PLANT SHUTDOWN SYSTEMS
Contents
1.0 INTRODUCTION
2.0 SAFETY SYSTEMS
– GENERAL
3.0 PROCESS
SHUTDOWN
4.0 FIRE & GAS
DETECTION
5.0 EMERGENCY
SHUTDOWN
6.0 HEATING,
VENTILATION AND AIR CONDITIONING
7.0 EMERGENCY
POWER
8.0 HYDROCARBON
DISPOSAL
1.0 INTRODUCTION
1.1 PURPOSE AND SCOPE
The purpose of
these guidelines is to provide the upstream petroleum industry with clear and consistent
guidance on assessing the needs for the design and operation of emergency
support systems for production facilities. They are intended to assist those
persons having
responsibilities
in the petroleum industry for assessing emergency support system requirements and
their effectiveness for identified major accident events for production
facility.
1.2 RELATIONSHIP
WITH REGULATIONS
This document is
one of a series of guidelines for use by the upstream petroleum industry. Its relationship
with Acts and Regulations is depicted in Figures 1.1 .
The principal
components are:
1. The
Petroleum (Submerged Lands) Act, which empowers the Minister to regulate.
2. Regulations,
which set mandatory standards for industry to achieve.
3. Regulatory
guidelines which set out the administrative procedures for the regime and provide
practical ways of meeting goals .
(a) General
guidelines, Codes, and Standards such as
API Standards, etc, which provides useful references for companies
setting their own standards.
(b) Industry
approved competency standards.
4. Company
standards, which should provide the demonstration of managing risks to as low
as is reasonably practicable (ALARP).
2.0 SAFETY SYSTEMS
– GENERAL
The definition of
safety systems for production facilities/activities has evolved through the application
of accepted international standards which represent ‘best practice’, to hazard identification
and analysis, and, most recently, to risk based methods.
Production
operators are required to submit and maintain a Safety Case, which should demonstrate
that the risks to production operations are being managed to as low as
reasonably practicable (ALARP). This risk based approach provides a means to
demonstrate that risks are being managed to ALARP and is taken as one of the
primary emphases for these Guidelines.
These Guidelines
are intended to provide information to the ‘system’ level only. Therefore established
industry standards, which continue to represent a very useful resource for the design,
operation and maintenance of safety systems, may provide more specific guidance
at the sub-system or component level.
Specific
recommendations for the frequency of maintenance, inspection and testing are presented
in the context of good industry practice. These recommendations may provide an appropriate
basis for initial system operation and maintenance, which may be adapted in the
light of operator/facility/system experience. Ultimately the responsibility for
facility management rests with the operator.
2.1 SAFETY CASE
As mentioned in
the preamble to these Guidelines, the statutory framework for the representation
of the management of risk, is the Safety Case, comprising the following
components:
• Facility Description;
• Safety Management System;
• Formal Safety Assessment.
2.1.1 Facility
Description
The Facility
Description includes a description of the safety features and systems
associated with pr0duction facility/activity, as follows:
• Layout;
• Protective systems, including fire and gas
leak detection;
• Shutdown systems
• Fire and Blast protection, passive
systems;
• Fire protection, active systems;
• Heating, Ventilation and Air Conditioning
(HVAC);
• Emergency Power, Communications and Lighting;
• Escape, Evacuation and Rescue;
• Temporary Refuge (if designated).
2.1.2 Safety
Management System
The Safety
Management System (SMS) description includes details of specific provisions for
the management of safety of the facility/activity through the use of management
systems (e.g. policies, objectives, procedures, work instructions, etc.) of
particular relevance in the definition, design, installation, operation and
maintenance of engineered or hardware safety systems, the subject of these
Guidelines, are the following:
• Risk Assessment and Management; (see
Hazards Management Process, below)
• Design, Construction and Commissioning;
• Maintenance, Inspection, Testing, and
Modification.
2.1.3 Formal
Safety Assessment
The Formal Safety
Assessment (FSA) describes the identification, analysis and assessment of hazards
to personnel. In particular, events that have the potential to cause multiple
fatalities are designated as Major Accident Events (MAEs) and are the primary
focus of the FSA. In the case of exploration and production activities, the
release of hydrocarbon fluids under pressure represents one category of
accident event with the potential to result in a MAE. Engineered safety systems
for the prevention, detection and mitigation of uncontrolled hydrocarbon
releases are the subject of a mature body of experience and analysis method which
is reflected and referenced by these Guidelines. The FSA includes an Emergency
System Survivability Assessment (ESSA) which evaluates the ability of these
systems to function in an emergency event to control or mitigate the consequences,
in this case, of a hydrocarbon release.
The ESSA includes
the assessment of the Functionality, Integrity (i.e. Reliability and Maintainability)
and Survivability of the safety systems, specifically in the context of emergency/accident
event risks to personnel and the facility. This approach to assessment corresponds
with the definition and structure of safety critical system ‘performance standards’.
2.2 HAZARD
MANAGEMENT PROCESS
The management of
hazards which may result in an MAE is affected through the application of a
‘hierarchy of controls’ as follows:
• Prevention;
• Detection;
• Control/Mitigation;
• Response;
• Recovery.
In the context of
engineered safety systems, it is the first three elements of this hierarchy
that are covered in these Guidelines.
2.2.1 Prevention
The first strategy
for the prevention of MAEs is that of eliminating the hazard. In the case of oil
and gas exploration and production, one of the primary hazards is hydrocarbon
fluids under pressure.
Given that all
hazards cannot be eliminated, the next strategy is to prevent an undesired release
from occurring.
The Process Shutdown (PSD) system, discussed
further, is designed to prevent a loss of containment through shutdown of the
hydrocarbon processing system (e.g. isolation from input sources of energy,
such as pressure, heat, flow, etc.) on the basis of abnormal conditions (e.g.
high/low pressure, high/low temperature, etc.) detected within the system.
2.2.2 Detection
In the event that
a hydrocarbon leak occurs, it is necessary to detect it such that control
and/or mitigation measures can be initiated.
The detection of a
hydrocarbon leak is generally achieved through the use of Fire and Gas Systems,
which detect ignited and un-ignited hydrocarbon releases, respectively. These systems
are discussed further.
2.2.3
Control/Mitigation
The control of a
hydrocarbon release may prevent it resulting in a MAE. For example, if a gas
release is not ignited a fire or explosion will not occur. Safety systems which
may be used to control hydrocarbon releases, include:
• Emergency Shutdown (ESD) Systems.
• HVAC Systems.
• Hydrocarbon Disposal Systems.
It is common
practice that, as a minimum, a facility safety system comprises an Emergency
Shut Down (ESD) system and a Fire and Gas (F&G) detection system. The
ESD system should be designed, as far as reasonably practicable, • reduce the consequences of a hazardous
event when activated during an
emergency situation;
to:
• prevent an uncontrolled or hazardous
situation occurring;
• survive severe accident conditions.
Safety systems
should be maintained and tested at frequencies specified in the safety case and
test results recorded and retained for a suitable period of time.
Prevention
Section 3.0:
Process Shut Down (PSD) – the detection of abnormal
conditions is used
as a basis for preventing a system failure and hydrocarbon release. If PSD does
not effect a recovery an Emergency Shut Down (ESD) may be
initiated.
Detection
Section 4.0: Fire
& Gas Detection
the detection of a
release of hydrocarbons, ignited or not, is used as a basis for initiating Control actions.
Control/Mitigation
Section 5.0:
Emergency Shut Down (ESD) –
in the event of a confirmed hydrocarbon
release or an escalating process situation, a more stringent shutdown of
facility systems is initiated.
Section 6.0: HVAC
in the event of a gas release, may act to prevent
the accumulation of a
significant flammable cloud. It may also act
to exclude gas or smoke from ‘safe’
areas.
Section 7.0:
Emergency Power
provides for the operation of the safety
systems throughout an emergency and for the operation of other vital systems.
Section 8.0:
Hydrocarbon
Disposal Systems – may act to remove
hydrocarbons contributing to a gas loud or available for a fire.
2.3 SAFETY SYSTEM
METHODOLOGIES
Guidance on the
design, operation and maintenance of safety systems has evolved through several
distinct stages through the last 30 years, including:
• a pragmatic and practical approach of
‘what works’ (i.e. experience),
supplemented by a
minimum standard defined as ‘best practice’ and regulatory requirements (e.g.
UK HSE - SI 1974/289);
• the development of methods to identify
ways that undesirable events could
happen (e.g.
HAZOP, API 14C,
etc.); and most recently
• the use of a risk based life cycle needs
analysis (e.g. IEC 61508/61511 and
UKOOA IPF).
These Guidelines
seeks to reflect the best aspects of this evolutionary development as a framework
for the analysis, design, operation and maintenance of safety systems.
In summary, the
following are regarded as key aspects of the evolution of safety system specification
and should be considered/applied by industry to operations and facilities.
2.3.1 Lifecycle
The application of a life cycle approach provides a vehicle for
strategic, project and operational risk management of the design, operation,
maintenance and disposal of an production facility. The consideration of risk
through the lifecycle of a facility allows for appropriate economic management
as well as the safety aspects of an operation, which may affect the economic
performance/
viability of a project. It also provides a means to ensure that the risk
management process is an integral and coherent part of a facility’s lifecycle
development phases, through the involvement of different parties (e.g.
Engineering Design, Procurement, Fabrication Yard, Installation/ Commissioning
and Operations/Maintenance).
2.3.2 Risk Based
The use of a risk
based approach from the concept stage onwards provides a means to focus on
safety/business ‘needs’ of the project. Further, use of this approach allows
for justification (e.g. demonstration of ALARP) of control options based upon
benefits in terms of risks to personnel and the business, more generally.
One method of
using a risk based approach to the needs for safety system integrity is based upon
the following risk graph
- No special
safety features required
NR Not
recommended. Consider alternatives
In determining the
desired integrity level for a system/component the following parameters are
considered:
• The severity of the safety consequences if
the instrument protective function does not operate on demand;
• The likelihood of personnel being exposed
to the hazard;
• Are there alternative factors which will
reduce the safety impact of the
consequences of the hazard? These may
include, for example, the rate of
escalation of the
incident is such that personnel in the area will have time to get away from the
immediate area, or, that there will be sufficient warning from independent
means of the impending hazard for personnel to evacuate
• the
area ;How frequently is the
instrument protective function likely to be asked to perform its duty.
