Pipelines LOC

8/10/2019 Pipelines LOC

1/28


2/28

Location of Hazard

HS1 - Rigid Riser

HS2 - Flexible and comliant Risers

HS3 - Pipeline - Tie-in spools, Seabed pipeline, tees

HS4 - Riser Emergency shutdown valves (ESDV)

HS5 - Subsea Isolation Valves (SSIVs)

HS6 - Pig Trap

Subsea systems: manifolds, well flowlines, process equipment

Initiators

G1 - External Corrosion, coating damage, cathodic protection failure

G2 - Internal Corrosion, water, wax, scale

G3 - Erosion, sand, scale

G4 - Overpressure

G5 - High Temperature

G6 - Low Temperature Joule Thomson effect

G7 - Fatigue / vibration

G8 - Fire [Section 2.3.3]

G9 - Fitting failure

G10 - Incorrect installation or fabrication

Operator error [Section 11]

G11 - Inadequate Training [Section 11]

G12 - Inadequate competency [Section 11]

G13 - Violation [Section 11]


3/28


4/28

F4 - Equipment layout

F5 - Company standards / competence

F6 - Corrosion / erosion allowance

F7 - Operations and maintenance procedures

F8 - Safety Integrity Level (SIL) standards

F9 - Equipment selection

Riser jet fire effects

Risk Management Measures

F14 - Inherent Safety

fully rated pipelines & risers

riser and pipeline routing

Riser ESDV locations

Concrete ballast + protection coating

Pipe protection trenching burial rock dump covers

Fire protection

Damage Prevention

F15 - Relief systems

F16 - High Integrity Pressure Protection Systems (HIPPS)

F17 - Shutdown systems ESD system ESDVs

F18 - Alarms / trips

F19 - Cathodic protection anodes impressed current systems

F20 - operational procedures - control of erosion / internal corrosion, temperature during

blowdown, pigging, chemical inhibition


5/28

F21 - Competent personnel

F22 - Monitoring & Audit systems

F23 - Isolation and permit to work controls

F24 - Intelligent pigging

F25 - Wall thickness monitoring

F26 - Inhibition performance monitoring

F27 - Fire protection passive/active

F28 - Mooring controls

F30 - Strength & leak testing

F31 - Non-destructive testing (NDT) inspection

Performance Standards

Temperature & Pressure Rating

Material specification: strength, corrosion resistance, impact resistance

Cathodic protection (CP) potential

Remaining fatigue life

Frequency and type of inspection

Pressure relief arrangements, set point, capacity

Reliability of protective systems

Supports: number, locations, adequacy

Integrity of pig trap closures and seals

Fire protection, risers, ESDVs

Valves: closure mode, seal type, leak rate, fire resistance


6/28

HS0 The Pipeline System

4. Relevant Legislation, Approved Codes of Practice (ACOPs) and Guidance

includes:

Pipelines Safety Regulations 1996

A Guide to the Pipelines Safety Regulations 1996 (HSE Books, L82, ISBN

9780717611829)

Offshore Installations (Safety Case) Regulations 2005

A guide to the Offshore Installations (Safety Case) Regulations 2005 (HSE Books,

L30, ISBN 9780717661848)

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)

Regulations 1995

Prevention of fire and explosion, and emergency response on offshore installations

(HSE books, L65, ISBN 9780717613861)

Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs

9, 14, 16, 95, 115

Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4,

5 and 12

The Health and Safety at Work etc. Act 1974 (Application outsideGreat Britain) Order

2001

1. Duties

The pipeline operator has responsibility for the entire length of the pipeline (including risers,

pig traps etc and risers on other operators installations). Pipeline operators should be

identified and limits of responsibility should be defined in the safety case. The pipeline

operator is responsible for starting up the pipeline following a shutdown, and for procedures

and checks that are made before start up. The installation dutyholder should ensure that

the pipeline operator carries out these duties and should co-operate with the pipeline

operator. The safety case should state these responsibilities.

2. Pipelines Hazard Identification and Risk Assessment

The description of the pipeline system should address all hazards from and to pipelines and

their contents.


7/28

Hazard identification should include pipeline systems aspects such as management

interfaces between installations, inter-platform control, leak detection and pipelines

emergency procedures.

All hazards that could result in a loss of pipeline integrity at any location within the hazard

limit distance should be identified and included in the overall risk assessment for the

installation. The hazard limit distance is that distance from the installation beyond which a

pipeline release could not conceivably be a hazard to the installation.

The safety case should consider hazards to installations close to pipelines and risers or in

combined operations: jack-ups, flotels, crane vessels, diving support vessels. It should also

identify the hazards from or to any pipeline attached to subsea wells or manifolds that could

endanger drilling rigs or diving support vessels.

The safety case should evaluate the risks and the results should be included in the overall

risk assessment for the installation. The proposed hazard minimisation and risk reduction

measures should be consistent with the overall risk assessment.

