NICOLA LUCCHESI, VELAN ABV, EXPLORES GOOD

PRACTICES FOR EMERGENCY SHUTDOWN VALVES IN

OFFSHORE SAFETY SYSTEMS.

SHUTTING

E
mergency shutdown valves are used
in offshore production platforms as key
components of more complex emergency support
systems (ESS). The API RP 14C standards for designing,
installing and testing ESS describe emergency shutdown systems
(ESD), gas detection, containment systems, fire detection and
subsurface safety valve (SSSV) systems. ESS provide a level of
protection by initiating shut‑in functions and minimising the
 consequences of emergency situations, typically related to
uncontrolled flooding, escape of hydrocarbons, or outbreak of fire
in hydrocarbon‑carrying areas.
The aim of ESD systems is to protect personnel, facilities and
equipment, and minimise any damage to the environment that
might result from a catastrophic event. For example, both the
destruction of the Piper Alpha platform in 1988 and the accident at
the Brent Bravo facility in 2003 were caused by a lack of ESD valves.
Continuous improvement in the ESD design is a top priority for safety
management and increases the reliability of the whole system.
The intent of this article is to describe Velan ABV’s experience
in the design aspects of ESD valves and actuators and to highlight
the fact that requirements can range greatly from facility to
facility.

Background
While the number of ESD systems needed in an offshore platform
depends on its complexity and production capacity, there are
common levels of activation for different hazard situations. A less
serious critical situation is the unit shut down, where only a restricted
area or individual process is involved in the shut down process. A
more serious situation would be a surface process shutdown, where
all the production activity is shut down and all the pipeline processes
and injection SDVs fail, leaving some utilities such as main power
generation available. The third and most catastrophic situation is the
total platform shutdown, in which all the processes including power
generation are shutdown, the wellheads and sub‑surface safety
valves close, and the blowdown valves open to depressurise the
platform. In this case, the only system still active is the emergency
generator for firefighting systems.
A more general definition of a safety instrumented system
(SIS) has been proposed by IEC 61508 and ISA 84.00.01, where it is
described as a distinct and reliable system with the purpose of taking
a process to a safe state when predetermined conditions are violated.
Figure 1. ESD ball valve, 16 in. reduced bore, pressure class 2500, with An SIS is composed of several sensors, a programmable logic
hub end-connections and completed with a pneumatic SY actuator controller (PLC), and a final control element. Sensors collect
equipped with hydraulic damper and several quick exhaust valves for information necessary to determine if a dangerous situation could
very fast closing operation. Control panel includes two redundant SOVs, occur and, when such a situation is identified, the PLC disconnects
pilot valves and smart PST device ensuring a SIL 3 certification of the the power of the ESD solenoids and moves the valve into its safe
whole system. position.
The implemented
control loop function
is defined as the safety
instrumented function
(SIF). Performance can
be measured in terms of
reliability and availability.
Reliability is the probability
of performing the correct
logic safety function under
specifically determined
operating conditions for
a defined time period.
Availability is the fraction
of the total time that a
protective system is able to
function on demand.
SIF is designed to
minimise process risks to a
tolerable level, assigning to
each one a safety integrity
Figure 2. Typical SIS schematic diagram. level (SIL). IEC and ISA

| Oilfield Technology Reprinted from April 2015

standards mentioned above specify four possible discrete levels of
reliability and the further demand that platforms furnish quantifiable
proof of compliance. Generally, the offshore processes lie within the
levels of SIL1 or SIL2, with SIL3 applied for critical applications only.
SIL4 is rarely used, being common in the avionics, aerospace and
nuclear sectors.
It is commonly acknowledged that the weakest link (involving
40 ‑ 50% of the problems) in the SIS loop is the final control element.
A shutdown valve remains in one fixed position for long periods of
time, even years and could become stuck in that position with no
guarantee that it will be able to perform its desired safety function
when required. To ensure the reliability and availability of these
valves, good design practice must be followed.

Final control element design

The final control element is composed of three main components:
the valve, the actuator and the local control panel. Each has its own
sub-task in the control loop: the first is to ensure that the closure
member has only two stable, discrete positions with the ability to
stroke from one to the other under any operative or emergency
conditions. The second important task for valves is to guarantee a
tight shutoff, with the obturator in a closed position, without any
or only minor leakage. The actuator safety function moves the
obturator using an intrinsically safe mechanical device, mostly
a powerful compressed set of springs, when the supply line was
stopped by a PLC emergency signal. The local control panel receives
the input signals and cuts off the supply line and ensures the
stroking time.

