Subpart – O

PSST T-2 Refresher

Production Safety System Training

Course Subpart-O (PSST) (T-2)

• Student Registration and Verification

• Instructor
• Today’s Date = Tuesday, January 03, 2017
• Emergency Procedures & Exits
• Cell Phones on Silent or Vibrate (Be Considerate)
• Course Requirements and Class Times
• Breaks & Lunch Time
• Break Room and Rest Rooms
• Smoking in Designated Areas
• Three (3) Year Certification
01-03-16 AM
2

1
 Subpart-O Training Course Objectives

• Provide attendees with a documented training course as

detailed in the 30 CFR Part 250, API RP 14C (Surface) & API RP
17V (Subsea) curriculum guide outline and the education
necessary to enhance job skills.
• Provide information to learn the regulations and requirements
of
- 30 CFR 250 (OCS Oil & Gas Safety and Regulatory Items)
- 30 CFR 254 (Oil Spill Response Plans and Procedures)
- 30 CFR 250 Subpart-H Production Safety System Design
- API RP 14C (as they apply to the essentials of Top Side
Production Safety System Training)
- API RP 17V (as they apply to the essentials of Subsea
Production Safety Systems)
3

Code of Federal Regulations

30 CFR 250 and 254

• (BSEE) Bureau of Safety Environmental Enforcement is

the governmental agency that enforces Safety and
Compliance regulations in the OCS waters
• (BOEM) Bureau of Ocean Energy Management oversees
lease management, permitting, exploration and
development plans, geological and geophysical analysis and
permitting, royalty measurement, pipeline data,
environmental analysis, assessment and studies, resource
evaluation and coastal restoration projects.
• Lessee is the company that leases, drills wells, produces
hydrocarbons safely, owner and holder of operating and
pipeline rights and is responsible for All safe operations on
the lease. Contractors is considered just as responsible and
accountable on the job site as the leesee!!
4

2
 Subjects Referenced
30 CFR, API RP 14C, API RP 17V

• What subjects are referenced in API RP 14C & API RP 17V?

- It is the American Petroleum Institute Recommended
Practice, API RP14C, (Surface) API RP17V (Subsea)
guidelines for the analysis, design, installation, and
testing of basic Surface and Subsea safety systems for
offshore production facilities
- What locations can a person get regulatory information
requirements (See Web Links)
a. E-CFR Code of Federal Regulations (www.ecfr.gov)
b. BSEE (www.bsee.gov) / BOEM (www.boem.gov)
c. American Petroleum Institute (www.api.org)
- API RP 14C (Production Facility Topside)
- API RP 17V (Subsea Wells)
5

API RP 14C & API RP 17V

Safety System Primary Purpose

• What is it the primary purpose of the topside and subsea safety

system?

• The purpose of the facility’s safety system is to protect

personnel, environment, and the facility from any abnormal
conditions, adverse occurrences or any undesirable events that
will pose any threat to personnel safety and production processes.

• Identify undesirable events that can pose a threat to safety or the

environment, and define reliable protective measures that
prevent such events or minimize their effects if they occur .
6

3
 Safety System Analysis

• How does it accomplish the basic protection task?

- The task is accomplished by eliminating any inherent weakness in

the process components by :

Providing two levels of protection [Primary and Secondary]

- Example: PSH 1st then PSV 2nd level of protection

The primary device will provide the highest order of protection,

and the secondary device will provide the next highest level of
protection if primary protection fails to activate as designed.

-And that they shall be functionally different and independent

of the normal control system. 7

Safety System Protection

• The safety system provides protection in the following ways:

- Automatic monitoring and automatic protective action if an

abnormal condition is indicated or detected by a sensor that
can lead to an undesirable event

- Protective action can also be manually actuated by

personnel (activating an ESD station) when observing or is
alerted to an unsafe condition by alarms or visual reference

- Continuous protection by emergency support system [ESS]

that minimizes the effects of escaping hydrocarbons
8

4
Typical Topside Facility Flow Diagram
With Safety Devices Installed As per 14C

Typical Subsea Flow Diagram With Safety

Devices Installed as per API RP 17V

This valve protects the

host facility from the
subsea well or flowline

14C
17V

Note: All deepwater facilities

operate on PLC/Scada Systems
with numerous hydraulic systems
10

5
 Standard Process & Safety Definitions

• Abnormal Operating Condition

- A condition that occurs in a process component whenever an
operating variable ranges outside it’s normal operating
range limits.
• Atmospheric Service
- BSEE Notes anything between ½ inch vacuum and up to 5
PSI is atmospheric service

11

Standard Process & Safety Definitions

• Backflow [FSV]
- Fluid flow in a process component opposite to the normal
flow.
• Barrier [SSV, USV, BSDV, SDV]
- Element forming part of a pressure containing envelope to
prevent unintentional flow of production or injected fluids
• BSDV
- The BSDV is a certified zero tolerance valve that is installed
on deepwater applications only that acts like a barrier
between the subsea well / flowline and the host floating
process system (FPS)

12

6
 Standard Process & Safety Definitions

• Control Relay Block & Bleed Manual Reset [CRBBM]

[Interlock]
- A safety device that will satisfy the requirement for manual
reset when an automatic sensor activates and starts a
protective action.
• Detectable Abnormal Condition
- An abnormal operating condition is when operating
condition is outside normal ranges and can be automatically
detected by sensors.

Example = Pressure Safety High Low - PSHL

Example = Level Safety high Low - LSHL

13

Standard Process & Safety Definitions

• Emergency Evacuation area / Muster station

- A location where personnel is designated to gather in the
case of an emergency drill and or facility evacuation.
- Lessee shall develop plans to either contend with the
emergency or evacuate procedures
• Facility
- A vessel, a structure, or an artificial island used for drilling,
well-completion, well-workover, and/or production
operations.
• Failure
- Improper performance of a device that prevents its
completion of its design function

14

7
Standard Process & Safety Definitions

• Facility safety system

- The system can consist of a number of individual process
shutdowns and can be actuated by either manual devices or
automatic devices sensing detectable abnormal conditions
• Facility Shutdown [Facility, or Subsea Wells]
- The shutting in of all process stations of a platform
production process along with support systems
• Fired vessel
- A vessel in which the temperature of a fluid media is
increased by the addition of heat supplied by a flame or
external source heat within the vessel.

15

Standard Process & Safety Definitions

• Floating Production Systems (FPS)

- A floating structure, a fixed structure, or an artificial island
used for production operations
• Flow Line Segment [FA-1, Choke, FA-2, Header]
- Any portion of a flowline that has an operating pressure
different from another portion of the same flowline
• High Liquid Level [LSH]
- Liquid Level in a process component above the highest
operating level

16

8
Standard Process & Safety Definitions

• High Pressure [PSH] [Abnormal Condition]

- Pressure in an operating component in excess of the max
operating pressure but less than the [MAWP] Flowlines,
process equipment, or [MAOP] Pipelines.
• High Temperature [TSH] [Abnormal Condition]
- Temperature in a process component in excess of the design
operating temperature
• Indirect Heated Component
- Vessel or heat exchanger used to increase the temperature
of a fluid by the transfer of heat from another fluid, such as
steam, hot water, hot oil, or other heated medium

17

Standard Process & Safety Definitions

• Logic Solver = (Personal Computers - PC)

• Logic Solvers = (PLC/Scada) Software
• Logic Function = (Computer hardware and software) are used
to connect associated sensors and final elements together
- A function that performs the transformations between input
information (provided by one or more input functions) and
output information (used by one or more output functions).

18

9
 Standard Process & Safety Definitions

• Low Liquid Level [LSL] [Abnormal Condition]

- Liquid Level in a component below the lowest operating
level
• Low Pressure [PSL] [Abnormal Condition]
- Pressure in a component less than minimum operating
pressure
• Low Temperature [TSL] [Abnormal Condition]
- Temperature in a process component less than minimum
operating temperature

19

Standard Process & Safety Definitions

• Maximum Allowable Working Pressure: [MAWP]

- The highest operating pressure allowable at any point in any
component, other than a pipeline during normal operation
or static conditions.
• Maximum Allowable Operating Pressure: [MAOP]
- The highest operating pressure allowable at any point in a
pipeline system during normal operation or static conditions.
(in a Pipeline Only)
• Permissive [Process operation within normal conditions]
- A function that allows an action or state when all defined
conditions are met which requires CRBBM reset

20

10
 Standard Process & Safety Definitions

• Pressure Relief [PSV, PSE, PVSV, PRD]

- Relieve excess pressure or vacuum (Undesirable Event)
• Process Shutdown [SSV, USV, BSDV, SDV, SCSSV]
- The isolation of a given topside and subsea process by
closing appropriate SDV’s to shut in flow to the process
station or divert excess flow elsewhere

21

Standard Process & Safety Definitions

Process Component Example

Hydrocarbons Gas
Inlet

Natural Gas Mist Extractor

Baffle MAWP – 1440 PSIG

Emulsion
Oil Level
Water Level
Remember!! If you
protect the process
Water component as required Oil
it will protect you 22

11
 Standard Process & Safety Definitions

• Qualified Person
- An individual with characteristics or abilities gained through
training and or experience or both, as measured against
established requirements such as standards or tests, and
that shall enable the knowledgeable individual to perform a
required function.
• Sensor [PSHL, PSV, LSHL, FSV, TSH, ASH, OSH]
A device used to sense or measure the condition of a process
variable or condition of a piece of process equipment and
provide input to the process control or safety system

23

Standard Process & Safety Definitions

• Safety Instrumented System [SIS] [PLC / Scada]

- A system of sensors, logic solvers, and actuators that take a
process facility to a safe state when an abnormal condition is
detected
• Subsea Isolation Valve [SSIV]
• An emergency shutdown valve located in the flowline prior to
the facility that is normally installed below the splash-zone as
a backup for FPS protection before the BSDV in the event of
line rupture or fire. Closes upon activation of ESD.
• Vent
- A pipe or fitting on an atmospheric vessel that opens to
atmosphere to prevent Overpressure or Underpressure

24

12
 Potential Incidents of Non-Compliance
Subpart-A 30 CFR Part 250.101

• The OCS Lands Act 1953 (OCSLA) authorizes and requires

BSEE to provide for both an annual scheduled inspection and a
periodic unscheduled (unannounced) inspection of all oil and
gas operations on the outer continental shelf.

• The annual inspection examines all safety equipment designed

to prevent undesirable events like blowouts, fires, explosions,
spills, safety devices to monitor abnormal conditions and help
prevent major or minor accidents or incidents .

25

Notice to Lessees (NTL)

Subpart A General 30 CFR 250.103

• Notices to Lessees and Operators (NTLs)

- BSEE may issue Notices to Lessees and Operators (NTLs)

that clarify, supplement, or provide more detail or
description about certain requirements that emerged
from workshops and discussions or interpretation of a
regulation or OCS standard

- NTLs may also outline what you must provide as required

information in your various submissions to BSEE.

26

13
 Best Available and Safest Technologies
Subpart A - BAST Subpart Part 250.107

• BAST would provide that wherever failure of equipment may

30 CFR
have 250.107 effect
a significant (c) on safety, health, or the environment,
an operator must use the BAST that BSEE determines to be
economically feasible on all new drilling and production
operations, and wherever practicable, on existing operations.
• BSEE would specify what is economically feasible BAST. This
could be accomplished generally, for instance, through the use
of NTLs, or on a case-specific basis.
• 30 CFR 250.107(c)(2) would allow an operator to request an
exception from the use of BAST by demonstrating to BSEE
that the incremental benefits of using BAST are clearly
insufficient to justify the incremental costs of utilizing such
technologies.

27

Safe And Workmanlike Operations

Subpart - A 30 CFR Part 250.107

• The lessee shall protect health, safety, property, and the

environment
• Lessee shall perform all operations in a safe and workman like
manner.
• Lessee shall Maintaining all equipment and work areas in a
safe condition.
• Lessee shall Utilize recognized engineering practices
• The lessee shall immediately take all necessary precautions to
control, remove, or otherwise correct any hazardous oil and
gas accumulation or other health, safety, or fire hazard

28

14
 Safe And Workmanlike Operations
Subpart – A 30 CFR Part 250.107

• What is required when a new person arrived’s on location for the

first time?
- A Facility Orientation when you arrive:
- A Review of the Facility Station Bill which directs where all:
- Life saving equipment locations,
- Fire Fighting equipment, primary and secondary
- Fire Drills and Abandon Facility review of procedures
- Emergency Exits Muster Stations
- Abandon alarms Alarm Signals and Their Meaning
- ESD Station locations First Aid, Eye Wash Stations
- Review Station Bill Legend for all types of equipment and
location on every deck level.

29

Crane Operations API RP 2D

Subpart A 30 CFR 250.108

• OCS Crane Guidelines found in API RP 2D (Operation &

Maintenance of Cranes)
• Records of inspection, testing, maintenance and crane
operator qualifications in accordance with the provisions of
API RP 2D shall be kept at the lessee’s field office nearest the
OCS facility for a period of
- 4 years on the Shelf API RP 2D latest approved edition
- 4 years Deepwater facilities are under USCG jurisdiction
- All design, repairs, and construction records including the
required anti-two block safety devices installation shall be
retained for the life of the crane at the OCS field office.

30

15
 Hot Work Permit for Device
30 CFR 250.111 & 30 CFR 250.871

• Due to the risk of flammable gas coming up from the oil or gas
well or production equipment, normal (non-intrinsically safe
certified) electronics are banned outside the living quarters.
• Verify that all personal equipment devices and electrical tools
(e.g., pagers, cell phones, drills, cameras, video equipment)
used in classified areas are suitable for the location or are
used in conjunction with an authorized “Hot Work Permit.”

31

Electrical Systems Installations

Subpart H 30 CFR 250.114
30 CFR 250.863 API 14C 6.2.5.3

• All areas shall be classified in accordance with

• Classification and Electrical Installations of Areas and Zones
for at Offshore Drilling Rigs and Production Fixed and Floating
Facilities for Offshore Production.
• API RP 500 Is the Classification of all platform areas
• API RP 505 Is the Classifications of Locations for Electrical
Installations at OCS Facilities Classified as Class 1, Zones 0,
Zone1, Zone 2
• API RP 14-F is the Design, Installation, and Maintenance of
electrical systems
• API RP 14FZ is the Design, Installation and Maintenance of
Classified Zones

32

16
 Electrical Systems Regulations
Subpart – A 30 CFR 250.114

• Employees who maintain your electrical systems must have

expertise in area classification and the performance,
operation and hazards of electrical equipment.

