Petrofac

Gas Dehydration

SECTION 13
SHUTDOWN SYSTEMS AND ESDV TESTING

Introduction

Fire and Gas Detection Systems

2.1

Fire and Gas/ESD Interfaces

2.2

Fire Detection

2.3

Gas Detection

Emergency Shutdown Levels

3.1

Level 1 Unit Control/Unit Shutdown

3.2

Level 2 Process Shutdown/Surface Platform Shutdown (SPS)

3.3

Level 3 Process Shutdown with Depressurisation/Blowdown

3.4

Level 4 Power Outage/Total Platform Shutdown (TPS)

3.5

High Integrity Protection Systems

Emergency Shutdown Valve Testing

4.1

General Requirement

4.2

Leakage Acceptance Criteria

4.3

Records

Table
12.1

Colour Code

Figures
13.1

Overall Platform Shutdown Block Diagram

13.2

ESD Block Diagram

13.3

Smoke Detector

13.4

Crude Export

13.5

Emergency Pipeline Valve Regulations 1989 3-monthly Inspection Record

13.6

Emergency Pipeline Valve Regulations 1989 6-monthly Partial Closure

Test Record

13.7

Emergency Pipeline Valve Regulations 1989 6-monthly Full Closure Test

Record

Training Services

Page 1 of 11

Petrofac 2010

Petrofac

Gas Dehydration
1

INTRODUCTION
In the event of an emergency arising on an offshore installation, emergency
shutdown (ESD) systems are installed in order to protect personnel, plant
and equipment.
The ESD system is designed to provide a rapid means of:

Shutting down, isolating and depressurising hydrocarbon processing

systems

Shutting down non-essential utility systems

Isolating the platform both from the reservoir and from import/export
pipelines

Subsequent actions following ESD situations are to alert personnel via the
public address system, and to provide automatic startup of platform
protection equipment such as firepumps.
Once an ESD sequence has been initiated and completed, the platform will
be in as safe a condition as possible and essential systems will be available
so that personnel can tackle the emergency adequately.
The platform ESD system normally interfaces with the following equipment
in order to bring it to a safe and steady condition swiftly and effectively:

Fire and gas system

Instrument marshalling cabinet (IMC)

Platform control system (PCS)

Subsea control system (SCS)

Computer aided process operations (CAPO)

FIRE AND GAS DETECTION SYSTEMS

Fixed fire and gas detection systems are installed on offshore installations
in order to provide continuous automatic monitoring of the platform work
areas, process/utility systems, accommodation and other areas.
They are designed to indicate both audibly and visually, the presence of:

A fire in any of the monitored areas on the installation

An accumulation of flammable gas in any part of the installation

monitored by the system

The system will indicate the presence of fire and/or gas both locally at
satellite panels and centrally at the main point of control, typically the
central control room.

Training Services

Page 2 of 11

Petrofac 2010

Petrofac

Gas Dehydration
2.1

Fire and Gas/ESD Interfaces

As well as triggering protection systems such as water sprinklers or deluge
systems, an alarm condition arising from confirmed fire or high gas in the
detection system is connected to the platform ESD system, and therefore
initiates the necessary level of shutdown required.
Typical examples of shutdown system hierarchy are shown in Figures 13.1
and 13.2 which show the levels at which fire and gas actions tie into the
associated ESD systems. In both cases it can be seen that they connect at
the higher levels of shutdown.
Normally fire and gas/ESD actions stop and depressurise the oil and gas
process plants, close the downhole safety valves on the various wells, and
isolate flowlines which feed in from external sources.