3. Pipelines Description

Within the installation description the duty holder should include all interconnecting facilities

i.e. pipelines and subsea facilities, including:

a description or diagram of connections to pipeline systems and of any pipeline withthe potential to cause a major accident;

dutyholders, owners and operators of connected installations and pipelines and

interface points;

fluids, pipeline sizes, directions, and approximate flow rates;

subsea valves, tees, wyes, remotely operable valves, etc.;

all potential pressurising sources: subsea wells, other pipelines connected subsea,pumps, compressors

process flow diagrams of subsea production facilities,

special subsea operations such as hot water circulation, dual (or multi) purpose

lines, round-trip pigging, liquid/gas separation, pumping/compression facilities;

a description of the pipeline over-pressure protection system (see below);

a description of the leak detection system (see below); and


8/28

pipeline pigging philosophy and practice: scale and wax removal, biociding, inhibitor

distribution, intelligent pigging, liquids removal, semi-intelligent pigging, tethered riser

inspection etc

Specific pipeline data in the safety case should include:

pipe diameter;

wall thickness (including thicknesses for different parts of the pipeline where these

vary), stating any allowance for corrosion;

the pipeline to platform approach route;

the riser route including the topsides part of it and any demarcation points;

the riser ESD valve location(s) and any subsea isolation valves;

the fluids in the pipeline;

pipeline inventory at maximum allowable operating pressure between the pipeline

extremities (i.e. from installation to installation, including any branches connected

subsea);

design configurations: rigid pipe, flexible, bundle, piggy back, internal cladding,

weight coating, with key dimensions etc

construction methods used: conventional lay, reeled, towed, pipe-in-pipe, riser

caisson (wet/dry), J-tube etc

the standard or code used to design the pipeline;

the current safe operating pressure;

the safe operating temperature range;

the grade(s) of steel and materials of construction of the pipeline, riser and topsides

pipework, sour/non-sour service rating, types of corrosion resistant alloys

corrosion management arrangements, including monitoring and control of corrosion,internally and externally, reliability of corrosion inhibition, cathodic protection etc

systems, sand and scale management, inspection arrangements

any other element of the design or operation of the pipeline which is critical to the

safety of the installation.

4. Design of the Pipeline


9/28

The duty holder and pipeline operator should ensure that the pipeline riser has been

designed and constructed and is operated safely in accordance with recognised standards

and guidance.

Where a recognised standard/code of practice has not been employed, the duty holder

should provide justification on a case-by-case basis that the applied standard or code or

method is appropriate.

5. Design for Extreme Weather

Most North Seainstallations are designed to withstand a wave which occurs on average

every 100 years or every 50 years. However structural design standards now require

design for a wave that occurs every 10,000 years. Further information is available via this

link: http://www.hse.gov.uk/offshore/extremeweather.htm.

The 10,000 year wave level can rise well above the current elevations of riser ESD valves.Floating installations being restrained by moorings and inertia can be likewise affected. The

safety case should demonstrate that dutyholders and pipeline operators have assessed the

ability of risers, ESD valves and other facilities to survive such extreme weather.

6. Pipeline Damage Prevention

The safety case should include a description of pipeline damage prevention arrangements,

including: a list of identified hazards (e.g. dropped freight, caissons, tubulars, equipment,anchors, mooring lines, vessels, submerged flexible risers etc.); pipeline route information

issued; operational measures (no anchoring areas, vessel size limitations, approach routes,

etc); and permanent protection measures. The pipeline should be protected from third party

or construction damage caused by vessel anchors and mooring wires and chains, by pipe

lay abandon and retrieval wires, and by fishing trawls.

HSE has issued guidance on the management of anchor hazards for pipeline operators,

this is available via the following link: http://www.hse.gov.uk/pipelines/pipeline-anchor-

hazards.pdf

Anchoring procedures for standby vessels, supply vessels, diving support vessels, heavy

lift crane vessels, flotels, drilling rigs, etc should be included in the safety case. Risks come

from dropped objects such as freight being loaded and from vessel collisions with risers,

and from dropped objects such as caissons. Pipelines and risers should be routed safely or

protected. Procedures should limit vessel sizes and types, weather conditions for loading,etc.


10/28

Pipelines located under platform cranes should be protected from dropped freight

containers, tubulars, etc. Procedures should limit the types and weights of freight to be

handled so as to not exceed the design capabilities of the pipeline protection.

Safety cases for non-production installations should include a description of arrangements

for identifying the routes and locations of pipelines, wells and other subsea equipment and

assessing the risks that they pose to the installation (SCR05 Schedule 3 para 12).

Particulars of the plant and arrangements to minimise the effects of damage to subsea

equipment by drilling equipment should be included (SCR05 Schedule 3 para 6).

Combined operations notifications should include a suitable diagram(s) showing the

location of risers, pipelines and other subsea equipment in relation to the layout of the

combined operation. Safe operating limits of the installations, mooring lines, crane radii etc

should also be provided (A guide to the Offshore Installations (Safety Case) Regulations

2005 L30 para 295 page 69).

Jack-up spud cans making deep holes in the seabed into which a pipeline can slip should

be considered within the safety case as appropriate.

7. Modifications and Repairs

The safety case should include a description of procedures to be followed for modifications

and repairs, including hazard identification, risk assessment, notifications, isolation

arrangements (topsides and subsea), standards of work inspection and testing.