• On each engine that has an electric ignition system, you

must use an ignition system designed and maintained to
reduce the release of electrical energy.

33

Electrical Systems Regulations PLC/Scada

(Deepwater) Subpart – A 30 CFR 250.114

• IEC 61508, a standard regulating the Functional Safety of

Electrical/Electronic/Programmable Electronic Safety-related
Systems

• IEC 61511 covers the design and management requirements

for SIS’s from cradle to grave. Its scope includes: initial concept,
design, implementation, operation, and maintenance through
to decommissioning. It starts in the earliest phase of a project
and continues through startup. It contains sections that cover
modifications that come along later, along with maintenance
activities and the eventual decommissioning activities.
34

17
 Documents Incorporated By Reference
Subpart -A API Standards 30 CFR 250.198

• American Petroleum Institute, (API) is a private organization

that can only recommend certain practices and standards

• BSEE Through 30 CFR 250.198 directs that designated API RP

documents are incorporated by reference for use in OCS
operations and regulations enforcement.

• These are standards used for guidance for a safe operation of

all safety to personnel, facilities and/or process facilities.

35

Deepwater Operations Plan

Subpart - B 30 CFR 250.286

• What is a DWOP Plan?

• A DWOP is a plan that provides sufficient information for BSEE
to review a deep water development project, and any other
project that uses non-conventional production or completion
technology, from a total system approach.
• BSEE will use the information in your DWOP to determine
whether the project will be developed in an acceptable
manner, particularly with respect to operational safety and
environmental protection issues involved with non-
conventional production or completion technology.
• The DWOP plan will be submitted regardless any water depth

36

18
 API RP 17V Subsea Well
Safety System Requirements

• The “Subsea System”

- The minimum subsea production safety devices shall
include all process components from the wellhead [USV] ,
downhole surface controlled subsurface safety valve
[SCSSV] to upstream of the boarding shut down valve
[BSDV] which is located at the host facility entrance.
• When gas injection, gas lift, or water injection is used the
below shut down valves shall be installed and tested:
- A gas injection shutdown valve [GISDV]
- A gas lift shutdown valve [GLSDV]
- A water injection shutdown valve [WISDV]
BSDV
Incoming
Flowline
Manifold 37

Pollution Prevention and Control

Subpart – C 30 CFR Part 250.300

• The lessee shall immediately take all necessary precautions not to

create conditions, to control, remove, or otherwise correct any
hazardous oil and gas accumulation or other health, safety, or fire
hazard that will pose unreasonable risk
• Immediate corrective action shall be taken in all cases where
pollution has occurred.
- All loose material, small tools, and other small objects shall be kept in a suitable storage
area or a marked container when not in use and in a marked container before transport
over offshore waters;
- All cable, chain, or wire segments shall be recovered after use and securely stored until
suitable disposal is accomplished;
- Skid-mounted equipment, portable containers, spools or reels, and drums shall be
marked with the owner's name prior to use or transport over offshore waters; and
- All markings must clearly identify the owner and must be durable enough to resist the
effects of the environmental conditions to which they may be exposed.
- Any items that are lost overboard shall be recorded on the facility's daily operations
report
38

19
 Pollution Prevention and Control
Subpart - C 30 CFR Part 250.301

• Drilling and Production facilities shall be inspected daily or at

intervals prescribed by the District Supervisor to determine if
pollution is occurring
- Note: Intervals prescribed by BSEE would be an approved pollution
matrix for extension visits for unmanned facilities.
Point Listing for Unmanned Facility
Pollution Inspection Rate Only
Evaluation Code

Inspection Physical Boarding

Points
Interval Inspection Interval

70-100 Bi_Weekly B-Weekly

110-150 Weekly Weekly

160-200 Every Three Days Weekly

210-250 Every Other Day Weekly

260+ Daily Weekly

39

H2S Training Plan Drill

Subpart-D 30 CFR 250.490 250.805

• All facilities shall conduct a drill for each person during normal
duty hours at least weekly, once every (7) days imitating an
actual emergency with full donning practice and verifying
evacuation procedures, and discussed at monthly safety meeting
• This H2S drill shall consist of a dry run performance activities
related to all persons assigned station.
• Training: All operators, contract, and personnel must complete
an H2S training program before beginning work at the facility
and then within one year (Annual) after completion of previous
class.
• All persons shall have H2S training documentation at the facility
or carry a training completion card on person.

40

20
 Undesirable Events
API RP 14C 4.2.1

• Undesirable Event
- An Adverse Occurrence in a process component or process
station which poses a threat to safety of personnel and
process systems such as overpressure, under pressure, liquid
overflow, etc.
- An undesirable event may be indicated by one or more
process variables ranging out of abnormal conditions
operating limits into adverse conditions.
- An abnormal operating conditions shall be detected first by
sensors that will initiate shut down action as per approved
safe chart to protect the process components before an
undesirable event happens

41

Undesirable Events
API RP 14C 4.2.1

• Overpressure
• Underpressure
• Leak / Loss of Containment
• Liquid Overflow
• Gas Blow by
• Excess Temperature Effects / High-Low
• Direct Ignition Source
• Excess Combustible Vapors in the Firing
Chamber
42

21
Undesirable Events
Overpressure API RP 14C 4.2.1.1

Over Pressure

Detectable
Primary Secondary
Abnormal
Protection Protection
Conditions
High Pressure
Pressured Vessel PSH PSV
Second
Atmospheric Vessel Vent
Vent: PSV
43

Undesirable Events
Overpressure API RP 14C 4.2.1.1

• Pressure in a process component in excess of the MAWP or

MAOP.
• Over Pressure occurs whenever inflow exceeds outflow.
• High Pressure is the detectable abnormal condition

44

22
Undesirable Event
Underpressure API RP 14C 4.2.1.5

Under Pressure

Detectable Abnormal Primary Secondary

Conditions Protection Protection

Low Pressure

Pressured Vessel Gas Makeup PSL

Atmospheric Vessel Vent PSV/Vent

45

Undesirable Event
Underpressure API RP 14C 4.2.1.5

• Pressure in a process component less than the collapse

pressure that poses a risk to safety
• Three (3) possible conditions that could cause
Underpressure:
1. Whenever control valves fail,
2. Thermal contraction in isolated vessels occurs,
3. Blockage of inlet during withdrawal
• Underpressure occurs whenever outflow exceeds inflow.

46

23
 Undesirable Event (Gas Make Up)
Underpressure API RP 14C 4.2.1.5

• Why is Gas Make Up a primary safety device for pressure

vessels?
• GAS MAKE UP will make up the required operating pressure
to counteract the under pressure condition (Undesirable
Event) that will result when vessel (Example: When dumping
excess hydrocarbons without enough pressure to make up the
pressure volume loss)
• With hydrocarbon low entry rate into the low pressure vessel
there is not enough flash gas to pressure up vessel to required
operating pressure verified by range chart recorder.

47

Undesirable Event (Gas Make Up)

Underpressure API RP 14C 4.2.1.5

From
Wellhead

48

24
Undesirable Event
Underpressure API RP 14C 4.2.1.5

49

Undesirable Event AP RP 14C 4.2.1.2

Leak / Loss of Containment

Leak
Detectable Abnormal Primary Secondary
Conditions Protection Protection

Accidental Escape Fluids

Large Leak Pressured Vessel PSL, FSV, LSL ESS
Atmospheric Vessel LSL ESS

Small Leak Gas ASH ESS

Containment
Small Leak Liquid (Skid or Drip LSH on Sump
pan)
50

25
 Undesirable Event AP RP 14C 4.2.1.2
Leak / Loss of Containment

• The detectable condition for a Leak or loss of containment is

described as the accidental escape of fluids (Hydrocarbons)
from a process component to the environment
• A leak can occur whenever a valve leaks, sight glass leak, flow
line or pipe section breaks.
• FSV [Flow Safety Valves] shall be installed on all outlets of all
process vessels to minimize or prevent backflow from
downstream components to prevent leakage.

51

Undesirable Event
Liquid Overflow API RP 14C 4.2.1.3

Liquid Over Flow

Detectable Abnormal Primary Secondary

Conditions Protection Protection
Discharge Liquids through Gas
Vapor
Downstream
Pressured Vessel LSH
Devices
Atmospheric Vessel LSH ESS

Small Leak Gas ASH ESS

52

26
 Undesirable Event
Liquid Overflow API RP 14C 4.2.1.3

• The discharge of liquid from a process component through a

gas or vapor outlet or the relief system.
• Liquid overflow can be caused by liquid input in excess of
liquid outlet capacity.
- This may be the result of failure of an upstream flow rate
control device, failure of the liquid level control system, or
blockage of a liquid outlet.
• High level is the detectable abnormal condition that indicates
that overflow may occur

53

Undesirable Event
Gas Blow By API RP 14C 4.2.1.4

Gas Blow-By

Detectable Abnormal Primary Secondary

Conditions Protection Protection

LSL or Overpressure In A
Downstream Component

Downstream
Gas Blowby LSL
Devices

54

27
 Undesirable Event
Gas Blow By API RP 14C 4.2.1.4

• Gas Blowby is the discharge of gas from a process component

through a liquid outlet.
• Gas blow-by can be caused by failure of a liquid level control
system or inadvertent opening of a bypass valve around a
level control valve
• Low level [LSL] is the detectable abnormal condition that
indicates gas blow-by may occur .
• Gas Blow By may cause a downstream component to
overpressure.

55

Undesirable Event API RP 14C 4.2.1.6

Excess High Temperature

Excess High Temperature

(Fired and Exhaust Heated Component)
Detectable Abnormal Primary
Secondary Protection
Conditions Protection

High Temperature

Excess Fuel High Temp Media TSH TSH Stack and ESS

Low Level LSL TSH (M or P Liquid & Stack)

Low Flow FSL TSH (M Liquid)

High Stack Temperature TSH ESS and FSV

56

28
Undesirable Event API RP 14C 4.2.1.6
Excess High Temperature

• Excess Temperature
- Temperature in a process component in excess of the rated
working temperature
- This could excess or high temperature or to other extreme in
very cold piping or external conditions
• The effects of high medium or process fluid temperature can
be a reduction of the working pressure and subsequent leak or
rupture of the affected component and/or overpressure of
the circulating tubes in a closed heat transfer system,
• High temperature, low flow, and low level are the detectable
abnormal conditions that indicate that excess temperature
may occur.

57

Excess Low Temperature

(Pipe Embrittlement)
Undesirable Event

Excess Low Temperature

(Pipe Embrittlement)

Detectable Abnormal Primary

Secondary Protection
Conditions Protection

Low Temperature in the

Downstream Section
TSL to avoid low
temperature Secondary TSL for
Low Temperature
embrittlement shutdown and allow for
Embrittlement
and warm up warm up
system

58

29
 Excess Low Temperature
(Pipe Embrittlement)
Undesirable Event

• Excess Low Temperature

- Excess low temperature is below the minimum allowable
working temperature of a process component.
- This type of low temperature results in loss of ductility, or
embrittlement, of the process component material.
- Embrittled materials can mechanically fail even at pressures
far below the process component’s maximum allowable
working pressure
- Excessive pressure drop of gases can produce a Joule-
Thompson cooling effect. This effect can create extremely
low temperatures in the downstream piping after the
pressure drop, and can cause the low temperature limit of
the piping to be exceeded. Flashing liquids may also cause
low temperatures 59

Undesirable Event API RP 14C 4.2.1.7

Direct Ignition Source (Fired Component)

Direct Ignition Source

Detectable Abnormal Primary Secondary
Conditions Protection Protection
Hot Surface, Fire or
Explosion by Combustible
Material, Low Airflow
Natural Draft Burner Flame Arrestor ESS
PSL (Low Air
Forced Draft Burner BMI
Supply)
Spark at the Stack Stack Arrestor ESS
TSH(Medium)
Hot Surfaces ESS / FSV
TSH (Stack)
60

30
 Undesirable Event API 14C RP 4.2.1.7
Direct Ignition Source (Fired Component)

• A direct ignition source is an exposed surface, flame, or spark

at sufficient temperature and heat capacity to ignite
combustibles mixtures.
• High temperature and low airflow (forced draft burners only)
are the detectable abnormal conditions that indicate a direct
ignition source can occur
• The effect of a direct ignition source can be a fire or explosion
if contacted by a combustible material.

61

Excess Combustible Vapors in a Firing

Chamber (Fired Component)
API 14C RP 4.2.1.8

Excess Combustible Vapors in Firing Chamber

Detectable Abnormal Secondary

Primary Protection
Conditions Protection
Component Rupture by
Explosion, Flame Failure,
High or Low Fuel PSI
Low air supply pressure
and blower failure (Forced
Draft
Natural Draft Burner BSL PSH - PSL
Forced Draft Burner BSL PSL – BMI - FSL
62

31
 Excess Combustible Vapors in a Firing
Chamber (Fired Component)
API 14C RP 4.2.1.8

• Excess combustible vapors in addition to those required for

normal ignition of either the pilot or the main burner.
• The effect of excess combustible vapors in the firing chamber,
on ignition, can be an explosion and possible rupture of the
component.
• Flame failure and high or low fuel supply pressure are
detectable abnormal conditions that can indicate excess
combustible vapors in the firing chamber.
• Low air supply pressure and blower failure can also indicate
this condition in forced draft burners.

63

Undesirable Events
Abnormal Conditions

Why is the 5 psi low side noted? What is the secondary protection for under pressure?
Because Less than 5 psi is considered Atmospheric!!

MAWP 1440 PSH PSL

PSV Set @ 1395 +15% -15%
1127 psi 442 psi 5 psi

Undesirable Detectable HOP = 980 Detectable Undesirable

Event Abnormal Abnormal Event
Condition Normal Condition
Under
Operating
Overpressure High Low Pressure
Pressure
Pressure Range Pressure Gas Make
Up
LOP = 520 (Primary)
(2nd) PSL
What
Noted is the Normal Operating Range and the MAWP, PSH & PSL is the undesirable event for high pressure?
Settings?
What is the detectable abnormal condition for the HOP? What is the undesirable event for low pressure?
What is the detectable abnormal condition for the LOP? What is the primary protection for under pressure?
64

32
Emergency Support System (ESS) Topside
API RP 14C Appendix C Table C.1

• The ESS individual systems provide a method of performing

specific safety functions common to the safety of entire
process facility or subsea systems
• The Emergency Support System is comprised of the following:
- ESD Stations
- Fire Detection / Fire Loop [TSE]
- Smoke & Thermal Protection, [Fire Eye UV, TSH, USH, YSH]
- Gas or Toxic Gas Detection [ASH, OSH]
- Adequate Ventilation
- Containment Systems
- Sump Systems
- Subsurface Safety Valve [SSSV] (SCSSV – SSCSV)
65

Emergency Support System (ESS) Topside

API RP 14C Appendix C Table C.1

• These individual systems help provide a secondary method of

performing specific safety functions common to the safety of
the entire process facility.
• Each individual system is essential to provide a specific level of
protection to threats to safety, by initiating shut-in functions
or reacting in a manner that minimizes the consequences of
personnel safety and release of hydrocarbons.

