diver access to subsea systems

Guidelines for

Isolation and Intervention: Diver Access to Subsea Systems

IMCA D 044 October 2009

International MarineContractors Association

www.imca-int.com

AB

AB

The International Marine Contractors Association (IMCA) is the international trade association representing offshore, marine and underwater engineering companies. IMCA promotes improvements in quality, health, safety, environmental and technical standards through the publication of information notes, codes of practice and by other appropriate means. Members are self-regulating through the adoption of IMCA guidelines as appropriate. They commit to act as responsible members by following relevant guidelines and being willing to be audited against compliance with them by their clients. There are two core activities that relate to all members: Competence & Training Safety, Environment & Legislation The Association is organised through four distinct divisions, each covering a specific area of members’ interests: Diving, Marine, Offshore Survey, Remote Systems & ROV. There are also five regional sections which facilitate work on issues affecting members in their local geographic area – Asia-Pacific, Central & South America, Europe & Africa, Middle East & India and North America.

IMCA D 044

This guidance has been prepared for IMCA under the direction of IMCA’s Diving Division Management Committee based on material provided by Torquil M Crichton and other co-authors of Technip UK Limited.

www.imca-int.com/diving

The information contained herein is given for guidance only and endeavours to reflect best industry practice. For the avoidance of doubt no legal liability shall

attach to any guidance and/or recommendation and/or statement herein contained.

© 2009 IMCA – International Marine Contractors Association

Guidelines for Isolation and Intervention: Diver Access to Subsea Systems

IMCA D 044 – October 2009

1 Introduction ........................................................................................................... 1

2 Glossary .................................................................................................................. 2

3 Principles of Isolation ............................................................................................ 5 3.1 Principles of Isolation ........................................................................................................................................ 5

3.2 System Isolations ................................................................................................................................................ 5

3.2.1 Liquid and Gas Equipment ................................................................................................................... 5

3.2.2 Electrical Equipment ............................................................................................................................. 6

3.2.3 Optical Equipment ................................................................................................................................ 6

3.2.4 Hydraulic Equipment ............................................................................................................................ 6

3.3 Specific Risk Assessment .................................................................................................................................. 7

3.4 Isolation Precedence ......................................................................................................................................... 7

4 Flowline/Manifold/Tree and Wellhead Systems ................................................. 8 4.1 Isolation ................................................................................................................................................................ 8

4.1.1 Types of Flowline/Manifold/Tree and Wellhead Isolations .......................................................... 8

4.1.2 Considerations for Flowline/Manifold/Tree and Wellhead Isolations ...................................... 14

4.1.3 Testing Flowline/Manifold/Tree and Wellhead Isolations ........................................................... 16

4.1.4 Integrity of Flowline/Manifold/Tree and Wellhead Isolations .................................................... 22

4.2 Intervention ....................................................................................................................................................... 24

4.2.1 Types of Intervention ......................................................................................................................... 24

4.3 Installation of Subsea Equipment .................................................................................................................. 27

4.3.1 General .................................................................................................................................................. 27

5 Subsea Control and Umbilical Systems ............................................................ 29 5.1 Isolation .............................................................................................................................................................. 29

5.1.1 Types of Subsea Control and Umbilical System Isolations ......................................................... 29

5.1.2 Electrical/Communication/Signal Isolations ................................................................................... 31

5.1.3 Optical Isolation .................................................................................................................................. 39

5.1.4 Hydraulic and Instrumentation Isolations ...................................................................................... 41

5.1.5 Mechanical Isolations .......................................................................................................................... 59

5.2 Intervention ....................................................................................................................................................... 60

5.2.1 Types of Subsea Control and Umbilical System Interventions .................................................. 60

5.2.2 Electrical and Communication/Signal System Interventions ....................................................... 61

5.2.3 Optical System Interventions ........................................................................................................... 70

5.2.4 Hydraulic and Instrumentation System Interventions ................................................................. 71

5.2.5 Mechanical System Interventions ..................................................................................................... 83

5.3 Installation and Retrieval of Subsea Components ..................................................................................... 84

5.3.1 General .................................................................................................................................................. 84