Valves
The main standards for offshore valves are API 6D and API 6A, even
if EPCs and/or operators integrate these norms with their own
specifications. Furthermore, valves could be in accordance with
the NORSOK standards developed by the Norwegian petroleum
industry, with the aims of providing equipment suitable for the
extreme North Sea weather conditions. Commonly, even though
EPCs’/operators’ specifications are influenced by experience and
procurement policies, nevertheless a design agreement with the
valve manufacturer has to be reached.
The most common ESD valve is the trunnion ball valve. Valves
can be either reduced or full bore, although all the valves installed
to protect risers and exported oil and gas systems have to be full
bore since they must be piggable. This pipe cleaning has to be done
carefully and demands a perfect valve bore alignment, otherwise the
pig can damage seats and ball surfaces, especially during the first
commissioning when the line could contain dirty debris remaining
from the piping assembly.
Two major risks of dangerous failures negatively affect the target
by closing the line with a quarter turn rotation of the ball: this can
result in seized seats and a jammed stem. The process fluid and the
external environment also play a big role in determining the probability
of the valve failing. The operating fluid can be a single clean phase of
crude oil, gas, condensates, or a mixture of them, but especially at
the beginning of the process the fluid is ‘dirty’ and strongly abrasive.
A ball valve fixed in the same position for a long period also faces the
risk that sand and debris could be pushed by the flow in the upstream
ring cavity, creating a consolidated mass that can act as a wedge at
the bottom of the seat ring and increasing the valves’ torque or, in the
worst case scenario, causing the upstream seat to seize. To deal with
this, the valve design should include emergency sealing injection on its
seats, whereby the injection of a lubricant or a flushing fluid can act as
a hydraulic ‘push’ lifting the seat ring off the ball face.
Figure 3. ESD ball valve, 18 in. full bore, pressure class 2500 with Inconel
overlay on all the internal wetted parts, completed with hydraulic
SY actuator spring return and manual PST device. External painting
suitable for offshore severe service.
Debris can often be trapped between a valve’s seats and the
ball, where it scratches the contact surfaces during strokes. This
damage can compromise the tight shutoff function. Soft‑seated
valves are considered more vulnerable compared to hard seats and,
even if some EPCs prefer soft‑seated design due to their zero leakage
capacity, metal‑seated valves with tungsten carbide hard facing are
more reliable.
Moreover, wellhead fluids might have considerable amounts
of H2S, which corrodes the internal wetted surface. To counter
this, the valve material must meet NACE MR‑01‑75 standards; in
addition, the protection of all seat and sealing areas with corrosion
resistant alloys (CRA) is recommended. Confined spaces are
mainly exposed to aggressive pitting and crevice corrosion. Nickel
alloys are commonly used due to their excellent weld deposition
characteristics and superior crevice corrosion resistance.
An important precaution to take to help avoid stem jam is
using external seals to isolate the bushing areas from the outside
environment. When valves are in a horizontal position or located
in splash zones, seawater and rain can seep into the stem packing,
leading to premature stem failures due to corrosion. Furthermore
for fast operations of high‑pressure valves, some design precautions
have to be considered to achieve the right coupling between stem
and actuator. Narrow tolerances, longer bushings and reference
pins help guarantee a perfect alignment between axes.
Actuation
The most common actuator for ESD systems is the pneumatic scotch
yoke (SY) spring return, even though the hydraulic version could be a

