LOSS OF CONTAINMENT - PIPELINES

Lead Assessment Unit for this Section: HID SI3

Team responsible for authoring and updating this section: HID SI3A
1.

Scope

This Section provides guidance for the assessment of safety case content, with respect to
pipelines connected or close to an offshore installation, from hazard identification and risk
evaluation to risk management measures. It covers the major accident hazards associated
with pipelines. The pipeline is defined from pig trap to pig trap, from/to the ESD valve where
a pig trap is not fitted, from subsea wellhead(s) to surface installation. Interplatform and
pipeline system effects must be considered.
Interfaces with other disciplines are relevant, such as with fire explosion and impact
protection, well and compressor / pump pressures, oil / gas processing, safety systems,
damage prevention, corrosion, emergency response, diving activities, human factors and
others. The scope includes not only pipeline containment and protection etc but may also
include the effects of a failure: e.g. of a riser jet fire.
2. Adequacy of Demonstration
The safety case should include the identification of all hazards from the initiators, and the
risk evaluation and management arrangements. See the Pipelines Hazard Categorisation
List
The safety case should include an adequate description of all pipelines, including design
parameters as necessary, and evaluate the impact of pipelines and their inventories on the
overall case for safety. The safety case should demonstrate that the Pipelines Safety
Regulations (and other relevant statutory provisions) are complied with. By including the
summary of the Major Accident Prevention Document (prepared in accordance with the
Pipelines Safety Regulations, Regulation 23) for each relevant pipeline, the risk
assessment in the safety case is interfaced with that for the pipelines.
3. Pipelines Hazard Categorisation List.
Loss of Containment Pipelines

Location of Hazard
HS1 - Rigid Riser
HS2 - Flexible and comliant Risers
HS3 - Pipeline - Tie-in spools, Seabed pipeline, tees
HS4 - Riser Emergency shutdown valves (ESDV)
HS5 - Subsea Isolation Valves (SSIVs)
HS6 - Pig Trap
Subsea systems: manifolds, well flowlines, process equipment
Initiators
G1 - External Corrosion, coating damage, cathodic protection failure
G2 - Internal Corrosion, water, wax, scale
G3 - Erosion, sand, scale
G4 - Overpressure
G5 - High Temperature
G6 - Low Temperature Joule Thomson effect
G7 - Fatigue / vibration
G8 - Fire [Section 2.3.3]
G9 - Fitting failure
G10 - Incorrect installation or fabrication
Operator error [Section 11]
G11 - Inadequate Training [Section 11]
G12 - Inadequate competency [Section 11]
G13 - Violation [Section 11]

G14 - Deficient operational procedures [Section 11]

G15 Deficient Maintenance procedures
G16 - Ship collision [Section 2]
G17 - Dropped object
G18 - Seismic event [Section 3]
G19 - Missile (from explosion or equipment failure)
G20 - Ageing / mechanical degradation
G21 - Abnormal external load
G22 - Helicopter collision / rollover [Section 8]
G23 - Inadequate design
G24 - Incorrect material specification
G25 - Thermal radiation
G26 - Slugging / pressure transient
G27 - Structural support failure [Section 3]
G28 - Fishing gear snagging or line damage
G29 - Anchor / mooring line /
pipelay abandon recovery line damage
G30 - Explosion overpressure
Risk Evaluation
F10 - Concept selection
F1 - Historic Data (Pipeline and Riser Loss of Containment, PARLOC)
F2 - Company & Pipeline System Data
F3 - Pipeline system studies: HAZID, HAZOPS, FMEA, Design reviews

F4 - Equipment layout
F5 - Company standards / competence
F6 - Corrosion / erosion allowance
F7 - Operations and maintenance procedures
F8 - Safety Integrity Level (SIL) standards
F9 - Equipment selection
Riser jet fire effects
Risk Management Measures
F14 - Inherent Safety
fully rated pipelines & risers
riser and pipeline routing
Riser ESDV locations
Concrete ballast + protection coating
Pipe protection trenching burial rock dump covers
Fire protection
Damage Prevention
F15 - Relief systems
F16 - High Integrity Pressure Protection Systems (HIPPS)
F17 - Shutdown systems ESD system ESDVs
F18 - Alarms / trips
F19 - Cathodic protection anodes impressed current systems
F20 - operational procedures - control of erosion / internal corrosion, temperature during
blowdown, pigging, chemical inhibition

F21 - Competent personnel

F22 - Monitoring & Audit systems
F23 - Isolation and permit to work controls
F24 - Intelligent pigging
F25 - Wall thickness monitoring
F26 - Inhibition performance monitoring
F27 - Fire protection passive/active
F28 - Mooring controls
F30 - Strength & leak testing
F31 - Non-destructive testing (NDT) inspection

Performance Standards
Temperature & Pressure Rating
Material specification: strength, corrosion resistance, impact resistance
Cathodic protection (CP) potential
Remaining fatigue life
Frequency and type of inspection
Pressure relief arrangements, set point, capacity
Reliability of protective systems
Supports: number, locations, adequacy
Integrity of pig trap closures and seals
Fire protection, risers, ESDVs
Valves: closure mode, seal type, leak rate, fire resistance