Relatively high demand may be interpreted as between one and ten times per
year, low as between once per year and once per ten years, and very low as less
than once in ten years.
The Safety
Integrity Level (SIL) reflects the risk inherent in a safety system
application, from High Risk (SIL 3) to lower risk levels (SIL 2/1). Since this
is only one means of defining the required integrity of a safety system/
component these
Guidelines will use a descriptive label (i.e. High Risk) to correspond to/with
a high level integrity requirement.
2.3.3
Comprehensive Analysis
A comprehensive
hazard/risk analysis at the detail design stage complements higher level strategic/project
risk analyses whilst ensuring that risks at the system/component level are identified
and managed. One means of carrying out a comprehensive hazard based analysis is
that described in API 14C.
As discussed above this analysis method may be supplemented through the use of
application risk levels (e.g. Safety Integrity Levels) to provide a basis for
justification/selection of ALARP control
solutions.
2.3.4 Performance
Standards
‘Performance
Standards’ provide a formal vehicle for performance assurance throughout the life
cycle of a project/facility. They also complement performance standards defined
to assure performance of the facility Safety Management System.
A performance
standard for safety systems would include:
• The role of the system, or system
component;
• What the system or component is required
to do under stated circumstances (functional specification);
• With what integrity (reliability and
availability) it is required to perform in
those circumstances (integrity specification);
and
• Any requirements for survivability after a
major incident (survivability
specification).
Performance
standards for safety systems can apply at a variety of levels. For example, the
overpressure protection function for a hydrocarbon vessel may have a
performance standard. The pressure sensor device and the inlet shutoff valve,
both of which are components of the overpressure protection system can also
have their individual performance standards. An ESD logic system can have a performance
standard.
2.4 DESIGN
Safety systems may
include:
• Fire and Gas detectors;
• Leak detectors;
• Emergency Shutdown and Blow-down valves;
• Fire rated cables and components;
• Programmable logic.
In the execution
of projects, the detailed design may not have been completed at the stage when
instrument-based protective systems need to be purchased. Orders are placed
using the best information available at the time. On completion of the detailed
design, the instrument based protective systems should then be evaluated
against their required performance standards and any necessary modification
carried out.
2.4.1 Complexity
Systems should be
selected and designed to minimize complexity while still meeting the required
performance standards. Increased complexity may lead to a reduced level of understanding
by operators and higher inspection, test and maintenance requirements.
Each element of
the system should be specified to performance standards consistent with the overall
required functional, safety integrity, and survivability performance standards,
and not simply to the highest level achievable.
By their nature,
logic systems contribute less to the total system unreliability than the field sensor
and actuators.
2.4.2 Failure to
Safety Concept
The failure to
safety concept for plant and equipment is the automatic reversion to the least hazardous
condition upon failure of protective system logic, sensors, actuators or power sources.
This requirement is normally realized by employing a de-energize to trip
design. During normal operation, with the plant in a healthy condition, inputs
from plant sensors, the logic system, and outputs to the final protective
devices will be energized. The systems will interpret the de-energising of an
input as a trip demand and will de-energise the appropriate outputs to initiate
a shutdown. This design would also ensure a shutdown on the loss of electrical
power to the system inputs, outputs or logic. The failure to safety principle
is preferred for all equipment on the installation. In order to achieve such a
concept, consideration should be given to each item of plant and equipment to ensure
predictability of failure modes. However, for certain applications, (e.g. Fire
& Gas
equipment) an energized
to trip (non failsafe) design concept is justified. Under these circumstances,
additional measures must be taken to ensure the safety integrity of these devices,
e.g. line monitoring, built in fault detection, and/or dual redundancy.
2.4.3 Reset
Philosophy
The method and
location of reset facilities for protective systems should be appropriate to
the importance of each individual function, and thus may vary across the plant.
System vendors generally express reliability in terms
of Mean Time between Failures (MTBF) or its reciprocal, failures per unit time.
These expressions are useful in selecting and specifying a system but to
determine its availability the following should also be considered:
• Fail to danger and
fail to safety failure rates;
• Failure to act on
demand;
• Realistic mean
time to repair (MTTR).
For each High Risk
(SIL3) system a reliability and availability analysis should be carried out and
formally documented to ensure that the required safety integrity can be met.
This will require data on system or component reliability or failure rates,
demand rate on the system, proof test interval and mean time to repair. An
iterative process will be required in the design of the system to arrive at the
optimum solution which meets the specified safety
integrity. Care
must be taken to allow for the effects of common cause failures when calculating
overall system integrity.
Realistic proof
test intervals and repair times should be used in reliability and availability analyses.
Manual proof test intervals of less than three months are likely to impose
undue burdens on operations and maintenance requirements.
The
reliability/availability analysis can draw on either analysis of failure rates
from comparable situations or calculations using appropriate predictive methods.
Unrevealed
(covert) failures in the system will impair its safety effectiveness. Steps
should therefore be taken to eliminate by design these failure modes. Where
this is not practical, a suitable test method and frequency should be specified
that allows such failures to be revealed.
For High Risk (SIL3)
applications, it should be a design objective that no single failure can cause
the system to fail to perform its intended safety function.
The demand rate on
a High Risk (SIL3) system may be determined in part by the quality of any
associated lower risk (SIL1/2) protective systems. Common cause failure
mechanisms between separate instrument-based, protective systems performing the
same or related protective functions should be minimised.
The scope and
frequency of testing of High Risk (SIL3) systems to ensure the required safety integrity
and the assumptions with regard to the demand rate must be fed forward to the operations
phase and be reflected in the protective system maintenance plan and
procedures.
Logic systems
should be specified for the integrity of the highest integrity function, which
is implemented within it.
2.4.5
Environmental Considerations
Systems should be designed so that equipment has an adequate immunity to
electromagnetic disturbance at frequencies and field strengths likely to be
experienced in the intended operating environment. The measures taken to verify
this requirement should be selected according to consequences resulting from
malfunction or degradation in the performance of the equipment. Also, the
equipment should not be the source of electromagnetic disturbance at levels
which may disrupt the operation of other equipment.
Protective
functions should be maintained under all reasonably for climatic conditions
likely to exist at the intended operating location.
Fire, blast and
dropped object protection for protective systems should be considered in relation
to the required performance standards. These should take into account the
required survival and operating modes of systems following a major incident.
2.4.6 Operator
Interfaces
The operator
interface should be designed using human factor principles (ISO 11064: Ergonomic
Design of Control Centre). The presentation of information to the operator should
be clear and unambiguous. The volume of alarms and messages which will be presented
to the operator in a plant upset situation should be assessed and managed.
The reliance on
the operator interface should be determined and the performance requirements
should be specified. Where reliance is placed on an operator to respond, then these
cases should be analysed to ensure that the claimed performance can be
achieved.
Suppression of
consequential alarms resulting from a process upset or trip may be considered, provided
they occur within predetermined times. However, this should be assessed against
the additional complexity introduced.
The operator
should readily be able to determine the cause of any disturbance or unusual event.
The number of
control room operators should be determined based on the ability to handle both
normal and upset situations.
Consideration
should be given to use of hard wired matrix and mimic panels for information regarding
High Risk (SIL3) systems.
Controls should be
in place to ensure that only appropriate authorised personnel have access to
change data or programs. If access control is by password, these should be
changed at appropriate intervals under the control of the designated
responsible person.
2.4.7 Maintenance
and Test Facilities
Facilities to
enable complete online testing of all system components including power supplies
and field equipment should be provided unless adequate safety integrity can be achieved
by testing during planned shutdowns. The objective is to detect and rectify
covert failures.
The maintenance
and testing philosophy, including frequencies, should be developed as part of
the design process and be fed forward to, and be incorporated in, maintenance
and operating procedures.
Maintenance and
test routines should be the product of cooperation between the design team and
the future operating personnel, to ensure their smooth assimilation into the
operational phase.
The status of any
maintenance override should be drawn to the attention of the operator, be documented
and continuously annunciated at a suitable operator interface.
All components
should be designed to achieve ease of fault finding, replacement and maintenance.
2.4.8 Software
Software based
systems should incorporate an internal log to demonstrate the software version
or revision giving date and time of the last change.
2.4.9 Data
Communication
Hardwired
communications links are preferred, where practicable, to radio links. Where
Programmable Electronic System (PES) data is transmitted over communication
links, it should be recognised that the communication link introduces several
potential sources of common cause failure.
The safety
integrity of High Risk (SIL3) systems should not be reliant on data solely
reliant on data communications links unless adequate measures have been
implemented to ensure the availability of the link.
Physical damage to
communication links may be addressed by redundant links with diverse routing.
Redundant links should be exercised regularly.
High Risk (SIL3)
systems may be interfaced with other systems via communication links.
Malfunctions of
the communication links or other systems should not affect the safety integrity
of the High Risk (SIL3) system.
The quality of the
total communications path should be assured. The total path includes interfaces
between processors and communications links.
2.4.10 Power
Requirements
When evaluating the availability of protective systems, consideration
should be given to the security of electrical supplies under plant upset
conditions and partial and complete failure of the main electrical systems. Diversity
of supply may be required to ensure continuity of system operation. Failure of
one of these supply routes should not adversely affect the system performance.
The sizing and
rating of electrical supplies should take into account the worst case load with
all elements energised. Surge currents at switch on should also be considered.
The required
duration and availability of electrical supplies following loss of main
generation should be established and documented.
Any
uninterruptible power supply systems should be properly matched to the
protective system loads particularly in terms of voltage variations, harmonic
distortion, and supply changeover times. Specific attention is drawn to this
need for matching when switched mode power supplies are used within the
protective systems.
After installation
of the protective systems, their correct performance should be checked when the
main AC electrical supplies are interrupted and heavy loads are switched on and
off the electrical distribution system.
2.4.11 Design
Change Control
The need for
changes to the functionality during the system life should be assessed and allowed
for in the design.
Protective systems
should be under the control of a designated responsible person or position.
Management systems
and procedures, commensurate with the criticality of the system, should be in
place during both the project and operational phases to effectively control and
monitor changes.
Proposed changes
should be assessed by all relevant parties before implementation.
