Failure to manage valve locking and car sealing systems

Article published in the Regulator | Issue 1: 2017

Recent inspections by NOPSEMA have identified that some facilities have failed to appropriately manage safety critical valve locking and car sealing systems. NOPSEMA’s inspectors have identified several instances where valve locks or car seals were either degraded to the point of being ineffective, were installed in a way that didn’t prevent inadvertent operation of the valve, or were not installed at all. These findings point to a number of deficiencies in the respective valve locking and car sealing programs which could lead to the failure of a safety critical device; stopping it from preventing loss of containment and a potential major accident event.

Almost all offshore facilities have process safety devices such as pressure safety valves (PSVs) and safety instrumented functions (SIFs), and it is critical to the overall safe operation of a facility that these devices continue to operate effectively. Process safety devices generally require some form of maintenance or proof testing to ensure they will function correctly when required to do so. In most instances, it is not practical to shut down an entire process to conduct such work. Therefore, isolation valves are commonly provided to enable a device to be maintained or tested while the process remains online. Therein lies the problem.

The presence of an isolation valve introduces the risk the valve will be in the incorrect position (i.e. closed) rendering its safety function ineffective. Depending on the process safety device, the problem may persist undetected for an extended period of time until the device is tested or required to perform its safety function. This may give personnel working and living on an offshore facility a false sense of security; believing safety critical devices can be relied upon, when this may not be the case.

To address this problem, valves that can prevent the continued and effective functioning of a safety device, such as a PSV or SIF, are typically sealed or locked in the safe position. The operation of the valve is strictly controlled and risk assessments are undertaken so alternative measures can be put in place for the duration of time that the valve is in its ‘unsafe’ position. For the locking or sealing system to be effective, it must have the following basic features as a minimum:

  • The lock or seal should provide a reasonable mechanical barrier to inadvertent or accidental operation of the valve to an unsafe position.

  • The lock or seal should be checked regularly to ensure that it is in place according to the master P&IDs or alternative document which is controlled and approved by a competent person.

  • The lock or seal should be inspected regularly to ensure that it is effective as a mechanical barrier and that there is no significant degradation.

  • Temporary removal of the lock or seal should be approved by an authorised competent person and a risk assessment undertaken to ensure that the risks are managed to ALARP.

  • Following temporary removal of the lock or seal, the valve must be returned to its safe position and the lock or seal reinstated as soon as reasonably practical at the conclusion of the work for which the lock or seal was removed.

Failure to manage valve locking and car sealing systems

Because of the importance of these safety critical valve locking and sealing programs, NOPSEMA will continue to inspect and assess facilities against the principals highlighted in this article and enforcement action may be taken where deficiencies are observed. 

In 2008, facility workers in the US closed an isolation valve between the heat exchanger shell and a relief valve to replace a burst rupture disk. Maintenance workers replaced the rupture disk on the day, however, they forgot to reopen the isolation valve. The next day, other facility workers closed a block valve to isolate the pressure control valve from the heat exchange so that they could connect a steam line to the process line to clean the piping. The steam flowed through the heat exchanger tubes, heated the liquid in the exchanger shell, and increased the pressure in the shell. The closed isolation and block valves prevented the increasing pressure from safely venting through either the pressure control valve or the rupture disk and relief valve. The pressure in the heat exchanger shell increased until it violently ruptured.

An effective car sealing program could have prevented this incident. Typically the valve isolating the relief valve would have been locked open. An effective program would have ensured that the valve was restored to its ‘safe’ open position at the conclusion of the maintenance work.