Analysis, Design, Installation, and Testing of Safety Systems for Offshore Production Facilities API RECOMMENDED PRACTICE 14C EIGHTH EDITION, FEBRUARY 2017 Special Notes API publications necessarily address problems of a general nature With respect to particular circumstances, local, state, and federal laws and regulations should be reviewed Neither API nor any of API's employees, subcontractors, consultants, committees, or other assignees make any warranty or representation, either express or implied, with respect to the accuracy, completeness, or usefulness of the information contained herein, or assume any liability or responsibility for any use, or the results of such use, of any information or process disclosed in this publication Neither API nor any of API's employees, subcontractors, consultants, or other assignees represent that use of this publication would not infringe upon privately owned rights API is not undertaking to meet the duties of employers, manufacturers, or suppliers to warn and properly train and equip their employees, and others exposed, concerning health and safety risks and precautions, nor undertaking their obligations to comply with authorities having jurisdiction Information concerning safety and health risks and proper precautions with respect to particular materials and conditions should be obtained from the employer, the manufacturer or supplier of that aterial, or the material safety datasheet Work sites and equipment operations may differ Users are solely responsible for assessing their specific equipment and premises in determining the appropriateness of applying the provisions of this recommended practice At all times users should employ sound business, scientific, engineering, and judgment safety when using this recommended practice Classified areas may vary depending on the location, conditions, equipment, and substances involved in any given situation Users of this recommended practice should consult with the appropriate authorities having jurisdiction API publications may be used by anyone desiring to so Every effort has been made by the Institute to ensure the accuracy and reliability of the data contained in them; however, the Institute makes no representation, warranty, or guarantee in connection with this publication and hereby expressly disclaims any liability or responsibility for loss or damage resulting from its use or for the violation of any authorities having jurisdiction with which this publication may conflict API publications are published to facilitate the broad availability of proven, sound engineering and operating practices These publications are not intended to obviate the need for applying sound engineering judgment regarding when and where these publications should be utilized The formulation and publication of API publications is not intended in any way to inhibit anyone from using any other practices Any manufacturer marking equipment or materials in conformance with the marking requirements of an API standard is solely responsible for complying with all the applicable requirements of that standard API does not represent, warrant, or guarantee that such products in fact conform to the applicable API standard All rights reserved No part of this work may be reproduced, translated, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior written permission from the publisher Contact the Publisher, API Publishing Services, 1220 L Street, NW, Washington, DC 20005 Copyright © 2017 American Petroleum Institute Foreword Other API documents for safety and antipollution systems used in offshore oil and gas production include the following: — API Recommended Practice 14E, Recommended Practice for Design and Installation of Offshore Production Platform Piping Systems; — API Recommended Practice 14F, Design, Installation, and Maintenance of Electrical Systems for Fixed and Floating Offshore Petroleum Facilities for Unclassified and Class 1, Division and Division Locations; — API Recommended Practice 14G, Recommended Practice for Fire Prevention and Control on Fixed Open-type Offshore Production Platforms; — API Recommended Practice 14J, Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities; — API Recommended Practice 17V, Recommended Practice for Analysis, Design, Installation, and Testing of Safety Systems for Subsea Applications; — API Recommended Practice 75, Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities The verbal forms used to express the provisions in this document are as follows: Shall: As used in a standard, “shall” denotes a minimum requirement in order to conform to the standard Should: As used in a standard, “should” denotes a recommendation or that which is advised but not required in order to conform to the standard May: As used in a standard, “may” denotes a course of action permissible within the limits of a standard Can: As used in a standard, “can” denotes a statement of possibility or capability Nothing contained in any API publication is to be construed as granting any right, by implication or otherwise, for the manufacture, sale, or use of any method, apparatus, or product covered by letters patent Neither should anything contained in the publication be construed as insuring anyone against liability for infringement of letters patent This document was produced under API standardization procedures that ensure appropriate notification and participation in the developmental process and is designated as an API standard Questions concerning the interpretation of the content of this publication or comments and questions concerning the procedures under which this publication was developed should be directed in writing to the Director of Standards, American Petroleum Institute, 1220 L Street, NW, Washington, DC 20005 Requests for permission to reproduce or translate all or any part of the material published herein should also be addressed to the director Generally, API standards are reviewed and revised, reaffirmed, or withdrawn at least every five years A one-time extension of up to two years may be added to this review cycle Status of the publication can be ascertained from the API Standards Department, telephone (202) 682-8000 A catalog of API publications and materials is published annually by API, 1220 L Street, NW, Washington, DC 20005 Suggested revisions are invited and should be submitted to the Standards Department, API, 1220 L Street, NW, Washington, DC 20005, standards@api.org iii Contents Page Scope Normative References 3.1 3.2 Terms, Definitions, Acronyms, and Abbreviations Terms and Definitions Acronyms and Abbreviations 4.1 4.2 4.3 4.4 4.5 Safety Device Symbols and Identification Introduction Functional Device Identification Symbols Component Identification Example Identification 11 11 11 11 11 11 5.1 5.2 5.3 5.4 Safety Analysis and System Design Purpose and Objectives Safety Flow Chart Safety System Operation Premises for Basic Analysis and Design 16 16 16 18 18 6.1 6.2 6.3 6.4 Protection Concepts and Safety Analysis Introduction Protection Concepts Safety Analysis Analysis and Design Procedure Summary 19 19 19 31 32 Annex A (normative) Process Component Analysis 33 Annex B (informative) Examples of Safety Analysis Flow Diagram and SAFE Chart 81 Annex C (informative) Remote Operations 94 Annex D (normative) Safety System Bypassing 96 Annex E (normative) High-Integrity Pressure Protection Systems 98 Annex F (informative) Logic Solver 105 Annex G (normative) Emergency Support Systems 107 Annex H (informative) Toxic Gases 117 Annex I (normative) Testing and Reporting Procedures 120 Bibliography 129 Figures Scope of API 14C vs API 17V Examples of Safety Device Identification 14 Offshore Production Facility Safety Flow Chart 17 A.1 Safety Devices: Dry Tree Wellhead Flowlines 34 A.2 Safety Devices: Underwater Wellhead Flowlines 35 A.3 Satellite Well 36 A.4 Safety Devices: Dry Tree Wellhead Injection Lines 39 A.5 Safety Devices: Headers 42 A.6 Safety Devices: Pressure Vessels 45 A.7 Safety Devices: Atmospheric Vessels 50 A.8 Safety Devices: Typical Fired Vessel (Natural Draft) 53 A.9 Safety Devices: Typical Fired Vessel (Forced Draft) 54 A.10 Safety Devices: Exhaust-heated Component 55 v Contents Page A.11 A.12 A.13 A.14 A.15 A.16 A.17 A.18 B.1 B.2 B.3 B.4 Safety Devices: Pipeline Pump 60 Safety Devices: Glycol-powered Glycol Pump 61 Safety Devices: Other Pump 62 Safety Devices: Simple Overhung Centrifugal Pump Seal System 63 Safety Devices between the Bearings Type Centrifugal Pump Seal System 64 Safety Devices: Compressor Unit 70 Safety Devices: Pipelines 74 Safety Devices: Heat Exchangers 77 Example Safety Analysis Flow Diagram of Platform Production Process 83 Example SAFE Chart 84 Example Process Component Diagram for a Natural Draft Burner on a Pressure Vessel 90 Resulting Process Component Diagram for a Natural Draft Burner on a Pressure Vessel after Analysis 91 B.5 Example Heater Treater SAFE Chart 92 B.6 Blank SAFE Chart 93 G.1 Gas Detector Spacing 113 Tables Sensing and Self-acting Safety Device Symbols 12 Actuated Valve Safety Device Symbols 14 Component Identification 15 A.1 Flowline Segment Safety Analysis Table 37 A.2 Flowline Segment Safety Analysis Checklist 37 A.3 Safety Analysis Table: Dry Tree Wellhead Injection Lines 40 A.4 Safety Analysis Checklist: Dry Tree Wellhead Injection Lines 40 A.5 Safety Analysis Table: Headers 43 A.6 Safety Analysis Checklist: Headers 43 A.7 Safety Analysis Table: Pressure Vessels 44 A.8 Safety Analysis Checklist: Pressure Vessels 46 A.9 Safety Analysis Table: Atmospheric Vessels 50 A.10 Safety Analysis Checklist: Atmospheric Vessels 51 A.11 Safety Analysis Table: Fired Components, Natural Draft 55 A.12 Safety Analysis Table: Fired Components, Forced Draft 56 A.13 Safety Analysis Table: Exhaust-heated Components 56 A.14 Safety Analysis Checklist: Fired and Exhaust-heated Components 57 A.15 Safety Analysis Table: Pumps 65 A.16 Safety Analysis Checklist: Pumps 65 A.17 Safety Analysis Table: Compressors 71 A.18 Safety Analysis Checklist: Compressors 71 A.19 Safety Analysis Table: Pipelines 75 A.20 Safety Analysis Checklist: Pipelines 76 A.21 Safety Analysis Table: Heat Exchangers 78 A.22 Safety Analysis Checklist: Heat Exchangers 79 G.1 Guidelines for Fusible Plug Installations 110 G.2 Guidelines for Combustible Gas Detectors 111 I.1 Safety Device Test Procedure Examples 121 I.2 Safety Device Test Data 128 vi Introduction This document presents a systematization of proven practices for providing a safety system for offshore production facilities Proper application of these practices, along with good design, hazard analysis, maintenance, and operation of the entire production facility, should provide an operationally safe facility The title of this document has been amended to include both fixed and floating facilities The Eighth Edition of this document is updated to include the changes in safety systems technology and provides additional guidance for facility safety systems as they have become larger, more complex, and moved into deeper water Added requirements include extensive emphasis on the performing of hazards analysis due to increased flow rates, pressures, temperatures, and water depth This document has been developed in coordination with the first edition of API 17V, Recommended Practice for Analysis, Design, Installation, and Testing of Safety Systems for Subsea Applications Key changes to the main document include better alignment with API Standard 521, Pressure-relieving and Depressuring Systems, additional requirements for pumps and compressors greater than 1000 hp, and additional requirements to protect against backflow and settle-out pressures Low-temperature hazards have been addressed for the first time, and the definitions section has been expanded All annexes have been defined as normative or informative and the analysis tables from the seventh edition have been removed New annexes cover high-integrity pressure protection systems (HIPPS), logic solvers, bypassing, and remote operations While HIPPS has been presented as an option for overpressure protection of multiple components, an HIPPS is used after thorough consideration of other alternatives Caution should be applied when using HIPPS given the rigorous design, testing, and maintenance requirements for the system vii Analysis, Design, Installation, and Testing