66

33
 Emergency Support System (ESS) Topside
API RP 14C Appendix C Table C.1
API RP 17V Annex B

• Included in the ESS individual systems will also provide a

method for subsea systems
• Subsea installed shutdown valves and SCSSV’s should shut in
when activated by a hard wired ESD signal from the topside
ESD system.
• As a backup to this system, all subsea hydraulic power units
(HPU’s) shall be equipped with hydraulic dump valves for low
pressure and high pressure systems that are connected to the
ESD.
• This will applicable to electrohydraulic and direct hydraulic
systems
• For all electrical systems, these shall be fail safe on loss of
electrical power.
67

ESD Emergency Support System (ESS)

Appendix C Table C.1.1 ESD
API 14G & API 17V

• Emergency Shutdown System (ESD Station Locations) is a

system of manual stations that is strategically located , and
when activated, will initiate complete process facility
shutdown.
a) Heliport Decks
b) All Stairway Landings (Each Deck Level)
c) Boat Landings (Synthetic Tubing “Polyflo” acceptable here
only) Verify Plastic Ferrule Installation Only,
d) Boat Landing Electrical push button now acceptable
e) Center of the Bridge or at each end of the Bridge
connecting two facilities
f) Emergency Evacuation / Muster Stations
g) Near Driller’s console during drilling and work over ops
68

34
 ESD Emergency Support System (ESS)
Subpart - H 30 CFR 250.842
Appendix F Table C.1.1 ESD

• ESD Stations Location:

h) Near the main Exits of Living Quarters
i) Control Rooms and Central Monitoring Stations
j) Other locations as needed to provide stations accessible to
all platform areas
• Protect against accidental activation, should be quick opening
and non-restrictive
• Electronic versions require fail open circuitry

69

Fire Detection Systems TSE (ESS)

Subpart - H 30 CFR 250.842
API 14C Appendix C C.1.2

• A fire detection system utilizing pneumatic fusible elements

(TSE), or various electrical fire detection devices, including
flame (USH), thermal (TSH), or smoke (YSH) detection devices
− They should be installed to detect fires in all areas classified
by API 500 (Division 1 or 2) or API 505 (Zone 0, 1 or 2)and in
all buildings where personnel regularly or occasionally sleep.
• Temperature Safety Elements, commonly known as Fusible
Plugs are special connection devices that have one end sealed
with eutectic (Lead) material (in solid form).
• (Temperature Safety Elements – TSE) Fire Loop
- TSE API RP 14C Table C-1 installation guidelines
- Integrated with ESD Control Circuit (TSE = ESD) and will
result in a total facility shutdown when activated
70

35
 Gas Detection Systems ASH (ESS)
Subpart - H 30 CFR 250.842
API RP 14C Appendix C.1.3 API RP 14F 11.2

• Other Detection Systems

- Analyzer Safety High (ASH – Combustible Gas Detector)
- (LEL Set points: 25% Indicates & Alarm, 60% Total Shutdown)
• Combustible gas detecting sensors should be located in all enclosed
areas that are classified by API 500 (Division 1 or 2) or API 505 (Zone 0, 1
or 2), such as the following:
- Enclosed areas containing flammable gas compressors;
- In buildings where personnel regularly or occasionally sleep and that
contain a flammable gas source.
• In enclosed areas containing flammable gas compressors, the minimum
number of sensors is one per compressor unit, plus an additional sensor
per three units or fractional part thereof (minimum of two sensors in all
enclosed compressor buildings).

71

Gas Detection Systems ASH (ESS)

Subpart - H 30 CFR 250.842
API 14C Appendix C .1.3 - C .1.4 (Ventilation)

• Adequate ventilation is defined as ventilation

which is sufficient to prevent accumulation of
significant quantities of vapor-air mixture in
concentrations over 25% percent of the Lower
Explosive Limits (LEL)

72

36
 Containment System / Sump (ESS)
Subpart - H 30 CFR 250.842
API RP 14C Appendix C C.1.5-C.1.6

A containment system is installed to

collect and direct escaped liquid
hydrocarbons to a safe location. All
equipment subject to leaks or overflow
should be protected by curbs, gutters,
or drip pans that drain to a sump

FA – Flame Arrestor

Vent Pipe Vacuum Break

All gravity drain piping networks should be designed to LSH Oil

Overboard
prevent escape of gas from sumps through the drains. Discharge
This is typically accomplished by water seals located at
Return oil to system
each drain, or each drain pipe header, or with a total
network water seal located in the sump inlet piping

73

Emergency Support System (ESS) (SCSSV)

Subpart - H 30 CFR 250.842

• Surface Control Subsurface Safety Valves (SCSSV) (SSSV)

• The SCSSV is a hydraulic pressure controlled from a Surface
Control Panel and located in a well 100 ft below the mudline
or seabed floor on the host process facility
• When an abnormal condition such as ESD or Fire [TSE] on the
surface facility has been activated,
- This action shall require a total facility shut-in, operating
hydraulic pressure to the [SCSSV] is exhausted by the
wellhead control panel within 2 minutes after the last SSV is
closed. Total time SSV max closure = 45 Seconds
SCSSV = 2 Minutes, Max time is 2 Minutes 45 Seconds
- If the last SSV closes in 16 seconds, What will be the total
accumulated closure time? 2 Minutes and 16 Secs
74

37
Emergency Support System (ESS) (SSCSV)
Subpart - H 30 CFR 250.842

• Sub Surface Control Safety Valves (SSCSV) (Dry Tree

Only) (Storm Choke)
• SSCSV Location & Installation:
• The SSCSV is located in a well 100 ft below the mudline
or seabed floor and installed by wireline in a well tubing.
• The Sub Surface Control Safety Valve [SSCSV] is a “down-
hole” SSSV operated (NC) by flow characteristics
(abnormal subsurface internal pressure and flow) of the
well stream.
• Flow characteristics in this case, is described as the
development of an abnormal pressure differential flow (a
high flow velocity) through the central bore or internal
components of the SSCSV.
75

Safety Analysis Table (SAT)

Subpart - H 30 CFR 250.842
API RP 14C Appendix A

• What is a Safety Analysis Table (SAT) Table?

- It is a composite table that is applicable to regarding its
component position in the process flow and safety devices
required to counter act any abnormal conditions or any
undesirable events.
- The safety analysis of each process component highlighting
undesirable events from which protection should be
provided along with detectable conditions which can be
monitored for any abnormal conditions.

76

38
 Safety Analysis Table (SAT)
Subpart - H 30 CFR 250.842
API RP 14C Appendix A

• The SAT table will list abnormal detectable conditions that is

used to initiate action through automatic or monitoring
controls to prevent or minimize the effects of undesirable
events.
• The SAT table also represents the logical sequence of safety
system development, including Undesirable Events that could
be created in downstream process components because of
failures in the equipment or safety devices of the component
under consideration.

77

Safety Analysis Checklist (SAC)

Subpart - H 30 CFR 250.842
API RP 14C Appendix A

• The Safety Analysis Checklist is a reference of ten (10) specific,

process component item “tables” that list all the required
safety system control devices that should be utilized to
protect each individual process component (as listed).

A-1 - Flowline Segment A-6 - Fired and Exhaust Heated

A-2 - Wellhead Injection Lines A-7 – Pumps

A-3 - (SAC) Headers A-8 - Compressor Units

A-4 - Pressure Vessels A-9 – Pipelines

A-5 - Atmospheric Vessels A-10 - Heat Exchangers Shell-Tube

78

39
 SAC - Safety Analysis Checklist
Subpart - H 30 CFR 250.842
API RP 14C Appendix B

• The SAC Reference List also has a directory (individual item list)
of all safety devices required to protect each process component
from the worst possible input and output conditions.
• Listed under each safety device items, are certain (specific)
conditions that allow for the omission (or elimination) of
particular safety devices (as listed).
• This action is justified since safety devices (or engineering design
features) on other process components will provide the same
level of protection or in a specific configuration, so the abnormal
condition detected will not lead to a threat to safety.

79

Safety Analysis Checklist (SAC)

Subpart - H 30 CFR 250.842
API RP 14C Appendix B

• The SAC Reference List has a directory (individual item list) of

all safety devices required to protect each process component
from the worst possible input and output conditions

80

40
Safety Analysis Function Evaluation
Safe Chart Subpart - H 30 CFR 250.842
API RP 14C Appendix E

• The SAFE Chart is the most important facility document

required due to the fact the BSEE approved SAFE Chart shows
ALL process components and the required safety devices for
that process component. This will the first document BSEE will
probably ask for.
• The Safety Analysis Function Evaluation (SAFE) Chart (for a
specific process facility) is used to relate all safety sensing
devices, SDVs (BDVs, etc.), Shutdown devices (including ESD)
and Emergency Support Systems to their functions (in a chart
matrix format).
• The SAFE chart will also list all process components and
Emergency Support Systems with their required safety devices
and the function to be performed by each device.

81

Safety Analysis Function Evaluation (Safe

Chart) Subpart - H 30 CFR 250.842
API RP 14C Appendix E

• If the safety device is not needed (if it can be omitted as

determined in the SAC Reference List tables), the reason shall
be listed in the SAFE Chart format matrix by referring to the
appropriate SAC Item number
• The relationship of each with its required function must be
documented (and verified) by checking the appropriate “box”
in the chart matrix.
• Note:
• Example: Show Student how to build and read a Safe Chart

82

41
 Safe Chart & Safety Device Requirements
Subpart – H 30 CFR 250.842
API RP 14C Appendix E Safe Chart Buildup

SAC Reference A1.b.2 States the FA-1 SAC Reference A.1.c.2 States the FA-1
Flowline is Less than 10 Feet in Length Flowline has greater MAWP than SITP

SAC Reference A.1.d.2 States the FA-1

SITP 2650 Flowline has a FSV installed on the final
flowline segment

SAC Reference
A.1.a.2 States
the FA-1
Flowline has
greater MAWP
than SITP

FA-1 FA-2
MAWP 6000 MAWP 2000

What Well head and Flowline Parameters will you use to build Safe Chart data for the FA-1 Flowline
What SAC References will you use to eliminate the safety devices on the right side?
PSHPSLPSV FSV 83

Safety Analysis Function Evaluation Chart

(Safe Chart) (Example How to Read)
API RP 14C Appendix E

The FA-1 has all the required safety

devices SAC’D Out
The FA-2 has all the required safety
SITP 2650 devices SAC’D Installed

FA-1 FA-2
MAWP 6000 MAWP 2000 Why is the
The FA-2 Flowline MAWP is less PSV Installed?
than SITP if all header valves
are closed 84

42
 Safety Analysis Function Evaluation Chart
(Safe Chart) (Example How to Read)
API RP 14C Appendix E

Final Effect

Component ID
Verify Latest Revision Number Process Closure

Alternate Device

Safety Device

Process Follow line 11 till first and second

Process dots then follow line 2, 4 & 8 up to
Component
Component actuation device then up to see
ID #
Name end results on closure or alarms
85

Safe Chart Conclusion

• From each Wellhead to the Departing Pipelines, all process

vessels, components, associated equipment and systems must
have a relevant flow schematic and be listed on the BSEE
Approved SAFE Chart.
• Completion of the SAFE Chart provides the safety system
designers, facility personnel and BSEE inspectors with a means
of verifying correct design logic of the facilities basic safety
system.

86

43
 Pressure and Fired Vessels ASME Coded
Vessels Subpart - H 30 CFR 250.851 (a)

• Pressure and fired vessels greater than 15 psi or greater must

be designed, fabricated, and code stamped in accordance with
the applicable provisions of Sections I, IV, and VIII of the
American Society of Mechanical Engineers (ASME) Boiler and
Pressure Vessel Code & API RP 510.
• You must equip pressure vessels and compressors units with
both PSH, PSL, PSV, FSV sensors as required.
• Coded vessels ASME identification plate shall be permanently
affixed to the vessel,
• If ID plate is not attached the vessel must be taken out of
service until another tag is acquired or vessel is recertified.

87

ASME Process Component Certification

Identification Tag Subpart - H 30 CFR 250.851 (a)

• Maximum working pressure and working temperature

• Year of Manufacture
• Name of Manufacturer
• National Board number or drawing number (if
available)
• Any ASME and National Board stamps
• Additional stamped certifications such as HT (Heat
Treated) or RT-1 (Radiological Testing

44
 Pressure Vessels (Flare & Vent Scrubber)
Subpart - H 30 CFR 250.851

• Pressure and fired vessels (such as flare and vent scrubbers)

where the operating pressure is or will be at least 5 psig and
less than 15 psig
- Must employ a safety analysis checklist in the design of each
component.
- These vessels do not need to be ASME Code stamped as
pressure vessels.
- Therefore not required to be coded vessels

89

Horizontal Three Phase Separator

PSV, PSHL, and Range Chart Locations

PSV and PSHL is always sensing at the highest portion of the gas area

PSV Location In PSHL

Gas Area

Crystal
Digital
Gauge
Barton
Model Chart Recorder
202 & Sensing
Recorder Point
HOP & LOP 90

45
Pressure Safety Valve (PSV)
Subpart - H 30 CFR 250.851

• PSV’s (except for completely redundant relief valves), Setting

and Tolerances must be never be set no higher than:
- the maximum allowable working pressure (MAWP) of the
vessel or:
- maximum allowable operating pressure MAOP (Pipeline).
• A PSV is a secondary protection safety device that ensures the
production system components or process equipment will not
overpressure (Undesirable Event).