A description should be included of past modifications and repairs to the pipelines that

could affect the safety case hazard identification and risk assessment: i.e. where

modifications fall below the standard of the rest of the pipeline.

8. Pipeline Over-pressure Protection

The safety case should describe the type and operation of any pipeline over-pressureprotection

Pressure breaks should be examined critically. The primary protection should be by design

for the highest foreseeable pressure (inherently safe design). Secondary protection may

include relief valves, High Integrity Pressure Protection System (HIPPS) (section

2.3.1.F16), etc.


11/28

The well head shut-in pressure of a subsea well connected to the installation should be at

or below the safe operating pressure of the relevant riser. The maximum output pressure or

the high pressure shut down set points for pumps and compressors and other pressure

sources connected to the pipeline should be at or less than the riser safe operating

pressure. The maximum allowable operating pressures (or safe operating pressure) of

pipelines connected subsea to a riser should be so as to prevent overpressurisation from or

of a third party pipeline or installation.

The considerations mentioned above must be satisfied, using a suitable HIPPS system or

similar if necessary. See Safety Instrumented Systems for the Overpressure Protection of

Pipeline Risers, SPC/Tech/ED/31 at

http://www.hse.gov.uk/foi/internalops/hid/spc/spctED31.htm. SPC/Tech/ED/31 describes

various levels of pipeline and riser design, additional protection measures, HIPPS design,

operational testing and maintenance.

9. Pipeline Safety Systems

The safety case should include a hazard identification that identifies the critical safety

system components. The duty holder should describe all the safety systems in place for

safe operation, safety of personnel and prevention of hazard escalation. The performance

standards required of these systems should be described, stating for example the action

and shutdown levels. These components should be tested and maintained. The safety

systems should cover the greatest and most frequent hazards, and they should provide the

fastest response and warning of hazards. Emergency procedures are intended to cover the

rest.

10. Pipeline Emergency Shut-Down Functions

The safety case should describe the emergency shut-down facilities. The levels of shut-

down should be clearly defined. The level at which the riser ESD valves are closed should

be stated. ESD system data (e.g. riser valve closure) transmitted to or from connected

installations should be described. If SSIVs are installed, their mode of operation should be

described: i.e. automatic or manual.

11. Connection to Pipeline Systems

When communication data or control links between installations connected by pipeline are

lost there are usually temporary manual procedures after which the pipeline should be shut

down. In some cases remotely controlled action can be taken under major accident


12/28

conditions by connected installations. The sequence and timing of such actions, including

emergency shut-down arrangements should be described in the safety case.

12. Pipeline Leak Detection

The safety case should describe the type and operation of the pipeline leak detection

system, including data and control functions monitored, monitoring locations (e.g. at each

end of the pipeline) and the alarm and shutdown set points for these functions.

13. Emergency Response

The safety case should describe emergency arrangements, which should cover all

identified hazards and interfaces and roles of other operators (at other installations) for the

safety of the installation and of other installations.

14. Integrity Management

The safety case should confirm that the inspection, maintenance and integrity management

arrangements in place for the pipeline include the entire length of the pipeline.

A description should be included in the safety case of the inspection assessment and

maintenance arrangements. This should summarise: the methods of inspection of the

pipelines and risers; the management system for carrying out the inspection work; and

decision making processes used to determine the scope and programme for remedial work

or operations.

A description should be included in the safety case of procedures to satisfy the operation,

maintenance and testing requirements for the emergency shutdown (ESD) valves,

demonstrating that seat leakage is measured, assessed and remedial action taken if

required.

15. Subsea Operations

The safety case should describe pipeline and control connections between the installation

and subsea manifolds wells and other installations.

The safety case should contain a summary description of procedures for simultaneous

production (if applicable) and diving, or other pipeline works or maintenance, on a pipeline,

at a subsea manifold or well connected by pipeline to the installation. This should detail the

measures in place to control any pipeline hazards that could affect the diving support

vessel, its crew or divers, the installation or another installation.


13/28

HS1 Rigid Risers

16. Pipeline Operations

The duty holder should state the expected frequency and purposes of pigging throughout

the field life, covering routine scale, wax, water/liquids removal, inhibitor / biocide

distribution, to intelligent pigging inspection.

The duty holder should summarise the inspection scheme for each part of the pipeline,

describing the techniques and frequencies used and justifying their adequacy.

The duty holder should assess the effects of leaking seats on riser ESD valves and

appropriate action to take should be documented. This should be covered in the safety

case as the summary of a study assessing the effects of the maximum allowable seat

leakage.

The design and operation should take account of safe operating temperature limits to avoid

hydrates, condensates in gas systems, wax, ice, steel embrittlement, failure of blowdownsystems and failure of polymers in flexible risers and pipelines.

Process upset conditions include slugs, surges and emergency shut-downs. Some system

designs rely upon the processes remaining within certain parameters, and suitable controls

must operate effectively to prevent excursions.

17. Decommissioning and Abandonment

Taking a pipeline out of use involves cleaning out of hazardous substances from pipelines,

risers and topsides, and ensuring safe disconnection from live plant, and decommissioning

or removal of facilities as required. This involves ensuring the safety of divers and that of

other personnel involved with platform abandonment, and leaving the facilities in a safe

state. The safety case should address these issues as appropriate.