of Safety Systems for Offshore Production Facilities Scope This document presents provisions for designing, installing, and testing both process safety and non-marine emergency support systems (ESSs) on an offshore production facility The basic concepts of a facility safety system are discussed, and protection methods and requirements of the system are outlined API 14C For the purposes of this document, all process components from the surface wellhead and/or topside boarding valve are considered For subsea equipment, Figure provides a description between the scope of API 17V and this document PSS ESS PSHL CIU BSDV SDV DCS Node or MCS EPU HPU TUTA Water Line Umbilical API 17V Production Flowline Flying Leads UTH Production Tree Production Manifold, Boosting, Separation, Compression, HIPPS, SSIV Jumper Flying Leads Flying Leads Injection Tree Flying Leads SCSSV Injection Flowline Jumper Injection Manifold SCSSV Reservoir Figure 1—Scope of API 14C vs API 17V API 17V is a companion document, which provides guidance for subsea safety systems This document illustrates how system analysis methods can be used to determine safety requirements to protect common process components Actual analyses of the principal components are developed in such a manner that the requirements are typically applicable whenever the component is used in the process However, it is incumbent on the user to apply appropriate additional hazardous analysis methodologies to ensure that hazards are identified and mitigated This document also includes: a) a method to document and verify process safety system functions [i.e safety analysis function evaluation (SAFE chart)]; API RECOMMENDED PRACTICE 14C b) design guidance for ancillary systems such as pneumatic supply systems and liquid containment systems; c) a uniform method of identifying and symbolizing safety devices; d) procedures for testing common safety devices with recommendations for test data and acceptable test tolerances Detailed process safety system design is not discussed and should be left to the discretion of the designer as long as the recommended safety functions are properly implemented Rotating machinery is considered in this document as a unitized process component as it interfaces with the platform safety system When rotating machinery (such as a pump or compressor) installed as a unit consists of several process components, each component can be analyzed as prescribed in this document Annex A contains a safety analysis for each process component commonly used in a production process, including a checklist of additional criteria for consideration when the component is used in a specific process configuration Normative References The following referenced documents are indispensable for the application of this document For dated references, only the edition cited applies For undated references, the latest edition of the referenced document applies (including any addenda/errata) API Specification 6A, Specification for Wellhead and Christmas Tree Equipment API Specification 6AV1, Specification for Validation of Wellhead Surface Safety Valves and Underwater Safety Valves for Offshore Service API Specification 6FA, Specification for Fire Test for Valves API Recommended Practice 75, Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities API Standard 521, Pressure-relieving and Depressuring Systems API Standard 607, Fire Test for Quarter-turn Valves and Valves Equipped with Nonmetallic Seats IEC 61508-2 , Functional safety of electrical/electronic/programmable electronic safety-related systems— Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems IEC 61508-3, Functional safety of electrical/electronic/programmable electronic safety-related systems—Part 3: Software requirements Terms, Definitions, Acronyms, and Abbreviations 3.1 Terms and Definitions For the purposes of this document, the following terms and definitions apply 3.1.1 abnormal operating condition Condition that occurs in a process component when an operating variable ranges outside of its normal operating limits International Electrotechnical Commission, 3, rue de Varembé, P.O Box 131, CH-1211, Geneva 20, Switzerland, www.iec.ch ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES 3.1.2 atmospheric service Operation at gauge pressures between 0.5 ounce psi (0.2 kPa) vacuum and psi (35 kPa) pressure 3.1.3 backflow Fluid flow in a process component opposite to the normal flow direction 3.1.4 blowdown valve An automatically operated valve used to vent the pressure from a process station 3.1.5 boarding shutdown valve BSDV A shutdown valve (SDV) (3.1.68) installed on a production facility that isolates the subsea wellhead flowlines from the production facility NOTE See Figure 3.1.6 classified area Any area electrically classified in accordance with API 500 or API 505 3.1.7 containment Any method used on an offshore facility to collect and direct escaped liquid hydrocarbons to a safe location 3.1.8 control circuit Electrical, pneumatic hydraulic transmission system (e.g wiring, tubing, relays) and logic solver (hardware and software) used to connect associated sensors and final elements 3.1.9 detectable abnormal condition An abnormal operating condition that can be automatically detected 3.1.10 direct ignition source An exposed surface, flame, or spark at sufficient temperature and heat capacity to ignite combustibles 3.1.11 emergency evacuation/muster station A location where personnel gather in the case of an emergency and develop plans to either contend with the emergency or evacuate NOTE The location is typically inside or adjacent to the quarters and near the means of evacuation such as lifeboats 3.1.12 emergency shutdown system ESD system System of manual stations that initiates facility shutdown when activated NOTE Activation of the ESD system can also be initiated automatically by fire detection devices and other safety devices ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES a) a shut-in of the sour production handling equipment, applicable wells, and pipelines/flowlines; b) blowdown of certain process equipment; c) providing (or increasing) ventilation; d) closing air