documented prior to any excavation activities; and#

420165013M_Order Directing Amendment_02042019_text.pdf, page 4CPF No. 4-2016-5013M Page 3 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Order. Item 2: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.432(b), which states: § 195.432 Inspection of in-service breakout tanks. (a) . . . . (b) Each operator must inspect the physical integrity of in-service atmospheric and low-pressure steel aboveground breakout tanks according to API Std 653 (except section 6.4.3, Alternative Internal Inspection Interval) (incorporated by reference, see § 195.3). However, if structural conditions prevent access to the tank bottom, its integrity may be assessed according to a plan included in the operations and maintenance manual under § 195.402(c)(3). The risk-based internal inspection procedures in API Std 653, section 6.4.3 cannot be used to determine the internal inspection interval. The Notice alleged that Respondent’s procedure regarding the inspection of in-service breakout tanks pursuant to 49 C.F.R. § 195.432(b) was inadequate because it referenced an incorrect section of API Standard (Std) 653. Specifically, the Notice alleged that TransCanada’s O&M Procedure 195.432, "Inspection of In-Service Breakout Tanks", revision 8, dated 2015/02/16, referenced API Std 653, Section 4, for the inspection requirements of aboveground breakout tanks. The Notice alleged that the correct reference should have been to API Std 653 in its entirety. In its Response, TransCanada did not contest the allegation and acknowledged that its procedure included an incorrect reference to API Std 653, Section 4. TransCanada stated that it would amend the procedure to require breakout tank inspections be performed in accordance to the requirements of API Std 653 and include a reference to the version of API Std 653 that has been incorporated by reference into 49 C.F.R. Part 195. TransCanada submitted amended procedures on August 26, 2016, Section 4.0 of which states, “Low pressure steel aboveground tanks are inspected according to API 653 . . . .” With respect to the version of API Std 653, the procedure references “API Standard 653, latest edition incorporated by reference (IBR) in 49 CFR § 195.3.” Similarly, the procedures reference certain other API Standards, using the language “latest edition incorporated by reference in 49 CFR § 195.3.” Having considered Respondent’s procedure, I find that although TransCanada’s amended procedure now identifies API Std 653 in its entirety, it still does not clearly identify the specific version of API Std 653 incorporated by reference in 49 C.F.R. § 195.3. The language of the procedure, i.e., the “latest edition incorporated by reference in 49 CFR § 195.3,” assumes that Respondent’s personnel have the most recent version of 49 CFR Part 195 accessible, and may lead to confusion about the correct edition to use if an individual has an old version of the Code or if the Code has been recently revised. The version of API Std 653 currently incorporated by reference in 49 C.F.R. Part 195 is “API Standard 653, ‘Tank Inspection, Repair, Alteration, and#

420165013M_Order Directing Amendment_02042019_text.pdf, page 5CPF No. 4-2016-5013M Page 4 Reconstruction,’ 3rd edition, December 2001 (including addendum 1 (September 2003), addendum 2 (November 2005), addendum 3 (February 2008), and errata (April 2008)).” Furthermore, the amended procedure does not specifically require that in-service atmospheric steel aboveground breakout tanks, in addition to low-pressure steel aboveground breakout tanks, be inspected according to API Std 653. Under 49 C.F.R. § 195.432(b), an operator must follow all of the requirements of API Std 653, as referenced in 49 C.F.R. § 195.3, except section 6.4.3, unless structural conditions prevent access to the tank bottom. The Standard details specific maintenance inspection, repair, alteration, relocation, and reconstruction requirements that operators must follow with regard to certain in-service tanks. Upon review of Respondent’s amendment to “O&M Procedure 195.432 Inspection of in-service break out tanks,” as quoted above, the procedure remains inadequate to ensure safety with regard to § 195.432(b). Accordingly, I find that Respondent’s procedures are still inadequate to assure safe operation of its pipeline system. TransCanada is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise its procedural manual, titled “O&M Procedure 195.432 Inspection of in- service break out tanks” part 3.0, to specifically identify API Standard 653, “Tank Inspection, Repair, Alteration, and Reconstruction,” 3rd edition, December 2001, (including addendum 1 (September 2003), addendum 2 (November 2005) addendum 3 (February 2008), and errata (April 2008)), as a reference for in- service atmospheric and low-pressure breakout tank inspections; 2. Revise its procedural manual, titled “O&M Procedure 195.432 Inspection of in- service break out tanks” part 4.0, subsection 2, to state that in-service atmospheric and breakout tanks are to be inspected according to API Standard 653, “Tank Inspection, Repair, Alteration, and Reconstruction,” 