Changes to
protective systems should be fully verified, including testing, before they are
brought into service.
2.4.12 Design
Method for High Risk (SIL3) Applications
For High Risk
(SIL3) applications the following design activities are considered essential requirements
for an acceptable final product and should be incorporated at the correct
stages of design development:
• Establish functional requirements (e.g.
safety analysis tables or cause and
effect charts);
• Produce functional, safety integrity, survivability
and hardware specifications;
• Design system to the above specifications;
• Analyse safety integrity of the design, to
ensure that the required performance standard for each function has been met;
• Build and test system;
• Produce maintenance schedules and detailed
proof test routines for each
system element
during the project detailed phase;
• Review operational and maintenance
experience to ensure that the specified performance standards are maintained.
The safety
integrity analysis should be carried out by an independent authority, either
from a separately managed area of the organisation, or from outside the company
entirely
2.4.13 System
Testing
Testing of the
logic system for all instrument-based protective systems should be carried out in
accordance with the previously agreed test programme prior to installation.
Simulated inputs and outputs may be used in testing at the vendor’s works. It
should include a complete verification of the operating manuals, cause and
effects, logic diagrams and related
documentation.
Full system testing, including all field elements, should be carried out during
commissioning.
2.4.14 Assessment
and Certification
Independent
assessment and/or certification of systems may be used to provide increased confidence
in vendor’s claims for systems’ performance. This can apply to vendor-standard systems
and to design specific confil.gurations.
Independent
assessment should be performed for all High Risk (SIL3) systems. Considerations
should include:
• Hardware details;
• Expected demand rate;
• Specification proof testing and
maintenance programme for the equipment;
• Causes of systematic failure;
• Equipment quality;
• Design processes;
• Maintenance facilities;
• Operational and security arrangements.
It is essential
that all analysis should consider the complete system, from input transducer to
the actuation of the final control element. The major contributor to system
unreliability is usually field devices with failure analysis being sensitive to
variations in device design.
2.4.15 Field
Equipment
The design,
selection and location of sensors and actuators contribute significantly to the
overall performance of an instrument-based protective system. This section
addresses those points relevant to ensuring design and selection.
Plant located
components of instrument-based protective systems should be uniquely identified
in accordance with drawings and documentation.
Identification
should be by permanent labels at equipment locations.
Diversity
Many common cause
failures of redundant field devices can be avoided by properly applied diversity
of devices. Where possible, diversity should be obtained by measuring a
variable via separate tappings.
Analogue input
devices are preferable to switched input devices. The ability to continuously compare
signals reduces the mean time to detection of failure and hence increases
integrity.
Such methods can
utilise discrepancy tracking for the early detection of equipment failure or malfunction
and may utilise the process control analogue instrumentation in such a tracking
scheme.
In the interest of
standardisation, consideration should be given to reducing the variety of field
devices. While this may seem to contradict diversity, it is meant to avoid a
proliferation of equipment manufacturers and models. Excessive variety can
reduce the level of understanding of the details of maintenance, calibration
and trouble shooting involved with each device.
Initiating Devices
All system
initiators should be separate and independent monitoring and control system instrumentation.
The method of
sensing an abnormal operating condition should normally be by dedicated transmitters
except in the case of vessel level trips where witches or other techniques may
be more effective. Any trip amplifier devices used to interface transmitters to
non programmable logic systems should be testable in service.
Smart (HART)
transmitters can be considered suitable for High Risk (SIL3) applications if the
advice in EEMUA publication 160 section 12 is followed. In addition, the
software issue should have been proven in a sufficiently large installed base
over a sufficiently long period of time. (See Appendix B of the UKOOA
‘Guideline for Instrumented-Based Protective Systems, 1995’) Generally this allows
the use of smart transmitters in analogue mode only.
It is recommended
for the foreseeable future that field instruments should not be integrated digitally
with logic systems for High Risk (SIL3) pplications.
In all cases the
input devices should be specified and selected for reliable operation and should
fail to a safe known condition on fault, or on interruption of power or other
operating medium. Components should be selected with built in features that
drive the device output to a prescribed status for specified failure modes.
Fire and gas
detectors should be selected and located to meet the performance standards for the
detection of specific hazards in the area. This will include fire sizes, gas
cloud sizes, and response times.
Output Devices
Output devices
should be specified and selected for reliable operation and to ensure that interruption
of the operating medium (electric, pneumatic or hydraulic supply) causes
failure to a known condition.
Shutdown and
depressurising valves should normally be operated via solenoid valves.
Electrical surge
suppression should normally be provided when driving inductive loads such as
solenoid valves.
Duplicate solenoid
valves and/or shutdown or blowdown valves may be necessary to meet the required
integrity (probability of failure on demand).
Shutdown and
Blowdown Valves
All shutdown and
blowdown valves should preferably be inherently failsafe e.g. spring return. Isolation
valves should fail closed and blowdown valves should fail open on loss of power
medium to the actuator or loss of control signal. However, there may be
specific applications where the flare header is not rated for simultaneous
blowdown of all areas of the plant. In this case the failure action of the
blowdown should be selected to minimise risk for all the relevant operating
regimes.
Where non
inherently failsafe actuators, e.g. double acting, are justified, then adequate
integrity for the application should be demonstrated. Each actuator should have
a local dedicated power source provided with appropriate protection. This
should be capable of meeting the regulatory requirements with regard to number
of operations. Where these are not stated, then three valve strokes should be
possible (where stroke is defined as a unidirectional movement).
The power medium
should preferably be air. However, hydraulic or electric failsafe actuators may
be justified for some applications despite their greater system complexity. In
all cases, adequate safety integrity and survivability of the valve and
associated controls should be ensured.
Consideration
should be given to the required performance of valves, actuators and ancillary devices
following long periods of inactivity in the same state.
The valves should
be capable of being operated under maximum line differential pressure.
In cases where
bypass repressurising around shutdown valves is justified they should also be automatically
operated by the protective system, be specified as shutdown valves, and be inherently
failsafe.
The speed of
response (stroking time) of the shutdown valve should be appropriate to the hazard
being protected against. Surge effects and the potential to lock in pressure
need to be considered when selecting or specifying closure times.
Control valves
should not be used as primary isolation devices, but may have a predefined trip
position on shutdown.
They may be
utilised as secondary isolation devices where SIL level requires robustness. In
these cases they should be operated by the shutdown system.
Where it is
necessary to use control valves in a safety related application, e.g. for
controlled blowdown of plant to flare, the control valves and their associated
systems and ancillary devices should be suitable for the required integrity of
the application.
Blowdown/Shutdown
Valve (Spring to Open/Close Valve) Torque
Valve Actuator
Start to
open/close torque
(Break-open/close
torque)
Spring start
torque (SST).
A safety factor of
100% (i.e. 2 times) should be applied on top of the valve start
to open/close
torque. This is at the 'compressed spring state'.
Reseat torque
(Opening/closing
torque)
Spring end torque
(SET).
A safety factor of
25% (i.e. 1.25 times) should be applied on top of the valve
opening/closing
torque (i.e. the spring should provide a torque of 1.25 times the
valve opening/closing
torque at its relaxed state).
Running torque
(Resistance
torque)
Spring running
torque (SRT) and air running torque (ART) - minimum torque
produced by the
actuator.
A safety factor of
50% (i.e. 1.5 times) should be applied and maintained on top
of the required
valve running torque during closing and opening.
Start of
close/open torque
(Break-close/open
torque)
Air start torque
(AST).
Pneumatic operator
beginning torque should be 2 times the valve
closing/opening
breakout torque.
Reseat torque
(Closing/opening
torque)
Air end torque
(AET).
Pneumatic operator
end of stroke torque should be 1.25 times the valve
closing/opening
torque (i.e. at the end of the closing/opening stroke).
Impulse Lines
Consideration
should be given to the means of achieving process connections to reduce the
risk of blockage
in isolation valves, impulse lines and instrument chambers. This applies
specifically when
it is known that particulate or waxy deposits are, or can be, present in the
process medium or
where scaling may occur.
Process and
environmental conditions should be considered in the specification and
selection
of impulse lines.
This includes protection from impact damage.
The risk of stress
corrosion cracking should be minimised in the selection and design of
impulse lines.
Care should be taken to avoid under lagging corrosion especially where trace
heating is used.
It is recommended
that double block and bleed 50
mm monoflanges are used on all impulse
line connections.
Control Lines
& Cables
Consideration
should be given to the protection and segregation of cables and control lines
associated with
the protective system. The routing of cables should avoid running through
high risk or
vulnerable areas where practicable. Diversity of routing should be considered
for
“energise to
execute” circuits as a means of reducing common mode failures in event of a major
incident. Any 'critical signals' should be hard wired.
Consideration
should be given to the segregation and shielding of cables to
Fire, Blast and
Dropped Object Protection
Fire, blast and
dropped object protection for instrumentation, actuators, cables and other associated
devices, which are part of protective systems, should meet the required survivability
specification of the performance standards.
Maintainability
and Testing
Due regard should
be given in the design to the needs of maintenance and testing activities. Specifically
the method and frequency of testing to ensure adequate facilities are provided.
Facilities for
physical testing of initiating devices should be provided where practicable, unless
all testing is to be carried out on shut down plant. Manual override switches
should be installed to isolate the devices prior to testing.
2.5 OPERATION
& MAINTENANCE
The purpose of
systems maintenance and testing is to ensure that the performance standards from
the original design are maintained throughout the lifecycle of the protective
systems.
2.5.1 Responsible
Person
Each protective
system should be under the control of an identified responsible person or job position.
The responsible
person or job position is accountable for ensuring that the systems continue to
perform to the required performance standards. Specific responsibilities
include:
• Assurance of the competency of the
operators and maintenance technicians who work with or on the system;
• Control of access to the system including
use of keys and passwords;
• Coordinate testing
of the system;
• Control changes to the system;
• Ensure appropriate records are maintained;
• Assess the results of testing, maintenance
activities, systems failures, and
demand rate on the
system to ensure system integrity is maintained.
2.5.2 Maintenance
and Testing
Design
assumptions, particularly on the scope and frequency of testing, should be
clearly documented and translated into operational information and procedures.
The maintenance
and testing scope, frequency and responsibilities should be clearly documented.