91

Pressure Safety Valve (PSV)

Subpart - H 30 CFR 250.851

• Must be designed and installed according to applicable

provisions of sections I, IV, and VIII of the ASME Boiler and
Pressure Vessel Code
• Must conform to the valve sizing and pressure-relieving
requirements specified as per design criteria,
• The outlet of the PSV must be able to discharge or relief
pressure to a safe location or in a safe manner (or to a
specific location like a vent/flare scrubber), to avoid striking
personnel and prevent the creation of a hazard, ignition
source or release of fluids

92

46
 Pressure Safety Valve (PSV)
Subpart - H 30 CFR 250.851
Subpart - H 30 CFR 250.880

• Should an ASME Coded PSV develop a leak, it is best to replace

it with an exact spare (from stock) that meets the
specification/installation requirements.
• PSV valves shall be either bench-tested or equipped to permit
testing with an external pressure source.
• The PSV main valve piston must be lifted during annual test.
• All Weighted disk vent valves used as PSV's on atmospheric
tanks may be disassembled and inspected in lieu of function
testing.
• PSV repairs should be done by a qualified PSV repair technician
• PSV Setting or Resetting can be accomplished by a T-2 qualified
person.

93

Pressure Safety Valve (PSV) (Relief Valve)

Subpart - H 30 CFR 250.851
Pinc P-429 ASME B&VC Section VIII (Appendix M 5.6)

• Pressure Safety Valves (PSV) are designed to exhaust

abnormal increasing pressure (the valve’s internal parts will
open-to-flow) as the component Pressure Setting (normally
the MAWP) is achieved or surpassed,
• When pressure is decrease the PSV will auto reset
• (No CRBBM required for manual reset).
• If a manual isolation valve is located beneath the PSV the
valve must be a full ported manual valve (Ball Valve)
capable of being locked in the open-to-flow placement
during normal operation
• API RP 14C Appendix 4 documents that PSV’s isolated by a
PSE, check valve or pilot operated PSV, Isolation valve is not
required.
94

47
Pressure Safety Valve Test Tolerance
Subpart-H 30 CFR 250.851 API RP 14C D.3.1

• PSV Test Tolerance

- For any PSV set at 70 PSI or less the test tolerance would be
(Plus) + or (Minus) - 2 PSI
- Example: PSV Setting 50 psi + Tolerance Levels

High
Tolerance 52 PSI
PSV +2 PSI
Setting 4 psi

50 PSI Low
Tolerance 48 PSI
- 2 PSI

95

Pressure Safety Valve Test Tolerance

Subpart-H 30 CFR 250.851 API RP 14C D.3.1

• PSV Test Tolerance

- For PSV set at anything above 70 PSI or greater the test
tolerance would be (Plus) + or (Minus) - 3 %
- Example: PSV Setting 1390 psi
- This PSV setting is recommended for a 1440 MAWP Process
Component for full PSV tolerance parameter coverage

High
Tolerance 1431 PSI
PSV +3 %
Setting 83 psi

1390 PSI Low

Tolerance 1348 PSI
-3%
96

48
Pressure Safety Valve Test Tolerance
Subpart – H 30 CFR 250.851 API RP 14C D.3.1

• PSV Test Setting, Tolerance and MAWP

- Note: Even though API RP 14C (Appendix D D.3.1) gives a
PSV test tolerance that will exceed the MAWP
- The CFR Regulation requires that the PSV high side test
setting or tolerance shall never exceed the process
component MAWP, MAOP, SITP, Gas Lift Supply Pressure .

High 1483 PSI

Tolerance BSSE Interprets this
tolerance setting as
PSV Setting +3 % being above the MAWP
86 PSI

1440 PSI Low

Tolerance 1397 PSI
-3%
97

How is the Process Component Operating

Pressure Determined?
Subpart - H 30 CFR 250.851 (b)

• Determining the HOP & LOP is done by using a “Pressure Chart

Recorder” (Range Chart)
• (Range Chart) will record the normal operating pressure no less
than four (4) continuous hours and no more more than 30 days
between HOP and LOP Ranges.
• Run new range chart at any time when the normal operating
system pressure changes by 50 psig or 5 percent, whichever is
greater.
• You must maintain the most recent pressure recording
information you used to determine operating pressure ranges
at your field office nearest the OCS facility or at another
location (Electronic Database) conveniently available

98

49
 Pressure Range Chart Recorder
Subpart - H 30 CFR 250.851

PSV Set @ 485 psi

LOP 275 psi PSV -5% = 460 psi
Highest Possible PSH
Setting is 460 psi
LOP 275 psi -15% = PSH Set @ 368 psi
PSL Set at 234 psi PSL Set @ 234 psi

Date On Operator’s Name

Platform ID
Time On
Spring Range Time Off

Component ID
PSV Setting to be
Noted on Range Chart MAWP @ 500 psig
PSV Setting @ 485 psig HOP 320 psi
for the Highest PSH PSV Setting -5% = 460 psi
Setting Possible
HOP 320 psi +15% =
Graduated chart PSH Set at 368 psi
numbers is required
99

PSHL PLC Scada Range Chart Example

Subpart-H 30 CFR 250.851

HOP
LOP

Range Chart Issues?

Which HOP & LOP settings to use
on this range chart?
Use the 30 day rule & print area
where the settings is shown!
This is not a usable range chart!
100

50
 PSHL System Range Chart Example
Subpart-H 30 CFR 250.851

All use the same range

chart because operating
pressures are equal across
with no BPV or choke
Installed , This is what we
call a system chart.

101

PSHL Setting Rounding Requirements

Subpart - H 30 CFR 250.851

• BSEE does not recognize decimal values only “whole” numbers

when calculating PSHL And Tolerance Settings.
- Example: HOP 966 psi +15% = 1110.9 psi
- PSH setting is 1110.9 psi Note: The High Side .9 is greater than
1110 psi so since this is the high side but is required to stay
within the 15% range, So just remove the decimal to round down
to 1110 psi to satisfy 15% or less requirement.
- Example: LOP 456 psi -15% = 387.6 psi
- PSL setting is 387.6 psi The Low Side .6 is greater than 387 psi
so since this is the low side and to stay within the 15% range, it
is required to just remove decimal and add one whole number
- Example: PSH = 625.8 Always go down to 625 psi
- Example: PSL = 425.8 Always go up to 426 psi
- The rounding requirements is for ALL Settings and Tolerances 102

51
PSH Pressure Safety High Settings
30 CFR 250.851 - API RP 14C D.3.2

• Rule 1: Pressure Safety High (PSH) – Set at Plus + 15% or 5

PSI (whichever is the greater apart) above the Highest
Operating Pressure (HOP).
HOP
• Examples: Range Chart

- 1060 + 15% = 1219 psi

HOP
- HOP = 1010 psi What is the PSH Setting?
1024 psi
- 1161 PSI
- HOP = 980 psi What is the PSH Setting?
1024 + 15%
- 1127 PSI
- HOP = 890 psi What is the PSH Setting? = 1177.6 psi
= 1177
- 1023 PSI PSH Setting

- Remember the high side rounding just drop the decimal point
103

PSH and PSV Pressure Settings

30 CFR 250.851 API RP 14C D.3.2

• Rule 2 states that you will use the (minus) – 5% below the
PSV setting as the highest Possible PSH setting limit.
• There is (4) four different pressure caps, PSV, SITP, Gas Lift
Supply, MAOP, (all -5%) to be taken into consideration.
• There is three requirements to follow when setting the PSH
- 1) Known HOP Parameter = HOP (Range Chart) = 1060 PSI

Step1 = HOP setting = 1060 psi +15% = 1219 psi
- 2) Known PSV Set Parameter = PSV Setting = 1250 PSI

Step 2 = PSV setting is 1250 - 5% = 1187 psi

Step 3 = Pick the smaller number between 1219 or 1187
- Which one is used for the highest possible PSH Setting ?
- PSH shall be set at 1187 psi which is – 5% below PSV setting
104

52
PSH and PSV Pressure Settings
30 CFR 250.851 API RP 14C D.3.2

Lets exercise an PSV/PSH example: Note: Always use the PSV Setting and Not the MAWP
1) MAWP on process component is 1440 psi
2) PSV Setting is = 1350 psi
3) Range chart (HOP) Highest Operating Pressure = 1126 psi
4) Step 1 = Calculate the range chart using the HOP Setting
5) Step 2 = Calculate the HOP = 1126 +15 % = 1294 psi
5) Using the PSV setting - 5% will give me the HIGHEST possible
PSH setting! PSV Setting = 1350 - 5 % = 1282 psi
6) Step 3 = Pick the smaller number 1294 psi or 1282 psi
7) Use the 1282 because this is the smaller number and the
Highest Possible PSH setting PSH 1282 psi

105

PSH and PSV Pressure Settings

30 CFR 250.851 API RP 14C

• Why the -5% PSH setting below the PSV set

pressure? (Hint: See Undesirable Events) HOP
Range Chart
- Setting the Pressure Safety High (PSH)
at the - 5% or 5 psi whichever is greater HOP = 1265 psi
PSV Setting = 1440
below the PSV set pressure is to ensure
that the PSH Activation for pressure Step 1
HOP 1265 + 15%
source is shut in before the PSV activates. = 1454.75
1454 PSH Setting
- Why is this so important?
Step 2
- The PSH is the primary protection for high PSV Setting – 5%
1440 – 5% = 1368 psi
pressure
Determine which is the
- The PSV is being the secondary protection lower pressure PSH Setting.
for overpressure 1368 psi would be the final
setting

106

53
 PSL Pressure Safety Low Settings
30 CFR 250.851 API RP 14C

• Pressure Safety Low (PSL) Set at Minus - 15% or 5 PSI

(whichever is greater) below the Lowest Operating
Pressure (LOP).
LOP
• Examples: Range Chart

- 760 - 15% = 646 psi

- LOP = 820 psi What is the PSL Setting? LOP

826 psi
- 697 PSI
- LOP = 578 psi What is the PSL Setting?
826 - 15%
- 492 PSI
- LOP = 210 psi What is the PSL Setting? = 702.1 psi
= 703
- 179 PSI PSL Setting

- Remember the low side rounding just drop the

decimal point and add one whole number 107

PSHL Pressure Safety Low Settings

5 PSI Rule 30 CFR 250.851 API RP 14C

• Pressure Safety High Low (PSHL) Set at Plus + or Minus

- 15% or 5 PSI (whichever is Greater) below the Highest or
Lowest Operating Pressure (HLOP) or use the 5 Psi Rule.
• Examples: Using the 5 PSI Rule (33)
- HOP 32 + 15% = 36 psi (36 – 32 = 4 PSI)
- HOP 32 + 5 psi = 37 psi (37 - 32 = 5 PSI)
- Which one do we use? The greater one above the HOP, 37 PSI
- LOP = 18 PSI What would be the PSL Setting?
- 18 - 15% = 16 PSI, 18 - 5 PSI = 13 PSI
- Which is greater from the LOP?
- So the PSL Setting would be 13 PSI
- HOP = 26 psi What would be the PSL Setting? 21 psi
108

54
 PSHL Tolerance Calculations
Subpart – H 30 CFR 250.851 API 14C H.4.2

• AS per API 14C there is a PSHL setting tolerance to help stay within
parameter levels when testing PSHL Pilots
• PSHL settings above 33 psi, Use the 5% + or – Tolerance Rule
• PSHL settings below the 33 psi, Use the 5 psi + or – Tolerance Rule
Remember: to Always PSH Setting
reset PSHL setting to Tolerance + or -5%
original PSH setting number

PSH Setting 1115 +5% Tolerance PSH Setting 1115 -5% Tolerance
+ 5% = 1170 psi Any settingokay
found between here is -5% = 1059 psi
per BSEE

PSH Setting
(Below 33 psi) Tolerance
+ or -5 psi

PSH Setting 32 psi + 5 psi PSH Setting 32 psi - 5 psi

Tolerance Tolerance
Any setting found between here is
+5 psi = 37 psi okay per BSEE
- 5 psi = 27 psi
109

PSHL = Pressure Safety High Low

Typical Pneumatic Axelson ESP PSHL Pilots

Axelson ESP PSHL Pilots

PSH

PSL

To Increase Set Pressure Turn Adjustment

Cap Clockwise
To Decrease Set Pressure Turn Adjustment Cap
Counter Clockwise
110

55
 PSHL = Pressure Safety High Low
Typical Electronic PSHL Pilots

• Pressure Sensor: The simplest form of an electronic pressure measurement

system is the pressure sensor. It is the pressure sensor which changes the physical
variable “pressure” into a quantity that can be processed electronically.
Pressure Sensors are used for sensing pressure, control and monitoring. The
pressure sensor is also the basis of electronic pressure measurement systems.
• Pressure Transmitters: a sub-group of pressure transducers, feature additional
reset and calibration options. With some sensor types for example, to reset the
measuring span over large ranges. This calibration option is usually referred to by
such terms as “scale down”, “span reset” or “turn down”.
• Pressure Transmitter and Pressure Transducer which is often called a pressure
transmitter, They are virtually the same thing except the transducer
converts pressure into an analog electrical signal, and also the
main difference being the kind or type of electrical signal each sends.
• A Pressure Transmitter sends a signal in milliamps (mA).
• A Pressure Transducer sends a signal in volts (V) or millivolt (mV) Next Level Up
• Smart transmitters such as Hart®, which also have logging capabilities, can be
calibrated, tested and reset via the control desk or hand terminals.

111

LSHL = Level Safety High Low

Typical Electronic LSHL Monitoring

• Differential Pressure Transmitter: This equipment will sense the difference in

pressure between two ports and produce an output signal with reference to a
calibrated pressure range. This sensor is used in oil & gas environments to measure gas
flow rate
• Level Transmitter: There are different types of electronic level indication,
• Displacer type transmitters: which rely on the principle of buoyancy with a
transmitter installed to monitor the level height
• Capacitance probes: Liquid level and interface are detected by measuring the
capacitance value between the wall of the vessel holding the liquid and the probe
itself.
• Magnetic level indicators (MLIs): External system where you see levels go up and
down, with sensors on the side, attached to monitor levels for transmitting to PLC
• Differential pressure level transmitters: Which measures the level pressure
differential span through a transducer which gives a millivolt valve to the PLC system.
The mechanics of transmitting the displacer movement because of the buoyancy force
from the wet side of the instrument to the dry side where it can be translated into an
electronic, or in earlier designs, a pneumatic, signal proportional to the liquid level
change.
• Radar or Ultrasonic level measurement techniques: The use of sound or radio or
electromagnetic waves.
112

56
Typical Electronic PSHL & LSHL Equipment

PSHL

LSHL
TSH

113

PSHL Pilots Spring Range Spring and

Pressure Piston - Must be a match set

Higher Pressure Range Lower

Lower
Pressure

Higher
Pressure

57
 PSHL Pressure Pilots, CRBBM, Indicator
Subpart – H 30 CFR 250.851 API 14C H.4.2

HOP = 65+15% = 74 psi Panel Indicator

Green - In Service
LOP = 40-15% = 34 psi PSL PSH Red - Out Of Service
34 psi 74 psi

Calibrated
Test Gauge Output to
Panel for SSV
Closure
Instrumentation
30# supply always CRBBM
through low side (Control Relay
first. Block & Bleed
Low side is to be Manual Reset
cleared first Relay)
before high side Pressure
will go into service Input for
Regulation
Testing
Purposes
By-Pass
Flagging
T-2 Qualified
Operator
Monitoring

+ 5% Tolerance
+ 3% 1436 PSV Set 446
Tolerance 1395 425 PSL -15%
1354 404 - 5% Tolerance
- 3%
1207 PSH +15%
1150
1093

116

58
 PSHL Operational Dead Band

• What is Dead Band?

