To optimize safety, the booster pump system needs to be integrated into both the startup and shutdown process
Mike McKinley
Technip
The addition of subsea booster pumping to a development increases the complexity of the safety system integration task over that of conventional subsea field developments. More conventional developments typically only deal with a subsea production control system and a topsides process control system.
In any subsea project, a control systems integration team should be formed as early as possible to flush out potential danger areas, and to establish the safety and shutdown philosophies to follow throughout the project. It is easy to procrastinate when it comes to controls tasks. Just remember the old saying: “You can pay now, or you can pay later.” This is always true when it comes to safety.
In the early life of a subsea development that uses seabed booster pumps, when the shut-in pressure is still high, the possibility of over-pressurizing the pipeline downstream of the subsea pump(s) looms. This danger, combined with the need to weave the pump control hardware as safely and reliably as possible into an existing platform safety system, brings a new dimension to the project conference tables where decisions are made about control systems integration to ensure the safety of personnel and the environment. The booster pump system must not over pressurize the pipeline, and must respond appropriately to all emergency and process safety conditions.
Over pressuring the pipeline can be prevented with the use oflocal interlocks (interlocks with conditions and outputs from the booster pump control system only), and global interlocks (interlocks with conditions and outputs from multiple control systems).
A simple example of a local interlock is to prevent booster pump from running while the pump discharge valve and pump re-circulation valve (if included) are closed. In that case, both conditions, and the output – pump disable – are local to the booster pump control system. A simple global interlock would prevent the booster pump from running while the platform boarding valve on that flowline is closed. In this case, the condition indication – boarding valve position – comes from the platform system, and the action output – pump disable – is executed by the booster pump control system.
The platform’s traditional safety system, boarding valves, and flowline PSHL sensors must be the primary overall safety devices. Interlocks built into the systems reflect good operating practices and aid in prevention of a shutdown.
Nevertheless, the task of defining interlock method, structure, and data flow is amplified with the introduction of additional subsea equipment, especially one that plays a role in the field’s safety system. A comprehensive interlock philosophy should be agreed upon and developed together by the different subsea controls groups, the topsides control group, and the operations group.
To respond appropriately to all emergency and process safety conditions, the booster pump system must be incorporated into the overall system’s cause and effect logic. Columns need to be added to show how the booster pump system responds to various platform- and subsea-generated shutdowns. If the system is designed such that shutdown conditions can originate from the booster pump system, then the cause and effect charts are the place to document that.
A comprehensive shutdown philosophy also must be agreed upon and developed together by the different subsea controls groups and the topsides control group. Systems at different layers have different shutdown responsibilities. Usually, the platform control system is responsible for protection of personnel and environment. Two examples are:
- The platform system controls the subsea production control system HPU vent valves during an ESD. This becomes invaluable if communications are lost between the subsea production control system and the subsea production control pods. When the subsea production control system cannot close relevant safety valves, the platform will be able to.
- The platform system controls the main booster pump circuit breakers. If the booster pump control system cannot shut down a pump, and that risks pipeline over-pressurization, the platform system “pulls the plug.” Likewise, the sub-systems, subsea production control system, and subsea booster pump control system, are responsible for protection of assets. Two examples of this are:
- The subsea production control system controls tree valve closures during a non-emergency operation.
- The subsea booster pump control system functions valves on the pump station during a shutdown to isolate the pump from the product stream and to prevent backflow which could harm the pump.
A subsea production development in the Gulf of Mexico must comply with Minerals Management Service (now Bureau of Ocean Energy Management, Regulation, and Enforcement) Document NTL No. 2009-G36Using Alternate Compliance in Safety Systems for Subsea Production Operations, Effective Jan. 1, 2010. Appendix A – Valve Closure Timing, Electro-Hydraulic Control System – provides federal maximum allowable closure times for the five different shutdown conditions as defined by MMS: Process Upset, Pipeline PSHL, ESD/TSE (Platform), Subsea ESD (Platform), and Subsea ESD (MODU).
For each condition, the maximum allowable closure times are defined for boarding valves, underwater safety valve(s) (USV1, 2), surface-controlled subsea safety valves (SCSSV), and production hydraulic supply venting. For example, upon sensor activation of a platform emergency shutdown or temperature safety element device, boarding valves must close within 45 seconds, USV1 must close within 20 minutes (five-minute re-settable timer), USV2, if used, must close within 20 minutes, SCSSVs must close within 60 minutes (20-minute re-settable timer), and production hydraulics must vent within 24 hours (60-minute re-settable timers).
Typical topsides network and subsea instrumentation for development with subsea pumping.
It is important to note that of the above listed five shutdowns defined by the MMS, a booster pump control system classifies them all as either:
- Emergency shutdown (ESD): Shutdown all pumps in a field
- Flowline shutdown (FSD): Shutdown all pumps feeding an affected flowline.
As of press time, the MMS had not yet released safety regulations pertaining to subsea booster pump systems. However, their development is in progress, and specific requirements for subsea sensors and pump shut in timings are expected. Until new subsea booster pump regulations are released, so the operator must weave booster pump shutdown timings into those defined in Document NTL No. 2009-G36-Appendix A for alternate field cases, and submit it to BOEMRE for approval.
This is done by answering the question: When is it dangerous to personnel or the environment to leave a booster pump running? You do not want to keep pumping oil to a platform that has detected an emergency condition such as a fire or high pressure, and you do not want to keep pumping oil towards a closed boarding valve, risking pipeline over-pressurization. So, just as a platform’s first response to minimize danger is to close all boarding valves, the booster pump system also must shut down pumps to prevent pipeline over-pressurization.
The mechanics of how to do this reliably has to be agreed on philosophically by topsides and the pump team, and accepted by BOEMRE. ESDs typically transmit via hardwired contact closures to the subsea production control system. There is no reason to deviate from that for a booster pump control system. Details such as whether or not the booster pump control system can issue the first shutdown request to the variable frequency drive (VFD), then, if unsuccessful, the platform thrown the main breaker, are issues to be worked out as early as possible.
The booster pump system not only needs to weave seamlessly into the shutdown process, but also plays a part in starting back up, the “reset” process. Reset logic is what prevents an operator from abandoning a shutdown before a safe state is reached. Typically, a reset button is available to an operator with sufficient security access. He may press it at any time, but it will only be active on a momentary basis. All shutdown operation conditions in the field must be cleared before a reset will execute. If the operator presses reset before all of the previously selected valves are closed, the reset will not execute, and the operator will have to try it again later.
One other fault that ties into safety is loss of communications. Each new piece of subsea kit added brings new communication paths that can fail. Each failure must be analyzed for impact on personnel and environment in order to determine the appropriate response.
Responses to different communication failures vary. Some result in a shutdown, some will not. Responses to each communication loss must be well thought out and defined by the operator. In some cases an alarm will suffice. Other cases may call for manual shutdown of the subsea production system, or shutdown of one or more booster pumps.