The maintenance and testing regime should recognise the scope and limitations of
any system self-testing.
The maintenance
philosophy document should also describe how demands on the systems will be
recorded and how the systems will be assessed periodically to ensure that their
safety integrity meets or exceeds the performance standards as per the design.
The implications of any failures should be assessed, and where required,
modifications to equipment or
procedures should
be carried out to minimise the likelihood of repeat occurrences.
The use of
maintenance overrides should be formally authorised and recorded. Their use should
be subject to instructions and procedures described in the operations
procedures for the plant. The status of overrides should be regularly assessed.
For large complex
systems, consideration should be given to placing a vendor support contract for
corrective and preventative maintenance, spares management, and support for system
changes.
The necessary
tools and diagnostic facilities should be available to permit technicians to perform
first line maintenance and restore system availability within a reasonable
period of time.
2.5.3
Documentation and Records
Current system
documentation should be available to maintain the system throughout its life cycle.
This will include overall system description, performance specifications, key
drawings, and operation and maintenance instructions. Records of the following
should be maintained throughout the life cycle of the system or for predefined
periods as appropriate:
• Inspection records;
• Testing records;
• Maintenance repairs;
• System failures;
• System demands and outcomes;
• System integrity assessments and any
subsequent changes to the scope or
frequency of
testing.
It is recommended
that check sheets, detailed in IEC 61508, be utilised.
2.5.4 Control of
Changes
Management systems
and procedures, commensurate with the criticality of the system, should be in
place to effectively control and monitor proposed and actual changes to
hardware, software and operational procedures.
All changes should
be shown to meet the systems safety performance standard and be fully assessed
by all relevant parties before implementation.
Any change to a
protective system should be fully documented, follow a quality plan and be reviewed
by two competent personnel.
Changes to
software based protective systems should be fully tested prior to
implementation on an operational host system. It should be capable of immediate
return to a known working version in the event of a fault.
The system
environment should be maintained in line with the original design parameters including
temperature, humidity, vibration, and electromagnetic disturbances. The impact
on system integrity by changes to the environment should be assessed.
2.5.5 Assessment
of Protective System Integrity
The results of
periodic system testing should be assessed and appropriate measures taken to maintain
the required system integrity.
The use of field
data to reassess the testing regime should only be used where a significant sample
of data is available. In this case the change to the testing regimes should be
fully justified, documented, and formally controlled.
For High Risk
(SIL3) systems, periodic reviews are necessary to ensure that the safety integrity
is maintained during the life of the plant. These reviews should re-examine the
quantified analyses originally carried out during the design phase taking into
account actual demands on the systems, outcomes of those demands, system
failure rates, any revised testing regimes and any changed operational
circumstances.
2.6
FACILITY/ACTIVITY
2.6.1 Drilling
Well Control
Equipment
Wellhead equipment
may vary from well to well to suit anticipated or known pressure conditions,
and in exploration drilling it should always be of a suitable pressure rating
to cope with high, or abnormal sub-surface pressures. Wellhead control
equipment should be installed under the direct supervision of competent personnel.
The drilling rig
should be equipped with independent hydraulically operated blowout preventer operating
equipment with an automatic repressuring system A control panel for the blowout
prevention equipment should be located on the rig floor at the Driller’s
station, with a second panel located away from the operations areas. A position
display panel should be fitted in a third office location for supervisory
personnel. The control panels should clearly show the open or closed state of
the blowout prevention equipment and the areas around the blowout preventer
control points should be kept clear and readily accessible at all times.
Upper and lower
kelly cocks of equivalent pressure rating to the wellhead control equipment should
be installed in the drill string to protect the swivel and rotary hose from
high well pressures.
When drilling into
known high pressure zones, or potential high pressure zones in production fields,
the use of drill pipe safety valves is ecommended.
On all drilling
and well servicing operations, an inside blowout preventer and full opening safety
valve should be kept on the rig floor ready for mmediate use in the drilling
string or tubing, if required. The valve should be fitted with handles for easy
handling and change subs to suit connections in use. The valves and controls
associated with the blowout preventer equipment should be clearly labeled to
indicate their specific function.
Pressure Testing
At the time of
installation, well control equipment including all inside blowout preventers (BOP’s),
kelly cocks and pumpdown subs should be hydraulically tested with water to the
full rated working pressure or maximum anticipated surface pressure, plus
safety factor, and the
results logged.
Test areas and equipment should be clearly indicated by warning notices or public
address (PA) announcements.
Inspection and
routine testing of such equipment, after installation, should be carried out at
regular intervals and logged. When drilling, blowout preventer rams should be
operated at regular intervals and results logged. The complete system should be
tested regularly and always prior to drilling into an unknown reservoir
section. Properly drafted BOP test sheets
should be
available for guidance.
If unusual
pressure variation or other abnormalities are observed in the system,
appropriate action should be taken and the details logged.
Control Valves
Any valves for the
shutting down and control of equipment in emergencies, such as choke manifolds
and standpipe manifolds, should be regularly tested and kept in good working condition.
Such valves should
plainly indicate whether they are open or closed and the positioning of them
should be either in line of sight to the Driller’s position or a method of
communication should be established between the man stationed at the control
valves and the Driller.
Well Control
Practice Drills
A blowout practice
drill should be carried out on each rig tour, until every member of each drilling
crew is familiar with his respective duties. In addition, each crew should have
a least one well control practice drill during each offshore duty cycle to
maintain alertness. Additional practice drills should also be considered prior
to drilling into new horizon sections
of a well.
Particular attention should also be given to training any new member of a crew
on his specific duties.
2.7.1 Alarm System
An alarm system
should be provided at the main machinery control station giving audible and visual
indication of any fault requiring attention. It should also:
• activate audible and visual alarms at
another normally manned control station;
• activate the Engineers alarm if the
original alarm has not received attention locally within a limited time;
• as far as practicable be of failsafe
design;
The alarm system
should be continuously powered with automatic change over in case of loss of
normal power supply. Such a failure should be alarmed. The alarm system should
be capable of indicating more than one fault at a time and the acceptance of an
alarm should not inhibit another alarm. Alarms should be maintained until they
are accepted and the visual indicators should remain until the fault has been
corrected, when the alarm should be automatically reset to the normal operating
condition.
PROCESS SHUTDOWN
3.0 PROCESS
SHUTDOWN
3.1 ROLE
The role of the
Process Shut Down (PSD) system is the detection of abnormal process conditions
which may result in a release of hydrocarbons and cause the shut down of the system
to prevent such a release.
3.2 FUNCTION
In the case of
hydrocarbon drilling and production systems an abnormal condition may include,
but not be limited to, the following:
• High or Low Pressure;
• High or Low Temperature;
• High or Low Level.
An abnormal
condition is characterised by the movement of system parameters (e.g. pressure,
temperature, etc.) towards or outside the operating envelope.
In some cases the
abnormal condition may be the release of gas (e.g. in the case of drilling where
gas detected in the mud returns may indicate a potential problem in the well). A
PSD will result in a shut down of energy sources which are contributing to the
abnormal condition. For example, in the case of high temperature, heat inputs
will be shut down or isolated, or in the case of high pressure the pressure
source will be isolated.
3.3 RELATIONSHIP
The Process Shut
Down (PSD) system acts to prevent an undesired release of hydrocarbons upon
detection of variations in system parameters which are known to be indicative
of a loss of control. PSD is related to various other safety systems as
follows:
3.3.1 Emergency
Shut Down (Section 5.0)
The PSD if
effective should return the system to a stable state with no or little threat
of an undesired hydrocarbon release. In cases where the PSD does not produce a
stable state in the hydrocarbon system an Emergency Shut Down (ESD) may be
required. The ESD system may be considered an extension of the PSD system, for
cases where the limited actions taken
in a PSD are
ineffective and the situation is escalating towards an emergency or Major Accident
Event (MAE).
3.3.2 Emergency
Power (Section 7.0)
In some cases, PSD
will cause the shut down of electrical supplies. In this event it is important
that power is available to effect the PSD and to provide for the continued
operation of parts of the facility not affected by the PSD. Emergency Power
systems may be activated at this time although it would be more typical that
emergency power supplies would be initiated in the event of an ESD.
3.3.3 Hydrocarbon
Disposal (Section 8.0)
Depending upon the
part of the hydrocarbon process affected by the PSD it may be required to
remove hydrocarbons from the system, either to prevent knock-on effects to
other systems or as a precaution in case the situation escalates further
towards an emergency or MAE.
Venting of
hydrocarbon gases may be released through a blow down executive action. Liquid hydrocarbons
may be drained to a ‘safe’ location.
3.4 DESIGN
Prevention is the
preferred strategy for the management of risk due to undesired hydrocarbon releases
and fires/explosions.
The PSD system
should be designed to provide a reliable means of detecting excursions of process
conditions towards or beyond operating/design limits and, providing alarms
and/or signals for executive action of other rocess/safety systems.
As discussed in
Section 2.0, API 14C
is a widely accepted method for the analysis and design of Process Safety
Systems. It requires that these systems have:
• independence from other systems or
reliability equivalent to an independent system; and
• two levels of protection, primary and
secondary, which should be independent and achieved through equipment which is functionally
independent.
In this context,
API 14C
provides guidance on the selection of safety devices and protective shut in
actions for isolating a process component, in the event of an abnormal
operating condition (e.g. overpressure, leak, excessive temperature, etc.). In
the case where a detected abnormal operating condition is a release of
hydrocarbons other safety systems may be caused to operate/take effect. That
is, in the event of a gas leak, the ESD and blow down systems may act to reduce
the amount/pressure of hydrocarbons for release thereby reducing the duration/consequences
of such a release.
For example, in
the case of overpressure, the primary means of protection is defined as a pressure
sensor to either shut off or divert inflow to the component, including
fuel/heat sources if appropriate. In this case a single device (i.e. the
pressure sensor) must be supplemented by another device (i.e. to cause shut
off/divertion of flow) to affect complete primary protection.
The secondary
means of protection should be a pressure relief or safety valve. In the case
where a shut off mechanism is employed, it should be at the primary source of
the energy, rather than at the input to the specific component effected, since
this would act to propagate the effect upstream until the primary source is
caused to be shut off.