5.3.2 Subsea Control and Umbilical System Components – Installation and Retrieval ................. 85

6 Isolation Flowchart and Isolations Summary Table ........................................ 90 6.1 Isolation Flowchart for Subsea System ........................................................................................................ 90

6.2 Isolations Summary Table – Subsea Control and Umbilical Systems .................................................... 91

7 Typical System Drawings .................................................................................... 92

8 References ............................................................................................................ 97 8.1 Reference Documentation ............................................................................................................................. 97

8.1.1 IMCA Guidance ................................................................................................................................... 97

8.1.2 Other Documents .............................................................................................................................. 97

8.2 Applicable Standard Graphical Symbols ...................................................................................................... 98

8.3 Laser Classifications Summary ...................................................................................................................... 99

Figures

Figure 1 – Double block and bleed arrangements at intended break .............................................................................. 9 Figure 2 – Small bore isolation valve configurations .......................................................................................................... 11 Figure 3 – Typical test downline configuration – DSV to subsea worksite .................................................................. 17 Figure 4 – Positive test method ............................................................................................................................................. 19 Figure 5 – Negative or in-flow leak off test method .......................................................................................................... 20 Figure 6 – Volume calculation test method ......................................................................................................................... 21 Figure 7 – Integrity test graph – acceptable......................................................................................................................... 24 Figure 8 – Integrity test graph – unacceptable .................................................................................................................... 24 Figure 9 – Typical valve arrangement for post-installation flooding ............................................................................... 28 Figure 10 – Minimum valves on typical pig launcher/receiver .......................................................................................... 28 Figure 11 – Typical subsea control and umbilical system isolations ............................................................................... 30 Figure 12 – Double block and bleed (DBB) valve manifold for instrument device ..................................................... 45 Figure 13 – Block-block and bleed (BBB) valve manifold for instrument devices ....................................................... 46 Figure 14 – Block and bleed valves with self-sealing diver coupling ............................................................................... 48 Figure 15 – Isolation testing double block and bleed plus self-sealing coupling ........................................................... 53 Figure 16 – Isolation testing single block and bleed plus self-sealing coupling ............................................................. 55 Figure 17 – Isolation flowchart for subsea system ............................................................................................................. 90 Figure 18 – Fundamental considerations .............................................................................................................................. 92 Figure 19 – Typical manifold and flowline P&ID ................................................................................................................. 93 Figure 20 – Typical subsea tree P&ID ................................................................................................................................... 94 Figure 21 – Typical subsea control and umbilical system schematic .............................................................................. 95 Figure 22 – Typical DSV to subsea worksite test downline ............................................................................................. 96 Figure 23 – Standard graphical symbols ................................................................................................................................ 98

Tables Table 1 – Potential energy sources in subsea workscopes ................................................................................................ 5 Table 2 – Isolation and intervention considerations .......................................................................................................... 26 Table 3 – Subsea electrical power categories ..................................................................................................................... 62 Table 4 – Subsea components with optical elements ........................................................................................................ 70 Table 5 – Hydraulic system connection categories for subsea components ................................................................ 72 Table 6 – Subsea instrumentation types and categories ................................................................................................... 79 Table 7 – Subsea control and umbilical system components – installation and retrieval .......................................... 89 Table 8 – Isolations summarised ............................................................................................................................................ 91 Table 9 – Laser classifications ................................................................................................................................................. 99

IMCA D 044 1

1 Introduction

This guidance document is primarily aimed at project managers, project engineers, offshore construction managers, diving supervisors and safety personnel, all of whom have a responsibility for developing safe schemes of isolation and intervention for divers accessing subsea systems. Additionally, engineering personnel involved with the design of such systems should also use this document to ensure that all new (or being modified) subsea systems incorporate adequate isolation facilities.

This document sets out what is considered to be good practice for ensuring a safe degree of isolation is established prior to conducting diver intrusive works on any energy-conveying system in which pressure differentials, electrical power or laser power may exist at levels which – on loss of containment – would be harmful to personnel or cause damage to the environment or equipment.

The guidelines are applicable for use when preparing workscopes, procedures, reviews and risk assessments for any diver related work.

