Menu

Recommendation on Emergency Shutdown Requirements (ESD) for Mobile Offshore Drilling Unit (MODU)


1. INTRODUCTION

1.1 Purpose

This article is to provide the Emergency Shutdown Requirements (ESD) requirements for each subsea center in a particular field when the Mobile Offshore Drilling Unit (MODU) is working above a subsea center.

2. REFERENCES

2.1 Codes and Standards

API 6A Specification for Wellhead and Christmas Tree Equipment
API 14D Specification for Wellhead and Surface Safety Valves and Underwater Safety Valves for Offshore Service
API 17D Specification for Subsea Wellhead an Christmas Tree Equipment
API 17F Specification for Subsea Production Control Systems
API 505 Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class I, Zone 0, Zone 1 and Zone 2
IEC 61508 Functional Safety of Electrical/Electronic/Programmable Electronic Safety Related Systems
IEEE Recommendations for Electrical and Electronic Equipment on Mobile and Fixed Offshore Installations

2.2 Terms and Abbreviations

The following abbreviations and definitions are used in this document:

API American Petroleum Institute
DCS Distributed Control System
ESD Emergency Shutdown
ESS Emergency Shutdown System
ETU Electronic Test Unit
FSC Fail Safe Closed
FSO Fail Safe Open
HPU Hydraulic Power Unit
HP High Pressure
LP Low Pressure
IWOCS Installation / Workover Control System
MCS Master Control Station
MODU Mobile Offshore Drilling Unit
PSD Process Shutdown
ROV Remote Operated Vehicle
SCM Subsea Control Module
SCSSV Surface Controlled Subsea Safety Valve

3. ESD Philosophy

3.1 General

For any ESD initiated by the ESS on the host facility, the production trees must be shut-in by closing the choke first. Rapid close chokes have been specified for this reason. Closing the tree by using a gate valve while high velocity flow is moving through that valve can potentially damage the seal surface on the gate and seats. Gate valves closing under high flow rate conditions can also expose the flowline system to the effects of water hammer. The production controls system will be programmed to initiate the shut-in by closing the choke first, and allow up to 45 seconds for each choke to close if possible.

In order to prevent flowline packing, all production trees within a subsea center must be closed within four minutes. In most cases, simultaneous choke operations are required to close all production wells within this time frame. Without subsea accumulation, the control system pressure may drop to the point that some of the Fail Safe Closed valves, including primary master and wing valves, would begin to creep closed, thereby exposing them to the risk of gate and seat damage.

As production tree chokes are closed, the next tree in the sequence should begin its ESD sequence starting with choke closing. If pairs of trees are closed simultaneously, then each pair can begin as the previous trees chokes are closed. The entire tree closing sequence does not have to be complete for the next production tree to start its shutdown sequence. Gas lift choke positions on the production trees are not changed during any ESD.

Water injection trees will also be closed during all ESD processes. Since the water injection trees do not have a time frame in which to be closed within, the chokes will not be used in order to reserve hydraulic pressure for the production trees. Export valves on the water injection flowlines will be closed when the water injection pumps are turned off therefore flow will be minimal. Wing valves on the water injection trees will be vented first, and then the remaining tree valves will be vented closed. The choke positions will not be changed. The water injection trees will be closed after all production trees have been closed but prior to the LP circuits being vented at the HPU.

The Gas Injection Valve will be the only valve closed on manifolds during an ESD, however, the ESD sequence will check to ensure all methanol injection valves are closed. All other manifold valves will not be operated or vented by the MCS system during any ESD but will be affected if the HPU supply pressure is vented (depends on the type of ESD). Production Header, Test Header, and Cross-Over Valves will fail into their current position (fail as is valves). All Test Branch Valves and Methanol Injection Valves along with the Gas Lift Header Isolation Valve will close as the HPU LP supply is vented. Production Branch Valves will remain open or will open (if closed) if the HPU LP supply is vented.

