285 / 1145
following a shutdown, often preferred for reservoir management, the gas cap can grow and
be further pressurised; the riser becomes fully packed, sometimes to several hundred bar.
Releasing this high pressure gas cap too quickly presents significant hazard potential to the
HP Separator, which is downstream of the HP/LP interface. This should normally be safety
accomplished by first opening the relevant shutdown valves, and then through the slow
opening of a topsides choke valve (HCV), see figure 2. However, should the choke valve be
opened too quickly, or should the choke be inadvertently opened before the shutdown valves
are opened, the HP separator will be subjected to a very large overpressure. A packed riser
can be inadvertently de-packed across each of the four valves shown in figure 2. The
Separator pressure relief system is unlikely to be sized for this very rapid release of
pressure.
Figure 2 – Production riser lined up to the HP Separation train.
The riser de-packing hazard can be significant because the consequence is a high energy
event during a start-up operation when personnel will be in the hazard zone. With multiple
risers, and/or multiple start-ups, there are potentially several opportunities for error per year.
1.3.2 Oil Cargo pump line-up
Another overpressure hazard where an operator error is the initiating event, is presented by
the Oil Cargo Pump misalignment. Oil Cargo pumps may be lined up for a for a variety of
different functions including cargo transfer between tanks, offloading, tank-stripping and tank
washing. In some scenarios, a hazard is caused by opening of an on/off valve out of
sequence, and because the system is liquid filled, the overpressure hazard develops in
milliseconds. Hazards are less significant than in the riser depacking case, but are worthy of
some attention because of the lessons that can be learnt from these cases.
2
Challenge for SIL assessment
2.1
Frequency
Initiating Event frequency will depend on the number of opportunities and operator error rate.
To estimate this, it’s necessary to unravel the different scenarios, in order to define the
number of times each valve is opened per year. Different valve combinations can be the
result of operator error, global process or emergency shutdown functions (which may close
different combinations of valves), or even failure to close of valves.