DOT mandates API document for leak detection

Don Scott
Enbridge Pipelines Inc.
Edmonton

A manifold array along a segment of Enbridge Pipelines' system is one of areas modeled in the company's CPM system. (Photograph from Enbridge Pipelines Inc., Edmonton; copyright Merle Prosofsky Photography Ltd., Edmonton)

Beginning July 6, 1999, all operators of U.S. hazardous liquids pipelines engaged in pipeline leak detection known as "computational pipeline monitoring" (CPM) must use, by reference and with other information, the document API 1130.

The U.S. Department of Transportation's Office of Pipeline Safety (DOT-OPS) on July 6, 1998, adopted this document into 49 CFR (Code of Federal Regulations) Part 195, the federal rules that are intended to ensure safe operation of the nation's hazardous liquids pipelines.

API 1130 defines CPM as "an algorithmic monitoring tool"; it allows the pipeline controller to respond to a pipeline-operating anomaly that may indicate product release. As a system, therefore, CPM is computer-based.

Operators who have no such computer-based, leak-detection system are not required to install one. But those currently running such a system or installing one in the future must consult API 1130 in designing, evaluating, operating, maintaining, and/or testing their CPM systems.

Noteworthy sections of the rule include 195.2 which defines CPM; 195.3 which incorporates API 1130 into Part 195; Subpart C Design Requirements (195.134) which outlines the requirement for a CPM system; and Subpart F Operation and Maintenance (195.444) which outlines compliance with API 1130.

The rule is perhaps the first of many that will consider defining "unusually sensitive" areas along a pipeline. Later, companies may be required to install systems to detect ruptures and procedures to close emergency flow-restricting devices (EFRDs) when ruptures are detected in those unusually sensitive areas.

Many companies have implemented or are implementing CPM to meet requirements of the new rules. Enbridge Pipelines Inc. (formerly IPL Inc.), Edmonton, owns and operates crude-oil and refined products pipelines in both Canada and the U.S. and committed early to providing a CPM system. Its experience is discussed here in a format that follows considerations of API 1130.

Initial implementation of CPM at Enbridge predated publication of API 1130, but the company's considerations included the same issues outlined in the document.

Through experience, Enbridge also learned other aspects of implementing a CPM. Additionally, the company took a leading role on the API task force that produced the document.

Leak detection

As with all pipeline companies, the primary focus at Enbridge Pipelines is prevention of liquid hydrocarbon leaks, but the company recognizes the need for methods to detect releases. The company has formal programs for leak detection that use the following methods:

Aerial, ground line patrol
Third-party reports (and the related landowner-awareness program)
Monitoring line conditions by pipeline controllers with supervisory control and data acquisition (scada)
Software-based monitoring (CPM)
On-site inspections by company staff
Hydrocarbon vapor sensors at stations.

CPM is the newest of these leak-detection methods; Enbridge continues to expand and improve it as operators gain experience with the system.

Scope; definitions

Before embarking on implementation of CPM, Enbridge Pipeline's engineering section wrote a road map for the work by preparing and obtaining approval for a strategic and tactical plan. This plan outlined the philosophy and goals of the work and how Enbridge would accomplish them.

One of the key elements was that the CPM system would be a pipeline-controller tool. Enbridge would not attempt to develop a system that automatically shut down pipelines based upon anomalies.

The company also recognized that the size of its system and its complexity (and uniqueness of each pipeline) meant it would have to be a multi-year program. And Enbridge decided that it would develop in-house expertise to create the models and to maintain the CPM.

From the outset, developers agreed that "false alarm" should never be used because it was possible, upon an alarm, that the pipeline controller and company staff (when involved) might spend their investigative efforts trying to disprove an alarm rather than search for the cause. The belief in this approach remains as strong as at the start.

API 1130 provides an extensive section in Appendix B to define and determine what constitutes a pipeline "rupture." Enbridge did not consider this size determination until after API 1130 was produced.