These energy sources (pressurised liquid, pressurised gas, electricity and laser light) may be found as a conveyed product or service utility within either or both of the following two major subsea equipment categories:

Flowline/manifold/tree and wellhead systems (containing any of – oil, gas, condensate, water injection, chemical injection – either separately or in various combinations);

Subsea control and umbilical systems (containing any of – hydraulic fluid, high and low voltage powered equipment, communication signals, instrumentation signals, optical data signals, power transmission and distribution, chemicals, gas – each within dedicated sub-systems).

The general principles of isolation philosophy and isolation practice, as applicable to such systems, are given in section 2, whilst detailed guidelines regarding isolation and intervention are given in sections 4 and 5 respectively.

Adequate planning is essential for an effective isolation, not only to ensure awareness of the task requirements and ready availability of all materials, tools, etc., before work begins, but also to identify and assess the isolation options and their associated hazards and effects.

Safe standards of isolation are primarily determined by the size and nature of the potential hazards associated with the equipment to be worked on. Other fundamental factors which should be addressed are:

i) an understanding of all the parameters associated with the energy source being isolated;

ii) status, condition and accessibility of available isolation hardware;

iii) identification of adjacent live systems which may influence or be affected by the isolations; and

iv) the anticipated duration of the actual intervention work.

Occasionally, the requirement may arise to utilise divers to conduct work on items of hardware which have been specifically designed for ROV installation, operation or recovery. In such instances, the isolation and intervention guidelines set out in this document should still be applicable.

Whilst it is not possible for these guidelines to account for the detailed and specific complexities of each and every subsea system encountered, the principles set out in this guidance should be applicable.

2 IMCA D 044

2 Glossary

AAV Annulus access valve

AC Alternating current

ACPI Annulus choke position indicator

ACV Annulus choke valve

AMV Annulus master valve

APT Annulus pressure transducer

AWV Annulus wing valve

BBB Block-block and bleed (valve)

BBV Block-block-and-vent (valve)

Bleed valve A valve for draining liquids, or venting gas, from a pressurised system

Blind flange A component for closing an open end of pipework which is suitably rated to maintain the pressure rating of the pipe

Block valve A valve which provides a tight shut-off isolation purpose

Charged The item has acquired a charge either because it is live or because it has become charged by other means such as by static or induction charging, or has retained or regained a charge due to capacitance effects even though it may be disconnected from the rest of the system

CIV Chemical injection valve

DB Double block (valve)

DBB Double block and bleed (valve)

DC Direct current

DCS Distributed control system

DCV Directional control valve

Dead Not electrically ‘live’ or ‘charged’

Design working pressure Maximum working pressure at which a hose or tube is rated for continuous operation

DHPT Down-hole pressure and temperature (sensor)

DHSV Down-hole safety valve

Disconnected Describes equipment (or part of an electrical system) which is not connected to any source of electrical energy

Double block and bleed An isolation method consisting of an arrangement of two block valves with a bleed valve located in between

Double seated valve A valve which has two separate pressure seals within a single valve body. It is designed to hold pressure from either direction as opposed to a single seated valve

DSV Diving support vessel

DWP Design working pressure

EDB Electrical distribution box

ELCB Earth leakage circuit breaker

Electrical equipment Includes anything used, intended to be used or installed for use, to generate, provide, transmit, transform, rectify, convert, conduct, distribute, control, store, measure or use electrical energy

EPU Electrical power unit

ESD Emergency shutdown

IMCA D 044 3

Final isolation Subsea isolation, local to the worksite. This isolation should consist of a secure physical separation. It is a readily understood way in which prevention of the uncontrolled release of energy can be confirmed to diving personnel tasked with carrying out the work

FOP Fibre-optic processor

HAZOP Hazard and operability (study)

High voltage Within this document used to refer to any voltage over 1000V and up to 30KV

HIRA Hazard identification and risk assessment

HPU Hydraulic power unit

IEC International Electrotechnical Commission

ISO International Organization for Standardization

Isolated Indicates equipment (or part of an electrical system) which is disconnected and separated by a safe distance (the isolating gap) from all sources of electrical energy in such a way that the disconnection is secure, i.e. it cannot be re-energised accidentally or inadvertently

Isolation The separation of plant and equipment from every source of energy (pressure, electrical, mechanical and optical), in such a manner that the separation is secure