intakes and/or shutdown of HVAC systems 119 H.2.9 In lieu of total process shut-in, alarmed areas may be isolated; an example is closing an inlet valve to a compressor building It may be desirable in certain instances for H2S detectors not to initiate shutin/isolation action, but to alarm only H.2.10 Careful consideration should be given to the form of automatic corrective action taken to ensure that the situation is not made more hazardous H.2.11 Shutdown devices controlled by H2S gas detection systems should be installed “normally energized” (commonly referred to as “failsafe”) Refer to API 14F H.2.12 In addition to being toxic, H2S gas is combustible The range of combustibility is approximately 4.3 % to 45.5 % by volume Areas subject to combustible levels of H2S should be classified as Group C and electrical equipment should be suitable for Groups C and D atmospheres For mixtures of H2S and natural gas, the mixture should be considered Group D if the H2S constitutes less than 25 % of the mixture (by volume) and Groups C and D if greater than 25 % If machinery or equipment shutdown could create an ignition source, consideration should be given to actuation of a fire inerting system prior to shutdown H.2.13 If sour gas is sweetened to reduce personnel exposure hazard or for equipment protection, the sweetened gas shall be continuously monitored for H2S prior to the gas leaving the facility and preferably before being utilized for fuel or control gas at the facility Devices specifically designed for analyzing an in-stream sample for H2S content on a continuous basis should be utilized H.2.14 To better ensure proper application of H2S detection instruments, an environment and application checklist (similar to the example shown in ISA-92.00.02) should be provided to prospective suppliers by the user H.3 Systems for Discharging Hydrogen Sulfide and Sulfur Dioxide to Atmosphere Discharge of pressure-relief and normally venting devices should be located away from work areas and designed to provide adequate dispersion and to limit personnel exposure to H2S and sulfur dioxide concentrations not exceeding those discussed in H.1 If dispersion modeling determines that ignition of vented gas is required, the flare outlets should be equipped with an automatic ignition system and contain a pilot(s) or other means to ensure combustion On platforms where flaring is required, failure of the automatic ignition system and loss of flare should shut in the input source Annex I (normative) Testing and Reporting Procedures I.1 General Performance testing provides a practical method of confirming the system’s ability to perform the design safety functions On initial installation, tests shall be conducted to verify that the entire facility safety system, including the final SDVs or other final elements, is designed and installed to provide proper response to abnormal conditions Thereafter, periodic operational tests should be performed, at least annually, to substantiate the integrity of the entire system, including process station or facility shutdown if necessary Typical test procedures for individual types of safety devices are presented in Table I.1 Alternative procedures may be used as recommended by manufacturers or as determined through other assessments A reporting method shall provide for orderly accumulation of test data that can be used for operational analyses, reliability studies, asset integrity studies, and reports that can be required by regulatory agencies I.2 Design and Installation Verification I.2.1 Purpose Before a production system is placed in initial operation, the safety system should be thoroughly inspected and tested to verify that each device is installed, operable, performs its design function, and, if applicable, is calibrated for the specific operating conditions When re-commissioning a facility after being shut in for 30 days or more, the production safety system sensors and final elements shall be physically verified for proper operation This verification is to ensure that all sensors remain connected to the process and are functioning and all final elements are properly connected and functional Where an addition or modification is made to the facility safety system, that portion of the system that has been added or modified and any portion of the system associated with that change shall be completely inspected and tested to ensure functionality from sensor through logic and to confirm that the final elements function as required I.2.2 SAFE Chart The SAFE chart shown in Figure B.6 and discussed in 6.3.3 provides a checklist for the initial design and installation verification Each sensing device is listed in the column headed “DEVICE I.D.,” and its respective control function is indicated under the column headed “FUNCTION PERFORMED.” It shall be determined that a safety device is operable, properly calibrated, and accomplishes the design control function within the prescribed time period This fact can be noted on the SAFE chart When all initiating devices have been tested and their “function performed” confirmed, the design and installation is verified I.3 Safety System Testing I.3.1 Purpose Safety systems shall be tested to verify that each sensing device operates within the test tolerances defined in I.4 and the control circuit performs its shutdown function as specified Testing is required to maintain the reliability of the safety system Testing intervals should be adjusted based on analysis of the required testing records Test intervals may need to be shortened to maintain the reliability of the system in systems subjected to higher stresses (corrosion, heat, etc.), and the intervals may be extended where analysis indicates that extension of the interval will not degrade the system reliability 120 ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES Table I.1—Safety Device Test Procedure Examples Item A Safety Device Burner flame detector (BSL) Procedure 1) a) b) 2) B Combustible point gas detector (ASH) Emergency shutdown system (ESD) light pilot, block fuel supply to main burner, c) shut off fuel supply to pilot and check BSL for detection To check burner flame-out