4.0 FIRE & GAS
DETECTION
4.1 ROLE
To detect the
presence of hydrocarbon gas or ignited hydrocarbons and provide signals for the
initiation of Emergency Shut Down (ESD) and Fire Protection systems.
4.2 FUNCTION
The detection of
hydrocarbon gas in areas of the facility is a clear indication of a potential
for a fire or explosion Major Accident Event (MAE). At this stage it may be
possible to prevent ignition of the hydrocarbons thereby preventing a fire or
explosion. The detection of ignited hydrocarbons depends upon the nature of the
fire. Detection of light, heat and/or smoke may be used to indicate an ignited
hydrocarbon leak.
In either case the
detection of a hydrocarbon release acts to initiate other safety systems to control
the consequences of the event.
4.3 RELATIONSHIP
The Fire and Gas
(F&G) detection system acts to, detect an undesired release of
hydrocarbons, which may be ignited. F&G is related to various other safety
systems as follows:
4.3.1 Emergency
Shut Down (Section 5.0)
F&G detection
indicates that the sequence of events which may result in an MAE are well advanced
and provides the basis for executive action by the ESD system.
4.3.2 HVAC
(Section 6.0)
Through the ESD
system, detection of gas at the ventilation inlets of ‘safe’ spaces, such as control
rooms or accommodation modules, may cause shutdown of HVAC fans and/or dampers
in HVAC trunking.
4.3.3 Emergency
Power (Section 7.0)
Continued
operation of F&G detection in an emergency is important so that a
developing event can be monitored. (Hydrocarbon gas migration or gas ignition)
Continued operation requires provision of electrical energy through the
Emergency Power system.
4.3.4 Fire
Protection (Not part of these Guidelines)
In the event of a
hydrocarbon release or ignition, F&G detection may cause an active fire protection
system to come into effect in the area of the release and/or adjacent areas.
Active fire protection systems include water deluge, CO2 dumping and Dry
Chemical.
4.4 DESIGN
Prevention is the
preferred strategy for the management of risk due to undesired hydrocarbon releases
and fires/explosions. As discussed in Section 3.0 Process Shut Down systems, a hydrocarbon
leak may be detected as a result of abnormal operating conditions (e.g. low pressure,
back flow and low level). However, that system is not a completely effective
means
of identifying the
precursors to all hydrocarbon releases, and for this reason leak and fire detection
systems are deployed.
A leak may be
detected as an abnormal process operating condition or directly as hydrocarbon in
the atmosphere external to the process system. A release of hydrocarbon liquid
may be detected as an abnormal process operating condition. The exceptions to
this are in cases where the liquid releases a large amount of hydrocarbon
vapour when reduced to atmospheric
pressure or where
the liquid is released as a spray, creating a hydrocarbon vapour mist in the air.
The detection of liquid releases, as hydrocarbon vapours in the atmosphere, will
be discussed
Hydrocarbon fires
may be detected through heat produced or electromagnetic radiations emitted by
the fire, or by the products of combustion (e.g. smoke).
The F&G system
should be designed to provide a reliable means of detecting hydrocarbon vapour/gas
in the atmosphere and fire, and provide alarms and/or signals for executive
action by other safety systems.
The definition of
requirements for a F&G system should include consideration of the types of leaks,
their location and air movement patterns.
Fire and Gas
systems should be specified to detect given ratings of fires and
sizes/concentrations
of gas clouds. The practical difficulties of designing systems from hazard
detection through to final activation in high integrity should not be
underestimated.
4.4.1 Failsafe
Fire and Gas
systems are traditionally not designed to have failsafe control actions because
of the undesired consequences of
spurious or inaccurate detection. This requires consideration of automatic
testing, built in fault detection, line monitoring, and voting techniques to
ensure that the system performs its intended function.
4.4.2 Detection
Types
Classified areas
and locations where personnel in facilities should have the following types of
detector:
• Fire - pneumatic fusible loops; electronic
detectors (flame, heat, smoke);
• Gas - ventilation and detectors; visual
and audible alarms for low level of
flammable gas;
shutdown upon LFL/approach to LFL.
4.4.3 Detection -
Personnel Observation
Detection by
personnel observation is more effective in the cases where a space/area on the facility
is manned on a regular basis. The detection of a liquid hydrocarbon leak is
more readily achieved through observation/inspection by personnel. In the case
of detection by personnel observation it is important that suitable alarm call
points (break glass or push button type) are provided for notification of a
leak/fire. This means of detection may also be a requirement in the case where
a fire protection system is used which may threaten the observers’ life. An
example of this would be the use of CO2 to inhibit combustion, which produces a
threat to personnel.
4.4.4 Detection -
Automatic
Detection by an
automatic system may be used where a space is not normally manned and the hydrocarbon
release or effects of combustion are readily detected. These systems normally provide
rapid response in the event of a leak/fire and may be designed to readily show
the location of an event. Such systems include:
• pneumatic loops with fusible elements;
• electronic systems – flame, heat and
product of combustion detectors.
Flame detectors can provide a
speed response in the detection of fires. Flame detector installations should
consider the likely source of flame, detector cone of vision, and physical obstructions.
Flame detectors used in open areas should not be susceptible to false alarms
due to sunlight. Single spectrum detectors are susceptible to spurious alarms;
therefore, it may be desirable to arrange them in groups using appropriate
voting systems or to use devices that incorporate dual sensors of different
types (e.g., UV/IR) to minimize unwarranted alarms.
Heat detectors normally require
less maintenance than other types of detectors because of their basic nature of
operation and simpler construction. These factors may result in fewer unwarranted
alarms; however, since heat detectors are inherently slower in operation than other
types of electrical detectors, they should be considered for installation in areas
where high speed detection is not required.
Smoke detectors are recommended
where personnel regularly or occasionally sleep and in rooms containing heat
sources such as space heaters, ovens, and clothes dryers or areas subject to
electrical fires. Quarters should contain smoke detectors within each bedroom, corridor,
hallway and office.
4.4.5 Detector
Certification
Detectors should
be compatible and approved through laboratory testing/certification.
4.4.6 Detector
Selection
The following considerations
should be made in selecting a detector/detection system.
Effect to be
Detected
See Section 4.4.4,
above.
Electrical Area
Classification
In the case of
leak detectors it is critical that these devices provide indication of a
release without causing ignition. The classification of electrical equipment
for use on facilities (i.e. AS 2380) defines standards for the intrinsic and
explosion proofing of electrical equipment in such spaces. These
classifications should be applied to detectors.
Required Speed of
Response
In the case of
fire detection it is generally critical to have rapid detection such that fire protection
systems can be initiated prior to significant heat build up due to the fire in
the facilities steelwork and other equipment.
IR and UV
electronic detectors provide rapid response to the presence of a flame but are relatively
expensive. These detectors are used where a readily distinguishable flame is produced
by burning hydrocarbons and is not obscured by products of combustion or be masked
by background electromagnetic radiation.
Pneumatic fusible
loops respond to the heat of a fire and are most effective in detecting liquid fires.
These systems are relatively inexpensive and are effective in cases where an
obscured flame is present.
Coverage for
Effective Detection
Detectors must be
positioned so they are exposed to the effect to be detected. This requires consideration
of the effect to be detected and the location(s) of releases.
Hydrocarbon gas
and vapour/mists are most readily detected by automatic systems.
In the case of
vapours/mists, these are generally the result of discharge of liquid
hydrocarbons from high pressure through a small hole. Oil mist detection
systems are available which use sampling and analysis of an atmosphere, and IR
sensing. The effectiveness of these systems for localised releases is
critically dependent upon location of leaks and sampling points. It is considered
that other methods of control be applied to the prevention and detection of
such
leaks. One mode of
prevention is through the use of reduced pressures. Control occurs through the use
of shielding of flanges and separation from hot surfaces.
In the case of
gaseous hydrocarbons, it is the relative density of the gas compared to that of
air which will primarily define the location of detectors. Buoyant gases (i.e.
those lighter than air) will tend to rise and detectors should be placed high
in spaces where such releases may occur. In the case of dense gases,
accumulation will occur near the deck of the space and detectors should be
placed low down.
The location of
detectors may also be influenced by the type of space and ventilation patterns.
Enclosed spaces
will generally have some form of mechanical ventilation which acts to prevent
the build up of flammable concentrations of gaseous hydrocarbons. The location
of detectors should include consideration of ventilation air flows.
Consideration may be given to siting detectors in the exhausts from such
spaces. The use of open space design may act to disperse gaseous hydrocarbon
releases through natural air movements. In either case where significant
ventilation rates are available gas detection may be impractical or require
siting of detectors close to nominated leak sources.
The number of
detectors used may be determined by the required safety integrity level of detection
and/or by operational considerations. Use of a single detector may be
acceptable where the location of gas is readily known (e.g. HVAC
inlets/exhausts) which would leave only the detector as the determining factor
on detection reliability. More generally, if detection systems are used they
are in the form of multiple detectors which ‘vote’ to provide a more certain
indication of an undesired condition. This may include, for example, three detectors
in series (i.e. on a single loop) which requires two of the three to indicate
the effect for ‘confirmed’ detection. In some cases multiple ‘loops’ of
detectors may be deployed to improve detection effectiveness.
The deployment of
complex detection systems should be carefully considered since these will be
expensive to purchase and maintain, and may provide a false sense of security
in operations.
Sensitivity
Use of detector
voting and self testing systems may reduce the effect of spurious detectors action
(e.g. due to detector failure or environmental factors such as lighting).
Vulnerability to
Damage
Detectors should
be specified, positioned and protected for the environment they will work in. Some
considerations include:
• corrosive environments/discharges;
• the effects of cleaning chemicals;
• potential for impacts during operational
and/or maintenance activities.
4.4.7 Gas
Detection
Any area in which
operations could lead to the emission or accumulation of flammable or toxic
gases should be provided with suitable means of ventilation.
A drilling,
workover or production installation on a platform should have flammable gas detection
devices installed in any enclosed area containing petroleum handling equipment,
mud tanks, mud pumps, shale shakers or other open parts of the mud system. An
operation where an emission of flammable gases can result in hydrogen sulphide
gas concentrations of greater than 20 ppm, without the flammable gases emission
being detected, should not be carried out unless hydrogen sulphide gas
detection devices have been installed and are
functioning.
