Gulf of Mexico SPU

Mad Dog Gas Release HIPO

(28 Feb 2007)

Preliminary Lessons Learned

Mad Dog Gas Release HIPO 10 April 2007

Preliminary Lessons Learned Printed Copies are Uncontrolled
 Introduction

This lesson learned document should be considered a companion document to the “INCIDENT
INVESTIGATION AND ROOT CAUSE ANALYSIS REPORT FOR THE GULF OF MEXICO (GOM) MAD DOG SPAR
UNPLANNED GAS RELEASE HIPO, WHICH OCCURRED ON 28 FEBRUARY 2007”. These lessons are
specific to the MadDog facility but may also be applicable to other facilities in the GoM. Some or
all of the lessons could be of benefit to other BP facilities and projects in the E&P Segment,
though it is recognized that each such facility or project is unique. Before a determination is
made to apply these lessons, you must first consider whether they are physically applicable
to your facility or project, and whether their application would have any unintended ramifications
from a safety standpoint.

The lessons from the Mad Dog Gas Release HIPO bridge many aspects of a facility design and
operation; from process design and hazard analysis to alarm response and incident reporting.
Clarification of any lesson learned contained in this document should be directed to Bob
Peloubet, GoM Deputy SPU Engineering Authority, or to Bob Naeger, Holstein / Mad Dog PU
Facilities Manger.

Process Design

1. The Process Technical Authorities for both the Project and the SPU need
to understand in detail the facility process design, ensure the appropriate
level of design review is conducted and that the design is consistent with
the project basis of design.

2. Rupture Disks that Vent into a Flare System

a. Rupture disks should relieve into a constant back pressure system, otherwise a
tandem rupture disk setup should be used to maintain a constant back pressure
on the primary rupture disk.

b. A pressure transmitter between tandem rupture disks is necessary to monitor

the pressure in the void space. A critical alarm should activate when the
pressure in the void space increases, indicating either a burst disk, or a leak
through one of the disks. Depending on facility specific design conditions, it
may be appropriate to initiate a production shutdown when the pressure in the
void increases, indicating one of the two disks has burst.

c. The reverse burst pressure rating of the secondary disk should be confirmed to
be higher than the maximum operating pressure of the flare header. Checks
should also be made that the secondary disk will burst in the normal direction
when the flare header is at maximum operating pressure.

d. The secondary rupture disk should be proved to not physically impact the
primary disk, should a reverse direction burst occur.

e. The void space between tandem rupture disks should be closed, not vented.

Mad Dog Gas Release HIPO 10 April 2007

Preliminary Lessons Learned Printed Copies are Uncontrolled
 3. Flare / Blowdown Systems

a. All of the flare systems in GoM should be modeled, so that the flare scrubber
pressures and header pressures are known for the range of credible flaring
scenarios. AspenTech FlareNet software should be used to model the flare
system.

b. For new facilities, and for existing facilities that have modified the operation /
capacity of the facility flare system, it is recommended that flaring and
blowdown tests be conducted to confirm the flare system does operate as
designed.

4. Low Temperature Piping Design

a. Piping downstream of rupture disks should have an adequate rating for the
predicted low temperature during a burst disk scenario.

5. Cooling Water Piping Design

a. Cooling water piping that could have gas entry from either a tube leak or reverse
flow from the flare header should be designed and installed to handle the
mechanical movement / pressure wave expected during the incident.

6. Piping System Pressure Class Changes

a. All process & instrumentation diagrams (P&IDs) should be reviewed to ensure

piping pressure class changes are made at appropriate points in the process.
Systems that have dual pressure rating operations, such as test separators, and
systems that have pressure variations during shutdowns, such as compressor
systems, should be checked as a priority.

7. Compression Systems

a. The settle out pressures of a compressor system should be confirmed and

compared to the design pressure rating of the compressor suction piping. This
requires a full review of the shutdown and isolation system, including a review
of the location of ESD valves, check valves and blowdown valves associated
with the compressor system.

b. The blowdown of the compressor system should be through the identified

system blowdown valves. Checks should be made that during shutdown /
blowdown gas does not inadvertently vent through upstream / suction side
production flare valves.

c. All shell and tube gas coolers, with gas on the shell side, should have had tube
vibration analyses perform by the supplier. It should be confirmed that these
analyses were made and that the vibration levels predicted are acceptable.

Mad Dog Gas Release HIPO 10 April 2007

Preliminary Lessons Learned Printed Copies are Uncontrolled
Hazard Analysis

1. The hazard analysis (Hazop) should be performed with the degree of rigor
that would draw particular attention to upset conditions and the flare
system.

2. The Hazop and / or process design review needs to be revisited once the
process design and process equipment selection is finalized. This
may have an effect on the flare system design.

Alarms

1. A high pressure alarm on the flare scrubber should be considered a

critical alarm and only reset by a production team lead.

2. The facility alarm management system should be reviewed. Critical

alarms should be visible and apparent to the board operators.

Incident Reporting

1. An event which causes a rupture disk to burst is considered a reportable

incident and should be captured in Traction. The Traction actions should
also include a thorough RCFA.

Mad Dog Gas Release HIPO 10 April 2007

Preliminary Lessons Learned Printed Copies are Uncontrolled