3rd edition, December 2001, (including addendum 1 (September 2003), addendum 2 (November 2005); and 3. Submit the amended procedural manual to the Director within 30 days following receipt of this Order. Item 3: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.430(a), which states: § 195.430 Firefighting equipment. Each operator shall maintain adequate firefighting equipment at each pump station and breakout tank area. The equipment must be— (a) In proper operating condition at all times; . . . . The Notice alleged that Respondent’s procedure regarding firefighting equipment pursuant to 49 C.F.R. § 195.430(a) was inadequate because it failed to specify how and when maintenance would be performed on the firefighting equipment at each pump station and breakout tank to ensure that it was in proper operating condition at all times. Specifically, the Notice alleged that#

420165013M_Order Directing Amendment_02042019_text.pdf, page 6CPF No. 4-2016-5013M Page 5 TransCanada’s Procedure 195.430, "Firefighting Equipment", revision 8, Section 4.0, “General,” dated 2015/02/16, did not include the requirement that firefighting equipment be “in proper operating condition at all times” and did not specify how and when maintenance would be performed on the equipment to ensure proper operating condition. In its Response, TransCanada did not contest the allegation and stated that it was “in process of revising [its] procedures to specify how and when maintenance will be performed on the firefighting equipment at each pump station and breakout tank.”1 Respondent submitted a revised procedure for its firefighting equipment, by email dated August 26, 2016, and stated that its revised procedure defined the requirement for maintaining firefighting equipment and the required maintenance interval. Upon review of the revised procedure, PHMSA personnel informed Respondent that the company’s procedures still did not explicitly identify the frequency of inspections for the firefighting equipment at each pump station and breakout-tank area. On October 24, 2016, in response to PHMSA identifying inadequacies that remained in the procedure, TransCanada contended that its amended procedure was adequate because it stated that the firefighting equipment was to be “inspected on an M01 basis”, and that “M01 Level 1 is defined as a monthly inspection which is in accordance with NFPA 10 Section 7.2.4.1.4.” Having considered Respondent’s revised procedure, I find that although it states that inspections of firefighting equipment are to be performed on an M01 Level 1 basis, the amended procedure still does not clearly state that M01 Level 1 means monthly inspection intervals. The absence of such clarification in the procedure can lead to confusion about the intervals required by M01 Level 1. Accordingly, I find that TransCanada’s procedure is still inadequate to assure safe operation of its pipeline system. Respondent is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise its procedure, titled “O&M document (EDMS# 005713585),” to identify the frequency of maintenance intervals for firefighting equipment at pump-station and breakout-tank areas; and 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Order. Item 4: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.405(a), which states: § 195.405 Protection against ignitions and safe access/egress involving floating roofs. (a) After October 2, 2000, protection provided against ignitions arising out of static electricity, lightning, and stray currents during operation and maintenance activities involving aboveground breakout tanks must be in 1 Response, at 1.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 7CPF No. 4-2016-5013M Page 6 accordance with API RP 2003 (incorporated by reference, see 49 C.F.R. § 195.3), unless the operator notes in the procedural manual (49 C.F.R. § 195.402(c)) why compliance with all or certain provisions of API RP 2003 is not necessary for the safety of a particular breakout tank. The Notice alleged that TransCanada’s procedure regarding protection against ignitions and safe access involving floating tanks pursuant to 49 C.F.R. § 195.405(a) was inadequate because it failed to indicate which edition of API Recommended Practice (RP) 2003 was the applicable standard. Specifically, the Notice alleged that Respondent’s O&M Procedure 195.405, - "Protection Against Ignitions ... ", 3.0 Reference, did not specifically reference which edition of API RP 2003 was incorporated by reference into 49 C.F.R. § 195.3. In its Response, TransCanada did not contest the allegation and stated that it would amend its procedures to reference the correct version of API RP 2003 that was incorporated in Part 195. Respondent submitted amended procedures to PHMSA, by email dated August 26, 2016, Section 3.0 of which references “API Recommended Practice 2003 Protection Against Ignitions Arising out of Static, Lightning and Stray Current, latest edition incorporated by reference in 49 CFR § 195.3.”2 Having reviewed TransCanada’s revised procedures, I find that the phrase “latest edition incorporated by reference in 49 CFR § 195.3,” is still inadequate