[- “| a Fa D2 ‘COMMENT | eR | HOR =, OSS] 25-Nove eae 42S Ses wl Snip | ee) aoe BP EXPLORATION COMPANY LTD. (COLOMBIA) fe abs : w4 : : © 4 e EOUPETADL Paral Gigi “TRITON | 7” IPL TransCanada Pipelines CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL —- = TECHINT COTECOL S. de H aS _FECHINT _ Iscate: ~ | NONE | SHUTDOWN PHILOSOPHY yon ee a From erevacusras | “ola ine [toolsT< CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL SHUTDOWN PHILOSOPHY SOTECOL 106. OCENSA FFD/T-37CV-ICU-703 Page tof pocrecut [TTE[N-[t]cTol-[ol¢]-[e{R]-[il-[olol3] revo TABLE OF CONTENTS Page 4.0 _ INTRODUCTION. eu 141 Scope... 2 1:2 Applicable Codes, Standards, and Regulatory Requirements. 2 2.0 3.0 4.0 5.0 6.0. OVERALL PHILOSOPHY... 2.4. Shutdown from SCADA MASTER in Bogoté 22 Planned Shutdown... 2.3 Unplanned Shutdown... 2.3.1. Process Shutdown. 2.3.2. Emergency Shutdown eo 2.3.2.1. Automatic Shutdown 2.3.2.2. Operator Shutdown... RROOWwWON INTERFACES 5 3.1. General.. 5 3.2. Covefias TLU2.. 5 3.3. ODC - FFD Crossover... aa SHUTDOWN SYSTEM TEST 7 aresatadfarvna sn 7 ESD VALVE RESET... 7 APPENDIX A. SHUTDOWN FOR COVENAS TERMINAL (BLOCK DIAGRAM)..... YER WORD\ PRIODIRO.DOC 29 SEPTEMBER. 1997 PAGE 1 0F 8CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL SHUTDOWN PHILOSOPHY ~ FFD/T-37CV-ICU-703 jocrecunr | T[E[N]-In[c fo] -Jol4]-JPir]-[il-[olol3 4. INTRODUCTION 11. Scope This philosophy is to establish the protective instrumentation required for safe operation of the terminal facilities which will reduce the risk of unsafe operating conditions, loss of product, or mechanical failure. It provides “high level’ design philosophy for shutdown of the Terminal. Neither development of the interface control logic nor definition of hardware is a part of this report. The design of the shutdown system will be based on the scope of BP RP 30-6, "Design Philosophy for Protective Instrument Systems." 2, OVERALL PHILOSOPHY Plant shutdown can be planned or unplanned. The SCADA operator in Bogota has control of the Pipeline beginning with the storage tanks at the Cusiana Pump Station and ending at the control valve at the entrance of the Covefias Terminal. Planned shutdown results from previously identified and schedule operation or maintenance requirements. Unplanned shutdown results from an upset condition in the terminal facilities. Upset conditions that may result in a potential over pressure situations are monitored and controlled through a protective safeguarding system that is activated by direct intervention of the operator or automatic shutdown The fire and gas system does not interface with the ESD system. ‘Shutdown actions of FFD does not affect ODC operation and viceversa. YER WORD\ PRECSRO.DOC 29 SEPTEMBER, 1057 PAGE 2OF 8CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT 7 <> COVENAS ONSHORE TERMINAL — ‘SHUTDOWN PHILOSOPHY ome GaTeco. boc. ocensa_| FFD/T-37CV-ICU-703 Page 308 poctecunr [TEIN] -[T]c]o/ -[ol4 -[P[R]-[t[-[o[o]3] revo 2.1. Shutdown from SCADA Master in Bogota At Covefias, for shutdown purposes, only property valve can be operated from Bogota When the SCADA operator initiates a shutdown in Bogoté, this Shutdown is ‘executed without any Terminal operator interaction. However, these actions will be indicated on the Terminal operator's console. The shutdown is only on the property line valve. A SCADA or communications failure will not cause an ESD. 2.2. Planned Shutdown: ‘A Planned Shutdown of the Terminal can be carried out by shutting down the pieces of equipment required to perform maintenance or to comply with a scheduled operational requirement 2.3. Unplanned Shutdown: ‘There are two levels of unplanned shutdown: 2.3.1. Process Shutdown Process Shutdown results from deviation in process conditions which are not immediate emergencies, but can nevertheless