control: d) e) light main burner, block fuel supply to pilot, f) shut off fuel supply to main burner and check BSL for detection 1) Adjust the zero control, if necessary, so that meter reads % LEL with all gas positively eliminated from sensor 2) Place sensing adapter of portable purge calibrator over probe head and open shut-off valve on sample container 3) When meter reaches maximum level and stabilizes, record meter reading, calibration gas concentration, low alarm, and high shutdown set points (% LEL) If necessary, adjust meter to read % LEL of calibration gas 4) C To check pilot flame-out control: 5) 6) Close shut-off valve on sample container and remove sensing adapter Actuate test control or zero control, as appropriate, and observe low and high trip points Check shutdown relay for actuation 1) Pneumatic Station—Check each ESD station by moving to the shutdown position Observe for free valve movement and unobstructed gas bleed Verify loss of pressure at activating element if it is bypassed 2) Electric Station—Activate each station and verify receipt of signal at logic solver They may be bypassed to prevent platform shutdown The overall ESD system shall be tested at regular intervals by activation of an ESD station and verification that all outputs operate properly This may be done individually or as a group depending on platform design in order to avoid an actual facility shutdown Record the time (seconds) after operating the manual remote station for the flowline surface valve or BSDV to close Unplanned shutdowns may be used to provide evidence of satisfactory operation, providing adequate information is available to record the performance of individual components D Flowline and departing pipeline check valve (FSV) 1) Close upstream valve and associated header valves 2) Open bleeder valve and bleed pressure from flowline between closed valves 3) 4) Close bleeder valve Open appropriate header valve 5) 6) Open bleeder valve Check bleed valve for backflow If there is a continuous backflow from bleeder valve, measure the flow rate If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min) during the pressure holding test, the FSV should be repaired or replaced NOTE See I.4.6 for additional leakage guidance 7) Close bleeder valve and open upstream valve 121 122 API RECOMMENDED PRACTICE 14C Table I.1—Safety Device Test Procedure Examples (Continued) E High- and low-level sensors (LSHs) and (LSLs)— installed internally 1) Manually control vessel dump valve to raise liquid level to high-level trip point while observing level liquid in gauge glass 2) Manually control vessel dump valve to lower liquid level to low level trip point while observing liquid level in gauge glass Alternate procedure 1: 1) 2) Open fill line valve and fill vessel to high level trip point Close fill line valve 3) Drain vessel to low level trip point Alternate procedure (for pressure differential transmitter used for level sensors): NOTE Source pressures utilized for testing transmitters shall be external sources separate from the process, utilizing test gauges, test meter or calibrator to observe trip points and/or verify the zero and span of the transmitters 1) 2) Close valve connecting high side of transmitter to vessel Close valve connecting low side of transmitter to vessel 3) Connect external test pressure source to high side of transmitter External pressure source shall have means to measure pressure (or equivalent level) utilizing an external test gauge Vent to atmosphere low side of transmitter 4) 5) Introduce pressure at high side of transmitter equal to high liquid level and verify LSH actuates within test tolerance 6) Introduce pressure at high side of transmitter equal to low liquid level and verify LSL actuates within test tolerance 7) 8) Disconnect test pressure source Close vent valve of low side of transmitter 9) Open valves to vessel and return transmitter to service NOTE For transmitters without low side connections to vessel, steps 2, 4, and can be omitted F LSHs and LSLs—installed in outside cages 1) 2) Close isolating valve on float cage(s) Fill cage(s) with liquid to high level trip point 3) 4) Drain cage(s) to low level trip point Open cage(s) isolating valves Alternate procedure: 1) Close isolating valve on float cage(s) 2) 3) Drain cage to low level trip point Open lower cage isolating valve 4) Slowly bleed pressure from the top of the cage, allowing vessel pressure to push fluid from inside the vessel to the high level trip point Open upper cage isolating valve 5) G High- and low-pressure sensors (PSHs) and (PSLs)—external pressures test 1) 2) 3) 4) 5) Close isolating valve on pressure-sensing connection Bleed pressure from sensors and record low sensor trip pressure observed from an external test gauge Apply pressure to sensor(s) with a hydraulic pump, high-pressure gas, or nitrogen, and record sensor trip pressure observed from an external test gauge Adjust sensor, if required, to provide proper set pressure Open sensor-isolating valve, verifying that high pressure bleeds into process system, confirming that sensing port is not blocked ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES Table I.1—Safety Device Test Procedure Examples (Continued) H I PSHs and PSLs—bench test Safety relief valve (PSV)— external pressure test 1) Mount sensors on a test stand and connect pneumatic supply 2) 3) Apply pressure as indicated a) PSH Apply pressure to sensor with hydraulic pump, high-pressure gas, or nitrogen bottle, and record high sensor trip pressure b) PSL Apply pressure above set pressure and bleed pressure, and record pressure at which low sensor trips Tag sensor with set pressure and date 1) Remove lock or seal and close inlet isolating block valve 2) Apply pressure through test connection with nitrogen, high-pressure gas, or hydraulic pump, and record pressure at which the relief valve or pilot starts to relieve The safety valve or pilot should continue relieving down to reseat pressure Hold test connection intact until the pressure stops dropping to ensure that valve has reseated NOTE API 576 provides detailed isolation procedures 3) J K PSV—bench test Pipeline and process shutdown