A gas detection
system should be capable of continuously monitoring for the presence of gas in
the area in which the detection devices are located.
The monitoring
devices and the control mechanisms should be so arranged that functional tests
of the separate components and of the whole system can be carried out
efficiently.
The central
control for the gas detection system should:
• be capable of giving an alarm at a point
10-25% of the lower explosive limit;
• automatically activate shut-in sequences
at a point 20-60% of the lower
explosive limit;
and
• in the case of hydrogen sulphide detection
be capable of giving an alarm before the concentration exceeds 20 ppm.
Internal
combustion engines on a platform, other than engines operating fire pumps and pumps
required for well control or which are situated in the open and are constantly
attended when operating, should be provided with emergency shutdown devices.
These should be automatically activated when flammable gas is detected in the
air intake or, where these engines are installed in pressurised housings, in
the air intake of these housings and which are,
where necessary
equipped with remote control equipment that is:
• accessible to the driller on a drilling
and workover rig; and
• at some readily accessible point on a
production platform.
4.5 OPERATION
& MAINTENANCE
Functional tests
should be carried out by a competent person:
• at defined intervals; and
• immediately after any event indicating
that the system or any part of the
system is not
operating correctly.
The results of any
such test should be recorded in an approved manner.
4.5.1 Testing
F&G Panel(s)
should be tested quarterly, including shutdown tests using different
initiators.
Test failures
should be documented and utilised for determination of proof test periods. Fire
detectors should be tested quarterly for operation and recallibrated. Fusible
loops should be inspected as per API 14C.
5.0 EMERGENCY
SHUTDOWN
5.1 ROLE
The role of the
Emergency Shut Down (ESD) system is to isolate equipment and systems to prevent/minimise
loss of life on and property damage to the facility.
5.2 FUNCTION
The ESD system
provides for the isolation of equipment systems where an emergency situation
has arisen or is imminent. This may be through escalation or worsening of
abnormal process conditions which the PSD system has not acted to control, or
may be as a result of the detection of a hydrocarbon release or fire.
In general terms
the ESD system will cause segregation of the hydrocarbon process to prevent inflow
to a leaking section and thereby limit the quantity of hydrocarbons available
for release. Hydrocarbon disposal systems (Section 8.0) may be used to further
reduce the quantity of hydrocarbons available for release through blow down of
gas and drainage of liquid hydrocarbons.
5.3 RELATIONSHIP
The Emergency Shut
Down (ESD) system acts to prevent or control an undesired release of hydrocarbons
through escalation of shut down level from PSD or upon operation of F&G detection.
ESD is related to various other safety systems as follows:
5.3.1 Process Shut
Down (Section 3.0)
The PSD should
return the system to a stable state with little or no threat of an undesired hydrocarbon
release. In cases where the PSD does not produce a stable state in the hydrocarbon
system, an ESD may be required. It many cases, ESD is considered an extension of
PSD where the more limited actions taken in a PSD are ineffective and the
situation is escalating towards an emergency or Major Accident Event (MAE).
5.3.2 Fire and Gas
Detection (Section 4.0)
The primary cause
of ESD is detection of a hydrocarbon leak through the Fire and Gas (F&G) detection
system. F&G detection may result in the shut down of other safety systems
through the ESD system.
5.3.3 HVAC
(Section 6.0)
The ESD system may
cause the shut down of the HVAC system, including fans and/or fire dampers, for
example, detection of gas at the ventilation inlets of ‘safe’ spaces, such as control
rooms or accommodation spaces.
5.3.4 Emergency
Power (Section 7.0)
The F&G
detection system should be provided with Emergency Power to allow for ongoing monitoring
of an event after the initial event has resulted in an ESD.
5.3.5 Hydrocarbon
Disposal (Section 8.0)
Through an
executive action from the ESD system, segregated sections of the hydrocarbon process/system
in the vicinity of a release/fire may be blown down (i.e. hydrocarbon gas vented
to a safe location) and/or drained (i.e. liquid hydrocarbon removed/’dumped’ to
a safe location). Both of these actions will reduce the amount of fuel
available to feed a fire or reduce the effect of any ‘escalation’ of the
original event to another part of the hydrocarbon system.
5.4 DESIGN
Safety systems
should be defined on the basis of the inherent risk associated with the process/activity.
Shut down systems should take due consideration of risks and in particular event
sequence in the context of the overall facility.
Prevention is the
preferred strategy for the management of risk due to undesired hydrocarbon releases
and fires/explosions. The PSD system may provide for the shut down of a system component
prior to a release or it may detect process conditions which are symptomatic of
a release. In addition the F&G system may provide indication of a release.
In either case, it is the ESD system which will cause executive action to
control/mitigate the effects of the release.
As discussed in
Section 2.0, API 14C
is a widely accepted method for the analysis and design of Process Safety
Systems. It requires that these systems have:
• independence from other systems or
reliability equivalent to an independent
system; and
• two levels of protection, primary and
secondary, which should be independentand achieved through equipment which is
functionally independent.
In this context,
API 14C
provides guidance on the selection of safety devices and protective shut in
actions for isolating a process component, in the event of an abnormal
operating condition (e.g. overpressure, leak, excessive temperature, etc.). In
the case where a detected abnormal operating condition is a release of
hydrocarbons, it is the function of the ESD system to define executive actions
for the control/mitigation of the undesirable event.
For example, in
the event of a gas leak the ESD and blow down systems may act to reduce the amount/pressure
of hydrocarbons for release thereby reducing the duration/consequences of such
a release.
As far as
practicable the ESD system should be designed to be ‘failsafe’. Exceptions
should be made on the basis that the overall integrity of the ESD system is not
impaired. ‘Cascade effects’ should be avoided in the design of ESD systems.
The ESD system
should be independent of other monitoring, control and alarm systems. The system
itself should be designed with sufficient segregation such that failure of one
part of the system would not render other parts of the system inoperative.
Similarly faults in interfaced systems should not render the ESD system
inoperative.
ESD systems should
be protected against sources of electromagnetic interference.
ESD activation
should be enunciated at the main control station by visual and audible means which
should readily identify the location and source of the equipment initiating
ESD. For the final stage of ESD, the alarm should be part of the facility’s
general alarm system.
Manual reset
capability should be provided local to the equipment that has been shut down.
Appropriate
hardware and/or management system controls should be implemented to ensure
that ESD system is
not cancelled erroneously.
Online testing and
maintenance should be allowed for whilst the system may be readily returned to
operational readiness as soon as possible. In the case that system overrides
are provided, these should not be capable of being inadvertently operated. Such
overrides should be made known to personnel at the main control station and
should be limited in their scope of affect through suitable segregation of
overrides. Visual indicators of override should be
provided at
control stations and locally.
Power supplies
should be provided and arranged such that automatic change over is provided for
in the event of power loss. These supplies should be provided with alarms to
enunciate their failure.
Hydraulic and
pneumatic systems should have sufficient capacity to perform one complete shutdown
followed by reset. Standby should preferably be from local sources. In the case
of non-failsafe actuators, capacity should be provided for three valve strokes.
Power and control
lines to ESD field components should be routed to minimise the risk from causes
of damage including segregation from other control systems to prevent failure
of these systems affecting the ESD system. Where mechanical damage is possible,
consideration should be given to lines running through protective enclosures. Lines
that are required to maintain integrity during a fire should have appropriate
fire resistance.
ESD system
terminations should be segregated from other equipment/systems. In the case of interface
terminations, the ESD system terminations should be clearly identified. Manual
initiation points should be clearly identified.
The final stage of
ESD should include shutdown of all utilities (excluding emergency services),
production/test facilities, closure of wellhead valves, opening of all BDVs and
closure of DHSVs.
If employed,
redundancy should include consideration of:
• majority voting;
• common mode failure mechanisms;
• alarm of channel failure;
• online testing of channels, a complete
function test where practicable.
The use of PES should
be compatible with other ESD system technologies used and should be designed
for normal and emergency environmental conditions. Essential functions should
be provided with self checking and fault diagnostic capabilities. Testing
should allow for immediate reversion to system operation in the event of an
actual ESD signal. PES system failure should be annunciated through visual and
audible alarms, with consideration given to discrimination of hardware and
software malfunction. Failure of peripheral devices should
not cause the
system to become ineffective. Software quality should be adequately checked and
modifications only made in accordance with the software quality assurance plan
for the system. All parts of the PES should have a ‘no break’ power supply
which has low levels of superimposed electrical interference. Software should
be secured from interference by unauthorised personnel.
5.4.1
Documentation
The ESD system
design should be documented to include:
• philosophy details and logic diagrams;
• cause and effect matrices;
• loop diagrams;
• alarm system schedules, diagrams and
description of operation;
• power supply system diagrams.
In the case of PES
systems documentation should include:
• functional specification and diagrams;
• hardware and software particulars, usually
in the form of block and flow
diagrams;
• scope and function of novel features –
interlocks, self checking systems, auto
abort testing
mechanisms, etc;
• interface arrangements with field
equipment and peripheral devices;
• PES equipment siting;
• software quality assurance plan;
• I/O schedule;
• Message lists.
Maintenance
manuals should be produced and retained on the facility.
Records of ESD
system testing and commissioning should be retained.
5.4.2 Process and
Emergency Shutdown Systems
Shutdown
functionality may be implemented in programmable or non programmable systems.
Care should be
taken to ensure that the system supplier is both competent and experienced in the
chosen technology.
Rigorous
quantified assessment of reliability and system integrity is only usually
required in the case of High Risk (SIL3) shutdown systems. Other risk levels
should be the subject of a qualitative assessment/review.
5.5 OPERATION
& MAINTENANCE
In cases where
parts of the process system are to be bypassed (e.g. start up, changeover, maintenance,
etc.), the ESD system should be designed to facilitate such activities. Disconnection
of parts of the process system and associated parts of the ESD system is controlled
through the facility Permit To Work (PTW) system. Override of the ESD system’s
failure to safety function may be acceptable during manned operations such as
loading, drilling or workover, provided suitable risk analysis demonstrates that
risks are ALARP.
No process ESD
should confer a hazard on drilling operations.
A recognised
national or international standard for pressure testing should be applied to
all parts of the ESD pneumatic and hydraulic systems.