3.2 Emergency Shutdown System

The platform controls including an ESD which receives shutdown commands from several of areas within the platform and for a variety of reasons. When a shutdown which involves the subsea production system, is initiated, either a hardwired signal or communications signal is sent to the MCS and the MCS begins the shutdown sequence.

Hardwired signals are a direct connection between the ESS and the MCS through a pair of wires. A continuous 24 volts (or similar) is applied to the circuit and if the power is disconnected, the shutdown sequence will begin in the MCS. This arrangement is the most reliable method of ensuring the MCS receives the command to begin a shutdown of the subsea facilities. An alternative method is to use communication signals through the MCS over the RS485 Modbus link. The ESS can communicate with the DCS for a particular shutdown which can relay the message to the MCS. This type of ESD signal will be used for non-critical and minimal impact shutdowns as described below.

As a safety measure, timers will be implemented for critical ESDs which, when initiated, will vent the HPU and umbilicals in the event the MCS fails to close production wells. The timers will be located in the ESS and will consist of two modes to vent the LP circuits within a predefined time frame and then to vent the HP circuits after the LP is fully vented (based on time frame calculated from the detailed design hydraulic analysis). Four timers will be required on these HP and LP circuits to separate the A & B subsea centers from the C subsea center.

Once all wells within a subsea center (or centers for A & B) are closed by the MCS, the MCS will send a confirmation 24-volt signal back to the ESS. For a level 2 ESD (ESD2) this timer will be stopped if the MCS sends a confirmation signal to the platform Emergency Shutdown System (ESS) that ALL wells have been closed properly. An Abandon Platform, Level 1 ESD (ESD1), or MODU ESD (Rig ESD) will not stop the HPU/umbilical venting timer but the confirmation signal will be logged. 

3.3 Subsea Center Shutdown Sequence

The following sequence will be used for a complete shutdown of production trees and water injection trees on each subsea center in the order shown. The MCS will have programmed sequences for subsea centers A&B as one program and a separate program for subsea center C in order to accommodate the MODU ESD requirements.

  1. Production flowline boarding valves, gas export valves, and water injection export valves are closed (by topsides)
  2. ESS timer’s for HPU vent begins for HP and LP circuits
  3. MCS timer for Water Injection Trees shutdown begins
  4. Manifold Gas Injection Valve (GHIV) Closed
  5. Production Tree ESD sequence begins for all Production Trees:
    • Methanol Injection Isolation Valve Closed (MIIV)
    • Methanol Injection Valve 1 Closed (MIV1)
    • Methanol Injection Valve 2 Closed (MIV2)
    • Chemical Injection Valve Tree Closed (CIVT)
    • Chemical Injection Valve Downhole Closed (CIVD)
    • Production Choke Closed (PCV)
    • Production Wing Valve Closed (PWV)
    • Cross-over Valve Closed (XOV)
    • Production Master Valve Closed (PMV)
    • Annulus Wing Valve Closed (AWV)
    • Annulus Master Valve Closed (AMV)
    • Surface Controlled Subsurface Safety Valve Closed (SCSSV)
  6. MCS sends confirmation signal to ESS that ALL production trees are closed
  7. Water Injection Tree ESD begins:
    • Injection Wing Valve Closed (IWV)
    • Cross-over Valve Closed (XOV)
    • Injection Master Valve Closed (IMV)
    • Annulus Wing Valve Closed (AWV)
    • Annulus Master Valve Closed (AMV)
  8. ESS will vent the LP circuits when the timer reaches 10 minutes (unless the timer was turned off for ESD2 or Light Oil Train)
  9. ESS will vent the HP circuits when the timer reaches 40 minutes (unless the timer was turned off for ESD2 or Light Oil Train)

3.4 Abandon Platform

An abandon platform ESD signal will be generated by either the control room operator or other key personnel on the platform. The ESS will send the hardwired signal to the MCS to begin the shutdown sequence for ALL subsea centers. The HPU will vent all hydraulic pressure at the end of the separate LP and HP specified times.