- Dead Band is described as the range where a pilot trips out
of service to where it is able to reset or return to service. A
Sensor regains output pressure whenever the dead-band
range is surpassed.

117

Flowlines / Headers
Subpart - H 30 CFR 250.852 (a)

• You must equip flowlines from wells with both PSH and PSL
sensors. You must locate these sensors in accordance with
section A.1 of API RP 14C (Using range charts for HOP & LOP
settings)
• PSH sensor is not to be set above the flowline MAWP, SITP,
and the gas lift supply pressure.
• Note: If a FA-1 flow-line segment is longer (>) than 10 feet in
length, a extra PSL is required.
• Always VERIFY your work settings.

118

59
 Flowlines / Headers
Subpart - H 30 CFR 250.852 (c)

• If a well flows directly to a pipeline before separation, the

flowline and valves from the well located upstream of and
including the header inlet valve(s) must have a working
pressure equal to or greater than the maximum shut-in
pressure of the well unless the flowline is protected by one of
the following or the SITP is 1 ½ times greater:
- A relief valve which vents into the platform flare scrubber or
some other location approved by the District Manager.
- You must design the platform flare scrubber to handle,
without liquid-hydrocarbon carryover to the flare, the
maximum-anticipated flow of liquid hydrocarbons that may
be relieved to the vessel; or

119

Flowlines / Headers
Subpart - H 30 CFR 250.852 (c)(2)

- Two SSVs with independent PSH sensors connected to separate

relays and sensing points and installed with adequate volume
upstream of any block valve to allow sufficient time for the
SSVs to close before exceeding the maximum allowable
working pressure.
- Each independent PSH sensor must close both SSVs along with
any associated flow line PSL sensor
- If a well flows directly to the pipeline from a header without
prior separation, the header, the header inlet valves, and
pipeline isolation valve must have a working pressure equal
to or greater than the maximum shut-in pressure of the well
unless the header is protected by the safety devices as
outlined

120

60
High Integrity Pressure Protection System
API RP 17V (HIPPS)

• Where pressure relief that is in accordance with the requirements

contained within API 521 is not technically or economically
practical, (PSV Use) an alternative high integrity instrumented
approach to overpressure protection may be applied.
• An instrumented system based on the design, installation,
operation and maintenance of a High Integrity Pressure
Protection System (HIPPS), typically involving an arrangement of
sensors (pressure transmitters), final control elements (e.g.
valves, switches, motor starters, etc.), and a high integrity logic
solver configured in a manner designed to protect against
overpressure.
• The use of HIPPS is only to be applied when a traditional method
for relief system design, in accordance with API 521, is not
practical.
121

High Integrity Pressure Protection System

API RP 17V (HIPPS)

• HIPPS sensors, logic solvers and valves shall be functionally

independent from other protection layers, control and safety
systems. Functional independence ensures that failures within
another system cannot prevent operation of the HIPPS.
• The HIPPS shall be designed as an independent system in
addition to the PSH (or other protective functions) and
associated SDV required by Annex A.
• All lifecycle management requirements defined in API 75 shall
be applied to HIPPS systems.
• Electronic microprocessor based components (sensors, logic
solvers, etc.) shall be certified and implemented in accordance
with IEC 61508 for use in a safety instrumented system.

122

61
 High Integrity Pressure Protection System
API RP 17V (HIPPS)

• System shall act fast enough to prevent exceeding the

equipment design pressure (MAWP for vessels and MAOP for
piping systems).
- This shall be confirmed by modeling of the system response
to credible overpressure events.
- This simulation shall include analysis of overpressure
resulting from transient pressure waves produced by valve
closure.
• System shall be designed as fail safe.
• Manual shutdowns shall be provided unless otherwise
specified as part of the design documentation.

123

Flow Safety Valve (FSV)

Subpart - H 30 CFR 250.852 (g)

• A Flow Safety Valve (Check Valve) is a control assembly that

permits flow in only one outward direction (from the inlet-to-
outlet connection).
• It is also described as a device that minimizes or prevents
backflow of a flow stream.
• Every process outlet (Gas, Oil, Water, Well
Flow line, Gas Lift Input Line, Chemical
input lines) shall have an FSV installed in-
line.
• The FSV on the last FA flow line segment
is the only FSV tested

124

62
 Sensor Safety Device Function
Subpart - H CFR 30 250.853

• What function does a Sensor perform?

• A Sensor is a device that detects an abnormal operating
condition and transmits a signal to perform a specific
shutdown function.
• All shutdown devices, valves, and pressure sensors shall
function in a manual reset mode.
• Sensors with integral automatic reset like PSHL and LSHL shall
be equipped with an appropriate device to override the
automatic reset mode. (Manual Reset Required) (CRBBM)
• A PSV sensor is an integral automatic reset safety device that
does not require a CRBBM installed.
• All pressure and level sensors shall be equipped to permit
testing with an external source.
125

Control Relay Block and Bleed Manual Reset

Subpart - H CFR 30 250.853 (CRBBM)

• A Control Relay Block and Bleed Manual Reset (CRBBM) should be

thought of as an acknowledgement and or a permissive tool.
• This statement is defined next:
- Acknowledgement in the aspect that the operator is aware
of the safety sequence or condition requiring manual reset
action.
- Permission to achieve the next in-service status
(pressurization of the receiving control circuit to return to
normal operation).

126

63
Control Relay Block and Bleed Manual Reset
Subpart - H 30 CFR 250.853 (CRBBM)

Blocked

CRBBM

127

Level Safety High Low - (LSH)

Subpart H 30 CFR 250.853
API RP 14 C A.4.2.2.2. – A.5.2.2.2

• Level Safety High [LSH] condition is defined as:

• An abnormal increase in the fluid level within a process
component, that rises above its normal operating limit or
level.
• Level Safety High assemblies must always be tested with an
increasing fluid level.
• Level Safety High [Pneumatic] assemblies must be tested once
every month, not to exceed 42 days.
• Level Safety High [Electronic] assemblies must be tested once
every quarterly, not to exceed 120 days

128

64
 Level Safety High Low - (LSL)
Subpart H 30 CFR 250.853
API RP 14 C A.4.2.2.2. – A.5.2.2.2

• A Level Safety Low [LSL] condition is defined as:

- An abnormal decrease in the fluid level within a process
component, that falls below its normal operating limit or
level.
• Level Safety Low assemblies must always be tested with a
decreasing fluid level.
• Level Safety Low [Pneumatic] assemblies must be tested once
every month, not to exceed 42 days
• Level Safety Low [Electronic assemblies must be tested once
every quarterly, not to exceed 120 days

129

Level Safety High Low - (LSHL)

Subpart H 30 CFR 250.853
API RP 14 C A.4.2.2.2. – A.5.2.2.2

Fisher 2100 Series LSHL

130

65
 Logic Solvers (Electronic)
API RP 17V C.3.7

• What is a Logic Solver? Personal Computer - PC

• Computer hardware and software is used to connect
associated sensors and final elements together to make it
all work as designed logic. (PLC / Scada Systems)
• Logic Function
A function that performs the transformations between
input information (provided by one or more input
functions) and output information (used by one or more
output functions).
• Control circuit
• Electrical, pneumatic hydraulic transmission system (e.g.,
wiring, tubing, relays)
• That portion of either a safety system that performs one
or more logic function(s).
131

Pressure Safety High - (PSH)

Subpart - H 30 CFR 250.853

• Pressure Safety High (PSH) functions as a

Pressure Sensor when utilized in typical
safety systems to initiate Safety Valve (SSV
or SDV) closure, upon detection of
abnormal high pressure.
• An increase in monitored pressure above the
Pressure Safety High Pressure Setting will
result in a loss of output (instrument supply)
pressure to the receiving control circuit
causing a manual reset (CRBBM) to activate
and shut in the source press.
• A PSH Sensor will always be tested with a
rising or increasing external pressure source

132

66
 Pressure Safety Low - (PSL)
Subpart - H 30 CFR 250.853

• Pressure Safety Low (PSL) functions as a

Pressure Sensor when utilized in a typical
safety systems to initiate Safety Valve (SSV or
SDV) closure, upon detection of abnormal
low pressure.
• An decrease in monitored pressure above the
Pressure Safety Low Pressure Setting will
result in a loss of output (instrument supply)
pressure to the receiving control circuit
causing a manual reset (CRBBM) to activate
and shut in the source press.
• A PSL Sensor will always be tested with a
decreasing or lowering external pressure
source.
133

Surface Safety Valve – (SSV)

Subpart - H 30 CFR 250.853 API RP 14H

• The Surface Safety Valve Surface Safety Valve (SSV)

(SSV) located on the dry Location on Wellhead Dry Tree Assembly
tree wellhead assembly is
the primary barrier valve
shutting off the well source
when a detectable
abnormal condition occurs.
• Closure of the SSV must
not exceed 45 seconds
after automatic detection
of any abnormal condition

or actuation of an ESD/TSE.
134

67
Shut Down Valve - (SDV)
Subpart - H 30 CFR 250.853

• The Shutdown Valve is an automatically operated, Normally

Closed, (NC) flow control valve assembly that is installed on
process equipment to quickly shut off the source of inlet
pressure or flow during an emergency (ESD or TSE) or upon
the detection of an abnormal operating condition as per logic.
• A Normally Closed Valve such as the SDV will automatically
shift to the Closed-to-Flow status upon loss of the power
operating medium or instrument supply pressure.

135

Toxic Detector - (OSH)

Subpart - D 30 CFR 250.490
API RP 14C Appendix F

• OSH [Toxic Detector] are used in toxic service like in presence

of H2S, So2, Co2 environments
• The H2S toxic detectors require testing and calibration once
every [Bi-Weekly] two weeks

136

68
 Temperature Safety High - (TSH)
Subpart - H 30 CFR 250.853
Subpart - H 30 CFR 250.862

• The purpose of the TSH is to detect and respond to an

abnormal temperature increase above a specific
temperature setting.
• Pneumatic Temperature Controllers, Ex-Line, electrical
sensors and electronic transmitters can all be employed as
Temperature Safety High, safety devices on heated process
components utilized within production facilities.
Ex-Line Ex-Line
Electronic Thermal
Communicator

137

Temperature Safety Element – (TSE)

(Fusible Plug) API 14C A-1 Thru A-10
API RP 14C Table C-1 Guidelines

• TSE is a safety device used throughout the platform to

detect a fire on or around a process component
• Temperature Safety Elements, commonly known as Fusible
Plugs are special connection devices that have one end sealed
with eutectic (Lead) material (in solid form).
• Eutectic = mixture of several components, which melts
sharply below the melting point of any individual
component
• Fire Loop (TSE)

A pneumatic control line containing Temperature Safety
Elements (TSE) sensor used through out the platform to
detect a flame on or around a component.

138

69
 Temperature Safety Element – (TSE)
(Fusible Plug) API 14C A-1 Thru A-10
Subpart – H 30 CFR Part 250.862

• A total platform shutdown shall result upon the detection of a

fire TSE activation which is the same as an ESD activation.
• [TSE = ESD]
• TSE Installation and Locations Publication
• API RP 14C Table C-1 Guidelines

139

Ultraviolet Safety High - (USH)

Flame Detector/Fire Eye Sensor
Subpart – H 30 CFR Part 250.862

• The Ultraviolet Safety High (Flame Detector) is a discrete type,

electrical component that provides continuous monitoring for
the detection of a flame or fire within predetermined control
areas.
• USH Flame Detectors must be installed in specific locations as
defined in Electrical Codes
- API RP 500 / API RP 505
- API RP 14F / API RP 14FZ

140

70
 USV - Underwater Safety Valve
API RP 17V A.2.2.3 Wet Tree

• The Underwater Safety Valve [USV as its name suggest] is

underwater version of the dry tree wellhead assembly SSV.
On sub-sea completions, the USV is generally located in a
horizontal “run” of the underwater wellhead piping.
• For all practical purposes, the USV assembly operates in much
the same manner as the SSV does. However the physical
appearances, testing and structure of the USV and SSV are
quite different.

141

Ionization Safety High – (YSH)

30 CFR Part 250.862 Smoke Detector

• The Ionization Safety High [YSH - Smoke Detector] is a

discrete type, electrical device that is designed for the
continuous monitoring of smoke accumulation within
predetermined control areas.
• It is installed in specific locations as defined in Electrical
Codes
- API RP 500
- API RP 505
- API RP 14F
- API RP 14FZ

142

71
 Safety Device Sensors Symbols & ID
API 14C Table 2.1

• A standard method for identifying, abbreviation, and

symbolizing individual safety devices is needed to promote
uniformity when describing or referring to safety systems
components.
• This method can be used to illustrate safety devices on flow
diagrams and other drawings, and to identify an individual
safety device for any purpose.
• Abbreviations and symbols recommended are derived in so far
as possible, from Instrument Society of America (ISA) Standard
ISA-S5.1.