because it could lead to confusion. The correct version that is incorporated by reference in the Code is “API Recommended Practice 2003, ‘Protection against Ignitions Arising out of Static, Lightning, and Stray Currents,’ 7th edition, January 2008, (API RP 2003).” Accordingly, I find that TransCanada’s procedures are still inadequate to assure safe operation of its pipeline system. Respondent is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise its procedural manual, titled “O&M procedure 195.405, - "Protection Against Ignitions ... ", section 3.0, to specifically identify API Recommended Practice 2003, “Protection against Ignitions Arising out of Static, Lightning, and Stray Currents,” 7th edition, January 2008, (API RP 2003); and 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Order. Item 5: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.405(b), which states: § 195.405 Protection against ignitions and safe access/egress involving floating roofs. (a) . . . . (b) The hazards associated with access/egress onto floating roofs of in- service aboveground breakout tanks to perform inspection, service, 2 Revisions identified in italics.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 8CPF No. 4-2016-5013M Page 7 maintenance, or repair activities (other than specified general considerations, specified routine tasks or entering tanks removed from service for cleaning) are addressed in API Pub 2026 (incorporated by reference, see § 195.3). After October 2, 2000, the operator must review and consider the potentially hazardous conditions, safety practices, and procedures in API Pub 2026 for inclusion in the procedure manual (§ 195.405(c)). The Notice alleged that TransCanada’s procedure regarding protection against ignitions and safe access/egress involving floating roofs on breakout tanks pursuant to 49 C.F.R. § 195.405(b) was inadequate because it did not indicate which edition of API Publication (Pub) 2026 was the applicable standard. Specifically, the Notice alleged that Respondent’s O&M Procedure 195.405, "Protection Against Ignitions ... ", 3.0 Reference, did not specifically reference the 2nd Edition, April 1998, reaffirmed June 2006, of API Pub 2026 as the most current standard incorporated by 49 C.F.R. § 195.3. In its Response, TransCanada did not contest the allegation and stated that it would amend its procedures to reference the version of API RP 2026 incorporated in Part 195. Respondent submitted amended procedures to PHMSA by email on August 26, 2016, Section 3.0 of which references “API Recommended Practice 2026, Safe Access/Egress Involving Floating Roods of Storage Tanks in Petroleum Service, latest edition incorporated by reference in 49 CFR § 195.3.”3 Having reviewed TransCanada’s procedures, I find that the language “latest edition incorporated by reference in 49 CFR § 195.3,” is still inadequate because it could lead to confusion for the same reason identified above in Items 2 and 4. The correct version that is incorporated by reference in the Code is “API Publication 2026, ‘Safe Access/Egress Involving Floating Roofs of Storage Tanks in Petroleum Service,’ 2nd edition, April 1998 (reaffirmed June 2006) (API Pub 2026).” Accordingly, I find that Respondent’s procedures are still inadequate to assure safe operation of its pipeline system. TransCanada is hereby ordered to amend its written procedures as follows. Respondent must: 1. 2. Revise its procedural manual, titled “O&M Procedure 195.405, - "Protection Against Ignitions ... ", section 3.0, to specifically identify API Publication 2026, “Safe Access/Egress Involving Floating Roofs of Storage Tanks in Petroleum Service,” 2nd edition, April 1998 (reaffirmed June 2006) (API Pub 2026); and Submit the amended procedural manual to the Director within 30 days following receipt of this Order. 3 Revisions identified in italics.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 9CPF No. 4-2016-5013M Page 8 Item 6: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.54(a), which states: § 195.54 Accident reports. (a) Each operator that experiences an accident that is required to be reported under § 195.50 must, as soon as practicable, but not later than 30 days after discovery of the accident, file an accident report on DOT Form 7000-1. The Notice alleged that Respondent’s procedure regarding the filing of accident reports pursuant to 49 C.F.R. § 195.54(a) was inadequate because the procedure did not require accidents to be reported within the time period prescribed, using DOT Form 7000-1. Specifically, the Notice alleged that TransCanada’s “O&M Procedure 195.50 and 190.54 – Reporting Accidents,” did not require the filing of an accident report within 30 days after the discovery of an accident, using the DOT Form. In its Response, TransCanada did not contest the allegation and stated that it was in the process of revising its procedure to address the deficiencies alleged in the Notice. Respondent submitted amended procedures to PHMSA by email on August 26, 2016, Section 4.0 of which states that the “accident report is filed by use of the electronic incident/accident reporting system which can be accessed