Riser integrity has to be assured. The following applies to rigid risers and to the topsides

elements connected to flexible risers. The safety case should include information relating to

risers, from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if

fitted) as follows.

Approximate route, showing relevant module decks, bulkheads and structural

members, riser supports / guides;


14/28

ESDV location;

Mechanical joints, e.g. flanged and insulation joints;

Splash zone corrosion resistant cladding;

Any branches outboard of the ESDV as far as their respective isolation valve(s) and

their nominal diameter; and

Fire, explosion, impact or other protection provided for the riser and ESDV.

1. Riser Routing and Design

The safety case should, with the aid of diagrams, describe the riser routing in relation to the

topsides layout, installation structure, pipeline to installation approaches and field layout.

This enables assessment of the full impact of layout versus topsides and vessel activities.

The riser should, where possible, be routed away from fire, explosion and impact hazards.

The riser route should be chosen so as where possible to obtain a good ESDV location and

pig trap arrangement (such that the ESDV is located as low as reasonably practicable

along the length of the riser), such that, subject to other design constraints, the ESDV is

close to the top end of the vertical part of the riser.

Riser routes are sometimes chosen with little consideration of the ESDV location, this may

be because subsea and topsides design are considered separately. The constraints of the

topsides layout can result in a poor ESDV location, with a horizontal section of outboard

riser below deck that cannot be isolated by the ESDV.

Caisson risers should be terminated on the topside of the installation as low as is

reasonably practicable, so that the ESDVs can be located as required.

Specific issues to be addressed include:

position of cranes for loading vessels;

external risers located on the prevailing weather side of the installation, (being

vulnerable to impacts from drifting vessels);

fire protection;

access for inspection, i.e. when located in caissons, J-tubes or platform legs;

gas risers in concrete platform legs, which could leak and pressurise the leg causing

it to collapse;

adequate support of the riser, especially in the wave zone;


15/28

HS2 Flexible and Compliant Risers

dead weight supports should be with an anchor flange or similar, located out of the

splash zone (for inspection).

Risers should ideally be located in-board of jacket braces or other structural members to

protect them from vessel impact. If not, there should be fenders or other means installed

which can absorb impact energy without touching the riser. Parts of risers routed inboard of

acket frames are vulnerable to impact by objects dropped from the topsides; there have

been instances of caissons falling and landing near to a riser.

Where risers are located in J-tubes (conduits) or in caissons, the J-tubes or caissons

should be sealed off at both ends and filled with inhibited water to protect the riser from

corrosion. A number of incidents have resulted from the failure to properly manage the

integrity of pipelines in J-tubes of caissons. HSE guidance Hydrocarbon Risers in

Caissons and I/J Tubes Inspection issues and become potential sources of leakage in a

fire.

Riser integrity has to be assured. The topsides parts of flexible and compliant risers are

covered in the section 2.3.2.HS1. The safety case should include information relating to

risers from the seabed to either the ESDV or the pig trap (if fitted). In particular:

the approximate route in the extreme riser and vessel configurations showing

moorings, relevant module decks, bulkheads structural members, I tubes, hangoffs,

bend restrictors, midwater arches, seabed connections;

ESDV location;

mechanical joints, e.g. flanged joints, hang offs;

any branches outboard of the ESDV as far as their respective isolation valve(s), and

their nominal diameter; and

fire, explosion, impact or other protection provided for the riser and ESDV.

Flexible risers are vulnerable to damage from vessels, dropped objects, fatigue overstress

and internal damage. The stress analysis described in the safety case should cover all

applicable cases. Top end connections should be configured, either by their layout or by

bend restrictors, to avoid the flexible pipe being damaged by bending at the connection.


16/28

HS3 Pipeline - Tie-in spools, Seabed Pipeline

Riser stress analysis should cover extreme static installation offsets from its station, static

wind, wave and current loading, natural frequency analysis, dynamic response to wave

frequencies (stresses and fatigue damage assessment) and dynamic transient responses.

Operators should demonstrate awareness of the fatigue lives of their flexible risers,

including in damaged condition, and the limiting sea states for the riser system.

A description of fire, explosion and impact protection should address:

passive fire protection;

explosion protection - blast walls and plated decks;

dropped object protection;

operational protection against dropped objects: avoiding lifting over risers.

In operation each flexible riser annulus should be piped separately (to avoid interaction

between risers) to a safe area to vent gas pressure. Operator inspection should includeperiodic testing of each flexible riser annulus by vacuum and positive pressure testing as

applicable, to test for and find a failed external polymer layer. Where the outer layer has

failed there should be measures to prolong the life of the outer tensile wires, fatigue

analysis to determine the remaining life of the outer tensile wires, and replacement of the

riser when required.

The safety case should take account of the pipeline within the hazard range of the

installation, including features such as:

layout of tie-ins, spool pieces, crossovers, subsea isolation valves (SSIVs), other

subsea equipment and extent of protection measures such as mattresses, rock

dump, trenching, protection covers, etc.

other pipeline(s);

no-anchoring areas;

anchor patterns and jack-up footprints for vessels normally moored in the vicinity.

