IM Page 1 OPERATION OF THE CORRIB PIPELINE – PIPELINE SAFEGUARDING STATEMENT OF EVIDENCE ABP Ref PL16.GA0004 Ian Malcolm, Xodus Group Qualifications and Experience 1. My name is Ian Malcolm. I am a Senior Consultant with Xodus Group and I work in their Technical, Safety and Risk Division. 2. I have a Bachelor of Science Degree in Offshore Engineering and I have an Master of Science Degree in Reliability Engineering and Safety Management. I am a Chartered Engineer and a Member of the Institution of Gas Engineers and Managers. I have been working in the field of Technical Safety and Risk within the International Oil and Gas Industry for 14 years and I have another 13 years experience in the operation, maintenance and design of natural gas distribution systems in the UK. I have worked on safeguarding systems for onshore and offshore installations including subsea tieback pipelines and oil and gas export pipelines. 3. I have worked on the Corrib project since 2009 focusing on the pipeline pressure safe guarding systems. Scope of Evidence 4. Today I will describe the pipeline safeguarding systems that will be in place to detect rises above the normal operating pressures and how these systems prevent the pressure in the pipeline system from exceeding the Maximum Allowable Operating Pressure (MAOP). I will also describe to you SEPIL’s responses to An Bord Pleanála’s requests for information in their letter of 2 nd November 2009, items g and f. Specifically: a. I will summarise SEPIL’s conclusions on the potential for subsea wellhead valve leakage to increase the pressure in the offshore pipeline over a prolonged period when the wells are shutdown. b. I will summarise the conclusions of SEPIL’s examination of a cold vent at Glengad. c. I will describe the impact on the control of the wellhead valves from a severed umbilical. Pipeline Safeguarding Systems 5. Details of pipeline safeguarding can be found in the Corrib Onshore Pipeline EIS, Volume 2, Appendix Q4.5 and Q4.6.
Transcript
IM Page 1
OPERATION OF THE CORRIB PIPELINE – PIPELINE SAFEGUARDING
STATEMENT OF EVIDENCE
ABP Ref PL16.GA0004
Ian Malcolm, Xodus Group
Qualifications and Experience 1. My name is Ian Malcolm. I am a Senior Consultant with Xodus Group and I
work in their Technical, Safety and Risk Division.
2. I have a Bachelor of Science Degree in Offshore Engineering and I have an Master of Science Degree in Reliability Engineering and Safety Management. I am a Chartered Engineer and a Member of the Institution of Gas Engineers and Managers. I have been working in the field of Technical Safety and Risk within the International Oil and Gas Industry for 14 years and I have another 13 years experience in the operation, maintenance and design of natural gas distribution systems in the UK. I have worked on safeguarding systems for onshore and offshore installations including subsea tieback pipelines and oil and gas export pipelines.
3. I have worked on the Corrib project since 2009 focusing on the pipeline pressure safe guarding systems.
Scope of Evidence
4. Today I will describe the pipeline safeguarding systems that will be in place to detect rises above the normal operating pressures and how these systems prevent the pressure in the pipeline system from exceeding the Maximum Allowable Operating Pressure (MAOP). I will also describe to you SEPIL’s responses to An Bord Pleanála’s requests for information in their letter of 2nd November 2009, items g and f. Specifically:
a. I will summarise SEPIL’s conclusions on the potential for subsea wellhead valve leakage to increase the pressure in the offshore pipeline over a prolonged period when the wells are shutdown.
b. I will summarise the conclusions of SEPIL’s examination of a cold vent at Glengad.
c. I will describe the impact on the control of the wellhead valves from a severed umbilical.
Pipeline Safeguarding Systems
5. Details of pipeline safeguarding can be found in the Corrib Onshore Pipeline EIS, Volume 2, Appendix Q4.5 and Q4.6.
IM Page 2
6. For the purposes of pipeline design codes the Corrib pipeline system between the Corrib subsea wells and the Gas Terminal is divided into two sections:
a. An offshore pipeline from the subsea manifold up to and including the
Land Valve Installation (LVI) b. An onshore pipeline from the LVI to the Gas Terminal.
7. Pipeline codes require a pressure protection system to be used unless the pressure source to the pipeline cannot deliver a pressure in excess of the MAOP. Initially, the maximum pressure source at the subsea wells is approximately 320 barg, but this estimated to drop below 150 barg within 5 years from the start of production and to below 100 barg within 8 years. With the MAOP of the offshore pipeline being set at 150 barg and the onshore pipeline being set at 100 barg, the pressure source at the subsea wells is above the MAOP for the early years of the Corrib Field development.
8. [SLIDE 1] This is a schematic representing the production and safeguarding systems from the subsea wells to the Gas Terminal.