143

Safety Device Sensor Identification

API 14C Table 2.2 Process Variables

• Each safety device should be identified by a system of letters

used to classify it functionally
• The First letter identifies the measured or initiating process
variable. (Process Variables)
- P=Pressure
- L=Level
- T=Temperature
- F=Flow

144

72
 Safety Device Sensors Symbols & ID
API 14C Table 2.2

• Safety Devices
- The second letter identifies the device as a safety system
device.
- “S” for SAFETY shall be the second letter of the functional
device identification system
PSH

Always S for Safety

145

Safety Device Sensor Identification

API 14C Table 2.2

• Safety Devices
- The third letter refers to what the safety device

H= High

L = Low

V= Valve

E= Element
- Senses High or Low Sensing (PSH or PSL) or
- Acts upon or what type of function the device performs
Valve Action (PSV/PSE) or
- Fire Sensing Element (TSE)

146

73
Safety Device Sensor Identification
API 14C Table 2.2

Pressure High
Level Low
Safety
Temperature Element
Flow Valve
Initial Process Always Safety What it Senses or
Variable what its Job

147

Balloon Identifier Tails

API 14C Table 2.3

• Balloon with a tail indicates a safety

LSH
device associated with or attached
(installed) to a process component
• Balloon without a tail indicates a safety
device (installed) with general area
ASH
coverage and does not have a hard
connection to process components.
• Balloon with a dotted line indicates a OSH
safety device that is required but has
been removed (Not Installed) with a
SAC reference (Example: A.1.c.4)
• A.1.c.4 = Flowline Segment is protected PSV
by a PSV on an upstream segment
148

74
 Safety Device Sensor Symbols
API 14C Table 2.3 (Circular Balloon Tags)

Flow Safety Valve

Surface Safety Valve

Pressure Safety Valve

Boarding
Shut Down Valve Shut Down Pressure Safety
Valve Element 149

Safety Device Sensor Symbols

API 14C Table 2.3 (Circular Balloon Tags)

Flame Spark
Burner Safety Low Level Safety
Arrestor Arrestor
High Low

Temperature Safety Element

Temperature Safety High

150

75
 Safety Device Sensor Symbols
API 14C Table 2.3 (Circular Balloon Tags)

Underwater Safety Valve Water Injection Shut Down Valve

Subsea Isolation
Valve
Gas Lift Shut Down Valve Gas Injection Shut Down Valve
151

Safety Device Sensor Symbols

API 14C Table 2.3 (Circular Balloon Tags)

Analyzer Safety High Toxic Detector Pressure Safety

High Low

Surface Control Subsurface Safety Valve

SubSurface Control Subsurface Safety Valve

152

76
 Process Component Safety Device Balloons
API RP 14C Appendix A - API 14C Table 2.3

CRBBM 2 PSHL 4
5 FSV

SDV 1 PSV 3

Process 9
Component
LSL2
10
6 LSH LSL1
What do all these 7
safety devices protect? FSV 153 8

Safety Device Identification Balloons

API 14C Table 2.3

Located On The Wellhead Assembly

TSE SSV
PSHL FSV TSE
Wellhead

FA-1
Wellhead Flow
Tee Starts Here FA-2

FSV
PSV
TSE PSHL

LSH LSL
LSL
FSV
Note: TSE designations and
locations are symbolic and
FSV
are not intended to reflect
actual location or quantity.
See Table C-1 154

77
 Emergency Shutdown (ESD) System
Subpart - H 30 CFR Part 250.855

• The ESD system must conform to the requirements of

Appendix C, section C1, of API RP 14C, and the following:
- The pneumatic manually operated ESD valve(s) must be
quick-opening and non-restricted to enable the rapid
actuation of the shutdown system.
- Electronic ESD stations must be wired as de-energize to trip
circuits or supervised circuits
- You must maintain a schematic of the ESD that indicates the
control functions of all safety devices for the platforms on
the platform

155

Emergency Shut Down (ESD)

Subpart - H 30 CFR 250.855

• The Emergency Shutdown System [ESD] stations are safety

system control devices that allow facility personnel to
manually initiate a total facility shutdown whenever an
abnormal condition or an undesirable event is observed.
• They are manual control stations that are strategically located
throughout the facility (normally all exits) to initiate shutdown
of all wells and process stations.
• Activation of the ESD system shall result in the closure and
termination of all wells and sources to flow both at the SSV’s,
SCSSV’s, BSDV’s, and closure of all SDVs, Fired Components
and opening of all BDVs.
• This shall be a total facility shutdown.

156

78
 Emergency Shutdown (ESD) System
Subpart - H 30 CFR Part 250.855

• Emergency Shutdown System (ESD Station Locations) Is a

system of manual stations as per examples shown below.

Pneumatic Version Electronic Version

157

ESD Station Location Information

Subpart - H 30 CFR 250.855

• All ESD stations shall be noted on the facility station bill.

• When well-workover operations are conducted on a well with
the tree removed
- an emergency shutdown system (ESD) manually controlled
station shall be installed near the driller's console or well-
servicing unit operator's work station
- except when there is no other hydrocarbon-producing well
or other hydrocarbon flow on the facility

158

79
 Emergency Shutdown (ESD) System
Subpart - H 30 CFR Part 250.855
Boat Landing Only

• Only boat landings may utilize a loop of breakable synthetic

tubing (polyflo) in place of a handle so a vessel can hook loop
and pull it out tripping ESD safety function.
• This breakable loop is not required to be physically located on
the boat landing, but must be accessible from a vessel
adjacent to or attached to the facility
• Electronic ESD stations can be utilized at boat landing areas.
• Plastic ferrules are required to be used because of easy loop
removal.

159

Engine, Insulation, Spark Arrestors Air Intake

Shut Down Devices Subpart - H 30 CFR 250.856

• Exhaust piping from diesel engines shall be equipped with

spark arresters.
• All Diesel driven engines the air intakes shall be equipped
with a device to shut-down the diesel engine in the event of
runaway.
- Diesel engines, which are continuously attended, shall be
equipped with either remote operated manual or automatic
shutdown devices.
- Diesel engines, which are not continuously attended, shall
be equipped with automatic shutdown devices.

160

80
 Engine Emergency Shutdown Devices
Subpart - H 30 CFR Part 250.856

• The following diesel engines do not require a shutdown

device:
- Engines for fire water pumps;
- Engines on emergency generators;
- Engines that power BOP accumulator systems;
- Engines that power air supply for confined entry
personnel;
- Temporary equipment on non-producing platforms;
booster engines whose purpose is to start larger engines;
and
- Engines that power portable single cylinder rig washers.

161

Chemical Fire Fighting Systems

Subpart - H 30 CFR Part 250.860

• A major platform is a structure with either six or more

completions or zero to five completions with more than one
item of production process equipment.
• A minor platform is a structure with zero to five completions
with one item of production process equipment.
• A manned platform is one that is attended 24 hours a day or
one on which personnel are quartered overnight.
• A unmanned platform is one that is not attended 24 hours a
day or one on which personnel are not quartered overnight

162

81
 Hot Equipment Shielding
30 CFR 250.856 API RP 14C 4.2.5

° °
• Any surface with a temperature in excess of 160 (71 C)
should have protection when accidental contact of the hot
surface could be made by personnel within normal work or
walk areas.
• Protection may be in the form of guards, barriers, insulation,
or warning signs.
• Some mechanical components such as turbochargers, exhaust
manifolds, compressor heads, expansion bottles, and the like
(including associated piping) are exceptions; in these cases,
warning signs are acceptable.

163

Glycol Dehydration Units

Subpart - H 30 CFR Part 250.857

• You must install a pressure relief system or an adequate vent

on the glycol regenerator (reboiler) to prevent over
pressurization.
- The discharge of the relief valve must be vented in a
nonhazardous manner.
• You must install the FSV on the dry glycol inlet to the glycol
contact tower as near as practical to the glycol contact tower.
• You must install the shutdown valve (SDV) on the wet glycol
outlet from the glycol contact tower as near as practical to the
glycol contact tower.

164

82
 Gas Compressor Safety Devices
Subpart - H 30 CFR 250.858 API RP 14C

• You must equip compressor installations with the following

protective equipment:
- A pressure safety high (PSH) sensor, a pressure safety low
(PSL) sensor, a pressure safety valve (PSV), and a level safety
high (LSH) sensor, and a level safety low (LSL) sensor to
isolate and protect each interstage and suction scrubber.
- A temperature safety high (TSH) sensor on each compressor
discharge cylinder.
- You must design the PSH and PSL sensors and LSH controls
protecting compressor suction and interstage scrubbers to
actuate automatic SDVs located in each compressor suction
and fuel gas SDV and ignition kill switch.

165

Gas Compressor Safety Devices

Subpart H 30 CFR 250.858 API RP 14C

• An automatic blow-down valve (BDV) is required on the

discharge line of all compressor installations of 1,000
horsepower (746 kilowatts) or greater.
• For vapor recovery units, when the suction side of the
compressor is operating below 5 psig and the system is
capable of being vented to atmosphere
- You are not required to install PSH and PSL sensors on
the suction side of the compressor.

166

83
 Firefighting Systems
Subpart - H 30 CFR 250.859
API RP 14G Section 7.2
• A diagram of the firefighting system showing the location of
all firefighting equipment shall be posted in a prominent place
on the facility or structure (Station Bill)
• Fuel or power for firewater pump drivers shall be available for
at least 30 minutes of run time when fire pump system has
been activated
• Fire Water pumps shall be tested and documented weekly.
• Fire Pumps can be either diesel powered or electric pump
powered by facility power generators
• If necessary, an alternate fuel or power supply shall be
installed to provide for this pump-operating time unless an
alternate firefighting system has been approved by the
District Manager.
167

Firefighting Systems
Subpart - H 30 CFR 250.859

• All facilities shall utilize a fire water system unless BSEE has
facility approved for primary dry chemical coverage.
• A firewater system consisting of rigid pipe with fire hose
stations or fixed firewater monitors shall be installed.
• The firewater system shall be installed to provide needed
protection in all areas where production-handling equipment
is located.
• A fixed water spray system shall be installed in enclosed well-
bay areas where hydrocarbon vapors may accumulate

168

84
 Fire Fighting Systems
Subpart - H 30 CFR Part 250.859

- After 1 year of publication date, (11-07-2016) the Lessee

must have equipped all firewater pump drivers with
automatic starting capabilities upon activation of the ESD,
TSE, or other fire detection system.

For electric driven firewater pump drivers, in the event of a
loss of primary power,

you must install an automatic transfer switch to cross over
to an emergency power source in order to maintain at
least 30 minutes of run time. (Diesel Powered Backup
Generator)

169

Fire Fighting Systems

Subpart - H 30 CFR Part 250.859

• You must post a diagram of the firefighting system showing

the location of all firefighting equipment in a prominent place
on the facility or structure. (Station Bill)
• For operations in subfreezing climates, you must furnish
evidence to the District Manager that the firefighting system
is suitable for those conditions.
• All firefighting equipment located on a facility must be in
good working order whether approved as the primary,
secondary, or ancillary firefighting system.

170

85
 Fire Fighting Systems
Subpart - H 30 CFR Part 250.859

• Inoperable Firewater Systems. If you are required to maintain

a firewater system and it becomes inoperable,
- Either shut-in your production operations while making the
necessary repairs, or request that the appropriate BSEE
District Manager grant you a departure under 250.142 to use
a firefighting system using chemicals on a temporary basis
(for a period up to 7 days) while you make the necessary
repairs.
- If you are unable to complete repairs during the approved
time period because of circumstances beyond your control,
the BSEE District Manager may grant extensions to your
approved departure for periods up to 7 days.

171

Chemical Fire Fighting Systems

Subpart - H 30 CFR Part 250.860

• All Major platforms and minor manned platforms required a

fire water system unless there is an approved departure on
file
• To obtain approval to use a chemical-only fire prevention and
control system on a major platform or a minor manned
platform, in lieu of a water system, you must submit to the
District Manager:
- A justification for asserting that the use of a chemical system
provides equivalent fire-protection control. The justification
must address fire prevention, fire protection, fire control,
and firefighting on the platform; and
- A risk assessment demonstrating that a chemical-only
system would not increase the risk to human safety.
172

86
 Foam Firefighting System
Subpart - H 30 CFR Part 250.861

• When foam firefighting systems are installed as part of your

firefighting system, you must:
- Annually conduct an inspection of the foam concentrates
and their tanks or storage containers for evidence of
excessive sludging or deterioration.
- Annually send samples of the foam concentrate to the
manufacturer or authorized representative for quality
condition testing
- You must have the sample tested to determine the specific
gravity, pH, percentage of water dilution, and solid content

173

Foam Firefighting System

Subpart - H 30 CFR Part 250.861

• Based on these results, the foam must be certified by an

authorized representative of the manufacturer as suitable
firefighting foam per the original manufacturer's
specifications.
• If sample analysis is out of compliance replace foam ASAP
• The certification document must be readily accessible for
field inspection.
• In lieu of sampling and certification, you may choose to
replace the total inventory of foam with suitable new stock.
• The quantity of concentrate must meet design
requirements, and tanks or containers must be kept full
with space allowed for expansion.

174

87
 Fire and Gas Detection Systems
Subpart - H 30 CFR Part 250.862

• You must install fire (flame, heat, or smoke) sensors in all

enclosed classified areas.
• You must install gas sensors in all inadequately ventilated,
enclosed classified areas.
• Adequate ventilation is defined as ventilation which is
sufficient to prevent accumulation of significant quantities of
vapor-air mixture in concentrations over 25% percent of the
Lower Explosive Limits (LEL)
• A classified area is any area classified Class I, Group D, Division
1 or 2, following the guidelines of API RP 500, or any area
classified Class I, Zone 0, Zone 1, or Zone 2, following the
guidelines of API RP 505.

175

Analyzer Safety High (ASH) (Gas Detector)

Subpart - H 30 CFR Part 250.862

• The ASH is an electrical device that provides continuous

monitoring for the accumulation of gas vapors (in mixture with
air), within predetermined areas.
• As the gas vapor/air mixture increases to 25% of the lower LEL,
the ASH must indicate (yellow light indication) and alarm
(audible sound provided throughout the facility). Automatic
Reset
• At 60% of the upper LEL, the ASH must shut-in the facility
(additionally: audible sound throughout the facility, red light
indication, manual reset acknowledgement is required).

176

88
 Fire and Gas Detection System
Subpart - H 30 CFR Part 250.862

• A fuel gas odorant or an automatic gas-detection and alarm

system is required in enclosed, continuously manned areas of
the facility which are provided with fuel gas
• A gas detection system is not required for living quarters and
dog houses that do not contain a gas source and that is not
located in a classified area.
• Fire and gas detection systems shall be an approved typed,
designed and installed in accordance with API RP 14C, API RP
14G, and API RP 14F, API RP 14FZ, API RP 500, and API RP 505
Classification, Design and Installation of Electrical Systems for
Offshore Production Platforms.

177

Fire and Gas Detection System

Subpart - H 30 CFR 250.862 P-150

• When conducting quarterly (Flame, Heat, Smoke, Gas

Detection) inspections:
• Verify that the fire and gas detection system has an
automatic backup power source
• and is capable of continuous monitoring.
• BSEE inspector have noted a minimum at least (eight) 8
hours on battery power source.