All hazards that could result in a loss of pipeline integrity at any location (within the hazard

limit distance i.e. where the installation could be affected) should be identified and

included in the overall risk assessment for the installation.


17/28

HS4 Emergency Shutdown Valves (ESDV)

The safety case should assess the interaction between the installation and others linked by

pipeline(s) and the effect an interconnected pipeline system could have on the installation

or upon other installations.

1. Pipeline to Platform Approaches

The duty holder should describe, with suitable diagrams:

the layout and configuration of the plant;

the connections to any pipeline or installation; and

any wells connected or to be connected to the installation.

The plan of the location should be large enough to show any features that may be

significant in the assessment of the hazard or risk associated with the site.

The safety case should include a pipeline to installation approaches plan from the hazard

distance to the installation, showing the installation(s), pipelines (including any not

connected to the installation), direction of geographical (true /grid) and installation north, no

-anchoring areas, subsea wells, manifolds, control umbilicals, anchor patterns for vessels

normally moored in the vicinity, layout of tie-ins, spool-pieces, crossovers, SSIVs, extent of

protection measures such as mattresses, rock dump, trenching, protection covers, supports

and any significant changes in the seabed elevation.

For a flotel located over the pipelines, dropped object and anchor/ mooring line damage

should be considered. Similarly jack-up temporary moorings used during jacking

operations, construction vessels, diving support vessels, and standby vessels should be

considered.

Moorings for drilling semis (usually but not always located away from fixed platforms) and

ack-ups drilling satellite wells and exploration wells should be considered in connection

with the in-field pipeline layout. Pipelay initiation, abandon and recovery lines should be

considered.

The pipeline integrity management system should address spans, including those close to

the installation.

1. ESDV Location


18/28

The ESDV shall be located in a position:

in which it can be safely and fully inspected, maintained and tested;

such that the ESDV is above water (for normal design conditions); and

subject to the above, such that the distance along the riser from the ESDV to the

base of the riser is as short as reasonably practicable.

The duty holder should indicate the ESDV location(s) on the riser drawing. See theparagraphs in 2.3.2.HS1 on ESD valve location, explaining how the riser should be

designed for this, as well as how to locate a riser ESDV on a given riser route.

The valve should be located as low as is reasonably practicable, and so as to eliminate

unnecessary horizontal lengths of riser outboard of the ESDV. Operators often provide a

small underdeck area containing only the ESDV.

A risk assessment may seem to show that a change of location makes no difference to the

overall risk of the installation. The safety case should confirm that the ESDV has been

properly located regardless of any such risk assessment.

Locating the ESDV correctly is a higher priority than providing protection for it. Grouping a

number of ESDVs in a well protected area (against fire explosion and impact) with poor

ESDV locations is not appropriate. The priority is to correctly locate the ESDVs.

ESDV location should not be compromised because an SSIV is fitted. The SSIV serves a

different function, does not shut as fast as a topsides riser ESDV, does not isolate the

contents of the pipeline and riser between the SSIV and the riser ESDV, and is usually not

tested etc for seat leakage.

2. Riser Branches Outboard of ESD Valves

Branches outboard of ESDVs compromise the ability of the main ESDV to isolate the

installation from the pipeline. Such branches are part of the riser. The safety case should

demonstrate that any such branch in use, as a bypass for example, has been fitted with an

ESDV that meets the requirements of Schedule 3 of the Pipelines Safety Regulations. If the

branch is not in use it should be cut back and isolated permanently, as close as possible to

the main riser, or removed altogether. Valves on branches should be locked closed.

3. ESDV Fire, Explosion and Impact Protection


19/28

The duty holder should demonstrate, through description and general layout drawings, that

adequate fire, explosion and impact protection is provided for the ESDV and its actuating

mechanism. The actuator and any stored energy device (e.g. spring return or accumulator

and hydraulic piping) required for fail-safe close purposes should be protected. A

description of the protection of these items should be included in the safety case.

Risers and riser supports should be protected against fire where necessary. At locations

close to ESDVs the riser should be protected as for the ESDV against fire, explosion and

impact.

4. Fire Protection

The safety case should provide assurance that the ESDV actuator and all components

necessary for ESDV fail-safe closure will remain fully operable under anticipated fire

conditions. The pressure containing capability of the ESDV, including any out-board

maintenance valves and any flanged connections to the riser, should survive the

anticipated fire conditions.

Whilst both passive and active fire protection systems may be used, it should be noted that

passive systems (coatings, covers, etc) do not require prime movers, distribution systems

and an initiation signal, and are therefore likely to be more reliable and have higher integrity

(subject to proper inspection and maintenance) than active systems (deluge, etc).

Accordingly, active fire protection systems acting on their own may not be sufficient.

There should be fire and gas detection in the vicinity of the ESDV.

5. Explosion Protection

Explosion protection measures in place should be described in the safety case. Explosion

protection is usually best achieved by locating the ESDV well outside congested equipment

modules and away from entries to these areas, to avoid high explosion over-pressures and

damage. In many cases blast walls are provided.

6. Impact Protection

The main impacts to be considered by the safety case are:

dropped and falling objects;

missiles resulting from explosions; and

vessels/ships.