2.2

Fire Detection
Fire detectors are installed to provide the necessary alarms upon detection
of flame, heat or smoke.
Various types of detectors are used, among them being temperature sensing
elements (TSE) or infrared (IR) flame detectors.
Thermal detectors are colour coded (refer to the Table 13.1) to indicate the
temperature at which they operate eg 60C, 140F - yellow, up to 385C,
725F -black dot on orange. Should a fire occur in an area, the heat
generated causes a set of contacts to close due to differing coefficients of
linear expansion.
Table 13.1

Colour Code

Temperature Settings

Colour Code

60C 140F

Yellow

88C 190F

White

108C 225F

Black Dot on White

163C 325F

Red

232C 450F

Green

316C 600F

Orange

385C 725F

Black Dot on Orange

Training Services

Page 3 of 11

Petrofac 2010

Petrofac

Gas Dehydration

Smoke detectors use ionisation of the air in inner and outer chambers to
detect smoke (refer to Figure 13.3). The outer sampling chamber is open to
the atmosphere, allowing smoke to enter, and is separated from the inner
reference chamber by a perforated intermediate electrode. The air in both
chambers is ionised by alpha radiation from a radioactive source mounted
within the inner chamber. Under normal conditions ie no smoke, a
regulated voltage causes a small current to pass through the ionised air and
an electrode is charged to a balanced potential by the ionisation current.
When smoke enters the chambers, a low level of ionisation is achieved,
resulting in a reduced current flow which leads to a change in the balanced
potential at the electrode, triggering detection. An example of a smoke
detector is shown in Figure 13.3.
2.3

Gas Detection
Gas detection systems are designed to give an alarm and initiate protective
action when gases exist in dangerous concentrations in various areas of the
installation.
Detectors located at strategic locations, sense the level of gas
concentration and transmit a corresponding signal to dedicated control
modules located on the fire and gas panels in the control rooms.
Control modules normally have two alarm levels, set at percentages of the
lower explosive limit (LEL), typically 20% and 60%.
100% LEL is the point at which there is sufficient gas in a mixture of gas
and air to support combustion.

NB

Gas detectors are usually distributed at the following locations:

In hazardous areas where there is a potential source of gas leak

Non-hazardous areas (no potential source of gas leak) but where gas
could accumulate through pressurisation failure

Ventilation inlet and outlet ducts

Gas turbine enclosures and void areas under gas compressors etc

As the concentration of gas in an area increases it is sensed by the detector

which consists of a pair of sensing elements, one of which is rendered
insensitive to gas (the reference element). When exposed to flammable gas
the sensing element produces heat, raising its temperature and electrical
resistance.
Both elements are connected to a Wheatstone bridge circuit, which in turn
generates the alarm signal.
The reference element provides automatic compensation for changes in
ambient temperature, humidity and pressure.

Training Services

Page 4 of 11

Petrofac 2010

Petrofac

Gas Dehydration
3

EMERGENCY SHUTDOWN LEVELS

An ESD system is primarily designed to isolate the overall process system
into sections, and depending on the level of shutdown, may cause
depressurisation of the process plant.
Shutdown of some of the utility systems may also be initiated.
Process system isolation is effected by closure of block valves located at
strategic positions within the process plants primarily around significant
equipment items.
ESD system logic is normally distributed on a modular basis usually from
panels located within respective module local equipment rooms (LERs).
A central panel(s) detailing all plant status is located in the central control
room to enable monitoring/control from a central source.
Typically there are up to five levels of shutdown classified as follows:

3.1

Level 1 - Unit Control/Unit Shutdown

A unit shutdown can be effected either manually or automatically by
process detectors mounted in the field. This level will shut down specific
items or units if abnormal conditions such as pressure, temperature and
flow are detected local to each item.
Depending upon which unit is affected there can be a knock-on or domino
effect extending to other sections of the plant.