178

89
Erosion
Subpart - H 30 CFR 250.864

You must have a program of erosion control in effect for wells

or fields that have a history of sand production.
The erosion-control program may include sand probes, X-ray,
ultrasonic, or other satisfactory monitoring methods.
You must maintain records by lease that indicate the wells that
have erosion-control programs in effect.
You must also maintain the results of the programs for at least 2
years and make them available to BSEE upon request.

179

Surface Pumps
Subpart - H 30 CFR 250.865

• This is acceptable if such a pump is used as a sump pump or

transfer pump,
- has a discharge rating of less than1/2 gallon per minute
(gpm), discharges into piping that is 1 inch or less in
diameter,
- and terminates in piping that is 2 inches or larger in
diameter.
• You must also install a TSE in the immediate vicinity of all
pumps in hydrocarbon service or those powered by platform
fuel gas.
• The pump maximum discharge pressure must be determined
using the maximum possible suction pressure and the
maximum power output of the driver.
180

90
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869

• This module will explain proper procedures for

- Achieving the By-Pass mode of operation including

Manual Bypassing

Proper flagging of by-passed safety devices

Proper Monitoring of by-passed safety devices
• Safety Devices is installed to ensure safe operation and
protection for facility personnel, environment and the
facility.
• A Bypassed Safety Device means a safety device installed as
part of the facility safety system and is rendered inoperable
by a person’s action that prevents the safety device from
performing its design function.

181

Out Of Service General Platform Ops

Subpart - H 30 CFR 250.869 (a)

• Surface or subsurface safety devices must not be bypassed or

blocked out of service unless they are temporarily out of
service for startup, maintenance, or testing.
• You may place only the minimum number of safety devices out
of service.
• Personnel must monitor the bypassed or blocked-out functions
until the safety devices are placed back in service.
• Any surface or subsurface safety device which is temporarily
out of service must be flagged.
• A surface or subsurface safety device which is temporarily out-
of-service shall be flagged with a contrasting visual indicator
(tag) to identify the bypassed safety devices

182

91
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869 NCBTS (a) (1)

You must follow the monitoring procedures as follows

• If you are using a non-computer-based system, meaning
your safety system operates primarily with pneumatic
supply or non-programmable electrical systems,
• Personnel must monitor non-computer-based system
bypassed safety devices by
- positioning monitoring personnel at either the control
panel for the bypassed safety device, (Highly
Recommended)
- or at the bypassed safety device,
- or at the component that the bypassed safety device
would be monitoring when in service.

183

Out Of Service General Platform Ops

Subpart - H 30 CFR 250.869 NCBTS (a) (1)

You must also ensure that monitoring personnel are able to

view all relevant essential operating conditions until all
bypassed safety devices are placed back in service
- and is able to initiate shut-in action in the event of an
abnormal condition.
• Examples of Manual Shut In Action:
- Simply place the safety device that was placed in bypass
mode back in service in which should shut in platform
depending what is bypassed
- ESD System Activation
• Monitoring shall not be interrupted for reasons such as
breaks, lunch or to greet personnel arriving on the facility
including BSEE, company personnel, third party personnel,
supervisors, etc. 184

92
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869

• A recommended safe practice is for personnel

engaging in production safety systems activities be
issued out-of-service tags uniquely identifiable to
each employee or to have access to an sign out A
Out-Of-Service flag board L
L
• The practice is required to be followed for placing E
N
surface safety devices temporarily out-of-service
during platform start-up, maintenance, or testing
activities.
• It is designed to ensure tags are utilized to identify
safety devices placed in by-pass and that they are
removed “only after” the Safety Sensor or Safety
Device is returned to the in-service mode of
operation or Shut-In
185

Out Of Service General Platform Ops

Subpart - H 30 CFR 250.869 NCBTS

• T-2 Qualified Operator must continuously monitor equipment at all times

affected by the By-Passing of Safety Sensors and Safety Devices.
• At the end of each day, each person needs to collectively conduct a review
of his or her OOS bypass tags to ensure a Temporarily Out-of-Service Tag has
not been inadvertently left on a by-passed Safety Device.
• Monitor any By-Passed safety device closely for any abnormal operating
conditions

T-2
Qualified
Operator

186

93
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869 CBTS (a) (2)

• If you are using a computer-based technology system,

meaning a computer-controlled electronic safety system such
as supervisory control, data acquisition and remote terminal
units,
• you must monitor computer-based technology system
bypassed safety devices by maintaining instantaneous
communications at all times among remote monitoring
personnel and the personnel performing maintenance,
testing, or startup.
• Until all bypassed safety devices are placed back in service,
you must also position monitoring personnel at a designated
control station that is capable of the following:

187

Out Of Service General Platform Ops

Subpart-H 30 CFR 250.869 CBTS (a) (2) (i)

• Displaying all relevant essential operating conditions that

affect the bypassed safety device, well, pipeline, and
process component.
- If electronic display of all relevant essential conditions
is not possible,
- You must have field personnel monitoring the level
gauges (sight glass) and pressure gauges in order to
know the current operating conditions.
- You must be in communication with all field personnel
monitoring the gauges;.

188

94
Out Of Service General Platform Ops
Subpart-H 30 CFR 250.869 (a) (2) (ii) (iii)
(iv) Computer Base PLC/Scada Systems

• Controlling the production process equipment and the

entire safety system;
• Displaying a visual indicator when safety devices are
placed in the bypassed mode; and
• Upon command, overriding the bypassed safety device
and initiating shut-in action in the event of an abnormal
condition.

189

Out Of Service General Platform Ops

Subpart - H 30 CFR 250.869 (a) (3) (i)

• You must not bypass for startup any element of the

emergency support system or other support system
required by API RP 14C, Appendix C without first
receiving BSEE approval to depart from this operating
procedure in accordance with departures (250.142).
• These systems include, but are not limited to:
- The ESD system to provide a method to manually
initiate platform shutdown by personnel observing
abnormal conditions or undesirable events.
- You do not have to receive approval from the District
Manager for manual reset and/or initial charging of the
system;
190

95
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869 (a) (3) (ii) (iii)

- An fire loop system (TSE) to sense the heat of a fire and

initiate platform shutdown, and other fire detection devices
(flame, thermal, and smoke) that are used to enhance fire
detection capability.
- An combustible gas detection system (ASH) to sense the
presence of hydrocarbons and initiate alarms and platform
shutdown before gas concentrations reach the lower
explosive limit,
- Or verify an adequate ventilation system;
- Have an operable containment system (Sumps) to collect
escaped liquid hydrocarbons and initiate platform
shutdown;

191

Out Of Service General Platform Ops

Subpart-H 30 CFR 250.869 (a) (3) (vi) (vii) (viii)

− Subsurface safety valves, including those that are self-

actuated (subsurface-controlled SSSV) or those that are
activated by an ESD system and/or a fire loop (surface-
controlled SSSV).
− You do not have to receive approval from the District
Manager for routine operations in accordance with 250.817
(Temporary removal of subsurface safety devices for
routine operations)
− An Operable pneumatic supply system
− A system (Vent or Flare System) for discharging gas to the
atmosphere.

192

96
 Out Of Service General Platform Ops
Subpart - H 30 CFR 250.869 (a)(4)(b)

− In instances where components of the ESD, are bypassed

for maintenance, precautions must be taken to provide the
equivalent level of protection that existed prior to the
bypass.
− When wells are disconnected from producing facilities and
blind flanged, or equipped with a tubing plug, or the master
valves have been locked closed, you are not required to
comply with the provisions of API RP 14C or this regulation
concerning the following: (Cont.)

193

Out Of Service General Platform Ops

Subpart-H (Cont.)
30 CFR 250.869 (a)(4)(b)(1)(c)(d)

- Automatic fail-close SSVs on wellhead assemblies, and

- The PSH and PSL sensors in flowlines from wells.
• When pressure or atmospheric vessels are isolated from
production facilities (e.g., inlet valve locked closed or inlet blind-
flanged) and are to remain isolated for an extended period of
time,
- Safety device testing in accordance with API RP 14C or this
subpart is not required, with the exception of the PSV or
installation of a PSE (Rupture Disk), Thermal Protection
is required
- PSV’s is to tested as required in API RP 14C Regulations
• All open-ended lines connected to producing facilities and wells
must be plugged or blind-flanged, except those lines designed to
be open-ended such as flare or vent lines.
194

97
 Out Of Service General facility Ops
Subpart-H 30 CFR 250.869
Group By-Passing Safety Devices

• Caution: When placing safety devices in By-Pass, extreme

precautions should be taken to insure that no other group or
groups of safety devices are inadvertently placed out-of-service
which will disable all safety devices on that group
Note: You may
Group Bypass
place only the Individual Safety Device Bypass By-Passed or In-Service
minimum number By-Passed or In-Service

of safety devices
out of service
When Indicator is Green = In Service Safety Device
Tagged OOS
When Indicator is Red = Out Of Service (OOS)
Group Holding
Pressure

Note: The use of group by-pass is a P-103 inc offense!!

195

Out Of Service General facility Ops

Subpart-H 30 CFR 250.869 (Review)

1. The person (operator) placing safety devices temporarily

out-of-service is responsible for the monitoring of the by-
passed safety device, and
2. Either at the component, device or panel of the by-passed
device until the safety device is placed back in service or
placed (OOS) Out Of Service, and
3. The person (operator) must also flag the bypassed safety
device using his or her own flagging tag, before by-passing
safety device, and
4. The person (operator) must not be performing any other
duties other than monitoring the bypassed safety device.

196

98
Out Of Service General facility Ops
Subpart-H 30 CFR 250.869 (Example)

Always Flag First Before Closing Safety

The Master Panel CRBBM Indicator Device Block Valves or ANY panel
shall have an OOS flagging tag bypass.
installed with a monitoring person
• Example: Testing a LSHL Bridle by Bleed Pressure Off first
Fill with fluid to test
showing the bridle block valve with level safety high (LSH)
OOS flagging installed
- The vessel or component manual
isolation LSHL bridle valves is
depicted as closed for testing or
maintenance with OOS tags placed
on valve handles as required,
- After testing safety devices verify
all valves open, placed back in
service, and OOS flags removed. Drain fluid to test
WC-504A
Level Safety Low (LSL) 197

Out Of Service General Platform Ops

Subpart - H 30 CFR 250.869

• Note: If the combination of multiple alarms cannot be

corrected (compliantly) with just one person,
- Either shut-in the affected process or processes up to and
including entire facility if necessary,
- Additional Personnel may be required to monitor each
component and/or device(s) placed out-of-service in order to
comply with the regulatory and safety requirements.

198

99
 Time Delays On PSL Sensors. (PSL Lockout)
Subpart - H 30 CFR 250.870

• You must apply industry standard Class B, Class C, and Class

B/C logic to all applicable PSL sensors installed on process
equipment, as long as the time delay does not exceed 45
seconds.
• Use of a PSL sensor with a time delay greater than 45 seconds
requires BSEE approval of a request under 250.141.
• You must document on your field test records use of a PSL
sensor with a time delay greater than 45 seconds. For
purposes of this section,

199

Atmospheric Vessels
Subpart - H 30 CFR 250.872

• You must ensure that all atmospheric vessels are designed and
maintained to ensure the proper working conditions for LSH
sensors.
- The LSH sensor bridle must be designed to prevent different
density fluids from impacting sensor functionality. For
atmospheric vessels that have oil buckets, the LSH sensor
must be installed to sense the level in the oil bucket.
• You must ensure that all flame arrestors are maintained to
ensure proper design function (installation of a system to
allow for ease of inspection should be considered).

200

100
 Flame Arrestor – (FA)
Subpart H 30 CFR 250.872
API RP 14C A.5.2.2.1

• A Flame Arrestor [FA] is a flame-restricting, aluminum element

core or cell (assembly) that prevents the propagation of a
flame or a flashback fire from exiting an enclosed area
(generally a burner firebox) to the outside atmosphere.
• It allows air for combustion to be drawn into the natural draft
burner assembly shown.
• A Flame Arrestor functions to prevent flame or spark
emissions from exiting a combustion chamber and igniting a
combustible source outside of a burn control area.
• Flame arrestors should be inspected visually once a year
(Annual) for proper operation.

201

Subsea Gas Lift Testing Requirements

Subpart H 30 CFR 250.873
API RP 17V C.3.2

Allowable Testing
Type of Gas Lift system Valve
leakage rate frequency

Gas Lifting a subsea pipeline, Monthly, not to exceed

pipeline riser, or manifold via an GLSDV Zero leakage
6 weeks.
external gas lift pipeline

Function tested
Gas Lift Isolation Valve GLIV N/A quarterly, not to exceed
120 days.
Gas Lifting a subsea well through
Monthly, not to exceed
the casing string via an external gas GLSDV Zero leakage
6 weeks.
lift pipeline
400 cc per minute of Function tested
Gas Lift Isolation Valve
GLIV liquid or 15 scf per Quarterly,
minute of gas Not to exceed 120 days.

Gas lifting the pipeline riser via a

Monthly
gas lift line contained within the GLSDV Zero leakage
Not to exceed 6 weeks.
pipeline riser
202

101
 Subsea Water Injection Test Requirements
Subpart - H 30 CFR 250.874

Follow the gas lift valve testing requirements according to the

following table:
• WIV = Water Injection Valve
• WISDV = Water Injection Shut Down Valve
• SSSV = Surface Control Subsurface Safety Valve
Monthly, not to exceed
WISDV Zero leakage
6 weeks.

Semi-annually, not to
Surface-controlled SSSV or 400 cc pm of liquid or
exceed
WIV 15 CFM of gas
6 calendar months.

Monthly
WISDV Zero Leakage
Not to Exceed 6 Weeks
203

Fired and Exhaust Heated Components

Subpart - H 30 CFR 250.876

• No later than 09-07-2018 and at least every 5 years thereafter

you must have a qualified third party remove, inspect, repair,
or replace tube-type heaters that are equipped with either
automatically controlled natural or forced draft burners
installed in either atmospheric or pressure vessels that heat
hydrocarbons and/or glycol.
• If removal and inspection indicates tube-type heater
deficiencies, you must complete and document repairs or
replacements.
• You must document the inspection results, retain such
documentation for at least 5 years, and make them available
to BSEE upon request.