20/28

HS5 Subsea Isolation Valves (SSIVs)

Protection from impacts may be achieved by blast walls and plated decks.

The operator should carry out a study of the possible impacts, including those which could

be experienced following another incident, such as heavy machinery falling from above,

and should assess what protection is necessary.

Some of the protection may be in the form of procedural control, e.g. for crane handling,

boat approach, etc.

7. ESDV Operation and Testing

The duty holder should assess and mitigate the risks of the ESDV failing to operate on

demand; An SSIV can only partly address this risk.

The safety case should describe arrangements for periodic valve seat leakage testing and

timing of closure tests. The associated performance standards should take account of

potential escalation of an incident and be consistent with the risk assessment for the

installation.

8. Actuators and Control Panel

The duty holder should describe the types of actuators used on the ESDVs.

The ESDV, its actuator, the local control panel, and where fitted, its accumulators and any

ESDV dedicated maintenance valves, should be located close together.

SSIVs are not a mandatory requirement. However, the duty holder/pipeline operator is

expected to take account of the Cullen Report and in particular recommendation 44 to "....

demonstrate in the safety case that adequate provision has been made, including if

necessary the use of SSIVs, against hazards from risers and pipelines". The Cullen Public

Inquiry reported on the 1988 Piper Alpha disaster in which gas pipelines ruptured outboard

of the riser ESDVs. This led to major fires fed from the pipelines, which caused the total

destruction of the platform and 167 deaths.

Where the safety case identifies that riser failure can lead to a major release of

hydrocarbons, including liquids, then a SSIV should be fitted to reduce the risk to as low as

is reasonably practicable. Where an SSIV is not fitted, the safety case should justify thisdecision.


21/28

For liquids pipelines with a significant gas content a riser failure can lead to a major release

of liquid driven out by the expansion of the gas. Specialised software can quantify such a

release. A major part of a release can occur in the time taken for systems to be shut down

to depressurise the pipeline, especially where such systems are located elsewhere.

The decision as to whether or not an SSIV is to be fitted should be taken based upon an

analysis of the potential consequences and risks of a riser release, and of damage due to

escalation from another riser.

The safety case should fully assess the consequences of a failure. The cost of an SSIV

must be compared to the far greater cost if one is not fitted but is needed in an emergency.

In addition to fire/explosion risks, major pipeline releases can upset the stability/buoyancy

of floating production installations and vessels.

Where pipelines are branched into main transportation lines or third-party imports, without

an SSIV, there can be an unlimited supply of fuel into a fire. Emergency actions required by

third parties can take a considerable amount of time to achieve and tests have shown lack

of reliability; this must be factored into the assessment of whether an SSIV should be fitted.

The risk of the riser ESDV failing to operate on demand should be considered in the

assessment

Dutyholders/operators should consider combining several SSIVs into a single skid to

reduce installation costs and so make the fitting more reasonably practicable. Combining

import and export riser SSIVs can be done such that the flow goes from import pipeline to

export pipeline without going to the risers, thus reducing risks, the risers only being used for

pigging. Connection points for future pipelines can be added at negligible cost.

Pipelines to comment please? What is meant by this paragraph?

Due to the location of an SSIV, a significant inventory of hydrocarbons will be present

between the subsea valve and the top of the riser. Therefore, failure of the riser or

connected pipeline (at the installation) will result in an unavoidable discharge of

hydrocarbons under pressure, with the potential for a serious fire or vapour cloud explosion.

An SSIV cannot prevent this initial discharge from taking place and cannot protect

personnel in the open or working near the riser. Where the riser ESDV seat leaks the SSIV

cannot affect the short and medium term leakage rate in an incident. SSIVs are often only

function tested and not tested for valve seat leakage.

1. Non-return or Check Valves


22/28

On some risers a non-return valve (NRV) or check-valve may be used as a means of

isolation. Where this is the case, the safety case should justify the use of an NRV, taking

the following into consideration.

The NRV has the advantages of being a self-contained operation and of rapid closure in the

event of a pipeline rupture. Due to the closure times of actuated valves, there will be some

initial hydrocarbon discharge which will last longer than for an NRV.

An actuated SSIV has the advantage that it can be closed as a precaution in the event of a

small leak or a fire in the vicinity of the riser, whereas an NRV cannot be shut.

NRVs do not work on import lines. For export pipelines an NRV would prevent the normal

flow being reversed for operational reasons, such as for pipeline depressurisation. An NRV

makes it more difficult to pig the line, and NRVs are liable to be damaged by pigging. An

NRV may not prevent a small leak (i.e. may not give a tight seal).

Where appropriate, the safety case should demonstrate that the duty holder has

determined the exact criteria expected for the NRV operation and efficiency. NRVs may be

cheaper than SSIVs but the safety benefit is less, with the disadvantages noted above.

2. Location of an SSIV / NRV

The location of an SSIV should be determined from the balance of risks of

1. a release from the riser or pipeline inboard of the SSIV and

2. a release from the pipeline outboard of the SSIV.

SSIVs are usually located some distance away from the installation they are intended to

protect. This is necessary to reduce the risks due to any possible line failures resulting from

objects dropped from the platform, supply boats, etc. on the platform side of the valve.