Laser Light amplification by stimulated emission of radiation

Let go current The upper limit of current at which the muscles of the forearm can be used

LIM Line insulation monitor

Live Equipment in question is at a voltage by being connected to a source of electricity. This implies that, unless otherwise stated, the live parts are exposed so that they can be touched either directly or indirectly by means of some conducting object and that they are live at a possibly hazardous potential

Low voltage Within this document used to refer to any voltage up to 50V

MAOP Maximum allowable operating pressure

Master control station (MCS) Generic name for the topside computer system dedicated to control and monitoring of the entire subsea control and umbilical system

Maximum permissible exposure Level of laser radiation to which, under normal circumstances, persons may be exposed without suffering adverse effects (see BS EN 60825-1: 1994)

MCS Master control station

MEG Monoethylene glycol

Medium voltage Within this document used to refer to any voltage between 51V and 1000V

MPE Maximum permissible exposure

Nominal (value) Minimal value in comparison with the normal expected value

Normally open A device which, when closed, will perform the function of a closed isolation

Obturator An internal part of a valve such as a ball, gate, disc, plug or clapper which is positioned in the flow stream such that the flow may be either blocked or permitted to pass

OEM Original equipment manufacturer

P&ID Process and instrumentation diagram

PCPI Production choke position indicator

PCV Production choke valve

Perception current The lower limit of current which can be felt

4 IMCA D 044

Pig A device that can be driven through a pipeline by means of fluid pressure for purposes such as cleaning, dewatering, inspecting, measuring, etc.

PIG Pipeline internal gauge

PLMV Production lower master valve

PPT Production pressure transducer

PPTT Production pressure and temperature transducer

Preliminary isolation Initial isolation. Set as precursor to facilitate the obtaining of a further final isolation local to the worksite (where by design it is possible to do so). Generally it is a physical separation or (exceptionally) a software inhibit

PSL Product specification level

PUMV Production upper master valve

PWV Production wing valve

Rated working pressure The maximum internal pressure which the equipment is designed to contain and/or control

RCD Residual current device

ROT Remotely operated tool

ROV Remotely operated vehicle

RWP Rated working pressure

Safe body current The maximum current which can be allowed to flow through the diver’s body safely (explained in detail in IMCA D 045/R 015 – see section 8.1). It is not the current flowing in the electrical equipment

SAM Subsea accumulator module

SBB Single-block and bleed (valve)

SCADA Supervisory control and data acquisition

SCM Subsea control module

SCMMB Subsea control module mounting base

SCSSSV Surface controlled sub-surface safety valve

SEM Subsea electronic module

SIL Safety integrity levels

Spade A solid plate for insertion in pipework to secure an isolation

SSIV Subsea safety isolation valve

SSSV Sub-surface safety valve

SST Spheri-seal test

SUDA Subsea umbilical distribution assembly

SUT Subsea umbilical termination

SUTA Subsea umbilical termination assembly

TCT Tree-cap test

Tested Integrity has been proven and/or can be monitored

TUTU Topside umbilical termination unit

Ultra-high voltage Within this document used to refer to any voltage greater than 30KV

UPS Uninterruptible power supply

Vent valve A valve for draining liquids, or venting gas, from a pressurised system

XOV Cross-over valve

XT Christmas tree

IMCA D 044 5

3 Principles of Isolation

3.1 Principles of Isolation

The general principle of isolation is, where practicable, the removal of hazards or sources of energy from within the system to be worked upon, through the provision of an appropriate physical separation which can be confirmed to provide adequate disconnection of that system from any potential source of further energy.

The hyperbaric nature of subsea work means that divers are regularly exposed to the particular hazard of negative pressure systems during activities associated with system equalisation, as well as the normal potential hazards associated with the positive release of pressure from a system. Even a very small aperture with an associated pressure profile can cause severe injury should a diver come into contact with it. Thus when working on any subsea system containing liquid or gas under positive or negative pressure, there should be no pressure differential, relevant to the seabed ambient, trapped within a space or void.

Similarly, divers may become exposed to live electrical or optical connections containing electrical or laser energy at potentially hazardous levels which may also cause injury without warning. Thus, for any subsea system conveying electrical energy, or laser energy, there should be no exposed live electrical connections, or optical contacts located subsea.