4. Relevant Legislation, Approved Codes of Practice (ACOPs) and Guidance

includes:
Pipelines Safety Regulations 1996
A Guide to the Pipelines Safety Regulations 1996 (HSE Books, L82, ISBN
9780717611829)
Offshore Installations (Safety Case) Regulations 2005
A guide to the Offshore Installations (Safety Case) Regulations 2005 (HSE Books,
L30, ISBN 9780717661848)
Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations 1995
Prevention of fire and explosion, and emergency response on offshore installations
(HSE books, L65, ISBN 9780717613861)
Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs
9, 14, 16, 95, 115
Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4,
5 and 12
The Health and Safety at Work etc. Act 1974 (Application outsideGreat Britain) Order
2001
HS0 The Pipeline System
1. Duties
The pipeline operator has responsibility for the entire length of the pipeline (including risers,
pig traps etc and risers on other operators installations). Pipeline operators should be
identified and limits of responsibility should be defined in the safety case. The pipeline
operator is responsible for starting up the pipeline following a shutdown, and for procedures
and checks that are made before start up. The installation dutyholder should ensure that
the pipeline operator carries out these duties and should co-operate with the pipeline
operator. The safety case should state these responsibilities.
2. Pipelines Hazard Identification and Risk Assessment
The description of the pipeline system should address all hazards from and to pipelines and
their contents.

Hazard identification should include pipeline systems aspects such as management

interfaces between installations, inter-platform control, leak detection and pipelines
emergency procedures.
All hazards that could result in a loss of pipeline integrity at any location within the hazard
limit distance should be identified and included in the overall risk assessment for the
installation. The hazard limit distance is that distance from the installation beyond which a
pipeline release could not conceivably be a hazard to the installation.
The safety case should consider hazards to installations close to pipelines and risers or in
combined operations: jack-ups, flotels, crane vessels, diving support vessels. It should also
identify the hazards from or to any pipeline attached to subsea wells or manifolds that could
endanger drilling rigs or diving support vessels.
The safety case should evaluate the risks and the results should be included in the overall
risk assessment for the installation. The proposed hazard minimisation and risk reduction
measures should be consistent with the overall risk assessment.
3. Pipelines Description
Within the installation description the duty holder should include all interconnecting facilities
i.e. pipelines and subsea facilities, including:
a description or diagram of connections to pipeline systems and of any pipeline with
the potential to cause a major accident;
dutyholders, owners and operators of connected installations and pipelines and
interface points;
fluids, pipeline sizes, directions, and approximate flow rates;
subsea valves, tees, wyes, remotely operable valves, etc.;
all potential pressurising sources: subsea wells, other pipelines connected subsea,
pumps, compressors
process flow diagrams of subsea production facilities,
special subsea operations such as hot water circulation, dual (or multi) purpose
lines, round-trip pigging, liquid/gas separation, pumping/compression facilities;
a description of the pipeline over-pressure protection system (see below);
a description of the leak detection system (see below); and

 pipeline pigging philosophy and practice: scale and wax removal, biociding, inhibitor
distribution, intelligent pigging, liquids removal, semi-intelligent pigging, tethered riser
inspection etc
Specific pipeline data in the safety case should include:
pipe diameter;
wall thickness (including thicknesses for different parts of the pipeline where these
vary), stating any allowance for corrosion;
the pipeline to platform approach route;
the riser route including the topsides part of it and any demarcation points;
the riser ESD valve location(s) and any subsea isolation valves;
the fluids in the pipeline;
pipeline inventory at maximum allowable operating pressure between the pipeline
extremities (i.e. from installation to installation, including any branches connected
subsea);
design configurations: rigid pipe, flexible, bundle, piggy back, internal cladding,
weight coating, with key dimensions etc
construction methods used: conventional lay, reeled, towed, pipe-in-pipe, riser
caisson (wet/dry), J-tube etc
the standard or code used to design the pipeline;
the current safe operating pressure;
the safe operating temperature range;
the grade(s) of steel and materials of construction of the pipeline, riser and topsides
pipework, sour/non-sour service rating, types of corrosion resistant alloys
corrosion management arrangements, including monitoring and control of corrosion,
internally and externally, reliability of corrosion inhibition, cathodic protection etc
systems, sand and scale management, inspection arrangements
any other element of the design or operation of the pipeline which is critical to the
safety of the installation.
4. Design of the Pipeline

The duty holder and pipeline operator should ensure that the pipeline riser has been
designed and constructed and is operated safely in accordance with recognised standards
and guidance.
Where a recognised standard/code of practice has not been employed, the duty holder
should provide justification on a case-by-case basis that the applied standard or code or
method is appropriate.
5. Design for Extreme Weather
Most North Seainstallations are designed to withstand a wave which occurs on average
every 100 years or every 50 years. However structural design standards now require
design for a wave that occurs every 10,000 years. Further information is available via this
link: http://www.hse.gov.uk/offshore/extremeweather.htm.
The 10,000 year wave level can rise well above the current elevations of riser ESD valves.
Floating installations being restrained by moorings and inertia can be likewise affected. The
safety case should demonstrate that dutyholders and pipeline operators have assessed the
ability of risers, ESD valves and other facilities to survive such extreme weather.
6. Pipeline Damage Prevention
The safety case should include a description of pipeline damage prevention arrangements,
including: a list of identified hazards (e.g. dropped freight, caissons, tubulars, equipment,
anchors, mooring lines, vessels, submerged flexible risers etc.); pipeline route information
issued; operational measures (no anchoring areas, vessel size limitations, approach routes,
etc); and permanent protection measures. The pipeline should be protected from third party
or construction damage caused by vessel anchors and mooring wires and chains, by pipe
lay abandon and retrieval wires, and by fishing trawls.
HSE has issued guidance on the management of anchor hazards for pipeline operators,
this is available via the following link: http://www.hse.gov.uk/pipelines/pipeline-anchorhazards.pdf
Anchoring procedures for standby vessels, supply vessels, diving support vessels, heavy
lift crane vessels, flotels, drilling rigs, etc should be included in the safety case. Risks come
from dropped objects such as freight being loaded and from vessel collisions with risers,
and from dropped objects such as caissons. Pipelines and risers should be routed safely or
protected. Procedures should limit vessel sizes and types, weather conditions for loading,
etc.