What constitutes a pipeline rupture became important only because the DOT-OPS used that term to designate the leak occurrence at which a pipeline operator's CPM should alarm and the pipeline controller would take action.

Enbridge defined a rupture to be a leak large enough to be readily apparent to the pipeline controller through the scada display. A rupture would impair the operation of the line. Fig. 1a presents the piping and instrumentation diagram for the Cactus Lake pumping station on Enbridge's Line 1; Fig. 1b presents this segment in the CPM model.

Some simple calculations indicated that a leak of 30% or larger of line flow rate would display the characteristics of a rupture. But Enbridge was aiming for a detection threshold significantly less than rupture-sized.

The company wanted the CPM to enhance the pipeline controller's ability to detect leaks and other anomalies. Its goal, based upon preliminary studies, was to be able to have the CPM alarm at a leak no greater than 10% of flow in 1-hr calculation window.

Selection criteria

After a great deal of consideration, Enbridge selected a real-time transient model (RTTM) to provide CPM. The investigation included consideration of the experience of users of the various methodologies (and the particular application's vendor) and extensive discussion with the vendors.

Enbridge performed a leak-detectability analysis based upon a simple spreadsheet analysis. The calculation outline in API 1149 is much more sophisticated.

Subsequently, Enbridge has used API 1149 to calculate thresholds, and it found an acceptable agreement between theoretical and actual.

The decision on which methodology to use included evaluating how each would meet the needs based upon our selection criteria.

Enbridge, recognizing it could not obtain a perfect CPM system, looked over selection criteria and decided what was critically important and what was less important. The company then evaluated the CPM fit of each methodology and a particular vendor's application:

Accurate commodity-release alarming; high sensitivity to commodity release; timely detection of commodity release.

Enbridge considered these three selection criteria as a group. Stated another way, these are minimum non-leak alarms, low detection threshold, and fast response to the event.

The company recognized there had to be a balance among them. For example, to minimize non-leak alarms, the detection threshold may have to be increased. To obtain fast response, it may also be necessary to risk non-leak alarms.

Enbridge decided to meet its critical needs first, then to do the best it could on the three criteria by possibly adding some instrumentation to the lines and by tuning over time. To help achieve low thresholds, the company decided to break the line into segments by installing main line meters and additional pressure transmitters.

Efficient field and control center support.

A CPM system based on scada is data dependent. Enbridge recognized that field-calibration notification procedures would need to be changed to inform the control center when calibrations would occur. Then the CPM would need to know about the loss of data so that it would not alarm.

Calibrations normally are done during working hours and in the regular work week. The CPM support staff could accommodate planned data outages during its workday, and midnight callouts would not occur.

It was determined that on-call support from the development engineers would be necessary for such a new system. In the longer term, it is planned that the control center could support the CPM system.

Minimum software configuration, tuning. For Enbridge, configurability and tunability were critical requirements. The company accepted that the vendor's software would need to be configured to each pipeline and in fact wanted that flexibility.

Enbridge also knew that its pipelines would be subjected to change by new construction, throughput increases, and changes in fluids transported. Over time, the CPM would need to be reconfigured to the new conditions. Tuning would be long-term, and the company wanted to be able to improve the CPM as it gained experience.

Minimum impact from communication outages. This was a critical requirement. With as many as 38 pump stations on a pipeline segment and the long distances involved in Enbridge's system (1,100 miles), communication outages were inevitable.

The CPM needed to be able to continue operating through an outage. Data could be declared "bad" through the scada, and the CPM would need to be able to accept and work with known "bad" data.