develop into a serious problem if left uncorrected 2.3.2. Emergency Shutdowns Emergency Shutdowns resuits from a local upset condition or system utility failure (e.g. Fire, spillage, security, etc.). JER. WORD’ PRIGDRO.DOC 29 GEPTEMBER, 1007 PAGES OF 8CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL ‘SHUTDOWN PHILOSOPHY = OCENSA FFD/T-37CV-ICU-703 Page 4 of bocteamr | T[E[N]-[1¢]0]-[0/4|-JPiR[-[1[-Jo[o[3) revo 2.3.2.1. Automatic Shutdown The only field instrument that automatically produces a total plant shutdown is the high high level switch LSHH-550003 on the relief tank. The LSHH-550003 on the Relief Tank will shut down only the FFD and the TLU2 facilities. The top portion of the crude storage tank TK-12030 is reserved for relief in case of maintenance of the relief tank TK-55000. When the tank TK- 12030 is used as a relief tank the LSHH-120304 will cause a total shutdown when trips . There will be a pre-alarm for a high level in the tank. This pre-alarm will allow the Terminal operator time to initiate corrective action before a Terminal shutdown is commenced, LSHH-120304 is deactivated in normal operation. No other field instrument will cause a total Terminal shutdown. However, some major pieces of equipment are provided with their own shutdown system. Instruments provided with those packages can automatically shut down the package through the package control system when a process upset occurs. When this happens, it is indicated on the operator's DCS console. A package shutdown does not automatically shut down the Terminal. 2.3.2.2. Operator Shutdown There are two types of ESD available to the operator in the control room: «The first type is a software switch in the DCS. This switch is actuated by the operator through DCS console after receiving alarms from the field and the operator ascertains that a Shutdown is necessary. After an ESD push-button in the field is activated the Shutdown action has a time delay of 5 minutes. Within this time delay, the operator can either acknowledge and override the field signal or he can initiate a Shutdown immediately by actuating the ESD push button on the ESD panel. If the operator takes no action, after the time delay has elapsed, a Terminal S/D will commence automatically. YER, WORD\ PRIOESRO.DOC 29 SEPTEMBER, 1057 PAGE 4 OF &SHUTDOWN PHILOSOPHY CUSIANA - CUPLAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL ramme con Jooc. ocensa FFD/T-37CV-ICU-703, Page sof pocreemys [TTE[N]-[t[cfo] -Jola]-[pir[-Jil-Jo[oj3] evo The second type of ESD is a push button mounted on the ESD panel. This button is actuated by the operator at his discretion. This button will be used in addition to the DCS switch in the event the DCS software switch fails to initiate an ESD when actuated. When any one of the two types of shutdown signal ( automatic or operator) is actuated, a Terminal ESD is done. This ‘Shutdown closes the incoming and outgoing pipelines valves,( 710-ESDV-240024 and 710-ESDV-810024), closes all process valves and stops main and transfer pumps; except those equipment associated with fire fighting. The shutdown signal is transmitted to the SCADA system for alarm and control response in case design conditions threaten to be exceeded along the pipeline. 3. INTERFACES 3.1. General The SCADA Master Terminal in Bogot4 interfaces with all other sites through the DCS Systems at the Pump stations and the COVENAS Terminal, All necessary Terminal data and controls (ESD system, shipping pumps, motor operated valves, etc.) will be accumulated, processed, and routed through the DCS system to the SCADA Master. ‘Also, command to close property valve from the SCADA Master will be routed through the DCS. The existing ODC's ESD system will not be expanded but panel will be used to house the FFD logic. COVENAS TLU2 A separate ESD system