Reprinted from April 2015 Oilfield Technology |

valid alternative. In contrast, the double acting configuration is rare,
since even though it is more compact and cheaper, when used for
ESD applications a backup supply tank and a more complex control
are also needed.
Velan ABV has its own brand of actuators, MOSS actuators,
which are designed, manufactured and tested in‑house to cover the
full range of quarter‑turn valves.
Actuator sizing can become a discussion point between EPCs
and manufacturers. Because of the severe nature of the service,
EPCs tend to be too conservative in their specifications, forcing
manufacturers to select oversized actuators. The debate, generally,
focuses on two main points: the condition at which the valve
torques are calculated and the applicable safety margin (SM).
Valve torque is influenced by pressure drop and temperature
and there are three main situations where it can be determined:
operating pressure and temperature, design pressure and
temperature, and class‑rating pressure at maximum piping
temperature. Since there are no standard rules, the EPCs
generally make their choice during the piping design. The
first is the less conservative choice and is not indicated for
emergency purposes, whereas the latter choice ensures the
interchangeability of valves with the same piping class. From one
criterion to the other, the increase of torque can be remarkable,
at times more than 50 ‑ 70%.
The actuator sizing has to include a safety margin to
compensate for the deterioration of a valve’s performance during
its lifetime. EPCs/end‑users define three different applications
to establish this safety margin: general (150%SM), emergency
(200%SM), and special (250%SM).
Actuator‑torqued values are always calculated at the lowest
set pressure of the supply air in the facility to ensure valves are
operable in the event of pressure fluctuation. At the same time,
the capability of the actuator to withstand the maximum supply
pressure must be verified, since some EPCs do not allow the
installation of such protection devices as air‑filter regulators and
relief valves.
An improper combination of these effects can lead to valves
being equipped with oversized actuators that provide little benefit
in terms of size, weight and maximum output torque. This can also
negatively affect the valve design itself, requiring a higher MAST
(maximum allowable stem torque), which is achievable by changing
the stem material, or worse, by requiring the redesign of the valve to
give it a greater stem diameter.
The most dangerous failure is the spring rupture, mainly
caused by long exposure to a corrosive environment. Because of
this, springs are always provided with a protective coating and
hermetically sealed in a welded cartridge. Furthermore, a good
practice is to ensure a minimum water protection level, IP 67, by
adding seals to prevent the seawater from going inside the scotch
yoke housing. For the pneumatic model, it is also recommended
to avoid the entry of salty air inside the backside chamber of the
cylinder. A closed loop is generally implemented to lead part of the
clean air supply released from the supply chamber into the other.
Control panels
The right selection of components, accessories, and tubing is
strongly influenced by the maximum stroking time. Fast closures are
usually desired in ESD systems, where a closure velocity of 1 sec./in.
of valve size is the standard. Higher velocity has to be considered
as a critical requirement and must be taken into account during the
valve/actuator design. Especially for big valves, in which the inertia
| Oilfield Technology Reprinted from April 2015
of the movable components is elevated, special devices such as
hydraulic dampers have to be installed to mitigate the impact at the
end of the stroke.
During a failure situation, the closing velocity depends on
how fast the air is released from the cylinder. Quick exhaust valves
(QEV) are commonly assembled on board of the actuators, sized
by the necessary flow rate. Generally the opening time is not a
mandatory requirement for the EPCs, and a three‑times higher
solution is accepted. The opening time depends on how fast the
air is supplied to the actuator against the spring force. Air filter
regulators, pilot valves, and solenoid operating valves (SOV)
are the components involved. One note about the inlet piping
diameters: if the EPCs do not properly design the pipe bore, the
opening time will not be satisfactory even if the control panel is
correctly sized.
Testing
The only way to completely verify the status of an in‑line ESD valve
is by a proof test that strokes the valve from a fully open to a fully
closed position. This operation often requires the total shut down
of the process, which can only be done during a scheduled plant
shutdown. The installation of a smart partial‑stroking test (PST)
device in the control panel is the common practice to perform
on‑line diagnostic testing that finds at least a percentage of the
total failures.
The PST moves the ESD valve 10 ‑ 20% of the stroke, receiving
feedback about valve travel position and actuator pneumatic
pressure. This data supports the diagnostic analysis of the
valve performance and, in case of difficulties, the test will be
automatically aborted, alerting the operator with a signal. Even
though PST does not eliminate the need for full‑stroke testing
(since, for example, tight shutoff capacity cannot be detected),
its frequent use increases the reliability and the availability of the
whole system.
Conclusion
This overview provides a systematic summary of the essential
criteria needed to design ESD valves for offshore processes. The
complexity and the variability of these choices can be overcome
only with a close collaboration between EPCs/end users and valve
manufacturers from the early stage of the process.
With a continuous renewal approach, Velan ABV has developed
a new research project for a new actuator concept, able to exceed
most of the current limitations. Innovative quarter‑turn devices
with higher efficiency, low friction and better torque linearity are
the main project features, giving an answer to the often oversized
solutions. The project started in 2013 in partnership with the
University of Florence and should bear positive fruit by the end of
this year. 
References
1. API RP 14C, ‘Recommended Practice for Analysis, Design, Installation, and
Testing of Basic Surface Safety Systems for Offshore Production Platforms’.
2. Angus Mather, ‘Offshore Engineering’ Bertrams, 3rd Revised edition,
(October 2011).
3. Peters, J., ‘Emergency Shutdown Valve Study: Industry Operating Experiences
and views: The way forward’, Health and Safety Executive (HSE) Report.
Offshore Technology Report‑OTO 97 018
4. Manna, M., ‘Need for an industry standard for ESD valves from engineering
and safety point of view’, Safety users Group, February 2005.
5. Machado, G. B., ‘ESD in DP Vessel – For Safety, not for Blackout’, Dynamic
Positioning Conference, (October 2009).
6. Luna‑Mejias, G., ‘Using ESD Valves as Safeguards, Myth or Reality?’,
9th Global Congress on Process Safety, (April 2013).