valve (SDV) 4) Open inlet isolating block valve and lock or seal 1) Mount on a test stand 2) 3) Apply pressure through test connection with nitrogen, high-pressure gas, or a hydraulic pump, and record pressure at which the relief valve starts to relieve test pressure Record results 4) Tag PSV with the set pressure and the date of test 1) Partial stroke test Vent pressure off the actuator and allow valve to reach approximately 20 % closed/80 % open position Return pressure to actuator to return valve to fully open 2) Full valve closure test Initiate signal to close SDV from either remote or local switch Close SDV Verify SDV closure Open SDV L M Surface safety valve (SSV) operation test SSV pressure holding test 1) Shut in well 2) 3) Close SSV Open SSV 4) Return well to production 1) 2) 4) Shut in well and SSV as for operations test Position wing and flowline valves to permit pressure to be bled off downstream of SSV With pressure on upstream side of SSV, open bleed valve downstream of SSV and check for continuous flow If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min) during the pressure holding test, the SSV should be repaired or replaced Close bleeder valve 5) Return well to production 3) 123 124 API RECOMMENDED PRACTICE 14C Table I.1—Safety Device Test Procedure Examples (Continued) N Boarding shutdown valve— (BSDV) O High and low temperature (TSHL)—temperature bath test 1) Shut BSDV as for operations test 2) With pressure on upstream side of BSDV, open bleed valve downstream of BSDV and check for continuous flow If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min) during the pressure holding test, the BSDV should be repaired or replaced 3) 1) Close bleeder valve Return well to production 1) Remove temperature sensing probe 2) 3) Place a thermometer in a hot liquid bath Insert temperature sensing probe in the liquid bath and set manual dial on temperature controller at the same temperature indicated on the thermometer Record high temperature set point If the controller does not trip at the temperature of the liquid bath, adjust the controller to trip at that temperature 4) Remove temperature sensing probe from liquid bath, allow it to cool, and record low temperature set point 5) Remove sensing probe to original location and adjust controller to desired temperature Q Toxic gas detector (OSH) Toxic gas detectors should be tested in accordance with the manufacturer’s specifications R Pipeline-tested SDV— leakage test 1) Stop inlet source to pipeline 2) 3) Close SDV as for operations test Bleed off upstream section 4) Check for leakage upstream of valve If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min) during the pressure holding test, the SDV should be repaired or replaced NOTE See I.4.10 for additional leakage guidance I.3.2 5) Return SDV to service 6) Return inlet source to pipeline Frequency Safety devices and systems should be tested at the intervals recommended below Alternative intervals may be established based on field experience, where supported by historical testing records The recommended test frequencies not supersede the testing requirements called for in I.2.1 when the safety system is initially installed or modified a) Monthly (once each calendar month, not to exceed weeks): — PSH and PSL (pneumatic/electronic switch); — LSH and LSL (pneumatic/electronic switch/electric analog with mechanical linkage); — SDV (partial stroke testing); — SSV and BSDV (full stroke and leakage test); — flowline FSVs b) Quarterly (every third calendar month, not to exceed 120 days): — PSH and PSL (electronic analog transmitters connected to programmable electronic systems); ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES 125 — LSH and LSL (electronic analog transmitters connected to programmable electronic systems); — fire and gas sensors (excluding sacrificial components) c) Bi-annually (every calendar months) — TSH and TSL (excluding sacrificial components); — FSH and FSL (pneumatic/electronic switch); — VSH (vibration switches); — SCSSV; — ESD hand stations (with individual station in bypass) d) Yearly — FSL and FSH (electronic analog transmitters connected to programmable electronic systems); — PSV; — BSL; — departing pipeline-tested FSVs; — SDV (full stroke testing), — pipeline-tested SDV I.3.3 Sensor Testing Safety device tests shall confirm that sensors properly detect the abnormal conditions and transmit a signal to the logic solver to perform specific shutdown functions Sensors are usually tested by simulating an abnormal condition that the device senses to initiate shutdown functions and verifying that it is accurately received by the logic solver In addition to confirming the sensor’s accuracy and ability to transmit the signal, the testing procedure in Table I.1 also verifies that process connections and impulse lines, where they exist, are free of blockage and process condition is accurately presented to the sensor Testing of sensors should include the primary sensing element as defined in Table I.1 Manufacturer’s testing procedure may supersede the testing defined in Table I.1 To facilitate testing of a sensor, the trip function may be bypassed to prevent actual shutdown of the process system or the facility See Annex C for more information on bypassing safety systems I.3.4 SDV and Other Final Element Testing SDVs and other final elements should be tested to ensure they receive the signal transmitted by the logic solver and perform their design function The shutdown output or circuit, including the final SDV or other final element, should be tested at least annually I.3.5 Logic Solvers Application code or configuration for the logic solver shall be strictly controlled under an MOC program 126 API RECOMMENDED PRACTICE 14C I.3.6 Auxiliary Devices All auxiliary devices in the safety system between the sensing device and the SDV or other final element shall be tested at least annually to verify the integrity of the entire shutdown system These devices, including master or intermediate panels, should be tested in addition to the sensing devices Annual testing requirement can be fulfilled utilizing trip events that exercise the entire shutdown