3.5 ESD Level 1

An ESD Level 1 will be initiated by either the control room operator or other key personnel on the platform. The ESS will send the hardwired signal to the MCS to begin the shutdown sequence for ALL subsea centers. The HPU will vent all hydraulic pressure at the end of the separate LP and HP specified times.

3.6 ESD Level 2

An ESD Level 2 will be initiated by either the control room operator or other key personnel on the platform. The ESS will send the hardwired signal to the MCS to begin the shutdown sequence for ALL subsea centers. The HPU will vent all hydraulic pressure if confirmation that all subsea wells are closed is not received by the ESS from the MCS.

3.7 Water Injection Tree Shutdown Sequence

In the event all three water injection pumps are inoperable or the water injection system is shutdown, the subsea water injection trees will be closed. A communication signal will be sent to the DCS system from the ESS defining this process interruption. The DCS will automatically initiate the command through its serial link to the MCS system to begin the shutdown sequence for the water injection trees. The MCS will have one programmed sequence for all subsea centers.

The following sequence will be used to shutdown water injection trees on each subsea center in the order shown:

  1. Water Injection Export Valve is closed (by topsides)
  2. Water Injection Tree ESD begins:
    • Injection Wing Valve Closed (IWV)
    • Cross-over Valve Closed (XOV)
    • Injection Master Valve Closed (IMV)
    • Annulus Wing Valve Closed (AWV)
    • Annulus Master Valve Closed (AMV)

3.8 Main Gas Compression Train Shutdown

Failure of all three main gas injection compressors will require a shutdown sequence as follows: Manifold Gas Injection Valve (GHIV) Closed.

A communication signal will be sent to the DCS system from the ESS defining this process interruption. The DCS will automatically initiate the command through its serial link to the MCS system to begin the shutdown sequence for the production tree annulus circuits. The MCS will have one programmed sequence for all subsea centers.

3.9 Scale / Corrosion Inhibitor Shutdown

The chemical injection skids for scale and corrosion inhibitors have redundant pumps to each group of chemical injection lines. If the entire skid becomes inoperable or the DCS receives a pressure low on any header, chemical injection valves will be closed on all production trees which are associated with the corresponding chemical type. An alarm will also be generated by the MCS periodically (e.g. every 2 hours) to remind the operator the chemical injection valves are closed in case the problem was corrected but the valves were not opened. For scale inhibitor, an alarm will be generated after 24 hours to shutdown the tree to prevent scale in the production tubing.

A communication signal will be sent to the DCS system from the ESS defining this process interruption. The DCS will automatically initiate the command through its serial link to the MCS system to begin the shutdown sequence for the water injection trees. The MCS will have one programmed sequence for all subsea centers.

3.10 Methanol Injection Shutdown

Methanol injection is only required during startup and shutdown of a well or subsea center. If the injection skid becomes inoperable during normal production, the methanol injection valves on all trees and manifolds will be confirmed as closed. An interlock will then be implemented to prevent opening of any methanol injection valve.

4. MODU ESD

The purpose of the MODU ESD is to protect personnel on the drilling rig and to protect the environment when the rig drops a heavy object while operating above live wells. The dropped object could damage the well(s) and cause release of hydrocarbon towards the rig directly above.

The action taken by the MODU ESD is to shut-in all the wells in the area underneath the rig or connected to associated flowlines by implementing the shutdown sequence through the MCS. At the same time, a shut-in signal is sent to the HPU to start the hydraulic pressure venting sequence. MODU ESD sequences are divided into two groups where subsea centers A&B are on one and subsea center C is on a separate sequence.

If an object is dropped from the drilling rig, a phone call or a radio call will be made from the rig to the control operation on the Platform to request the activation of the MODU ESD. Dedicated pushbuttons located in the control room console will be used to activate the rig ESD when the control operator receives the phone call from the rig. The connection between the rig ESD pushbutton and the MCS/HPU will be hard wire (not through software logic).

4.1 IWOCS ESD Stuff

  • ESD if flowing to flowline with IWOCs
  • ESD if flowing through Test Tree – note: test tree system must be designed to interface with MODU or IWOCs ESD requirements



Tags: ESD MODU