3.2

Level 2 - Process Shutdown/Surface Platform Shutdown (SPS)

A process shutdown can be initiated manually or automatically as a result of
abnormal conditions or loss of essential specific units.
It may also be due to abnormal conditions in systems that are not directly
part of the process system, such as instrument air or fuel supply.
A process shutdown stops all oil and gas production and isolates the systems
into sections which remain at operating pressure - sometimes referred to as
a stop and hold. Wells are shut in, pumps and compressors are stopped.
Usually utilities are unaffected, but where turbines for example are running
on fuel gas, they would switch over to diesel fuel.
A surface platform shutdown is initiated typically by the following actions:

Training Services

Page 5 of 11

Petrofac 2010

Petrofac

Gas Dehydration

Confirmed fire or gas

Manual pushbuttons

Loss of ac power

High levels in separator or flare drums

Low instrument air pressure

Wellhead fusible loop

Manual shutdown pushbuttons which are located

installation at strategic points on the various levels

around

the

The wellhead fusible loop arrangement comprises a flexible tubing manifold

which is looped around the wellhead area and charged with air. A pressure
switch will activate the shutdown upon detecting low pressure.
In the event of a fire burning through the pressurised loop the low pressure
trip acts as a backup signal to the fire and gas system.
3.3

Level 3 - Process Shutdown with Depressurisation/Blowdown

This level of shutdown can be initiated:

Manually from pushbuttons located at strategic locations

Automatically from a higher level of shutdown or

Usually by an input from the fire and gas protection system

A trip and depressure stops all gas and oil production, isolates the process
system into sections and then automatically depressurises them to flare.
Vessels will depressurise at differing controlled rates depending on the
product that they contain and the temperature and pressures at which they
operate.
Flare systems are designed to accept depressurisation of the entire process
system simultaneously.
Depending on where the fire or gas is detected, riser isolation valves and/or
subsea isolation valves may be directed to close.
In certain situations it may be necessary to halt or delay the blowdown
action, for example if the flare system was damaged. Therefore on some
installations a blowdown cancel facility exists which allows a 15 minute
delay once it has been initiated.
During this time blowdown is inoperative unless overridden by a manual
action or by confirmed fire in the process area, in which case the blowdown
is operated immediately. Use of such a facility obviously requires careful
assessment of the situation before initiation.

Training Services

Page 6 of 11

Petrofac 2010

Petrofac

Gas Dehydration
3.4

Level 4 - Power Outage/Total Platform Shutdown (TPS)

This level of shutdown is typically initiated either manually or automatically
by a total loss of power.
This level of shutdown will stop main and emergency power generation,
isolate all power distribution (other than that required for post-level
operations) and initiate the lower levels of shutdown.
TPS can be initiated by manual pushbuttons, again typically located as
follows:

Central control room

OIMs lifeboat

Helideck

Upon initiation, the system activates various shutdown functions via the
hierarchical structure of the SPS and US functions.
This is the highest level of shutdown and will shut down all items of
equipment except the emergency generator.
TPS level allows a permissive to the uninterruptible power supply (UPS)
shutdown.
UPS shutdown pushbuttons are normally located in the same areas as the
TPS pushbuttons.
The action of initiating a UPS shutdown will isolate all UPS batteries and
shut down the emergency generator at the same time.
3.5

High Integrity Protection Systems

High integrity protection systems (HIPS) provide an alternative (electronic)
means of protection and act as a backup to the main ESD system. They use
independent process sensors and pilot solenoid valves in order to drive final
control elements.
Normally HIPS employ triplicated field devices to sense extreme out of limit
process conditions using two-out-of-three (2OO3) voting solid state logic
circuitry.
HIPS solid state circuitry provides high-speed response between field input
and output signals in the range of 100 milliseconds.
An example of using HIPS for both high and low pressure protection on a
typical crude oil export system can be seen in Figure 13.4.

Training Services

Page 7 of 11

Petrofac 2010

Petrofac

Gas Dehydration
4

EMERGENCY SHUTDOWN VALVE TESTING

4.1

General Requirement
The essence of the Emergency Pipeline Valve Regulations SI 1989 1029 is the
requirement to ensure that an ESDV is installed in the optimum location on
all pipeline risers that have internal diameters 40mm and above, and
achieve maximum reliability. Thus the ESDV location, design, procurement,
testing, inspection, maintenance and operation should ensure that the ESDV
will at all times operate on demand or fail-safe close, so minimising the
possibility of an uncontrolled release of the pipeline inventory inboard of
the ESDV.
Once closed the ESDV should remain closed until the safety of the platform
is assured and the control system is operated to open the valve. ESDVs
should be capable of stopping the flow of substance within the pipeline,
disregarding any minor leakage past the ESDV which cannot represent a
threat to safety.