Commissioning
should include testing of each part of the ESD system culminating with testing
of the whole system. Testing should include activation via all manual
initiation devices and/or sensors through to the final shutdown conditions.
Commissioning records should confirm satisfactory operation and response times
where appropriate.
5.5.1
Documentation
For the purposes
of effective operation of the ESD system the following documentation should be
provided:
• Outline of testing/maintenance methods and
frequency (Operations Manual);
• Detailed testing/maintenance procedures
(Maintenance Manual).
5.5.2 Sequence of
Event Recording
An event recorder
is recommended and should include initiating and ESD action signals. This may
be used to demonstrate system functionality and operation.
5.6
FACILITY/ACTIVITY
5.6.1 Drilling
It is usual for
ESD systems in drilling operations to be the subject of manual executive
action. Blow-out preventers and related well control equipment should be
installed, operated, maintained and tested in accordance with the manufacturers
recommendations or with company requirements, ‘Blow-out Prevention Equipment
Systems for Drilling Wells’, and should be rated with a
working pressure
of the casing. Prior to drilling below the conductor casing string in
exploration wells, or in development wells in those areas having known gas
accumulations, a pipe of adequate diameter with control valves or diverter
system should be installed. This should safely divert hydrocarbons
and other fluids
in the event of pressures occurring below the shoe of conductor string which may
fracture the formation.
Prior to drilling
below the surface casing string, the blow-out prevention equipment should include
a minimum of:
• three remotely controlled, hydraulically
operated blow-out preventers with a
working pressure
that exceeds the maximum anticipated surface pressure,
including one
equipped with pipe rams, one with blind rams and one of the
annular type;
• a drilling spool with side outlets for the
attachment of choke and kill lines, if
side outlets are
not provided in the blow-out preventer body. These side
outlets, at least
two in number, should be connected to pipelines of sufficient
strength to
withstand a pressure equal to the pressure rating of the blow-out
preventer assembly
to which they are connected. One of the said pipelines
should be
available for the purpose of bleeding well fluid to the choke
manifold and
should have a minimum internal diameter of 75 mm;
• a choke manifold containing not less than
two adjustable chokes connected to
one of these
pipelines;
• a kill pump facility connected to the kill
line; and
• a fill-up line.
Prior to drilling
below an intermediate casing string, the blow-out prevention equipment should
include a minimum of:
• four remotely controlled, hydraulically
operated blow-out preventers with a
rated working
pressure which exceeds the maximum anticipated surface
pressure,
including at least one equipped with pipe rams, one with blind rams
and one of the
annular type;
• a drilling spool with side outlets for the
attachment of choke and kill lines, if
side outlets are
not provided in the blow-out preventer body. These side
outlets, at least
two in number, should be connected to pipelines of sufficient
strength to
withstand a pressure equal to the pressure rating of the blow-out
preventer assembly
to which they are connected.
One of the said
pipelines should be available for the purpose of bleeding well
fluid to the choke
manifold and should have a minimum internal diameter of
75 mm;
• a choke manifold containing not less than
two adjustable chokes connected to
one of these
pipelines;
• a kill pump facility connected to the kill
line; and
• a fill-up line.
When drilling
operations are being carried out from a mobile drilling unit (other than a
jackup platform), after drilling out of the conductor string, provision should
be made so that:
• equipment being run in the well may be
secured in such a manner that it may
remain stationary
and independent of the motion of the drilling unit; and
• every blow-out preventer assembly in use
should have included in it at least
one set of pipe
and shear-blind rams.
It should be
ensured that:
• an inside blow-out preventer assembly
(back pressure valve) and a full opening
drill string
safety valve in the open position are kept on the rig floor at all times
whilst operations
are in progress, with suitable crossover substitutes to enable
installation on
all drill pipe, drill collars and tubing in use; and
• a kelly cock is installed immediately
below the swivel and another at the
bottom of the
kelly, of such design that it can be run through the blow-out
preventers.
It should be
ensured that the blow-out prevention equipment is not removed until the well
has been adequately sealed.
During operations
there should be a control panel, located on the drill floor, for operating blow-out
preventers, and another located at such a distance from the drill floor as to
ensure safe and ready access in times of emergency.
Each choke
manifold should have the following equipment clearly visible to the choke operator
when standing in his normal operating position for either the remote or hand adjustable
chokes:
• a pressure gauge which indicates the drill
pipe pressure at the drill floor; and
• a pressure gauge which indicates the
casing string/drill string annulus pressure
at a known point
upstream of the choke.
Blow-out
preventers which are installed on the ocean floor should be provided with
duplicate sets of control lines from the master control panel on the drill
floor to the various components of the blow-out preventer stack. Each control
line should contain a connector-control pod located at the top of the blow-out
preventer stack to enable disconnection from the blow-out preventer stack for
essential maintenance or in times of emergency.
The following mud
system monitoring equipment, with drill floor indicators, should be installed
and used during all drilling operations after setting and cementing the
conductor casing string:
• a recording mud pit level indicator to
determine mud pit volume gains and
losses. This
indicator should include a visual and audible warning device;
• a mud volume measuring device for
accurately determining the mud volumes
required to fill
the hole on trips;
• a mud return of full hole indicator to
determine when returns have been
obtained, when
they occur unintentionally, and when returns essentially equal
the pump discharge
rate; and
• a mud gas monitoring device to determine
the concentrations of gas in the
drilling mud.
Drilling operations
should not be commenced or continued unless the drilling rig is equipped with a
penetration rate recorder that will give a clear indication of a change in
formation that can be used as a guide to warn against approaching areas of
abnormal pressure. This should be maintained in good working order and be in
continuous operation while drilling.
5.6.2 Production
Pipelines
A pipeline ESD
valve (ESDV) capable of blocking flow should be installed and maintained.
The ESDV should
be:
• held open by electrical , hydraulic or
other signal, failure of which will cause
auto closure;
• capable of closure by a person adjacent to
it and automatically as part of ESD
function;
• capable of allowing passage of equipment
if the pipeline is so designed (e.g.
pigs);
• fire/explosion/impact protected.
Upon closure of a
pipeline ESD valve:
• The Person in Charge (PIC) ensures that
all connected facility PICs are
informed;
• valve only to be re-opened upon
authorisation of facility PIC following
consultation with
PICs of connected facilities;
• ESDV should be used for blocking only and
not for flow control.
Further, the ESDV:
• should be located such that it can be
safely/fully inspected, maintained and
tested;
• should not be submerged or submergible if
a fixed platform;
• should, if non-fixed, be as near as
practicable to a flexible line where part of
the riser is
tensioned; otherwise above highest wave crest and quick disconnect
fittings;
• should be located such that base of riser
is as short a distance as practicable
away.
Pipeline ESDVs
are:
• inspected for external
leak/damage/external corrosion every 3 months;
• motion tested from a local closure station
every 6 months;
• fully function tested through action of
the platform ESD system every 12
months.
Test records
should include:
• ESDV identity;
• pipeline title holder; facility owner and
Person In Charge;
• date of test;
• name, qualifications and employer of test
personnel;
• test procedures and equipment particulars;
• damage/defect and action taken/proposed
for remedy.
Wells
A failsafe surface
controlled sub-surface safety valve (SCSSV) should be installed in the tubing
string at least 30 metres
below the mudline or below the depth of the deepest installation pipe
penetration, and it should be controlled through the installation emergency shutdown
system.
A well that is
capable of naturally flowing hydrocarbons should have an approved subsurface safety
device. This device should close if the wellhead or production equipment is
damaged resulting in a surface leak. The device should be function tested on a
regular basis and where testing indicates it may not work, be repaired or
replaced immediately.
6.0 HEATING,
VENTILATION AND AIR CONDITIONING
6.1 ROLE
Prevention of the
accumulation of hydrocarbon gas to flammable concentrations.
6.2 FUNCTION
The HVAC system
may act to prevent accumulations of hydrocarbon gas to flammable concentrations
through provision of a copious air flow through an area or prevent ingress by maintaining
a space at a higher pressure to an adjacent one.
In the case that a
flammable concentration of gas is detected, the HVAC system in hazardous areas
may be shut down or allowed to continue operation, depending upon the overall
safety system philosophy for the facility. Normally the supply of air to non
hazardous areas would be sustained upon gas detection in a hazardous area to
prevent ingress of a flammable concentration.
In the case that
hydrocarbon gas is detected at the inlets to non hazardous spaces, the HVAC system
would normally be shutdown to prevent ingress of the gas.
6.3 RELATIONSHIP
6.3.1 Fire and Gas
Detection (Section 4.0)
F&G detection
of gas at the ventilation inlets of ‘safe’ spaces, such as control rooms or accommodation
modules, may cause shutdown of HVAC fans and/or dampers in HVAC trunking.
6.4 DESIGN
Prevention is the
preferred strategy for the management of risk due to undesired hydrocarbon releases
and fires/explosions. In the case of hydrocarbon gas/vapour releases, it is possible
to prevent the accumulation of hydrocarbon to a flammable level through the
application of natural or forced ventilation.
Where facilities
are open or partially open to the elements, careful consideration of prevailing
wind directions and the siting of vents can act to provide a significant flow
of air which prevents the build up of flammable concentrations of hydrocarbons
in the event of a leak.
In the case of
facilities that have enclosed spaces, a mechanical means is used to provide ventilation
for comfort and as a safety measure. In the context of the HVAC system as a safety
measure, a number of strategies may be employed, such as:
• Control rooms, spaces normally occupied by
personnel, and spaces which
contain
hydrocarbon processing equipment may be maintained at a positive
pressure (i.e. a
pressure above atmospheric). This pressurisation acts to
exclude
hydrocarbons from the ‘safe’ area thereby preventing a fire in these
spaces.
• The use of positive pressure to protect a
space as detailed above requires that
the ventilation
system inlet is not effected by a hydrocarbon release. Gas
detection and fire
dampers are used to prevent the ingress of gas or smoke in
cases where HVAC
inlets are inundated with gas or smoke respectively. The
selection of
ventilation inlet locations should be made to ensure, as far as
practicable, that
they can provide ‘clean’ air at all times.