9. [SLIDE 2] The normal steady state operating pressure at the inlet to the Gas Terminal at the design throughput is between 80 to 85 barg.
10. Due to pipeline pressure losses when fluid is flowing through the pipeline, to achieve these pressures at the Gas Terminal the pressure offshore at the subsea manifold, located 92 km from the Gas Terminal, has to be higher and within the range 117 barg to 122 barg.
11. There will be an operations team continuously present within the Gas Terminal Control Room, 24 hour per day, 7 days per week to monitor and control the pipeline pressures. The pressures can be controlled by the operators adjusting the choke valves on each subsea well and flow control at the terminal. The operators can also stop production from one or more subsea wells by closing individual valves.
12. In the event that the pressure exceeds the normal operating pressure there are additional automatic protection layers in place to ensure production from the subsea wells is shutdown in a safe manner. They are designed to be automatic without any operator intervention and keep the pressures within the onshore and offshore sections of the pipeline within their respective MAOPs.
13. [SLIDE 3] The first automatic protection layer is the Gas Terminal inlet trip, SS3. This trip is initiated when the pressure at the inlet to the Gas Terminal rises to 93 barg. [SLIDE 4] Pressure transmitters located at the inlet to the Gas Terminal will detect the rising pressure and will [SLIDE 5] send a signal to close the inlet isolation valve at the Gas Terminal and [SLIDE 6] send a signal to close the master valve and the wing valve for each subsea well. Closure of either of the master valve or the wing valve on each well will prevent the pressure in the offshore section of the pipeline rising above its MAOP [SLIDE 7].
14. [SLIDE 8] The second automatic protection layer is the SS2 trip. This trip is initiated when the pressure at the LVI rises to 99 barg. [SLIDE 9] The
IM Page 3
pressure transmitters located at the LVI will send a signal to close the two in-line safety shutdown valves.[SLIDE 10]. [SLIDE 11] This shows one of the two safety shutdown valves closing. Closure of either one of the valves will prevent the pressure in the onshore pipeline from rising above its MAOP.
15. It should be noted that the safety shutdown valves at the LVI do not control the pressure in the pipeline. They isolate the onshore pipeline from the offshore pipeline when the pressure at the LVI rises above the normal operating range.
16. This safe guarding system at the LVI is highly reliable and it’s reliability has been verified by an independent body.
17. [SLIDE 12] To increase the reliability of the automatic subsea well isolation system, the SS2 trip will also send a signal to automatically bleed the pressure in the hydraulic power unit at the Gas Terminal that provides hydraulic pressure to the subsea valves. [SLIDE 13] Releasing the hydraulic pressure will cause the master valve, the wing valve, the surface controlled subsurface safety valve and the well infield line isolation valve on the subsea manifold for each subsea well to close. Closure of any one of these valves on each well will prevent the pressure in the offshore pipeline from rising above its MAOP.
18. An independent analysis of the subsea well isolation system has been undertaken which included the surface controlled sub-surface safety valve, the master valve and the wing valve on each well, each of which will be tested on a regular basis. The analysis confirmed the subsea well isolation system to achieve a similar low failure probability to that of the LVI.
19. Over and above the automatic protection layers the operators in the Gas Terminal control room can manually operate pushbuttons to initiate an SS0 or an SS1 trip.
20. The SS1 pushbutton will close the master valve and the wing valve on each subsea well.
21. The SS0 pushbutton will close the surface controlled subsurface safety valve, the master valve and the wing valve on each subsea well.
22. The operators can also initiate closure of the subsea valves by venting the hydraulic fluid pressure from within the Gas Terminal or in the case of the wing valves by isolating the electrical power to the umbilicals.
Summary of Pipeline Safeguarding
23. The requirement within pipeline codes to have a pressure protection system when the pressure source to the pipeline can deliver a pressure in excess of the MAOP has been met.
24. The combination of operators being present 24 hours per day, 7 days per week in the Gas Terminal control room to monitor and control the pressures within the pipeline system, the presence of highly reliable automatic isolation
IM Page 4
systems at the LVI and subsea wells provide a comprehensive safeguarding system to prevent the pressures in the onshore and offshore sections of the pipeline from rising above their respective MAOPs.
Wellhead Valve Leakage when shut in over a prolonged period
25. Item (g) of An Bord Pleanála’s letter of 2nd November 2009 requested “An examination of the potential for pressure in the offshore pipeline to increase to wellhead pressure levels in the event that all wellhead valves had to be shut in over a prolonged period and in that period incremental leakage past the valves occurred”.
26. Details of SEPIL’s assessment can be found in the Corrib Pipeline EIS, Volume 2, Appendix Q4.5.
27. Subsea valves will be tested every six months during which the leak rate passed any single valve in the closed position must be less than SEPIL’s maximum allowable leak test criteria. If the valves do not meet the testing requirement, remedial action will be taken as prescribed in SEPIL’s management systems.