4.2

ESDV System Failures

ESDV reliability is demonstrated by frequent and successful testing. Any test
failure is serious as it indicates that, at some time prior to the failed test,
life may have been put at risk.
If at any time the ESDV is unable to close, the pipeline should not be
operated until the fault has been rectified.

4.3

Multiple ESDVs
The ESDV must be located above the highest wave crest which may
reasonably be anticipated - such that the distance between the bottom of
the riser and the ESDV is minimised. Thus where owners propose the use of
two or more ESDVs, only one ESDV can fulfil the above requirement and so
falls within the scope of SI 1989/1029. This ESDV is therefore considered as
the primary ESDV.

4.4

ESDV Types
ESDVs should be rapid acting isolation valves suitable for remote and local
operation. ESDVs should be capable of closing against maximum differential
pipeline pressure and under maximum flow conditions.
The ESDVs should, in the case of piggable pipeline systems, also be piggable
and therefore ball or gate valves will be suitable types.
Choice of ESDV type should primarily reflect the need to achieve both
maximum reliability and rapid controlled closure. ESDV selection should also
consider valve characteristics such as leak tightness and maintainability.
ESDVs should be matched to the actuator such that the operator can
demonstrate that the actuator, drive train, and valve stem are adequately
sized so as to close the ESDV under all foreseeable operating conditions.

Training Services

Page 8 of 11

Petrofac 2010

Petrofac

Gas Dehydration
4.5

Valve Operation

4.5.1 Local Closure

Regulations require in effect that the ESDV is capable of local closure.
This capability is intended to allow immediate valve closure by a person
who sees a hazard which may not be detected and/or transmitted by
instrumentation to the control room or ESD system, or where detection may
not be fast enough.
4.5.2 ESDV Reopening
Regulations only permit ESDVs to be reopened, once operated, if the reason
for the ESDV operation has been established to the satisfaction of the
Offshore Installation Manager (OIM) and he has authorised its reopening.
This requirement does not extend to reopening after closing for testing
purposes.
With the sole exception of testing, ESDVs should only be used for blocking
flow. They shall not be used for controlling flow during precommissioning,
commissioning, decommissioning, and routine pigging operations.
After an ESDV has closed, either via the ESD system or the local control
panel, the OIM should ensure that the Manager of every other Offshore
Installation to which the pipeline is connected and the pipeline control
centre is notified of the ESDV closure. The ESDV shall not be reopened until
the reasons for closure have been established to the satisfaction of the OIM
and until every other OIM has been notified.
4.6

Inspection and Testing

The inspection and testing requirements are designed to demonstrate that
the required reliability is being achieved.

4.6.1 Inspection
Regulations require that at intervals not exceeding 3 months, valves and
actuators shall be subject to an inspection for the purpose of identifying
external leaks, external damage, and external corrosion.
Each inspection record shall be signed by the inspection personnel and
countersigned by the OIM or a person nominated by him for such purposes.
The person should be a senior member of staff. A typical record sheet is
shown in Figure 13.5.