204

102
Production Safety System Testing
Surface ESD & TSE Activation Closure Times

• This is required on the Shelf Facility or Deepwater Dry Trees

• ESD & TSE Activation will close the SSV, SCSSV, BSDV, SDV’s,
BDV, Etc.
• TSE System should be tested on a quarterly (90 Days) basis and
is a separate test from the required ESD monthly test.

Safety Device Testing Allowable Leakage Rate or

Surface Frequency other Requirements

Monthly Not exceed 45 seconds after ESD

SSV Closure
(30 Days) has been activated.
Not to exceed 2 minutes after the
Monthly
SCSSV Closure last SSV has closed when the ESD
(30 Days)
has been activated

205

Production Safety System Testing

Subsurface Subpart - H 30 CFR 250.880
API 14C H.3.2 & H.3.3 Dry Tree

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Dry Tree
Liquid 400 cc or Gas 15 cfm
SCSSV Failure requires the device be
Six (6) Months
(SPPE Certified) repaired or replaced
Closure Time 2 Minutes

SSCSV The valve must be removed,

Six (6) Months
inspected, and repaired or
Not installed in a
(SPPE Certified) adjusted, as necessary, and
landing nipple
reinstalled or replaced.

The valve must be removed,

SSCSV Twelve (12) Months
inspected, and repaired or
Installed in a landing
adjusted, as necessary, and
(SPPE Certified) nipple
reinstalled or replaced.
206

103
 Production Safety System Testing
Dry Tree Subsurface 30 CFR 250.880
API 14C H.3.2 & H.3.3 Dry Tree

Safety
Allowable Leakage Rate or
Device Testing Frequency
other Requirements
Dry Tree
Liquid 400 cc > or Gas 15 scf >
the plug must be removed,
repaired, and reinstalled, or
Tubing Plug Six (6) Months
replaced.
An additional tubing plug may be
installed in lieu of removal.
Liquid 400 cc or Gas 15 scf
Test by opening the well to
possible flow
Six (6) Months
Injection Valve Exceedance failure requires the
device be removed, repaired,
reinstalled, or replaced

207

Production Safety System Testing

Surface Valves Subpart - H 30 CFR 250.880
API RP 14C D.3.1

Safety Device Testing Allowable Leakage Rate or

Surface Frequency other Requirements

Valve must either be bench-tested

or equipped to permit testing with
an external pressure source.
Twelve (12) Months
PSV
Weighted disc vent valves used as
Not to Exceed (13)
PSVs on atmospheric tanks may be
Pressure Safety Valve Months between
disassembled and inspected in lieu
tests
of function testing.
The main valve piston must be
lifted during this test.

208

104
Production Safety System Testing
Surface Valves Subpart - H 30 CFR 250.880

Safety Device Testing Allowable Leakage Rate or

Surface Frequency other Requirements

SDV
(Shut Down Valve)
Once a Month
Automatic inlet that Operational Only
Not to Exceed Six
are actuated by a
(6) Weeks
sensor on a vessel Closure Time 45 Seconds
or compressor

SDV in liquid discharge

Once a Month Operational Only
lines and actuated by
Not to Exceed Six
vessel low-level
(6) Weeks Closure Time 45 Seconds
sensors

209

Production Safety System Testing

Surface Valves Subpart - H 30 CFR 250.880

Safety Device Allowable Leakage Rate or

Testing Frequency
Dry Tree other Requirements

Zero (0) Leakage Rate

Closure Time 45 Seconds Max
SSV Valves must be tested for both
Once a Month
Surface Safety operation and leakage. If an SSV
Not to Exceed Six (6)
Valve does not operate properly or if
Weeks (42 Days)
(SPPE Certified) any fluid flow is observed, the
valve must be immediately
repaired or replaced

210

105
Production Safety System Testing
Surface Valves Subpart - H 30 CFR 250.880
API RP 14C D.3.6

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Dry Tree
Leakage 400 cc or 15 scf >
FSV must be repaired or
Once a Month
replaced
FSV All Flowline FSVs must be
Not to Exceed Six (6)
tested, including those
Weeks
Flow Safety installed on a host facility in
Valve lieu of being installed at a
The FSV on the last
satellite well.
flow line segment is
Well Flowline You must test FSVs for
the only FSV tested
leakage in accordance with
the test procedure specified
in API RP 14C

211

Production Safety System Testing

Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface
Must be tested for operation
and recalibrated every 3 months
provided that testing can be
TSE performed in a non-destructive
manner.
Temperature
Safety Element Quarterly Closure Time Host Facility
SSV 45 Seconds
(Fire, Flame, Three (3) Months BSDV 45 Seconds
Heat Detection SCSSV 2 Minutes
Systems)
Note: ESD and TSE
Host Facility activation testing is a
required two separate test
activations 212

106
Production Safety System Testing
Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface

Must be tested for operation

USH
Quarterly and recalibrated every 3 months
Fire (Flame)
provided that testing can be
detection
Three (3) Months performed in a non-destructive
systems
manner.

Must be tested for operation

YSH
Quarterly and recalibrated every 3 months
Smoke
provided that testing can be
detection
Three (3) Months performed in a non-destructive
systems
manner.

213

Production Safety System Testing

Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface

Must be inspected and operated

Fire Water Seven (7) Days Weekly
according to API RP 14G, Section
Pumps Not to Exceed (7) Days
7.2 (75 psig min) (180 GPM)

25% LEL Indicate and Alarm

ASH
60% UEL Total Platform
Analyzer
Shutdown
Safety High Quarterly
Verify Backup Power will last at
Combustible Three (3) Months
a minimum of 8 hrs.
Gas Detection
API RP 14F API RP 14G
Systems

214

107
Production Safety System Testing
Surface Safety Devices Subpart - H
30 CFR 250.880 API RP 14C D.3.8

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface

OSH - (Toxic)
Must be tested for operation
H2S - Hydrogen Bi Weekly
and recalibrated Bi-Weekly.
Sulfide
Detection Fourteen (14) Days
Not to exceed 14 Days
Systems
>20 PPM

SO2 - (Toxic) Must be tested for operation

Quarterly and recalibrated every 3 months
Sulfur Dioxide provided that testing can be
Detection Three (3) Months performed in a non-destructive
Systems >2PPM manner.
215

Production Safety System Testing

Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface
You must conduct the test by
ESD
Monthly alternating ESD stations
Pneumatic
(30 Days) monthly to close at least one
based
not to exceed 6 weeks. wellhead SSV and one SCSSV
(Twelve times a year) Closure
Host Facility
Closure Time 45 Seconds
The test must be conducted by
ESD Quarterly
alternating ESD stations to close
Electronic (90 Days)
at least one wellhead SSV and
Based Once every three
verify a surface-controlled SSSV
calendar months
closure for that well as indicated
Host Facility Not to exceed 120 days
by control circuitry actuation.
between tests
Closure Time 45 Seconds
216

108
 Production Safety System Testing
Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety Device Allowable Leakage Rate or

Testing Frequency
Surface other Requirements

TSH Those that could be destroyed by

Temperature testing must be visually inspected
Annual
Safety High and the circuit tested for
operations at least once every 12
Twelve (12) Months
Fired months. Verify settings versus
Components documentation (Ex-Line)

Installed on compressor
TSH
Bi-Annual installations that can be
Temperature
nondestructively tested
Safety High
Six (6) Months
Repaired or replaced as
Compressor
necessary Verify settings versus
Discharge Bottle
documentation (Ex-Line)
217

Production Safety System Testing

Surface Safety Devices
Subpart – H 30 CFR 250.880

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface

BSL
Burner Safety Twelve (12) Months Activation Time 45 Seconds
Low

FSL
Activation Time 45 Seconds
Flow Safety Twelve (12) Months
Low

FA - Flame
Arrestor
Twelve (12) Months Visual Inspection
SA - Spark
Arrestors
218

109
 Production Safety System Testing
Surface Safety Devices
Subpart – H 30 CFR 250.880

Allowable
Safety Device
Testing Frequency Leakage Rate
Surface
(Electronic) or other
(Electronic)
Requirements

Electronic 45 Second
Activation
Pressure Safety High - PSH
Quarterly
Pressure Safety Low - PSL PSHL & LSHL must
Three (3) Months
always be tested
But no more than (120
Level Safety High - LSH with an increasing
Days) between tests
Level Safety Low - LSL or decreasing
pressure or level
Electronic Scada / PLC

219

Production Safety System Testing

Surface Safety Devices Subpart – H
30 CFR 250.880 API RP 14C D.3.2

Allowable
Safety Device
Testing Frequency Leakage Rate
Surface
(Pneumatic) or other
(Pneumatic)
Requirements
Pressure Safety High - PSH
Pressure Safety Low - PSL
45 Second
Level Safety High - LSH Activation
Level Safety Low - LSL Once each calendar
Month with no more PSHL & LSHL must
PSH and PSL with than 6 weeks (42 Days) always be tested
Pneumatic/electronic switch elapsed time between with an increasing
test or decreasing
LSH and LSL controls with pressure or level
Pneumatic/electronic
switch/electric analog with
mechanical linkage
220

110
Production Safety System Testing
Subsea SCSSV Safety Devices
Subpart - H 30 CFR 250.880 API RP 17V C.3.5

Allowable Leakage
Safety Device Testing
Rate or other
Subsea Frequency
Requirements

If the device does not

SCSSV
operate properly, or if a
liquid leakage rate > 400
(SPPE Certified)
cc or a gas leakage rate >
Semi-annually 15 scf,
(Surface Controlled Sub
not to exceed 6 The device must be
Surface Safety Valve)
months removed, repaired, and
reinstalled or replaced.
(including safety devices
To ensure proper
installed in shut-in and
operation, or as approved
injection wells)
in facility DWOP.

221

Production Safety System Testing

Subsea Primary USV Safety Devices
Subpart - H 30 CFR 250.880 API RP 17V C.3.2

Allowable
Safety Device Testing Leakage Rate or
Subsea Frequency other
Requirements

If the device does not

USV function properly, or if
a liquid leakage rate
(SPPE Certified) Quarterly, 400 cc or gas leakage
Not to exceed rate 15 scf is observed,
Underwater (120 days) the valve must be
Safety removed, repaired and
Valve reinstalled, or replaced
as per facility DWOP

222

111
 Production Safety System Testing
Subsea BSDV Safety Devices
Subpart - H 30 CFR 250.880 API RP 17V C.3.2

Safety Device Allowable Leakage Rate

Testing Frequency
Subsea/Surface or other Requirements

BSDV
Zero (0) Leakage Tolerance
(SPPE Certified) Valves must be tested for both
operation and leakage.
Boarding Shut Down
Monthly
Valve You must test according to API
RP 14H for SSVs.
Not to exceed 6 weeks
Located at Host
(42 Days)
Facility If a BSDV does not operate
properly or if any fluid flow is
45 Seconds Closure
Protects the Host observed during the leakage
from the Subsea test, the valve must be
Well & Flowline from immediately repaired or
any Abnormal replaced
Conditions 223

Production Safety System Testing

Subsea Safety Devices
Subpart - H 30 CFR 250.880 API RP 17V C.3.2

Safety
Allowable Leakage Rate
Device Testing Frequency
or other Requirements
Surface
One rotating electronic ESD
Monthly station must be tested
ESD
(30 Days) through a logic simulation at
Electronic
Not To Exceed Six least once a month and
Based (Logic)
6 Weeks documented
Activation Time 45 Seconds
Shut-in at least one well
ESD during the ESD function test.
Quarterly
Electronic & If multiple wells are tied back
(90 Days)
Pneumatic to the same platform, a
Not to exceed 120 days
Combination different well should be shut-
between tests
Based in with each quarterly test.
Activation time as per DWOP
224

112
Production Safety System Testing
Subsea ESD Safety Devices 250.880
Subpart - H 30 CFR 250.880 API RP 17V C.3.2

Safety Device Testing Allowable Leakage

Subsea Frequency Rate or other
(Electronic) (Electronic) Requirements

Shut-in at least one well

during the ESD function
ESD
test.
Electronic Function Tested quarterly,
If multiple wells are tied
Subsea Single & Multiple not to exceed 120
back to the same
Incoming Wells days
platform, a different well
should be shut-in with
each quarterly test.

225

Records
Subpart - H 30 CFR 250.890

• You must maintain records that show the present status and
history of each safety device.
- Your records must include dates and details of installation,
certifications, removal, inspection, testing, repairing,
adjustments, and reinstallation.
- Documents for SSV, SCSSV, SSCSV, and SSSV Landing Nipples,
and Locks kept indefinitely in well file at field office
• You must maintain these records for at least 2 years.
- You must maintain the records at your field office nearest the
OCS facility and at a secure onshore location.
- These records must be available for review by a representative
of BSEE.

226

113
 Records and Training
Subpart – H 30 CFR Part 250.890

• You must submit to the appropriate District Manager a

contact list for all OCS operated platforms at least annually or
when contact information is revised.
• The contact list must include:
(1) Designated operator name;
(2) Designated person in charge (PIC);
(3) Facility phone number(s), if applicable;
(4) Facility fax number, if applicable;
(5) Facility radio frequency, if applicable;
(6) Facility helideck rating and size, if applicable; and
(7) Facility records location if not contained on the facility

227

Flaring / Venting Requirements

Subpart – K 30 CFR 250.1160 thru 1164

• During an equipment failure or repairs to relieve system

pressure, or unloading a well, the lessee must not flare or vent
flash gas or oil-well gas for more than 48 continuous hours
unless the BSEE Regional Supervisor approves.
• Lessees must not flare or vent well gas from a facility for more
than 144 cumulative hours during any calendar month unless
the lessees gets approval from the Regional Supervisor for any
extensions
• During an equipment failure or to relieve system pressure the
lessee must not flare or vent gas-well gas for more than 2
continuous hours unless the BSEE Regional Supervisor
approves
• You must document and report all vented or flared gas to BSEE
228

114
Civil Penalties Assessment Matrix
Subpart - N 30 CFR 250.1403 NTL 2016-N05

229

Station Bill
USCG 33 CFR 146.130

• Station Bill is a posted notice which sets forth the special

duties and duty stations of each member of the personnel of a
manned platform for emergencies
• Station Bill contains specific duties and duty stations for
facility personnel in case of an emergency.
• The station bill should be shown where all facility noted info is
located during orientation phase.
• It contains specific signals for emergency stations and for the
abandonment of the facility.
• It shall list the use and application of any special equipment to
be provided in an emergency.
• The station Bill shall be signed by the PIC and posted in a
conspicuous place on the facility.
230

115