The safety case should evaluate the risk of a rupture on the outboard (away from the

installation) side of the valve, in which case it is necessary to address:

gas cloud or oil pool dispersion;

protection of the pipeline; and

protection of the SSIV which can itself be an extra leak path.

In some cases an operator will wish to locate an SSIV for ease of construction - examples

are floating production installations with riser base valves, flowline bundles which arrive


23/28

close to an installation, SSIV skids serving several pipelines, spool-piece flanges being

used to avoid the cost of hyperbaric welds, etc.

The pipeline to platform approach layout should be considered carefully to ensure that each

SSIV is located on a sound risk-balancing basis, and that the overall layout addresses all

risks.

3. Description of SSIV

The duty holder should describe the SSIVs installed. There should be a description with

layout giving the location, modes of operation, type of valve and actuator and failure modes

(e.g. fail close on loss of hydraulics/signal).

The description must include the modes of closure/operation and the failure modes.

Dutyholders/Operators are sometimes reluctant to install fail-safe closed valves in case,

during a test or following a spurious failure, they close and remain jammed shut. It ishowever, of no benefit to fit an SSIV that is almost impossible to use or is functionally

locked open.

There should be fail safe modes of closure or similar in event of loss of hydraulics/other

platform signals. The system should include local energy storage (such as a spring or

hydraulic accumulator) to close the valve, and it should not rely on platform based hydraulic

or other power supply for closure in an emergency.

4. Protection

The safety case should demonstrate that the SSIV is protected from impact and snag loads

from anchor lines and fishing trawls. Usually a structure is provided for this purpose.

5. Inspection, Testing and Maintenance

The duty holder should describe the philosophy for carrying out inspection, testing and

maintenance on SSIVs and NRVs.

As with any safety system, the reliability needs to be assured, and this is normally done by

carrying out periodic tests. The duty holder should describe the extent, type and frequency

of these tests. There should be detailed procedures in place for this purpose. Some

dutyholders/operators are reluctant to carry out tests in case the valves are damaged or

cannot be opened again. Regular testing however improves the reliability of valves. Testing

should include:


24/28

HS6 Pigging Operations and Pig Traps

full (and, if desired, partial) closure;

valve seat leak tests; and

checks for confirming closure, e.g. provision of local (visual) valve position indicators

as well as the remote system indicators.

1. Design for intelligent pigging

Pipelines described in the safety case should be designed and built from end to end so that

intelligent or inspection pigging can be done. This means having a consistent internal

diameter, bends with a radius of at least 5 diameters, and providing pig launchers and

receivers of sufficient length for intelligent pigs, with sufficient space in which to load and

unload the pig traps. With subsea production systems connections should be provided for

pig launchers, or ideally there should be the facility for round trip pigging or similar: i.e. no

subsea operations required.

When a pipeline has been used for several years the question arises as to whether its

integrity can be assured. The only known method today to assure integrity is to carry out

periodic intelligent pigging runs.

Pipelines should be regularly scraped clear of water scale and wax by suitable pigging

operations as required to avoid the risk of internal corrosion. Spheres or pigs can be used

to apply inhibitor or biocide along the length of the pipeline.

Some gas pipelines are regularly cleared of liquid slugs into a slug catcher.

2. Pig traps

The safety case should demonstrate that pig traps have been suitably designed. Pig trap

closures should face outboard. Adequate protection (by double blocking of hydrocarbons,

interlocks etc) should be provided against accidental opening of closures whilst under

pressure. Pig traps should have facilities for venting, draining, purging, pressure testing,

water and nitrogen supplies and lifting aids as applicable.


25/28

Annex 1, Pipeline Reference Documents

1. Pipeline Design and Construction Standards

BS EN 14161:2011 Petroleum and Natural Gas Industries - Pipeline

Transportation Systems

BS PD 8010 Part 2:2004 Code of Practice for Pipelines. Part 2: Subsea Pipelines

DNV Offshore Standard DNV-OS-F101 Submarine Pipeline Systems 2010

ISO 13623:2009 Petroleum and Natural Gas Industries Pipeline Transportation

Systems (but see BS EN 14161)

ASME B31.4 Pipeline Transportation Systems for Liquid Hydrocarbons and Other

Liquids

ASME B31.8 Gas Transmission and Distribution Piping Systems

ISO 13628-11 Design and Operation of Subsea Production Systems Part 11:

Flexible Pipe Systems for Subsea and Marine Applications

API RP 17B Recommended Practice for Flexible Pipe (equivalent to ISO 13628-11)

BS EN ISO 16708:2006 Petroleum and Natural Gas Industries Pipeline

Transportation Systems Reliability BasedLimitStateMethods

2. Pipeline materials and construction standards

BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore

Part 1: Carbon and Carbon Manganese Steel Pipelines

BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore

Part 2: Duplex Stainless Steel Pipelines

ISO 13847 Petroleum and Natural Gas Industries: Pipeline Transportation Systems

Field and Shop Welding of Pipelines

ISO 15590 Petroleum and Natural Gas Industries: Induction Bends, Fittings and

Flanges for Pipeline Transportation Systems. Part 1: Induction Bends


Flanges for Pipeline Transportation Systems. Part 2: Fittings


Flanges for Pipeline Transportation Systems. Part 3: Flanges


26/28

ISO 15589 Petroleum and Natural Gas Industries Cathodic Protection for Pipeline

Transportation Systems Part 2: Offshore Pipelines

ISO 3183 Petroleum and Natural Gas Industries Steel Pipe for Pipeline

Transportation Systems

API 5L Specification for Line Pipe (equivalent to ISO 3183)