Training Services

Page 9 of 11

Petrofac 2010

Petrofac

Gas Dehydration
4.6.2 Testing

The testing philosophy reflects the importance of demonstrating that the

ESDV is capable of fully closing. For this, it is not considered essential that
full closures are required for every test as generally the loads to initiate
movement of the ball (or gate) are higher than those required to continue
its closure. Thus regulations require a minimum of two partial closures per
year (not exceeding 6 month intervals) and a full closure test to be
performed not less than 2 months or more than 4 months after each partial
closure test.
Regulation 5 requires that the ESDV should always be capable of blocking
flow. To demonstrate this the operator should consider conducting a seal
leak test at least once a year. The seal leak test will require the ESDV to be
fully closed and the pressure on the inboard side of the valve to be
completely vented.
All tests should be subject to operator approved procedures and during the
test period all precautions should be taken to reduce any hazards to a
minimum, including conducting the test as quickly and as safely as possible.
4.6.3 Partial Closure Tests
Refer to Figure 13.6
Regulations require that partial closure/reopening tests are conducted by
persons standing by the ESDV, ie using the local control panel.
The extent of partial closure should be such that the ESDV movement is
clearly visible.
4.6.4 Full Closure Tests
Refer to Figure 13.7
Regulations require that full closure/reopening tests are completed using
the Offshore Installation ESD system. During such tests it is recommended
that the performance of the ESDV actuator and control system is
demonstrated; eg time to close, time to open, differential pressure and
torque/power levels to actuate the ESDV.
On at least alternate full closures, it is recommended that an internal seal
leak test is also conducted. A differential pressure should be applied across
the ESDV equal to the prevailing pipeline operating pressure, by
depressurisation of the topside pipework inboard of the ESDV.
For liquid lines measurement of flowrates will be an acceptable method of
leak rate detection. For gas lines measurement of pressure changes will
suffice.

Training Services

Page 10 of 11

Petrofac 2010

Petrofac

Gas Dehydration
4.6.5 Failure to Close

In the event of a full closure test failure, or if it is not safe to conduct a full
closure test, then the pipeline should not be operated until the fault has
been rectified.
4.7

Leakage Acceptance Criteria

4.7.1 Internal Body Seal Leakage

The following maximum leakage rates are suggested:

Oil pipelines - 6kg/minute

Gas pipelines - 1 standard m3/minute

Leakage rates in excess of the above criteria are considered to contravene

Regulation 5(1). In such an event action should be taken which would result
in:

Altering the pipeline pressure until the allowable leakage rates are not
exceeded, or

Non-operation of the pipeline until the ESDV is repaired

4.7.2 External Leakage

Regulation 8(1) requires the ESDV, the actuator, and accumulators to be
inspected for external leakage, at intervals not exceeding 3 months.
Leakage from ESDVs should only be tolerated when assessed as being
insignificant.
Where leakage from an actuator and/or accumulators compromise the failsafe closure of the ESDV they should immediately be repaired.
4.8

Records
Under Regulation 8(4) a copy of the records and associated documents must
be kept on the offshore installation for a minimum of 2 years from the date
on which the event associated with the record occurred.
A copy must also be maintained for a minimum of 5 years at a principal
place of business in the United Kingdom of the owner of the pipeline.
All records and documents should be preserved in a manner which prevents
their deterioration and provides ease of access.

Training Services

Page 11 of 11

Petrofac 2010

Petrofac

Training Services

Petrofac 2010

SECTION 13

SHUTDOWN SYSTEMS AND ESDV TESTING

Figures
13.1

Process and Fire/Gas

13.2

ESD Cause and Effects Charts

13.3

ESD Block Diagram

13.3b Ionised Smoke Detectors

13.4

Gas Export Pipeline

Petrofac Training Services / June 2010

Production Operations

Figure 13.1a

Petrofac Training Services / June 2010

Fire and Gas Cause and Effects Chart

Production Operations

Typical Process Cause and Effects Chart

Fig 13.1b

Petrofac Training Services / June 2010

Typical Process and Fire/Gas Cause and Effects Char

Level 4
Abandon Platform
Pushbuttons at
Lifeboats and Helideck

Level 3
Fire and Gas Shutdown

Level 2
Surface Process Shutdown

Level 1
Partial Process Shutdown

Fig 13.2 Typical ESD Levels

Petrofac Training Services / June 2010

 Petrofac Training Services / June 2010

Fig 13b Ionised Smoke Detector

Petrofac Training Services / June 2010

Production Operations

Figure 13.4 Gas Export Pipeline

Petrofac Training Services / June 2010