system I.3.7 Installation for Testing Devices should be installed with online functional testing in mind Test bypasses should be installed so that individual devices can be tested without actual shutdowns Safety devices should be located to allow for easy and safe access Consideration shall be given to facility safety and operation while safety devices are bypassed Refer to Annex C for additional bypassing guidance I.3.8 Test Procedures Testing of common safety devices shall be performed Example test procedures are shown in Table I.1 Individual operators shall be responsible for providing procedures for each system a) The many types and models of safety devices preclude detailed procedures for each; however, general test procedures for the principal types will cover most safety devices If a device in use is not covered or does not fit the general procedures, specific test procedures should be developed by the operator b) Because of the many possible equipment arrangements, detailed test procedure steps to deactivate a shutdown or control device or to take a component out of service during testing are not given; however, guidance on bypassing and out of service is provided in Annex C Devices or equipment taken out of service for testing should be clearly identified and/or tagged to minimize the possibility of their being left in an inactive condition I.3.9 Personnel Qualification Testing of surface safety systems should be performed only by a competent person Individual operators shall establish requirements for competency I.3.10 Deficient Devices A safety device that fails or is otherwise found inoperable during the test procedure should be promptly replaced, repaired, adjusted, or calibrated, as appropriate, and the failure documented in the test records Until such action can be completed, the device should be clearly tagged as inoperable and equivalent surveillance shall be provided, the process component taken out of service, or the facility shut-in I.4 Test Tolerances I.4.1 PSV PSV set pressure tolerances are ±2 psi (14 kPa) for pressure up to and including 70 psi (480 kPa), and ±3 % for pressure above 70 psi (480 kPa) I.4.2 High- and Low-pressure Sensor (PSHL) PSHL set pressure tolerance for set pressures greater than psi (35 kPa) is ±5 % or psi (35 kPa), whichever is greater; however, the trip pressure should not exceed the pressure rating of the equipment protected A PSHL with a set pressure of psi (35 kPa) or less shall function properly within the service range for which it is installed ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES I.4.3 127 High-level Sensor (LSH) An LSH shall operate with sufficient remaining volume in vessel to prevent carry-over before shut-in Test tolerance for analog level transmitters is ±3 in (7.5 cm) of the LSH set point I.4.4 Low-level Sensor (LSL) An LSL shall operate with sufficient liquid volume above the highest liquid discharge to prevent gas discharge into liquid outlet before shut-in Test tolerance for analog level transmitters is ±3 in (7.5 cm) of the LSL set point I.4.5 Combustible Gas Detector (ASH) ASH set point tolerance is ±5 % of full scale reading; however, the trip point shall not exceed 60 % of LEL for point gas detection and LFL-m for line-of-sight detection, at the high level setting or 25 % of LEL for point gas detection and LFL-m for line-of-sight detection at the low level setting I.4.6 Check Valve (FSV) Flowline FSVs and departing pipeline-tested FSVs, where required in accordance with in A.9.2.2.2, should be tested for leakage If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min), the valve should be repaired or replaced The leakage criteria for the pipeline-tested FSVs can be made less stringent where the operator has demonstrated with appropriate analysis that a higher leakage rate is tolerable I.4.7 High- and Low-temperature Sensor (TSHL) If temperature devices are used to initiate shutdown in the event of fire or surface temperatures approaching ignition temperature, the danger point is usually much higher than normal operating temperature Thus, the instrument may be checked at one point on the scale, as described in Table I.1, and the set point adjusted sufficiently below the danger point to ensure that any working instrument will operate before reaching the danger point If the set temperature is near the operating temperature range, specific test tolerances should be established Calibration and testing procedures discussed in this section are not applicable to eutectic devices I.4.8 Toxic Gas Detector (OSH) OSH set point tolerance shall not vary from the test gas concentration (known to a tolerance of % or ppm, whichever is greater) by more than ppm or 10 % I.4.9 Electrical Flame Detectors (USH) USH tolerance is based on manufacturer’s testing guidelines I.4.10 Surface Safety Valves, Boarding Shutdown Valves, and Pipeline Tested Shutdown Valves SSVs, BSDVs, and pipeline-tested SDVs, where required for departing pipelines in accordance with A.9.2.2.2, should be tested for leakage If sustained liquid flow exceeds 400 cc/min or gas flow exceeds 15 ft3/min (0.4 m3/min), the valve should be repaired or replaced The leakage criteria for the pipeline SDVs can be made less stringent where the operator has demonstrated with appropriate analysis that a higher leakage rate is tolerable Testing requirements for SSSVs are covered in API 14B 128 API RECOMMENDED PRACTICE 14C I.5 Reporting Methods I.5.1 Purpose Safety device test result records should be maintained in a manner that will enable the performance of operational analyses and equipment reliability studies and the providing of reports that are required by regulatory agencies These records should document that standards and regulatory requirements are met I.5.2 Test Information The minimum test information for different safety devices is shown in Table I.2 Test results and operating conditions shall be recorded to adequately assess the performance of safety devices I.5.3 Deficient Devices Records of deficient devices are essential for reliability analyses As a minimum, the record should include the cause of the deficiency in addition to the data required in