Pipelines located under platform cranes should be protected from dropped freight
containers, tubulars, etc. Procedures should limit the types and weights of freight to be
handled so as to not exceed the design capabilities of the pipeline protection.
Safety cases for non-production installations should include a description of arrangements
for identifying the routes and locations of pipelines, wells and other subsea equipment and
assessing the risks that they pose to the installation (SCR05 Schedule 3 para 12).
Particulars of the plant and arrangements to minimise the effects of damage to subsea
equipment by drilling equipment should be included (SCR05 Schedule 3 para 6).
Combined operations notifications should include a suitable diagram(s) showing the
location of risers, pipelines and other subsea equipment in relation to the layout of the
combined operation. Safe operating limits of the installations, mooring lines, crane radii etc
should also be provided (A guide to the Offshore Installations (Safety Case) Regulations
2005 L30 para 295 page 69).
Jack-up spud cans making deep holes in the seabed into which a pipeline can slip should
be considered within the safety case as appropriate.
7. Modifications and Repairs
The safety case should include a description of procedures to be followed for modifications
and repairs, including hazard identification, risk assessment, notifications, isolation
arrangements (topsides and subsea), standards of work inspection and testing.
A description should be included of past modifications and repairs to the pipelines that
could affect the safety case hazard identification and risk assessment: i.e. where
modifications fall below the standard of the rest of the pipeline.
8.

Pipeline Over-pressure Protection

The safety case should describe the type and operation of any pipeline over-pressure
protection
Pressure breaks should be examined critically. The primary protection should be by design
for the highest foreseeable pressure (inherently safe design). Secondary protection may
include relief valves, High Integrity Pressure Protection System (HIPPS) (section
2.3.1.F16), etc.

The well head shut-in pressure of a subsea well connected to the installation should be at
or below the safe operating pressure of the relevant riser. The maximum output pressure or
the high pressure shut down set points for pumps and compressors and other pressure
sources connected to the pipeline should be at or less than the riser safe operating
pressure. The maximum allowable operating pressures (or safe operating pressure) of
pipelines connected subsea to a riser should be so as to prevent overpressurisation from or
of a third party pipeline or installation.
The considerations mentioned above must be satisfied, using a suitable HIPPS system or
similar if necessary. See Safety Instrumented Systems for the Overpressure Protection of
Pipeline Risers, SPC/Tech/ED/31 at
http://www.hse.gov.uk/foi/internalops/hid/spc/spctED31.htm. SPC/Tech/ED/31 describes
various levels of pipeline and riser design, additional protection measures, HIPPS design,
operational testing and maintenance.
9. Pipeline Safety Systems
The safety case should include a hazard identification that identifies the critical safety
system components. The duty holder should describe all the safety systems in place for
safe operation, safety of personnel and prevention of hazard escalation. The performance
standards required of these systems should be described, stating for example the action
and shutdown levels. These components should be tested and maintained. The safety
systems should cover the greatest and most frequent hazards, and they should provide the
fastest response and warning of hazards. Emergency procedures are intended to cover the
rest.
10. Pipeline Emergency Shut-Down Functions
The safety case should describe the emergency shut-down facilities. The levels of shutdown should be clearly defined. The level at which the riser ESD valves are closed should
be stated. ESD system data (e.g. riser valve closure) transmitted to or from connected
installations should be described. If SSIVs are installed, their mode of operation should be
described: i.e. automatic or manual.
11. Connection to Pipeline Systems
When communication data or control links between installations connected by pipeline are
lost there are usually temporary manual procedures after which the pipeline should be shut
down. In some cases remotely controlled action can be taken under major accident

conditions by connected installations. The sequence and timing of such actions, including
emergency shut-down arrangements should be described in the safety case.
12. Pipeline Leak Detection
The safety case should describe the type and operation of the pipeline leak detection
system, including data and control functions monitored, monitoring locations (e.g. at each
end of the pipeline) and the alarm and shutdown set points for these functions.
13. Emergency Response
The safety case should describe emergency arrangements, which should cover all
identified hazards and interfaces and roles of other operators (at other installations) for the
safety of the installation and of other installations.
14.

Integrity Management

The safety case should confirm that the inspection, maintenance and integrity management
arrangements in place for the pipeline include the entire length of the pipeline.
A description should be included in the safety case of the inspection assessment and
maintenance arrangements. This should summarise: the methods of inspection of the
pipelines and risers; the management system for carrying out the inspection work; and
decision making processes used to determine the scope and programme for remedial work
or operations.
A description should be included in the safety case of procedures to satisfy the operation,
maintenance and testing requirements for the emergency shutdown (ESD) valves,
demonstrating that seat leakage is measured, assessed and remedial action taken if
required.
15. Subsea Operations
The safety case should describe pipeline and control connections between the installation
and subsea manifolds wells and other installations.
The safety case should contain a summary description of procedures for simultaneous
production (if applicable) and diving, or other pipeline works or maintenance, on a pipeline,
at a subsea manifold or well connected by pipeline to the installation. This should detail the
measures in place to control any pipeline hazards that could affect the diving support
vessel, its crew or divers, the installation or another installation.