Ability to accommodate complex operating conditions. Enbridge's system has all the difficult conditions: batching, side-stream injections, partial line operation, and multiple injections/deliveries. Accommodating these was a critical need.
Availability during transients. This was another critical requirement. As mentioned previously, pipelines have multiple pump stations, and pump stations have multiple pumps. These lines are nearly always transient.
Configurable to complex pipeline networks. The ability to be configured to a complex network was critical because of Enbridge's long and complex pipeline network and because Enbridge wanted to use the same CPM on all pipelines.
Imbalance calculation capability. Performing an imbalance calculation on meters at the same clock time (or freeze scan) could not be considered because it would have required an extremely expensive reconfiguration of the scada and communications.
Dynamic alarm thresholds. Enbridge was concerned that fixed-value alarms would not be high enough during upset conditions or too high during near steady-state operation. Dynamic thresholds would help minimize the number of non-leak alarms.
Dynamic liquid pack constant. One of Enbridge's pipelines transports NGL, a relatively compressible fluid. Line packing is significant while this product is in the line. Consequently, dynamic line pack was a critical requirement.
Commodity blending. Because Enbridge has batched pipelines, interfaces are present. It was a critical requirement for the CPM to be able to accommodate batch interfaces. Enbridge also wanted to be able to tune the CPM to particular interface sizes and characteristics.
Heat transfer. Accounting for heat transfer is not a critical requirement. Enbridge wanted to be able to consider line-pack changes due to temperature but did not expect ever to have enough temperature sensors fully to account for heat transfer.
Real-time pressure profile. Providing the pipeline system's real-time pressure profile from an hydraulic model was a highly desirable feature. Because leaks are rare, Enbridge wanted to be able to get extra value from the CPM by having it provide hydraulic operating information to the pipeline controllers.
Slack-line conditions. By careful operation, Enbridge is able to eliminate column separation, a consequence of slack-line operations. But there is the possibility during upset conditions that column separation could occur.

It is critical that the CPM be able to operate during such a brief and rare column separation. A CPM crash would not be acceptable.

All liquids. Accommodating all types of liquids was a critical requirement for the range of liquids the company transports. Fluids range in density from 560 kg/cu m to 970 kg/cu m and viscosity of 0.1 cp to 400 cp. Non-Newtonian fluids were not considered.
Leak location, rate. Identifying leak location or rate with appropriate mile post location would have been nice features but not critical for initial decision making. It was something Enbridge wanted to be able to do in the future. Any size leak requires the same response.
Measurement, inventory compensaton. Accommodating commodity measurement and inventory compensation for various corrections (temperature, pressure, density, meter factor) was not critical.
DRA. Accounting for the effects of use of a drag-reducing additive was not initially considered important. But when DRA was subsequently used, it became critical.

Commodity properties

The densities and viscosities of the fluids Enbridge transports have a wide range. Using an RTTM well requires good knowledge of the fluids characteristics. The company has extensive fluid-characteristic tables based on laboratory tests, and these are used in the models.

Instrumentation, scada

Other than for installation of main line meters and some additional pressure transmitters, the CPM system uses the standard line operation instruments.

For the CPM, flow meters needed to be rugged with a suitable accuracy and no need for frequent or expensive calibration. For main line meters, Enbridge selected segmental wedge meters which provide a 1 to 11/2% accuracy and the only calibrations required are to the external differential pressure sensor. The company's standard flow meter has now become the sonic flow meter that exhibits about the same accuracy.

Calibration of field instruments is well handled. The CPM required that the field staff be diligent on advising the control center when instruments would be taken out of service. Calibration that meets the needs of regulatory guidelines is adequate for our CPM.

Enbridge learned it needed more-detailed knowledge than was readily available of the actual instruments and their installations. It was necessary to have summer students employed to visit field locations and record the actual position and elevation of instruments. They also put together books of information on the types of sensors and their characteristics. CPM developers used this information.

Enbridge's data communication is highly reliable: The time skew created by remote site polling is about 20 sec, which with the use of report-by-exception, somewhat reduces data quality.

Analog-to-digital conversion is 12 bits or better. Bad data are flagged in the scada system and handled well by the model. The close relationship of the CPM development staff with the scada developers leads to quick fixes of data issues.