In many cases, diving operations cannot commence until the topside installation has firstly applied primary isolation(s) to the main energy source(s), following which, manual and tangible final isolations will then need to be applied at the subsea worksite location. All isolations need to be proven, to demonstrate to diving personnel that protection from all potential energy sources has been established.

Potential energy sources which may be associated with subsea isolations are:

Source Description

Reservoir Primary source of high pressure hydrocarbons

Process pipework Large capacity pipework containing hydrocarbons

Main oil line pumps High pressure and high volume hydrocarbons

Gas compressors High pressure and high volume gas compositions

Water injection pumps High pressure and high volume treated water

Chemical injection High pressure, low volume chemical solutions

Hydraulic control systems High pressure, low volume accumulated systems

Electrical power supply systems High voltage/current electrical energy

Electrical control systems High voltage/current electrical energy

Fibre-optic data systems High intensity (laser) light energy

Instrumentation pipework Small capacity pipework containing fluid/gas

Table 1 – Potential energy sources in subsea workscopes

3.2 System Isolations

3.2.1 Liquid and Gas Equipment

For subsea liquid and gas conveying equipment, the general principle is that a minimum of two independent and tested isolations should be established between personnel engaged in any task where the presence of potential hazard from a positive or negative pressure source exists.

Where practicable to do so, at least one of the isolation tests should take the form of a positive test, in the direction of flow, or alternatively, a negative test by reducing the pressure

6 IMCA D 044

downstream of the isolation. Exceptionally, it may be appropriate to test both isolations against the direction of flow.

3.2.2 Electrical Equipment

For subsea electrical equipment, the general principle (assuming that the voltage is higher than is safe for the diver to work beside) is that the main power circuit of the electrical equipment, together with any associated auxiliary circuits which constitute a hazard, should be isolated and any stored energy in the electrical circuits should be discharged.

Isolation can be achieved by disconnecting and separating the electrical equipment from every source of electrical energy in such a manner that this disconnection and separation is confirmed and secure, i.e. it cannot be re-energised accidentally or inadvertently.

A minimum of two independent and certified isolations should be established between personnel engaged in any task where the presence of a potential hazard from electrical energy at potentially hazardous levels exists. Normally at least one of these isolations should be located on the topside host installation. However, it may be possible to set isolations local to the subsea worksite by physical disconnection of an inductive coupler (this does not apply to conductive connectors).

3.2.3 Optical Equipment

For subsea optical equipment, the general principle is that the main power circuit of the fibre optic equipment, together with any associated auxiliary circuits which constitute a hazard, should be isolated.

Isolation can be achieved by disconnecting and separating the fibre-optic equipment from every source of electrical power (topside) and final optical interface (subsea) in such a manner that this disconnection and separation is confirmed and secure, i.e. it cannot be re-energised accidentally or inadvertently.

A minimum of two independent and certified isolations should be established between personnel engaged in any task where the presence of a potential hazard from laser light energy at potentially hazardous levels exists. Normally at least one of these isolations should be located on the topside installation. If, however, the laser sources are Class 1, Class 1M, Class 2 or Class 2M laser sources, then isolation is not a requirement.

3.2.4 Hydraulic Equipment

For subsea hydraulic equipment, the general principle is that the main power circuit of the hydraulic equipment, together with any associated auxiliary circuits which constitute a hazard, should be isolated and any stored energy in the hydraulic circuits vented.

Isolation can be achieved by disconnecting and separating the hydraulic equipment from every source of hydraulic power in such a manner that the disconnection and separation is confirmed and secure.

A minimum of two independent and tested isolations should be established between personnel engaged in any task where the presence of a potential hazard from hydraulic pressure at potentially hazardous levels exists. Normally at least one of these isolations should be located on the topside host installation. However, it may be possible to set isolations local to the subsea worksite by either physical disconnection of stab plate halves or by operating manual isolation and vent valves (the vent port needs to be fitted with a diver-safe pressure relief cap) in combination with the physical disconnection of self-sealing hydraulic couplers.