16. Pipeline Operations

The duty holder should state the expected frequency and purposes of pigging throughout
the field life, covering routine scale, wax, water/liquids removal, inhibitor / biocide
distribution, to intelligent pigging inspection.
The duty holder should summarise the inspection scheme for each part of the pipeline,
describing the techniques and frequencies used and justifying their adequacy.
The duty holder should assess the effects of leaking seats on riser ESD valves and
appropriate action to take should be documented. This should be covered in the safety
case as the summary of a study assessing the effects of the maximum allowable seat
leakage.
The design and operation should take account of safe operating temperature limits to avoid
hydrates, condensates in gas systems, wax, ice, steel embrittlement, failure of blowdown
systems and failure of polymers in flexible risers and pipelines.
Process upset conditions include slugs, surges and emergency shut-downs. Some system
designs rely upon the processes remaining within certain parameters, and suitable controls
must operate effectively to prevent excursions.
17.

Decommissioning and Abandonment

Taking a pipeline out of use involves cleaning out of hazardous substances from pipelines,
risers and topsides, and ensuring safe disconnection from live plant, and decommissioning
or removal of facilities as required. This involves ensuring the safety of divers and that of
other personnel involved with platform abandonment, and leaving the facilities in a safe
state. The safety case should address these issues as appropriate.

HS1 Rigid Risers

Riser integrity has to be assured. The following applies to rigid risers and to the topsides
elements connected to flexible risers. The safety case should include information relating to
risers, from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if
fitted) as follows.
Approximate route, showing relevant module decks, bulkheads and structural
members, riser supports / guides;

 ESDV location;
Mechanical joints, e.g. flanged and insulation joints;
Splash zone corrosion resistant cladding;
Any branches outboard of the ESDV as far as their respective isolation valve(s) and
their nominal diameter; and
Fire, explosion, impact or other protection provided for the riser and ESDV.
1. Riser Routing and Design
The safety case should, with the aid of diagrams, describe the riser routing in relation to the
topsides layout, installation structure, pipeline to installation approaches and field layout.
This enables assessment of the full impact of layout versus topsides and vessel activities.
The riser should, where possible, be routed away from fire, explosion and impact hazards.
The riser route should be chosen so as where possible to obtain a good ESDV location and
pig trap arrangement (such that the ESDV is located as low as reasonably practicable
along the length of the riser), such that, subject to other design constraints, the ESDV is
close to the top end of the vertical part of the riser.
Riser routes are sometimes chosen with little consideration of the ESDV location, this may
be because subsea and topsides design are considered separately. The constraints of the
topsides layout can result in a poor ESDV location, with a horizontal section of outboard
riser below deck that cannot be isolated by the ESDV.
Caisson risers should be terminated on the topside of the installation as low as is
reasonably practicable, so that the ESDVs can be located as required.
Specific issues to be addressed include:
position of cranes for loading vessels;
external risers located on the prevailing weather side of the installation, (being
vulnerable to impacts from drifting vessels);
fire protection;
access for inspection, i.e. when located in caissons, J-tubes or platform legs;
gas risers in concrete platform legs, which could leak and pressurise the leg causing
it to collapse;
adequate support of the riser, especially in the wave zone;

 dead weight supports should be with an anchor flange or similar, located out of the
splash zone (for inspection).

Risers should ideally be located in-board of jacket braces or other structural members to
protect them from vessel impact. If not, there should be fenders or other means installed
which can absorb impact energy without touching the riser. Parts of risers routed inboard of
jacket frames are vulnerable to impact by objects dropped from the topsides; there have
been instances of caissons falling and landing near to a riser.
Where risers are located in J-tubes (conduits) or in caissons, the J-tubes or caissons
should be sealed off at both ends and filled with inhibited water to protect the riser from
corrosion. A number of incidents have resulted from the failure to properly manage the
integrity of pipelines in J-tubes of caissons. HSE guidance Hydrocarbon Risers in
Caissons and I/J Tubes Inspection issues and become potential sources of leakage in a
fire.

HS2 Flexible and Compliant Risers

Riser integrity has to be assured. The topsides parts of flexible and compliant risers are
covered in the section 2.3.2.HS1. The safety case should include information relating to
risers from the seabed to either the ESDV or the pig trap (if fitted). In particular:
the approximate route in the extreme riser and vessel configurations showing
moorings, relevant module decks, bulkheads structural members, I tubes, hangoffs,
bend restrictors, midwater arches, seabed connections;
ESDV location;
mechanical joints, e.g. flanged joints, hang offs;
any branches outboard of the ESDV as far as their respective isolation valve(s), and
their nominal diameter; and
fire, explosion, impact or other protection provided for the riser and ESDV.
Flexible risers are vulnerable to damage from vessels, dropped objects, fatigue overstress
and internal damage. The stress analysis described in the safety case should cover all
applicable cases. Top end connections should be configured, either by their layout or by
bend restrictors, to avoid the flexible pipe being damaged by bending at the connection.