by using the following URL: https://portal.phmsa.dot.gov. This report is submitted as soon as practicable, but not later than 30 days after discovery of the accident.”4 Having reviewed Respondent’s procedures, I find that although TransCanada has amended its procedure to require the filing of accident reports as soon as practicable, but not later than 30- days after discovery of the accident, the procedures do not specifically require that accident reports be filed on DOT Form 7000-1. Accordingly, I find that Respondent’s procedure is still inadequate to assure safe operation of its pipeline system. TransCanada is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise its procedural manual, titled “O&M Procedure 195.50 and 195.54 Reporting Accidents” section 4.0, subsection 3, to state that DOT Form 7000-1 must be used to file accident reports; and 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Final Order. Item 7: The Notice alleged that Respondent’s procedure regarding the reporting of pipeline incidents under TransCanada’s Keystone XL State Department Presidential Permit, Condition 50, and 49 C.F.R. Part 195, was inadequate. Specifically, Condition 50 states: Keystone XL State Department Presidential Permit, Condition 50 Reporting - Immediate: Keystone must provide immediate notification 4 Response, at 1. Revisions identified in italics.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 10CPF No. 4-2016-5013M Page 9 of all reportable incidents in accordance with 49 CFR Part 195, and shall notify the appropriate PHMSA regional office within twenty-four (24) hours of any non-reportable leaks occurring on the pipeline. The Notice alleged that Respondent’s procedure was inadequate with regard to Condition 50 because it did not require notification of incidents within the time period prescribed. According to the Notice, Respondent’s procedure for § 195.52, titled “Immediate Notice of Certain Accidents,” did not require the immediate notification of all incidents that must be reported under 49 C.F.R. Part 195. Rather, TransCanada’s procedure allegedly only required immediate notification for incidents meeting the criteria of § 195.52. Respondent submitted amended procedures to PHMSA by email on August 26, 2016. Having reviewed TransCanada’s procedure, I find that although Respondent’s revised procedure for § 195.52 specifically states that all non-reportable leaks “are reported to the appropriate PHMSA regional office within twenty-four (24) hours, in accordance with the Presidential Permit, Condition 50,”5 it does not specifically require immediate notification of all incidents that are reportable under 49 C.F.R. Part 195. The procedure only requires immediate notification of incidents that are reportable under § 195.52. Accordingly, I find that Respondent’s procedure is still inadequate to assure safe operation of its pipeline system. TransCanada is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise its procedural manual, titled “O&M Procedure 195.52, Section 1.0 and 4.0,” to reflect that immediate notification of all incidents reportable under 49 C.F.R Part 195 is required, in addition to the requirement that all non-reportable leaks are to be reported to the appropriate PHMSA regional office within twenty- four (24) hours, in accordance with the Presidential Permit, Condition 50. Specific reference to §§ 195.50, 195.52, 195.54, 195.55, and 195.56 must be included in the procedure; and 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Order. Item 8: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.567(c), which states: § 195.567 Which pipelines must have test leads and what must I do to install and maintain the leads? (a) . . . . (c) Maintenance. You must maintain the test lead wires in a condition that enables you to obtain electrical measurements to determine whether cathodic protection complies with § 195.571. 5 TransCanada’s O&M Procedure Manual – U.S. Hazardous Liquids Pipelines, 195.52 –Immediate Notice of Certain Accidents, Revision 8, Effective Date: 2015/2/16 (on file with PHMSA).#

420165013M_Order Directing Amendment_02042019_text.pdf, page 11CPF No. 4-2016-5013M Page 10 The Notice alleged that Respondent’s procedure regarding cathodic-protection test leads pursuant to 49 C.F.R. § 195.567 was inadequate because it did not specify a process for taking cathodic-protection readings when a test lead was found to be broken. Additionally, the Notice alleged that the procedure did not require broken test leads to be repaired before the next monitoring cycle. Specifically, the Notice alleged that TransCanada’s O&M Procedure 195.567 - "Test Leads," did not specify the actions needed for taking cathodic-protection readings when a test lead was broken. In its Response, TransCanada contested the allegation and stated that its procedure was adequate to ensure compliance with § 195.567. Specifically, Respondent stated that its procedure, titled “TES- CP- SS Cathodic Protection Survey Specification (CDN- US- MEX) EDMS No.:003670956 Section 6.6 Test Station Identification,” and another one, titled “195.573 External Corrosion Control Monitoring,” taken