Note: Hydraulic systems operating sub-surface or down-hole safety valves may provide a conduit for well bore fluids to return to the surface and these may be present in these systems. This possible hazard should be considered in any assessment of the isolation requirements for such systems.

IMCA D 044 7

3.3 Specific Risk Assessment

For the isolation of the subsea equipment described above (liquid and gas conveying equipment, electrical equipment and optical equipment), if, due to limitations in actual subsea architecture, two tested and independent isolations cannot be achieved, then it may be possible to identify an alternative method for undertaking the work, without compromising the safety of the operation. Any such alternative method needs to be subjected to a task specific risk assessment by competent personnel with appropriate company review and approval (see Figure 17).

3.4 Isolation Precedence

In certain projects it is possible that isolation techniques other than those set out in this document may be suggested. As an example, there may be a client or main-contractor isolation philosophy document containing detailed procedures for isolation. Any such alternative methods should be compared with the techniques contained within this document and the more stringent requirement used.

In all cases the need for double isolation remains a fundamental principle.

8 IMCA D 044

4 Flowline/Manifold/Tree and Wellhead Systems

4.1 Isolation

4.1.1 Types of Flowline/Manifold/Tree and Wellhead Isolations

A minimum of two independent and tested isolations should be established between personnel engaged in any task where the presence of a potential hazard from a pressure source or vacuum exists. The physical isolation of pressurised systems is generally achieved by using various combinations of valves, spades or blank flanges.

Isolations for subsea flowline/manifold/tree and wellhead systems are primarily provided in standard form by valves located between the diver intervention workface and the potential energy source. There are also many instances whereby pre-installed and tested blind flanges may provide isolation. The type, configuration, location and testing of such isolations are considered in further detail throughout this section.

Consideration is also given to certain alternative and specialised isolation techniques, which may not be appropriate for standard applications but, depending on system architecture, may require to be utilised.

The following isolation terminology is applicable both to bulk subsea systems (i.e. flowlines, manifolds, trees and wellheads) and the associated smaller, but more complex, subsea control and umbilical systems (see section 5). The process of achieving an appropriate overall isolation scheme for subsea intervention work invariably has implications for both systems, therefore there needs to be a common understanding of the basic principles involved.

Preliminary Initial isolation. Set as a precursor to facilitate the obtaining of a further final isolation local to the worksite. Generally this is a physical separation or (exceptionally) a software inhibit.

Final Subsea isolation, local to the worksite. This isolation consists of a secure physical separation. It is the tangible mechanism by which prevention of the uncontrolled release of energy is confirmed to those intending to carry out the work.

4.1.1.1 Standard Isolation Methods

4.1.1.1.1 Valves

Valves provide the simplest conventional form of preliminary and/or final in-line isolation device across the dimension range, from large diameter trunk pipelines through to small-bore injection tubing. When utilised in subsea systems they are defined within two specific categories: either manually operated (i.e. by diver or ROV) or remotely actuated (i.e. by subsea control system).

Certain designs of remotely actuated valves may also be operated by purpose-designed diver/ROV override mechanisms.

The optimised isolation configuration for accessing a subsea bulk system for intervention purposes should consist of two sets of main double block valves, each with a bleed valve located between them. This ‘bleed’ facility itself should consist of an arrangement of small-bore valves in a double block and bleed configuration, as they connect directly into the bulk system. Such valving should be in place on both sides of any intended break (see Figure 1).

IMCA D 044 9

VALVE 1A VALVE 2A VALVE 2B VALVE 1BCLOSED OPEN OPEN CLOSED

BLEED PORT

CONNECTION POINTTEST DOWNLINE

BULK SYSTEMPRESSURISED

TEST DOWNLINE CONNECTION POINT

BLEED PORT

LOCATION OFINTENDED BREAK


Figure 1 – Double block and bleed arrangements at intended break

Wherever practicable, it is prudent to utilise at least one manually operated valve for one of the isolations.

When two remotely actuated valves require to be utilised to establish the bulk system isolation scheme, the supply lines to both should be locally isolated at the worksite.

In the absence of any means to implement such isolations then the additional potential hazards arising need to be assessed with a view to either proposing an alternative isolation scheme or identifying an increased isolation envelope.