Riser stress analysis should cover extreme static installation offsets from its station, static
wind, wave and current loading, natural frequency analysis, dynamic response to wave
frequencies (stresses and fatigue damage assessment) and dynamic transient responses.
Operators should demonstrate awareness of the fatigue lives of their flexible risers,
including in damaged condition, and the limiting sea states for the riser system.
A description of fire, explosion and impact protection should address:
passive fire protection;
explosion protection - blast walls and plated decks;
dropped object protection;
operational protection against dropped objects: avoiding lifting over risers.
In operation each flexible riser annulus should be piped separately (to avoid interaction
between risers) to a safe area to vent gas pressure. Operator inspection should include
periodic testing of each flexible riser annulus by vacuum and positive pressure testing as
applicable, to test for and find a failed external polymer layer. Where the outer layer has
failed there should be measures to prolong the life of the outer tensile wires, fatigue
analysis to determine the remaining life of the outer tensile wires, and replacement of the
riser when required.

HS3 Pipeline - Tie-in spools, Seabed Pipeline

The safety case should take account of the pipeline within the hazard range of the
installation, including features such as:
layout of tie-ins, spool pieces, crossovers, subsea isolation valves (SSIVs), other
subsea equipment and extent of protection measures such as mattresses, rock
dump, trenching, protection covers, etc.
other pipeline(s);
no-anchoring areas;
anchor patterns and jack-up footprints for vessels normally moored in the vicinity.
All hazards that could result in a loss of pipeline integrity at any location (within the hazard
limit distance i.e. where the installation could be affected) should be identified and
included in the overall risk assessment for the installation.

The safety case should assess the interaction between the installation and others linked by
pipeline(s) and the effect an interconnected pipeline system could have on the installation
or upon other installations.
1. Pipeline to Platform Approaches
The duty holder should describe, with suitable diagrams:
the layout and configuration of the plant;
the connections to any pipeline or installation; and
any wells connected or to be connected to the installation.
The plan of the location should be large enough to show any features that may be
significant in the assessment of the hazard or risk associated with the site.
The safety case should include a pipeline to installation approaches plan from the hazard
distance to the installation, showing the installation(s), pipelines (including any not
connected to the installation), direction of geographical (true /grid) and installation north, no
-anchoring areas, subsea wells, manifolds, control umbilicals, anchor patterns for vessels
normally moored in the vicinity, layout of tie-ins, spool-pieces, crossovers, SSIVs, extent of
protection measures such as mattresses, rock dump, trenching, protection covers, supports
and any significant changes in the seabed elevation.
For a flotel located over the pipelines, dropped object and anchor/ mooring line damage
should be considered. Similarly jack-up temporary moorings used during jacking
operations, construction vessels, diving support vessels, and standby vessels should be
considered.
Moorings for drilling semis (usually but not always located away from fixed platforms) and
jack-ups drilling satellite wells and exploration wells should be considered in connection
with the in-field pipeline layout. Pipelay initiation, abandon and recovery lines should be
considered.
The pipeline integrity management system should address spans, including those close to
the installation.

HS4 Emergency Shutdown Valves (ESDV)

1. ESDV Location

The ESDV shall be located in a position:

in which it can be safely and fully inspected, maintained and tested;
such that the ESDV is above water (for normal design conditions); and
subject to the above, such that the distance along the riser from the ESDV to the
base of the riser is as short as reasonably practicable.
The duty holder should indicate the ESDV location(s) on the riser drawing. See the
paragraphs in 2.3.2.HS1 on ESD valve location, explaining how the riser should be
designed for this, as well as how to locate a riser ESDV on a given riser route.
The valve should be located as low as is reasonably practicable, and so as to eliminate
unnecessary horizontal lengths of riser outboard of the ESDV. Operators often provide a
small underdeck area containing only the ESDV.
A risk assessment may seem to show that a change of location makes no difference to the
overall risk of the installation. The safety case should confirm that the ESDV has been
properly located regardless of any such risk assessment.
Locating the ESDV correctly is a higher priority than providing protection for it. Grouping a
number of ESDVs in a well protected area (against fire explosion and impact) with poor
ESDV locations is not appropriate. The priority is to correctly locate the ESDVs.
ESDV location should not be compromised because an SSIV is fitted. The SSIV serves a
different function, does not shut as fast as a topsides riser ESDV, does not isolate the
contents of the pipeline and riser between the SSIV and the riser ESDV, and is usually not
tested etc for seat leakage.
2. Riser Branches Outboard of ESD Valves
Branches outboard of ESDVs compromise the ability of the main ESDV to isolate the
installation from the pipeline. Such branches are part of the riser. The safety case should
demonstrate that any such branch in use, as a bypass for example, has been fitted with an
ESDV that meets the requirements of Schedule 3 of the Pipelines Safety Regulations. If the
branch is not in use it should be cut back and isolated permanently, as close as possible to
the main riser, or removed altogether. Valves on branches should be locked closed.
3. ESDV Fire, Explosion and Impact Protection