28. A planned shutdown of the Gas Terminal with a duration of between 14 – 21 days is anticipated to occur once every 4 years. There will also be an annual planned shutdown lasting up to 1 day.
29. Prior to any planned shutdown the subsea wells are isolated by closing the master valve and the wing valve. If closing both these valves does not fully isolate the well, or the shutdown is planned to be more than 24hrs, then the operator can also close the surface controlled subsurface safety valve and the well isolation valves on the manifold.
30. The offshore pipeline pressure will be monitored as well as the pressures on each subsea tree for a pre-determined period after the wells have been shut-in to ensure the well valves have completely closed.
31. If following a planned shutdown all closed valves on a single subsea well leak at the maximum allowable leak test criteria, which is an extremely unlikely scenario, it would take more than 1500 days for the offshore pipeline pressure to increase to 150 barg (the offshore pipeline MAOP), significantly longer than the duration of any planned shutdown for Corrib.
32. In the event of an unplanned shutdown four valves on each well will close – the wing valve, the master valve, the surface controlled sub-surface safety valve and the well in-line isolation valve. If all four valves leak at the maximum allowable leak test criteria it will take a period greater than 500 days for the offshore pipeline pressure to increase to its MAOP of 150 barg.
33. If any increase in pressure was observed the operators at the Gas Terminal can depressurise the pipeline using the flare at the Terminal.
IM Page 5
Summary of Valve leakage
34. An examination of the potential for pressure in the offshore pipeline to increase to wellhead pressure levels in the event that all wellhead valves had to be shut in over a prolonged period and in that period incremental leakage past the valves occurred has been undertaken.
35. The examination has concluded that the pressure rise will be very slow and for all envisaged shutdowns, their duration will be insufficient for the pressure in the pipeline to rise above its MAOP.
36. If any pressure rise was observed the operators will have sufficient time to flare the gas at the terminal and reduce the pressure in the pipeline.
Cold Vent at Glengad
37. Item (g) of An Bord Pleanála’s letter of 2nd November 2009 requested “The concept of a vent at Glengad as a measure to protect against pressure at the wellhead side of the pipeline at the landfall rising above the maximum operating pressure should be examined.”
38. Details of SEPIL’s assessment can be found in the Corrib Onshore Pipeline EIS, Volume 2, Appendix Q4.5.
39. Two potential scenarios were considered for the design of a cold vent at the LVI location in Glengad:
To prevent a build up in pressure in the offshore pipeline due to leakage past closed valves at the subsea wells when the pipeline is shutdown.
To prevent a build up in pressure immediately following an unplanned shutdown of the pipeline, in which case the vent would act to supplement the automatic subsea well isolation system.
40. As previously described when the pipeline is shutdown, for the pressure in the offshore pipeline to increase, leakage needs to occur across multiple valves and should that occur the pressure rise will be very slow. For the duration of all envisaged shutdowns it will not be a cause for the pressure within the offshore pipeline to rise above its MAOP. For long duration shutdowns, in the unlikely event that multiple valves do leak, the pressure in the offshore pipeline will be managed by flaring at the Gas Terminal.
41. The flare is always available except for periods during a planned major shutdown, scheduled to occur once every 4 years, and prior to any planned shutdown the subsea wells will be shutdown in a controlled manner and subsea wells confirmed as being isolated.
42. Thus, there is no credible case for designing a cold vent due to valve leakage.
43. The second potential scenario for a cold vent would be following an unplanned shutdown production continues into the offshore pipeline. However, the automatic subsea well isolation system provides protection against this scenario.
44. Nonetheless, in order to fully examine the impact of a cold vent at Glengad and supply a full analysis to An Bord Pleanalá, a hypothetical assumption has
IM Page 6
been made that production from a single well continues into the offshore pipeline. If a cold vent were considered at the LVI for this case it would require to be of substantial proportions similar to the flare at the Gas Terminal. Provision will also be required for utilities and auxiliary systems such as liquid knock-out vessels and liquid storage tanks.
45. The LVI is situated in protected views and the LVI itself has been positioned in a dished area. A permanent cold vent would need to be located outside the dished area with appropriate foundations and guides for the vent tower. A fence would need to be erected approximately 135 metres away and completely around the vent to protect people from the heat should the vent ignite during a release.
46. Thus, provision of a Cold Vent at the LVI would result in high visual impact, high noise levels during venting and releases of large volumes of gas to atmosphere with the potential for uncontrolled ignition.
Summary of the assessment for a cold vent
47. The concept of a cold vent at Glengad has been examined.
48. A cold vent is not required to prevent the pressure in the offshore pipeline rising above its MAOP either due to valve leakage or due to failure of the subsea well isolation system. In the unlikely scenario of any release of pressure being required because of valve leakage, then this should be performed at the Gas Terminal where provisions have already been made for the safe and controlled release by flaring.