Valves should be capable of providing a reliable and positive shut-off seal for the isolation of a hazardous substance and/or energy source. They should be suitable for the expected service and associated potentially hazardous conditions to be encountered.

There are the two fundamental valve properties to consider:

i) type; and

ii) seat and seal material.

Standard valve types will conventionally be either ‘gate’, ‘plug’, ‘globe’ or ‘ball’. Seat and seal material will be either metal-to-metal or metal-to-elastomeric/ polymeric.

Full details of valve specifications and other applicable bulk system parameters should be obtained at an early stage in the onshore phase of the project. This should help avoid unnecessary delays during offshore integrity tests for a given isolation scheme.

Small-bore valves which form the directly-connected vent/bleed outlet in any subsea pipework system should always be arranged in a block-vent-block (‘double block and bleed’) valve configuration. The block valves provide two in-line isolations, which should be kept closed during the initial diver intervention activities (e.g. when connecting a dive support vessel (DSV) test downline to the main outlet port on the same valve assembly). The bleed valve provides a local safety vent through the bleed port.

10 IMCA D 044

The alternative, dual-in-line block only (‘double block’) valve, i.e. without any incorporated vent facility, should be considered the minimum form of small-bore valve isolation.

The protective cap fitted to the outlet port on small-bore double block or double block and bleed valves should be the ‘diver-safe’ integral-vent type (i.e. pressure vents prior to full disengagement). Such devices are designed to ensure any initial differential pressure equalisation occurring within, or through, the valve assembly (when preparing the cap for removal) can be vented in a safe manner, without the potential hazard of gross loss of containment or of the cap coming off in an uncontrolled manner. The use of any other type of cap (or plug) which does not incorporate a secondary pressure-relief mechanism is not considered suitable for diver intervention work.

The utilisation of a single-block valve only, in combination with either a non-venting cap/plug or an integral-vent type cap, fitted to the valve outlet port, is not considered appropriate to meet the principles for safe diver intervention given in these guidelines.

The suitability, or otherwise, for the various configurations of small-bore isolation valves and their caps/plugs is summarised in Figure 2.

The outlet port on small-bore valve assemblies should also be of suitable design to guarantee a fixed pressure-retaining connection when the DSV test downline is attached (and subsequently pressurised) to check for flow, either into or out of the cavity. This ensures a safe and secure facility is maintained for the equalisation of any entrapped pressure throughout the work.

IMCA D 044 11

PRODUCTFLOW

LEGEND

UNACCEPTABLE UNACCEPTABLE

ACCEPTABLE (but not recommended)

ACCEPTABLE - BASIC

ACCEPTABLE (but not recommended)

ACCEPTABLE - OPTIMISED

PRODUCTFLOW

PRODUCTFLOW

PRODUCTFLOW

PRODUCTFLOW

PRODUCTFLOW

PRESSURE

PRESSURE

PRESSURE

PRESSURE

PRESSURE

PRESSURE

Figure 2 – Small bore isolation valve configurations

4.1.1.1.2 Blind Flanges

The ends of pipelines, headers and spools are prepared with precision-machined flange faces such that they can be inter-connected to form a pressure-containing liquid/gas transportation system. These flanges are specified to at least the same design and test standards as the item to which they are attached.

The flange faces require to be maintained in their factory-finished condition throughout the load-out and offshore installation activities and for the duration of the field life. Protection for the sealing surfaces is therefore provided in the form of a matching circular blanking cover/plate or blind flange. These provide physical protection and, where required, comply with the system installation and commissioning specifications (i.e. free-flooding or pressure-tight), in combination with the intended field development programme (i.e. immediate hook-up, or future tie-in).

12 IMCA D 044

Blind flanges are therefore specified and prepared with either a single, or a dual-purpose role, as follows:

Single Duty – To provide physical protection only, for the sealing surfaces of the flange face. This is usually associated with a short-term requirement, the hook-up of adjacent items following soon after deployment.

The flange face may be protected with some simple covering arrangement or a proprietary blind flange which should not be fully tightened into place (e.g. by inserting spacer washers). With this type of protection arrangement, the flange interface is designed to free-flood and should therefore present no differential-pressure equalisation hazards for diver intervention.