API Specification 17J Specification for Unbonded Flexible Pipe

NACE Standard MR0175-2002 Sulphide Stress Cracking Resistant Metallic

Materials for Oilfield Equipment

BS EN ISO 13628-2 Petroleum and natural gas industries Design and operation

of subsea production systems Part 2: Unbonded flexible pipe systems for subsea

and marine applications

BS EN ISO 13628-10 Petroleum and natural gas industries Design and operation

of subsea production systems Part 10: Specification for bonded flexible pipe

BS EN ISO 15156-1:2009 Petroleum and natural gas industries. Materials for use in

H2S-containing environments in oil and gas production.

BS EN ISO 15156-2:2009 Petroleum and natural gas industries. Materials for use in

H2S-containing environments in oil and gas production. Cracking-resistant carbon

and low-alloy steels, and the use of cast irons.

BS EN ISO 15156-3:2009 Petroleum and natural gas industries. Materials for use inH2S-containing environments in oil and gas production. Cracking-resistant CRAs

(corrosion-resistant alloys) and other alloys.

3. Safety systems standards

API RP 14C Recommended Practice for Analysis, Design, Installation and Testing of

Basic Surface Safety Systems for Offshore Production Platforms 7th Edition March

2001

BS EN ISO 13628-14 (Draft) Petroleum and Natural Gas Industries: Design and

Operation of Subsea Production Systems. Part 14. Subsea High Integrity Pressure

Protection Systems (HIPPS)

SPC/TECH/ED/31 Safety instrumented systems for the overpressure protection of

pipeline risers

API Spec 6D Specification of Pipeline Valves


27/28

ISO 14313 Petroleum and Natural Gas Industries Pipeline Transportation Systems

- Pipeline Valves

Department of Energy Guidance Notes in Support of the Offshore Installations

(Emergency Pipeline Valve) Regulations 1989 SI 1989/1029

SPC/TECH/ED/49 Riser Emergency Shut Down Valve (ESDV) Leakage Assessment

Pipeline Riser emergency shut down valves - Inspection issues and

recommendations

(http://www.hse.gov.uk/pipelines/resources/emergencyshutdown.htm)

BS EN ISO 14723 Petroleum and natural gas industries. Pipeline transportation

systems. Subsea pipeline valves

4. Pipeline Integrity management standards

DNV Recommended Practice DNV-RP-F116 Integrity Management of Submarine

Pipeline Systems, 2009

DNV Recommended Practice DNV-RP-F206 Riser Integrity Management

Oil and GasUKGuidance Note: Monitoring Methods and Integrity Assurance for

Unbonded Flexible Pipe Rev 5 Oct 2002

API Technical Report 17TR2 The Ageing of PA-11 in Flexible Pipes

Oil and GasUKOP010 State of the Art Report on Flexible Pipe Integrity and

Guidance Note on Monitoring Methods and Integrity Assurance for Unbonded

Flexible Pipes

Energy Institute: Guidelines on integrity management of subsea facilities

PD 8010 Part 4 Risk-based integrity management of steel pipelines on land and

subsea pipelines (in preparation)

5. Pipeline operations

ISO 21329 Petroleum and natural gas industries. Pipeline transportation systems.

Test procedures for mechanical connectors

SPC/TECH/ED/18 Health & Safety Issues Associated with Changes from Dry Gas to

Wet Gas Operations

HSG 253 The safe isolation of plant and equipment, HSE Books, 2006, ISBN

9780717661718

HSE SPC/TECH/GEN/18 Underlagging Corrosion of Plant & Pipework


28/28

6. Other guidance and sources of information

HSE/IP/UKOOA PARLOC 2001: The Update of Loss of Containment Data for

Offshore Pipelines 5th Edition

ED Hydrocarbon Release Database (https://www.hse.gov.uk/hcr3/)

Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and

Blowdown Systems, 2001, Oil and GasUK/ Energy Institute, ISBN 978-0-85293-287-

2

Guidelines for the Management of Integrity of Joints in Pressurised Systems, 2007,

Oil and GasUK/ Energy Institute, ISBN 978-0-85293-461-6

Guidelines for the Management, Design, Installation and Maintenance of Small Bore

Tubing Systems, 2000,UKOil and Gas / Energy Institute, ISBN 978-0-85293-275-9

Guide to the Application of IEC 61511 to Safety Instrumented Systems in

theUKProcess Industries, EEMUA, ISBN 0-85931-168-6

TWI/DNV/SINTE Project Guideline for Engineering Critical Assessments for Pipeline

Installation Methods Introducing Cyclic Plastic Strain, DNV Report number 2003-

3135