49. Given that there is a highly reliable automatic subsea well isolation system to prevent the offshore pipeline from rising above its MAOP following an unplanned shutdown, a cold vent at the Glengad is not warranted.
Umbilical Severed
50. Item (f) of An Bord Pleanála’s letter of 2nd November 2009 requested “Submit an analysis of the condition where the umbilical becomes severed and the control of the valves at the wellhead and the subsea manifold is lost. The analysis needs to identify what conditions apply to the onshore pipeline and the risks involves in that circumstance.”
51. Details of SEPIL’s assessment can be found in the Corrib Pipeline EIS, Volume 2, Appendix Q4.5.
52. The umbilicals will run from the Gas Terminal through to the subsea manifold. [SLIDE 14] Onshore between the Gas Terminal and the LVI there are three umbilicals. At the LVI these are combined into a single umbilical through to the subsea facilities.
53. Two of the onshore umbilicals each contain the following:
One electrical power cable;
One data Communication cable;
One core containing High Pressure Hydraulic fluid;
One core containing Low Pressure Hydraulic fluid;
IM Page 7
One core containing Methanol and Corrosion Inhibitor.
54. The third onshore umbilical carries a spare cable and two supply cores for treated produced water disposal.
55. Electrical power is required for the operation of the actuated subsea valves. On loss of both electrical cables the wing valves on each subsea well will close. All other actuated valves will remain in the position they were before the loss of electrical power occurred (normally the fully open position).
56. Loss of electrical power will prevent the operator from monitoring the conditions within the subsea equipment. Line insulation monitors in the electrical power unit will initiate alarms within the control room, alerting the operators of the loss of electrical power.
57. The data communication cables allow the operator to operate subsea well valves and to read the available instrumentation, for example pressure and temperature indicators. Severing both the cables will prevent the operator from monitoring the conditions within the subsea equipment and prevent the operators from controlling any of the subsea valves. Alarms will alert the operators to loss of data communication.
58. High pressure hydraulic fluid is used to drive open the surface controlled sub surface safety valves on each well and it is required to keep the valves open. Low pressure hydraulic fluid is used to drive open the wing valve, the master valve and the well isolation valves for wells supplied from that core and it is required to keep those valves in the open position. If the hydraulic pressure drops in any core the valves supplied from that core will close. If all cores are severed all isolation valves on every well will close.
59. Methanol and corrosion inhibition fluid is injected at the LVI, the subsea manifold and the subsea wells to prevent the formation of hydrates and corrosion. The flow of methanol and corrosion inhibitor is monitored and should it stop, production will be shutdown. Severing of these cores will not be a cause for the pressures in the onshore or offshore sections of the pipeline to rise above their MAOPs.
60. In the event that the pressure in the pipeline rises for whatever reason after an umbilical is severed, the pressure transmitters at the LVI will detect the rise in pressure and close the LVI safety shutdown valves, preventing the onshore pipeline from rising above its MAOP. Simultaneously, these same pressure transmitters will also send a signal to the Gas Terminal by the fibre optic communication system to vent the subsea hydraulic fluid, thus closing all actuated subsea isolation valves and preventing the pressure within the offshore pipeline from rising above its MAOP.
61. The operators can also initiate closure of the subsea valves by venting the hydraulic fluid pressure from within the Gas Terminal or in the case of the wing valves by isolating the electrical power to the umbilicals.
IM Page 8
Summary of impact of severing umbilicals
62. If the offshore umbilical or all of the onshore umbilicals are severed, the Corrib field will shutdown on loss of electrical power and loss of hydraulic fluid pressure.
63. If only one onshore umbilical is severed, a number of the wells may automatically shutdown due to loss of hydraulic fluid pressure. The remaining wells will continue to produce within the operating envelope.
64. With some or all of the umbilicals severed the pressure protection systems are not compromised.
Summary of Conclusions
65. There are highly reliable safeguarding systems in place to prevent the pressures in the onshore and offshore sections of the pipeline from rising above their respective MAOPs.
66. In the event that all wellhead valves were shut in over a prolonged period and in that period incremental leakage past the valves occurred, the pressure in the offshore pipeline will increase very slowly. For the expected duration of all envisaged shutdowns the pressure in the offshore pipeline will not exceed its MAOP, but any pressure increase can be managed by the safe and controlled flaring of gas within the Gas Terminal.
67. Given that there is a highly reliable automatic subsea well isolation system a cold vent at the LVI is not warranted.
68. Even if any or all of the umbilicals were to be severed the pressure protection systems would not be compromised.
69. The systems that are in place to protect the pipeline from over-pressure have been exhaustively scrutinised. They are comprehensive, robust and exceed normal industry practice.