The duty holder should demonstrate, through description and general layout drawings, that
adequate fire, explosion and impact protection is provided for the ESDV and its actuating
mechanism. The actuator and any stored energy device (e.g. spring return or accumulator
and hydraulic piping) required for fail-safe close purposes should be protected. A
description of the protection of these items should be included in the safety case.
Risers and riser supports should be protected against fire where necessary. At locations
close to ESDVs the riser should be protected as for the ESDV against fire, explosion and
impact.
4. Fire Protection
The safety case should provide assurance that the ESDV actuator and all components
necessary for ESDV fail-safe closure will remain fully operable under anticipated fire
conditions. The pressure containing capability of the ESDV, including any out-board
maintenance valves and any flanged connections to the riser, should survive the
anticipated fire conditions.
Whilst both passive and active fire protection systems may be used, it should be noted that
passive systems (coatings, covers, etc) do not require prime movers, distribution systems
and an initiation signal, and are therefore likely to be more reliable and have higher integrity
(subject to proper inspection and maintenance) than active systems (deluge, etc).
Accordingly, active fire protection systems acting on their own may not be sufficient.
There should be fire and gas detection in the vicinity of the ESDV.
5. Explosion Protection
Explosion protection measures in place should be described in the safety case. Explosion
protection is usually best achieved by locating the ESDV well outside congested equipment
modules and away from entries to these areas, to avoid high explosion over-pressures and
damage. In many cases blast walls are provided.
6. Impact Protection
The main impacts to be considered by the safety case are:
dropped and falling objects;
missiles resulting from explosions; and
vessels/ships.

Protection from impacts may be achieved by blast walls and plated decks.
The operator should carry out a study of the possible impacts, including those which could
be experienced following another incident, such as heavy machinery falling from above,
and should assess what protection is necessary.
Some of the protection may be in the form of procedural control, e.g. for crane handling,
boat approach, etc.
7. ESDV Operation and Testing
The duty holder should assess and mitigate the risks of the ESDV failing to operate on
demand; An SSIV can only partly address this risk.
The safety case should describe arrangements for periodic valve seat leakage testing and
timing of closure tests. The associated performance standards should take account of
potential escalation of an incident and be consistent with the risk assessment for the
installation.
8. Actuators and Control Panel
The duty holder should describe the types of actuators used on the ESDVs.
The ESDV, its actuator, the local control panel, and where fitted, its accumulators and any
ESDV dedicated maintenance valves, should be located close together.

HS5 Subsea Isolation Valves (SSIVs)

SSIVs are not a mandatory requirement. However, the duty holder/pipeline operator is
expected to take account of the Cullen Report and in particular recommendation 44 to "....
demonstrate in the safety case that adequate provision has been made, including if
necessary the use of SSIVs, against hazards from risers and pipelines". The Cullen Public
Inquiry reported on the 1988 Piper Alpha disaster in which gas pipelines ruptured outboard
of the riser ESDVs. This led to major fires fed from the pipelines, which caused the total
destruction of the platform and 167 deaths.
Where the safety case identifies that riser failure can lead to a major release of
hydrocarbons, including liquids, then a SSIV should be fitted to reduce the risk to as low as
is reasonably practicable. Where an SSIV is not fitted, the safety case should justify this
decision.

For liquids pipelines with a significant gas content a riser failure can lead to a major release
of liquid driven out by the expansion of the gas. Specialised software can quantify such a
release. A major part of a release can occur in the time taken for systems to be shut down
to depressurise the pipeline, especially where such systems are located elsewhere.
The decision as to whether or not an SSIV is to be fitted should be taken based upon an
analysis of the potential consequences and risks of a riser release, and of damage due to
escalation from another riser.
The safety case should fully assess the consequences of a failure. The cost of an SSIV
must be compared to the far greater cost if one is not fitted but is needed in an emergency.
In addition to fire/explosion risks, major pipeline releases can upset the stability/buoyancy
of floating production installations and vessels.
Where pipelines are branched into main transportation lines or third-party imports, without
an SSIV, there can be an unlimited supply of fuel into a fire. Emergency actions required by
third parties can take a considerable amount of time to achieve and tests have shown lack
of reliability; this must be factored into the assessment of whether an SSIV should be fitted.
The risk of the riser ESDV failing to operate on demand should be considered in the
assessment
Dutyholders/operators should consider combining several SSIVs into a single skid to
reduce installation costs and so make the fitting more reasonably practicable. Combining
import and export riser SSIVs can be done such that the flow goes from import pipeline to
export pipeline without going to the risers, thus reducing risks, the risers only being used for
pigging. Connection points for future pipelines can be added at negligible cost.
Pipelines to comment please? What is meant by this paragraph?
Due to the location of an SSIV, a significant inventory of hydrocarbons will be present
between the subsea valve and the top of the riser. Therefore, failure of the riser or
connected pipeline (at the installation) will result in an unavoidable discharge of
hydrocarbons under pressure, with the potential for a serious fire or vapour cloud explosion.
An SSIV cannot prevent this initial discharge from taking place and cannot protect
personnel in the open or working near the riser. Where the riser ESDV seat leaks the SSIV
cannot affect the short and medium term leakage rate in an incident. SSIVs are often only
function tested and not tested for valve seat leakage.
1. Non-return or Check Valves