together, required that all loose or damaged test leads that did not require excavation to repair, as well as any test leads that did require excavation, be repaired and documented. Additionally, TransCanada noted the procedures recommended initiating corrective actions, if necessary, before the next inspection cycle. Respondent contended that, based upon these two requirements, the procedures did adequately specify the actions needed for taking cathodic protection readings when a test lead was broken and did adequately specify that it be repaired prior to the next required monitoring cycle. Having reviewed the record in its entirety, I find that TransCanada’s procedure for § 195.567 still does not specify what must be documented if lost or damaged test leads are inoperative or need to be repaired. Such information must be included in the procedure in order to ensure uniformity regarding the information Respondent must document when test leads are inoperative or need to be repaired in order to assure that the procedures facilitate compliance with § 195.567(c). Accordingly, I find that Respondent’s procedures are still inadequate to assure safe operation of its pipeline system. TransCanada is hereby ordered to amend its written procedures as follows. Respondent must: 1. Revise section 6.6 of its procedural manual, titled “Section 6.6, TES- CP- SS Cathodic Protection Survey Specification (CDN- US- MEX) EDMS No.:003670956,” to specify what will be documented if lost or damaged test leads are inoperative or need to be repaired; and 2. Submit the amended procedural manual to the Director within 30 days following receipt of this Final Order. Item 9: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.583(a), which states: § 195.583 What must I do to monitor atmospheric corrosion control? (a) You must inspect each pipeline or portion of pipeline that is exposed to the atmosphere for evidence of atmospheric corrosion, as follows:#

420165013M_Order Directing Amendment_02042019_text.pdf, page 12CPF No. 4-2016-5013M Page 11 If the pipeline is located: Onshore Offshore Then the frequency of inspection is: At least once every 3 calendar years, but with intervals not exceeding 39 months. At least once every calendar year, but with interval not exceeding 15 months. (b) During inspections you must give particular attention to pipe at soil- to-air interfaces, under thermal insulation, under disbanded coatings, at pipe supports, in splash zones, at deck penetrations, and in spans over water. The Notice alleged that Respondent’s procedure regarding the control of atmospheric corrosion pursuant to 49 C.F.R. § 195.583 was inadequate because it did not require giving particular attention to pipe under thermal insulation during inspections. Specifically, the Notice alleged that TransCanada’s “O&M Procedure 195.583 – Atmospheric Corrosion Monitoring” did not include requirements for the inspection of piping under thermal insulation. According to the Notice, a significant portion of TransCanada’s above-ground piping on the Gulf Coast is insulated manifold piping, yet the company made no provision for the inspection of this piping that is subject to a specialized type of atmospheric corrosion termed “corrosion under insulation.” In its Response, TransCanada did not contest the allegation and stated that it would revise its procedures to address the deficiencies alleged in the Notice. By email dated August 26, 2016, in response to PHMSA identifying inadequacies that remained in the amended procedures, Respondent submitted a document titled, “TransCanada Operating Procedure (Task Package) – Atmospheric Corrosion Inspection” (EDMS# 004266539). The document purported to address the inadequacies identified in the Notice regarding TransCanada’s O&M Procedure for § 195.583 Atmospheric Corrosion Monitoring. Respondent, however, did not submit a revised version of the procedure specifically identified in the Notice as being inadequate. On October 24, 2016, again in response to PHMSA identifying inadequacies that still remained in the amended procedures, TransCanada provided a statement of clarification regarding its procedure for § 195.583, and identified areas where the procedures had been modified to address the inadequacies alleged in the Notice. TransCanada modified its procedure for § 195.583 to specifically state that separate inspections were to be performed at each location of insulated piping. Respondent further modified its procedures to state that if corrosion were found under thermal insulation, the corrosion was to be repaired and the pipe coated in accordance with O&M Procedures §§ 195.585 and 195.581, respectively. Finally, Respondent stated that its procedure for § 195.583, in conjunction with “TransCanada Operating Procedure (Task Package) – Atmospheric Corrosion Inspection” (EDMS# 004266539), which is specifically referenced in the procedure for § 195.583, addressed all of the issues identified in the Notice and subsequent correspondence from PHMSA.6 Having reviewed the record in its entirety, I find that Respondent has satisfactorily revised its procedure for § 195.583 to address the allegations contained in the Notice. Specifically, the 6 Operator NOA Follow Up Response Email, dated October 24, 2016.