Table I.2 Table I.2—Safety Device Test Data Data Device identification ASH ESD FSV LSH LSL PSH/PSL VSH PSV SDV TSH TSL BSL BDV BSDV OSH X X X X X X X X X X X X X X X X X Maximum working pressure X Operating range X Response time X X X X X Required setting X X X X X X X X X Observed setting X X X X X X X X X Adjusted setting X X X X X X X X X Proper operation X X X X X Leakage X X X X Corrective action, if required X X X X X X X X X X X X X X X X NOTE Required, observed, and adjusted settings apply to transmitters and may not be required for point type devices NOTE BSDV requirements includes pipeline-tested SDV and SSVs X X Bibliography [1] API Specification 6D, Specification for Pipeline and Piping Valve [2] API Specification 14A, Specification for Subsurface Safety Valve Equipment [3] API Recommended Practice 14B, Design, Installation and Operation of Subsurface Safety Valve Systems [4] API Recommended Practice 14E, Recommended Practice for Design and Installation of Offshore Production Platform Piping Systems [5] API Recommended Practice 14F, Design, Installation, and Maintenance of Electrical Systems for Fixed and Floating Offshore Petroleum Facilities for Unclassified and Class 1, Division and Division Locations, Fifth Edition [6] API Recommended Practice 14FZ, Design and Installation of Electrical Systems for Fixed and Floating Offshore Petroleum Facilities for Unclassified and Class I, Zone 0, Zone 1, and Zone Locations [7] API Recommended Practice 14G, Recommended Practice for Fire Prevention and Control on Fixed Open-type Offshore Production Platforms [8] API Recommended Practice 14H, Recommended Practice for Installation, Maintenance and Repair Surface Safety Valves and Underwater Safety Valves Offshore [9] API Recommended Practice 14J, Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities [10] API Recommended Practice 17V, Recommended Practice for Analysis, Design, Installation, and Testing of Safety Systems for Subsea Applications [11] API Recommended Practice 55, Conducting Oil and Gas Producing and Gas Processing Plant Operations Involving Hydrogen Sulfide [12] API Recommended Practice 500, Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class I, Division and Division [13] API Recommended Practice 505, Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class I, Zone 0, Zone and Zone [14] API 510, Pressure Vessel Inspection Code: In-service Inspection, Rating, Repair, and Alteration [15] API Recommended Practice 520 (all parts), Sizing, Selection, and Installation of Pressure-relieving Devices [16] API Recommended Practice 551, Process Measurement [17] API Recommended Practice 556, Instrumentation, Control, and Protective Systems for Gas Fired Heaters [18] API Recommended Practice 576, Inspection of Pressure-relieving Devices [19] API Standard 670, Machinery Protection Systems [20] API Standard 2000, Venting Atmospheric and Low-pressure Storage Tanks 129 130 API RECOMMENDED PRACTICE 14C [21] API Specification Q1, Specification for Quality Management System Requirements for Manufacturing Organizations for the Petroleum and Natural Gas Industry [22] ASME Boiler and Pressure Vessel Code (BPVC) , Section VIII: Rules for Construction of Pressure Vessels; Divisions and [23] ASME B31.3, Process Piping [24] ASME B31.4, Pipeline Transportation Systems for Liquids and Slurries [25] ASME B31.8, Gas Transmission and Distribution Piping Systems [26] ISA-5.1 , Instrumentation Symbols and Identification [27] ISA-7.0.01, Quality Standard for Instrument Air [28] ISA-S12.13, Part II, Installation, Operation, and Maintenance of Combustible Gas Detection Instruments [29] ISA-TR12.13.01, Flammability Characteristics of Combustible Gases and Vapors [30] ISA-TR12.13.02, Investigation of Fire and Explosion Accidents in the Fuel-Related Industries—A Manual by Kuchta [31] ISA-TR12.13.04, Performance Requirements for Open Path Combustible Gas Detectors [32] ISA-20, Specification Forms for Process Measurement and Control Instruments, Primary Elements and Control Valves [33] ISA-RP42.00.01, Nomenclature for Instrument Tube Fittings [34] ISA-RP60.9, Piping Guide for Control Centers [35] ISA-TR84.00.07, Guidance on the Evaluation of Fire, Combustible Gas and Toxic Gas System Effectiveness [36] ISA-92.00.01, Performance Requirements for Toxic Gas Detectors [37] ISA-92.00.02, Installation, Operation, and Maintenance of Toxic Gas-Detection Instruments [38] ISA-92.00.04, Performance Requirements for Open Path Toxic Gas Detectors [39] ISEA-102 4, American National Standard for Gas Detector Tube Units—Short Term Type for Toxic Gases and Vapors in Working Environments [40] NACE MR0175/ISO 15156 , Petroleum, petrochemical and natural gas industries—Materials for use in H2S-containing environments in oil and gas production 5 ASME International, Park Avenue, New York, New York 10016-5990, www.asme.org The International Society of Automation, 67 T.W Alexander Drive, Research Triangle Park, North Carolina, 22709, www.isa.org International Safety Equipment Association, 1901 North Moore Street Suite #808, Arlington, Virginia 22209-1762, www.safetyequipment.org NACE International, 15835 Park Ten Place, Houston, Texas 77084, www.nace.org ANALYSIS, DESIGN, INSTALLATION, AND TESTING OF SAFETY SYSTEMS FOR OFFSHORE PRODUCTION FACILITIES 131 [41] 30 Code of Federal Regulations Part 250 6, Oil and Gas Sulphur Operations in the Outer Continental Shelf [42] 33 Code of Federal Regulations Chapter I, Subchapter N, Artificial Islands and Fixed Structures on the Outer Continental Shelf [43] 40 Code of Federal Regulations Part 112, Chapter I, Subchapter D, Oil Pollution Prevention [44] 49 Code of Federal Regulations Part 192, Transportation of Natural and Other Gas by Pipeline: Minimum Federal Safety Standards [45] 49 Code of Federal Regulations Part 195, Transportation of Hazardous Liquids by Pipeline [46] Offshore Technology Report OTO 93 02, Offshore Gas Detector Siting Criterion Investigation of Detector Spacing; by Lloyd’s Register for the UK Health and Safety Executive, April 1993 The Code of Federal Regulations is available from the U.S Government Printing Office, Washington, DC 20402, www.gpo.gov Product No G14C08