On some risers a non-return valve (NRV) or check-valve may be used as a means of

isolation. Where this is the case, the safety case should justify the use of an NRV, taking
the following into consideration.
The NRV has the advantages of being a self-contained operation and of rapid closure in the
event of a pipeline rupture. Due to the closure times of actuated valves, there will be some
initial hydrocarbon discharge which will last longer than for an NRV.
An actuated SSIV has the advantage that it can be closed as a precaution in the event of a
small leak or a fire in the vicinity of the riser, whereas an NRV cannot be shut.
NRVs do not work on import lines. For export pipelines an NRV would prevent the normal
flow being reversed for operational reasons, such as for pipeline depressurisation. An NRV
makes it more difficult to pig the line, and NRVs are liable to be damaged by pigging. An
NRV may not prevent a small leak (i.e. may not give a tight seal).
Where appropriate, the safety case should demonstrate that the duty holder has
determined the exact criteria expected for the NRV operation and efficiency. NRVs may be
cheaper than SSIVs but the safety benefit is less, with the disadvantages noted above.
2. Location of an SSIV / NRV
The location of an SSIV should be determined from the balance of risks of
1. a release from the riser or pipeline inboard of the SSIV and
2. a release from the pipeline outboard of the SSIV.
SSIVs are usually located some distance away from the installation they are intended to
protect. This is necessary to reduce the risks due to any possible line failures resulting from
objects dropped from the platform, supply boats, etc. on the platform side of the valve.
The safety case should evaluate the risk of a rupture on the outboard (away from the
installation) side of the valve, in which case it is necessary to address:
gas cloud or oil pool dispersion;
protection of the pipeline; and
protection of the SSIV which can itself be an extra leak path.
In some cases an operator will wish to locate an SSIV for ease of construction - examples
are floating production installations with riser base valves, flowline bundles which arrive

close to an installation, SSIV skids serving several pipelines, spool-piece flanges being
used to avoid the cost of hyperbaric welds, etc.
The pipeline to platform approach layout should be considered carefully to ensure that each
SSIV is located on a sound risk-balancing basis, and that the overall layout addresses all
risks.
3. Description of SSIV
The duty holder should describe the SSIVs installed. There should be a description with
layout giving the location, modes of operation, type of valve and actuator and failure modes
(e.g. fail close on loss of hydraulics/signal).
The description must include the modes of closure/operation and the failure modes.
Dutyholders/Operators are sometimes reluctant to install fail-safe closed valves in case,
during a test or following a spurious failure, they close and remain jammed shut. It is
however, of no benefit to fit an SSIV that is almost impossible to use or is functionally
locked open.
There should be fail safe modes of closure or similar in event of loss of hydraulics/other
platform signals. The system should include local energy storage (such as a spring or
hydraulic accumulator) to close the valve, and it should not rely on platform based hydraulic
or other power supply for closure in an emergency.
4. Protection
The safety case should demonstrate that the SSIV is protected from impact and snag loads
from anchor lines and fishing trawls. Usually a structure is provided for this purpose.
5. Inspection, Testing and Maintenance
The duty holder should describe the philosophy for carrying out inspection, testing and
maintenance on SSIVs and NRVs.
As with any safety system, the reliability needs to be assured, and this is normally done by
carrying out periodic tests. The duty holder should describe the extent, type and frequency
of these tests. There should be detailed procedures in place for this purpose. Some
dutyholders/operators are reluctant to carry out tests in case the valves are damaged or
cannot be opened again. Regular testing however improves the reliability of valves. Testing
should include:

 full (and, if desired, partial) closure;

valve seat leak tests; and
checks for confirming closure, e.g. provision of local (visual) valve position indicators
as well as the remote system indicators.

HS6 Pigging Operations and Pig Traps

1. Design for intelligent pigging
Pipelines described in the safety case should be designed and built from end to end so that
intelligent or inspection pigging can be done. This means having a consistent internal
diameter, bends with a radius of at least 5 diameters, and providing pig launchers and
receivers of sufficient length for intelligent pigs, with sufficient space in which to load and
unload the pig traps. With subsea production systems connections should be provided for
pig launchers, or ideally there should be the facility for round trip pigging or similar: i.e. no
subsea operations required.
When a pipeline has been used for several years the question arises as to whether its
integrity can be assured. The only known method today to assure integrity is to carry out
periodic intelligent pigging runs.
Pipelines should be regularly scraped clear of water scale and wax by suitable pigging
operations as required to avoid the risk of internal corrosion. Spheres or pigs can be used
to apply inhibitor or biocide along the length of the pipeline.
Some gas pipelines are regularly cleared of liquid slugs into a slug catcher.
2. Pig traps
The safety case should demonstrate that pig traps have been suitably designed. Pig trap
closures should face outboard. Adequate protection (by double blocking of hydrocarbons,
interlocks etc) should be provided against accidental opening of closures whilst under
pressure. Pig traps should have facilities for venting, draining, purging, pressure testing,
water and nitrogen supplies and lifting aids as applicable.

Annex 1, Pipeline Reference Documents

1. Pipeline Design and Construction Standards
BS EN 14161:2011 Petroleum and Natural Gas Industries - Pipeline
Transportation Systems
BS PD 8010 Part 2:2004 Code of Practice for Pipelines. Part 2: Subsea Pipelines
DNV Offshore Standard DNV-OS-F101 Submarine Pipeline Systems 2010
ISO 13623:2009 Petroleum and Natural Gas Industries Pipeline Transportation
Systems (but see BS EN 14161)
ASME B31.4 Pipeline Transportation Systems for Liquid Hydrocarbons and Other
Liquids
ASME B31.8 Gas Transmission and Distribution Piping Systems
ISO 13628-11 Design and Operation of Subsea Production Systems Part 11:
Flexible Pipe Systems for Subsea and Marine Applications
API RP 17B Recommended Practice for Flexible Pipe (equivalent to ISO 13628-11)
BS EN ISO 16708:2006 Petroleum and Natural Gas Industries Pipeline
Transportation Systems Reliability BasedLimitStateMethods
2. Pipeline materials and construction standards
BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore
Part 1: Carbon and Carbon Manganese Steel Pipelines
BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore
Part 2: Duplex Stainless Steel Pipelines
ISO 13847 Petroleum and Natural Gas Industries: Pipeline Transportation Systems
Field and Shop Welding of Pipelines
ISO 15590 Petroleum and Natural Gas Industries: Induction Bends, Fittings and
Flanges for Pipeline Transportation Systems. Part 1: Induction Bends
ISO 15590 Petroleum and Natural Gas Industries: Induction Bends, Fittings and
Flanges for Pipeline Transportation Systems. Part 2: Fittings
ISO 15590 Petroleum and Natural Gas Industries: Induction Bends, Fittings and
Flanges for Pipeline Transportation Systems. Part 3: Flanges