will be provided with the FFD Tanker Loading Unit (TLU2). The TLU2 ESD system will interface with the Terminal's DCS system which will effect any actions required to protect the TLU2. There will be no direct interface between the terminal's ESD system and the TLU2's ESD system. [BY JER WORD\ PRIDDGRO.DOC 29 SEPTEMBER, 1997 PAGE SOF 8CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL SHUTDOWN PHILOSOPHY SOTECOL lim oons ‘OCHS FFDT-37CV-ICU-703 Page 6 of boc recur TIEINT-Iclol-lol4[-[PiRi-Jil-Jofol3] reve The TLU2 ESD system shall interface with the existing TLU1 ESD system to give the operational flexibility to load out from the existing ODC loading pumps or the FFD Terminal loading pumps to either the existing TLU1 or the TLU2. There are three (3) load out conditions in the terminal operations which shall have ESD protection at the TLU1 and TLU2 buoys in the event of surge development when the tanker manifold valves are shut down too quickly under maximum load out conditions. Load Out Condition 1 Is when crude is to be loaded out from the existing ODC terminal to the TLU2. In the event of surge and pressure build up at the product manifold on the buoy deck of TLU2, the FFD telemetry shall, after a 5 second interrogation period, shut down the TLU2 PLEM vaives in ten (10) seconds and the onshore existing ODC pumps within five (5) to ten (10) seconds. A relief system ( tanks and surge valves) are provided on the buoy to subdue the surge condition. Load Out Condition 2 Is when crude is to be loaded out from FFD terminal to the TLU2. In the event of surge and pressure build up at the product manifold on the buoy deck on TLU2, the telemetry shall, after a 5 second interrogation period, shut down the new PLEM valves in ten (10) seconds and the FFD onshore loading pumps within five (5) to ten (10) seconds. Load Out Condition 3 Is when crude is to be loaded out from the FFD to the existing TLU1. In the event of surge and pressure build up at the SRB, the existing telemetry shall, after a 5 second interrogation period, shut down the existing PLEM valves in fifteen (15) to twenty (20) seconds and the onshore FFD loading pumps within ten (10) seconds. BY JER. WORD \ PRIODGRO.DOC 29 SEPTEMSER, 1007 PAGES OF 8COVENAS ONSHORE TERMINAL CUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT == SHUTDOWN PHILOSOPHY SSRN GOTECOL {boc ocensa FFD/T-37CV-ICU-703 Page 7 of 8 poctecunt | T[E[N]-[1|C]O[-]0]4]-JPIRI-|!|-]0[0]3| revo 3.3. ODC -FED Crossover The incoming 20 inch crossover between ODC and FFD has motor operated valve MOV-240014 which closes in case of a plant shutdown. 4. SHUTDOWN SYSTEM TEST ‘Shutdown system shall have test facilities unless test can be made on line, or, if the item can be taken off-line for test without disruption to operations. Test facilities shall be key protected and permit full system test from field sensor through to actuator avoiding shutdown but not inhibiting alarm initiation. 5. ESD VALVES RESET To reset ESDV's, both ESD’s panel push button and DCS software switch shall be actuated. Software switch shall have a password. Also MOV's Master Station shall be reset. [BF SER. WORD| PRIOGOROOOC 29 SEPTEMBER, 1057 PAGETOFSCUSIANA - CUPIAGUA FULL FIELD DEVELOPMENT COVENAS ONSHORE TERMINAL Bs SHUTDOWN PHILOSOPHY ramet SoTecor Joc: ocensa FFD/T-37CV-ICU-703 Pages ote poctecunr [TTEINT-IncTol-jol4]-[eiR[-Til-Tolo[3] reve 6. APPENDIX A. SHUTDOWN FOR COVENAS TERMINAL (BLOCK DIAGRAM) 5Y LER, WORD\ PRIOGSRO.COC 29 SEPTEMBER, 1007 PAGE SOF 8TOTER | —garvorsaa | aver ‘a Sore} arr WOIOIOT “twas S¥¥3N09 HOI NMOGLNKS ‘IVNIWQAL RIOHSNO S¥NIAOD Nols |... oJ a MALY sone SANTA oo > asa as sawnd 09} oniavor Nv Gs sawnd USUSNVUL S as [0 _»—m» ase navy }~q¢———| wo1vuaco TANVd asa Wns a's MATIOMLNOO soa tL vavos ~«——o_»—_| wir 4 sNoLing *——— usnaarars Nonna nsnaasa