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 13CPF No. 4-2016-5013M Page 12 revised procedure now includes a requirement that piping under thermal insulation be inspected once every three calendar years, but with intervals not exceeding 39 months. Further, the revised procedure directs the reader to another procedure, titled “TransCanada Operating Procedure (Task Package) – Atmospheric Corrosion Inspection” (EDMS# 004266539), which is incorporated into Part 195 by reference and includes provisions for atmospheric corrosion inspections of above-ground insulated manifold piping. I find Respondent’s argument persuasive that its “Atmospheric Corrosion Inspection” procedure provides sufficient guidance for performing atmospheric corrosion inspections on insulated piping.7 Accordingly, I find that TransCanada’s original procedures were inadequate, but that the inadequacies identified in the Notice have been corrected, and the amended procedures for § 195.583 are adequate to assure the safe operation of its pipeline system. Item 10: The Notice alleged that Respondent’s procedures were inadequate with regard to 49 C.F.R. § 195.579(c), which states: § 195.579 What must I do to mitigate internal corrosion? (a) . . . . (c) Removing pipe. Whenever you remove pipe from a pipeline, you must inspect the internal surface of the pipe for evidence of corrosion. If you find internal corrosion requiring corrective action under § 195.585, you must investigate circumferentially and longitudinally beyond the removed pipe (by visual examination, indirect method, or both) to determine whether additional corrosion requiring remedial action exists in the vicinity of the removed pipe. The Notice alleged that Respondent’s procedure regarding the inspection of removed pipe pursuant to 49 C.F.R. § 195.579(c) was inadequate because it did not require the removed pipe to be investigated circumferentially and longitudinally beyond the removed pipe to determine whether additional corrosion requiring remedial action existed in the vicinity of the removed pipe. In its Response, TransCanada did not contest the allegation and stated that it would revise its procedures to address the deficiencies alleged in the Notice. Respondent submitted amended procedures to PHMSA by email on August 26, 2016, which stated: “If internal corrosion is found, the adjacent pipe is investigated circumferentially and longitudinally beyond the removed pipe to determine the extent of internal corrosion in accordance with O&M procedure 195.587. Required remedial measures are performed in accordance with O&M Procedure 195.585.”8 7 See Operator NOA Follow Up Response Email, dated October 24, 2016 (“Section 4.3.2 (of the referenced document, Atmospheric Corrosion Inspection) identifies a requirement to evaluate the geometry of an installation to determine location of inspection ports to facilitate inspection and it provides criteria for its selection . . . .”) (on file with PHMSA). 8 Revisions identified in italics.#

420165013M_Order Directing Amendment_02042019_text.pdf, page 14CPF No. 4-2016-5013M Page 13 Having reviewed TransCanada’s procedures, I find that Respondent has amended its procedure for § 195.579 to include the language specifically identified in the Notice. Accordingly, I find that TransCanada’s original procedures were inadequate, but that the inadequacies identified in the Notice have been corrected and that the amended procedures for § 195.579 are adequate to assure safe operation of its pipeline system. For the amendments to procedures required by this Order, the Director may grant an extension of time to comply with any of the required items upon a written request timely submitted by the Respondent and demonstrating good cause for an extension. Failure to comply with this Order may result in the administrative assessment of civil penalties not to exceed $200,000, as adjusted for inflation (49 C.F.R. § 190.223), for each violation for each day the violation continues or in referral to the Attorney General for appropriate relief in a district court of the United States. Under 49 C.F.R. § 190.243, Respondent may submit a Petition for Reconsideration of this Order Directing Amendment to the Associate Administrator, Office of Pipeline Safety, PHMSA, 1200 New Jersey Avenue, SE, East Building, 2nd Floor, Washington, DC 20590, with a copy sent to the Office of Chief Counsel, PHMSA, at the same address, no later than 20 days after receipt of service of this Order Directing Amendment by the Respondent. Any petition submitted must contain a statement of the issue(s) and meet all other requirements of 49 C.F.R. § 190.243. The terms of the order, including corrective action, remain in effect unless the Associate Administrator, upon request, grants a stay. The terms and conditions of this Order Directing Amendment are effective upon service in accordance with 49 C.F.R. § 190.5. February 4, 2019 ___________________________________ __________________________ Alan K. Mayberry Date Issued Associate Administrator for Pipeline Safety#