 ISO 15589 Petroleum and Natural Gas Industries Cathodic Protection for Pipeline
Transportation Systems Part 2: Offshore Pipelines
ISO 3183 Petroleum and Natural Gas Industries Steel Pipe for Pipeline
Transportation Systems
API 5L Specification for Line Pipe (equivalent to ISO 3183)
API Specification 17J Specification for Unbonded Flexible Pipe
NACE Standard MR0175-2002 Sulphide Stress Cracking Resistant Metallic
Materials for Oilfield Equipment
BS EN ISO 13628-2 Petroleum and natural gas industries Design and operation
of subsea production systems Part 2: Unbonded flexible pipe systems for subsea
and marine applications
BS EN ISO 13628-10 Petroleum and natural gas industries Design and operation
of subsea production systems Part 10: Specification for bonded flexible pipe
BS EN ISO 15156-1:2009 Petroleum and natural gas industries. Materials for use in
H2S-containing environments in oil and gas production.
BS EN ISO 15156-2:2009 Petroleum and natural gas industries. Materials for use in
H2S-containing environments in oil and gas production. Cracking-resistant carbon
and low-alloy steels, and the use of cast irons.
BS EN ISO 15156-3:2009 Petroleum and natural gas industries. Materials for use in
H2S-containing environments in oil and gas production. Cracking-resistant CRAs
(corrosion-resistant alloys) and other alloys.
3. Safety systems standards
API RP 14C Recommended Practice for Analysis, Design, Installation and Testing of
Basic Surface Safety Systems for Offshore Production Platforms 7th Edition March
2001
BS EN ISO 13628-14 (Draft) Petroleum and Natural Gas Industries: Design and
Operation of Subsea Production Systems. Part 14. Subsea High Integrity Pressure
Protection Systems (HIPPS)
SPC/TECH/ED/31 Safety instrumented systems for the overpressure protection of
pipeline risers
API Spec 6D Specification of Pipeline Valves

 ISO 14313 Petroleum and Natural Gas Industries Pipeline Transportation Systems
- Pipeline Valves
Department of Energy Guidance Notes in Support of the Offshore Installations
(Emergency Pipeline Valve) Regulations 1989 SI 1989/1029
SPC/TECH/ED/49 Riser Emergency Shut Down Valve (ESDV) Leakage Assessment
Pipeline Riser emergency shut down valves - Inspection issues and
recommendations
(http://www.hse.gov.uk/pipelines/resources/emergencyshutdown.htm)
BS EN ISO 14723 Petroleum and natural gas industries. Pipeline transportation
systems. Subsea pipeline valves
4. Pipeline Integrity management standards
DNV Recommended Practice DNV-RP-F116 Integrity Management of Submarine
Pipeline Systems, 2009
DNV Recommended Practice DNV-RP-F206 Riser Integrity Management
Oil and GasUKGuidance Note: Monitoring Methods and Integrity Assurance for
Unbonded Flexible Pipe Rev 5 Oct 2002
API Technical Report 17TR2 The Ageing of PA-11 in Flexible Pipes
Oil and GasUKOP010 State of the Art Report on Flexible Pipe Integrity and
Guidance Note on Monitoring Methods and Integrity Assurance for Unbonded
Flexible Pipes
Energy Institute: Guidelines on integrity management of subsea facilities
PD 8010 Part 4 Risk-based integrity management of steel pipelines on land and
subsea pipelines (in preparation)
5. Pipeline operations
ISO 21329 Petroleum and natural gas industries. Pipeline transportation systems.
Test procedures for mechanical connectors
SPC/TECH/ED/18 Health & Safety Issues Associated with Changes from Dry Gas to
Wet Gas Operations
HSG 253 The safe isolation of plant and equipment, HSE Books, 2006, ISBN
9780717661718
HSE SPC/TECH/GEN/18 Underlagging Corrosion of Plant & Pipework

6. Other guidance and sources of information

HSE/IP/UKOOA PARLOC 2001: The Update of Loss of Containment Data for
Offshore Pipelines 5th Edition
ED Hydrocarbon Release Database (https://www.hse.gov.uk/hcr3/)
Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and
Blowdown Systems, 2001, Oil and GasUK/ Energy Institute, ISBN 978-0-85293-2872
Guidelines for the Management of Integrity of Joints in Pressurised Systems, 2007,
Oil and GasUK/ Energy Institute, ISBN 978-0-85293-461-6
Guidelines for the Management, Design, Installation and Maintenance of Small Bore
Tubing Systems, 2000,UKOil and Gas / Energy Institute, ISBN 978-0-85293-275-9
Guide to the Application of IEC 61511 to Safety Instrumented Systems in
theUKProcess Industries, EEMUA, ISBN 0-85931-168-6
TWI/DNV/SINTE Project Guideline for Engineering Critical Assessments for Pipeline
Installation Methods Introducing Cyclic Plastic Strain, DNV Report number 20033135