It was necessary for the CPM developers to know about any processing of data values by scada, any errors introduced in data transmission, and any scaling factors used in scada or the programmable logic controllers (PLCs). Enbridge prefers to have raw data and perform any corrections within the model.

Scada data are archived but not used by the model. The model produced its own archives.

CPM alarms are presented on the scada displays and are both visible and audible. All alarms are logged in a readily searchable Lotus Notes database. This database is available to anyone within the company.

Various material-balance windows are used. The original windows were 5 min, 1 hr, and 24 hr. It was determined that the 24-hr window provided no additional information over a 2-hr calculation window.

The calculation windows are easily configurable and may not need to be standardized to specific values. It may be that different pipelines have optimal calculation windows.

Trending features are available in scada and therefore are not duplicated in the CPM.

Operations, maintenance, and testing

A CPM system will alarm when certain anomalies occur. In the design at Enbridge Pipelines, alarms will occur when a flow meter provides erroneous readings, a pressure sensor or temperature sensor provides incorrect data, or during certain extreme upset conditions such as column separation. Any alarm must be evaluated.

Two conditions, data failure or model failure, provide a special alarm or panel to the pipeline controller. The controller then knows to call for support to restart the CPM. The Enbridge CPM is designed to operate through transients so that no alarm is produced.

CPM developers have worked with their customer, the four control centers, to develop responses to alarms. Because the pipeline controller and his supervisors are ultimately responsible for the safe operation of the pipeline, they must be the ones to develop procedures.

Testing is one of the long-term and perhaps costly operating issues. On small lines (i.e., < 14 in.), withdrawals can be readily performed with a suction truck and at many locations through a blowdown valve. For larger lines and remote sites, portable oil field tanks need to be set up and used to accumulate the withdrawn fluid.

It is also possible on any size of line to conduct a withdrawal test at a delivery location by disabling a delivery meter. This approach limits the test locations. Enbridge has also used false scada inputs to simulate that product is escaping the line. This method works but is not ideal.

Leak data from withdrawal tests are archived to test software upgrades.

All initial tests are unannounced to test the CPM and the pipeline controller. Some are performed under direction of the CPM developers; others are unknown except to management at the control center. These tests also test CPM team response.

For one particular line (in what would be classified as an unusually sensitive area), withdrawal tests are performed annually or semiannually and at two different leak rates.

Full reports are made after each test and the details are recorded.

CPM maintenance, documentation

New software versions or any changes to the logic of the model are tested with an off line version of the CPM and with archived data before they are released as production software. Enbridge also uses a sophisticated version control software package to ensure all model changes are controlled.

The CPM for all lines has been standardized with standard names for data points and standard modeling methods. This makes maintenance more efficient.

The pipeline controller has no access to any threshold changes. He or she can only acknowledge alarms. If a threshold needs to be degraded, the control center is informed of the new limit.

The CPM produces archives in a circular file that has an 8-day capacity. Data from any leak are saved, and the investigation of any alarms is recorded in a database.

Enbridge Pipeline controllers receive extensive training in all aspects of line operation and hydraulics. The training uses classroom instruction, self-test modules, computer-based testing, and a simulator trainer. The simulator trainer utilizes the same software as the CPM, providing the same "look and feel" as the CPM.

Specifically for the CPM, developers provide training when a new system starts operation and follow-up training as needed.

The control center can also rely on the assistance of the developers, one of whom is on 24-hr support.

One make of CPM system is used on all pipelines to simplify training and support.

Design records are kept in the engineering section, and the control center is supplied with a user manual. Existing information, for example system maps, is not duplicated in the CPM documentation.

The Author

Don M. Scott is supervisor of pipeline dynamics for Enbridge Pipelines Inc., Edmonton, with 10 years' experience in computer modeling of pipelines. He holds a mechanical engineering degree from the University of Manitoba.