• Enclosed spaces which contain hydrocarbon
processing equipment are
designated
hazardous areas. These spaces may be provided with forced
ventilation to
dilute and carry away any gas/vapour hydrocarbon releases. The
decision to
provide such ventilation will include consideration of whether the
space will be
visited by personnel and may determine, or be determined by, the
ignition rating of
equipment in the space. Where personnel may visit the
space, an
accumulation of gas/vapour may have the potential to cause a death
by poisoning or
asphyxiation through its accumulation in ‘dead’ areas in the
module,
particularly in the case where the hydrocarbon is heavier than air.
Protection of Non
Hazardous Areas
The use of
enclosed modules and positive pressurisation for the protection of non
hazardous areas from hazardous area atmospheres should be specified and applied
wherever possible in the design and construction of offshore installations.
Such modules
should have airlock protection at access points and the pressurised area should
be monitored and equipped with pressure drop alarm and shutdown systems.
Separation of
areas by fire and/or blast walls, appropriate to the risk from process areas,
is recommended.
Accommodation and
control centres should be protected by fire and/or blast walls or located remotely.
7.0 EMERGENCY
POWER
7.1 ROLE
Provide electrical
supply to enable ongoing emergency and evacuation system operation in the event
of an emergency situation.
7.2 FUNCTION
In the context of
safety systems, emergency power may be required to allow ongoing monitoring of
an event through the F&G system or for its control through the ESD system.
7.3 RELATIONSHIP
In the event of an
emergency situation, many power sources are shut down. Several systems require
electrical power to operate and emergency power is provided to ‘critical’
systems, such as ESD (Section 5.0) and F&G (Section 4.0), thereby allowing
the effective management of an emergency situation. The Emergency Power system
enables other safety systems in the control of MAEs.
7.4 DESIGN
Emergency Power
systems may be specified to support the safety systems for a period of 24 hours.
Such a supply may be dedicated for each safety system or may be a single
general system.
Emergency power
sources may comprise uninterruptible power supplies (UPS) and/or a compression
ignition or gas turbine, with a fuel of flash point greater than 43 degree
Celsius.
The source of
emergency power should be located outside any hazardous areas and should be independent
and remote from the main electrical power source(s) for the facility.
Suggested UPS
Autonomy Times
System Autonomy
Time (hrs:mins)
Fire and Gas
detection, and alarm. 03:00
Emergency Shutdown
and depressurising. 00:30
Process monitoring
and control. 00:45
PA, facility
audible alarms and status lights. 03:00
SOLAS
communications equipment. 24:00
Emergency and
escape lighting. 01:30
Navigational aids
and helideck lighting. 96:00
Note: These
autonomy times should not be reduced, even in cases where an emergency diesel
generator is installed to provide back up supply to UPS units.
The emergency
power source should come into operation upon loss of main power. In the event
of a generator being the source of emergency power, it should be possible to
start it independent of the automatic start mechanism.
Emergency
generator automatic starting mechanisms should not be inhibited in the event
that hydrocarbon gas is present at the generator.
8.0 HYDROCARBON
DISPOSAL
8.1 ROLE
To divert or remove
hydrocarbons from one location to another, thereby reducing the effect of an
emergency event.
8.2 FUNCTION
In the case of
drilling systems in the early stages of an exploration/development well, a ‘diverter’
is deployed to deflect uncontrolled well flow, should it occur, away from the
drill floor and other manned locations.
In the case of
process systems, hydrocarbon disposal is most generally the depressurisation or
blow down of process vessels. Through reduction in pressure of vessels, large
quantities of hydrocarbon gas/vapour are removed to a ‘safe’ location. The
depressurisation reduces the likelihood and consequences of an existing fire
escalating to other process sections. The effective operation of the blow down
system generally is dependent upon the successful operation of the ESD system
in segregating the process system into ‘isolated sections’.
8.3 RELATIONSHIP
Hydrocarbon
disposal systems are used to reduce the amount of hydrocarbons available to feed
a fire or to remove hydrocarbons which an existing fire may ‘escalate’ to,
thereby worsening the original event. These systems are generally initiated by
the ESD system (Section 5.0) after the hydrocarbon process has been isolated
(i.e. once flow into and out of system segments has been shut down).
8.4 DESIGN
The safe removal
of hydrocarbons from process equipment in the event of a leak may reduce the
duration and size of a fire. It may also prevent the escalation of a fire from
one part of the hydrocarbon processing system to another. Both of these effects
act to reduce the impact of a hydrocarbon release, especially when the release
has been ignited.
Various forms of
relief devices may be used to prevent an undesired release of hydrocarbons.
Pressure relief
valves and bursting discs, for example, may relieve a build up of pressure in a
process component, thereby preventing its failure. These devices are
complemented by drain (i.e. over pressure due to liquid) and vent (i.e. over
pressure due to gas) systems which remove any hydrocarbon to a safe place.
Action of these devices is symptomatic of a process system problem which must
be addressed to allow production to continue. They provide for a
controlled failure
of the system as a planned event rather than a undesired equipment failure.
The activation of
these systems is due to an intrinsic property of the processing system (e.g. the
effect of high pressure).
Successful
activation of the ESD system to shut process components down may be followed by
the removal of hydrocarbons by executive action. The most common means of doing
this is through the activation of blow down valves (BDVs) on the gas side of
process components.
Hydrocarbon gas is
blown down to a safe area for venting to atmosphere through suitably designed
piping. A knock out drum may be used to remove hydrocarbon liquids prior to venting.
The removal of
hydrocarbon liquid in offshore facilities has generally received less attention
than that paid to the removal of gas. This is because the pressure driving a
liquid release rapidly drops to the hydrostatic head of liquid. In contrast the
pressure driving the release of a gas or flashing liquid is sustained by the
compressible nature of the hydrocarbon being released.
8.4.1 Blowdown
Valves
See Section
2.6.15.4.
8.4.2 Gas Flaring
Stacks
Gas flaring stacks
and installations should incorporate a flame arrestor and/or continuous purge.
Additionally, the following precautions should be taken:
• Flare stacks should be located so that any
fluid carry over will not be deposited on process or other operating areas by
prevailing winds;
• Reliable and safe means of remote ignition
and re-ignition should be provided;
• Fire control equipment should be installed
in areas adjacent to the flare stack
for use in an
emergency.
8.4.3 Crude Oil
Burners and Booms
Crude oil burners
and booms for use in oil disposal during well testing should be located as far
as possible from wellhead and separating equipment and with due regard for
prevailing wind effects. The following precautions should be taken:
• the fitting of two separate burners,
located to give flexibility in dealing with
wind direction
effects, should be considered;
• effective heat shielding of the
installation structure should be provided by a
water spray
curtain or similar arrangement to control heat build up when
flaring during
extended tests or large production rates;
• reliable and safe means of remote ignition
and re-ignition should be provided;
• access to flaring areas should be
restricted to personnel actually involved with
the operation and
the control of other operations which may be ongoing during
flaring should be
considered.
APPENDIX A
GLOSSARY
ABBREVIATIONS
The following
abbreviations are used throughout these Guidelines.
AC Alternating
Current
ALARP As Low As
Reasonably Practicable
API American
Petroleum Institute
APPEA Australian
Petroleum, Production & Exploration Association Pty Ltd
AS Australian
Standard
BDV Blow Down
Valve
BOP Blow Out
Preventer
DHSV Down Hole
Safety Valve
DISR Department of
Industry, Science and Resources
ESD Emergency Shut
Down
ESDV Emergency
Shut Down Valve
ESSA Emergency
Systems Survivability Analysis
FD Facility
Description
F&G Fire and
Gas
FMEA Failure Modes
and Effects Analysis
FPSO Floating
Production, Storage and Offloading
FSA Formal Safety
Assessment
HAZOP Hazard and
Operability Study
HSE Health, Safety
and Environment
HVAC Heating,
Ventilation and Air Conditioning
IR Ionised
Radiation
ISO International
Standards Organisation
kW Kilowatt
LFL Lower
Flammable Limit
MAE Major Accident
Event
MODU Mobile Offshore Drilling Unit
MTBF Mean Time
Between Failures
MTTR Mean Time to
Repair
NFPA National Fire
Protection Association
OIM Offshore
Installation Manager
PA Public Address
PES Programmable
Electronic System
PIC Person in
Charge
PSD Process Shut
Down
PTW Permit to Work
P(SL)A Petroleum
(Submerged Lands) Act
QA Quality
Assurance
SC Safety Case
SCSSV Sub-Surface
Safety Valve
SIL Safety
Integrity Level
SOLAS Safety of
Life at Sea
SMS Safety
Management System
UKOOA United Kingdom
Offshore Operators Association
UPS
Uninterruptible Power Supply
UV Ultra Violet
REFERENCE
DOCUMENTS
DISR
- Guidelines for Preparation and Submission
of Safety Cases: Section 5, General Safety
Guidelines, 1995.
UK HSE/HSC
- Guidance on Design, Construction and
Certification of Offshore Installations – UK HSE
1990.
- Prevention of Fire and Explosion, and
Emergency Response on Offshore Installations –
Guidance by UK
HSC, 1995.
NORWEGIAN
PETROLEUM DIRECTORATE (NPD)
- Guidelines to regulations relating to
safety and communication systems. Issued by the
Norwegian
Petroleum Directorate February 1992.
AMERICAN PETROLEUM
INSTITUTE
- RP14C: Recommended Practice for Analysis,
Design, Installation and Testing of Basic
Surface Safety
Systems on Offshore Production Platforms, Sixth Edition, March 1998.
- RP14G: Recommended Practice for Fire
Prevention and Control on Open Type Offshore
Production
Platforms, Third Edition, December 1993.
INSTITUTE OF PETROLEUM
- Model Code of Safe Practice for the
Petroleum Industry, Part 8: Drilling and Production
Safety Code for
Operations Offshore, Third Edition, 1991.
UKOOA
- Instrument Based Protective Systems, 1995.
- Management of Safety-Critical Elements,
1996.
IMO
- SOLAS Consolidated Edition, 1974-1998.
- MODU Code, 1989.
IEC/AS
- IEC/AS61508, Parts 1-7: Functional Safety
of Electrical/Electronic/Programmable
Electronic Safety
Related Systems.
- IEC61511, Parts 1-3: Functional Safety
Instrumented Systems for the Process Industry
Sector.
PART YWO
PROJECT DESCRIPTION
No comments:
Post a Comment