In certain circumstances it may be a requirement to tighten the blind flange in place on surface, prior to deployment to the seabed (as it may be intended to allow the system to free flood in some other manner). Therefore the blind flange should be prepared with a welded outlet port to which is fitted, as a minimum, a small-bore double block valve, complete with either a ‘T’-piece or a diffuser. This is to ensure that there is no possibility of diver finger/hand entrapment during differential-pressure equalisation at depth.

Dual Purpose – To provide physical protection for the sealing surfaces of the flange face, plus the capability to maintain a pressure-containing isolation equal to the system design.

The flange face will normally be fitted with a proprietary blind flange and ring-gasket, and set in place with the full complement of tensioned studs. This level of preparation enables full pressure-testing against the blind-flange during pipeline commissioning. It also provides the capability, if required, of leaving the blind flange secured in place as a proven isolation, for some future tie-in.

With this type of flange protection, there exists the potential hazard of a trapped inventory of positive or negative pressure remaining in the cavity between the blind flange and the next (closed) valve in the bulk system. Therefore the blind flange should be prepared with a welded outlet port to which is preinstalled, as a minimum, a small-bore double block valve, complete with either a ‘T’-piece, or a diffuser. As an alternative, a small-bore double block and bleed valve arrangement could be preinstalled.

In the absence of any means to safely depressurise the bulk system prior to removal of the blind flange, then the additional potential hazards arising need to be assessed with a view to identifying an increased isolation envelope.

4.1.1.2 Alternative Isolation Methods

Certain other types of special or novel isolation techniques are available. Depending on specific design, these may or may not align with the recommended ‘double block and bleed’ isolation principle. Their utilisation should therefore be considered through detail engineering review processes.

The various techniques available are outlined below:

4.1.1.2.1 Double-Seal within Valve Body

Double-wedge gate, parallel-expanding gate or double-seal (double-piston effect) ball valves, which provide a double-seal in a single valve body with a bleed in between, may be utilised if necessary.

There are, however, certain limitations and restrictions to this type of valve which should be considered:

i) In some applications both isolations cannot be easily tested;

IMCA D 044 13

ii) The status of the double isolation depends upon the immobilisation of a single valve operating stem therefore there should be no possibility of it being operated during the intervention work;

iii) The valve body outlet bleed port directly accesses the inventory of the valve cavity. Also, this outlet is only protected from the potential energy in the bulk inventories (i.e. on either side of the valve unit) by the single isolations provided by each of the obturators within the valve assembly. The outlet should be fitted with a permanently attached double block access/vent valve arrangement as a minimum (a double block and bleed is recommended).

The ‘double seal’ valve design should only be used in preference to the conventional bulk system isolation arrangement (i.e. double block and bleed) after the increased hazards have been reviewed through the appropriate risk assessment process.

4.1.1.2.2 Pipeline Plugs

The utilisation of a bespoke in-pipe plug (or combination of plugs) to form a proven subsea isolation scheme is considered to be an appropriate form of novel isolation technique, subject to the following considerations.

Redundancy and independence should exist within, or between, the plugs such that failure of a part of the sealing system does not cause total loss of sealing capability. Similarly, power, control and monitoring systems for the isolation plug should be suitably robust and/or dual-redundant to account for any possible in-situ damage or failure.

Certain designs of in-pipe plugs may only be capable of providing an appropriate form of single isolation, whilst others may claim to provide full double block and bleed isolation. Due to variations in manufacturers’ design and the techniques by which these isolations are achieved, tested and maintained, the proposed device should be subject to thorough engineering evaluation and review at an early stage in the project.

The potential hazards associated with the utilisation of in-pipe isolation plug devices should be considered on a case by case basis under the appropriate risk assessment process.

4.1.1.2.3 Hot Tapping

Occasionally, for various reasons of operational or delivery constraints, it may be necessary to perform a live intrusive intervention on a pipeline whilst it remains at a percentage of (or even full) service pressure throughout the work. Accessing a bulk system in this manner is termed ‘hot tapping’.

This method of intervention has been successfully utilised onshore and subsequently adapted for subsea applications.

The section of pipe requiring intervention (e.g. to fit a valve assembly for some future tie-in) should be accessed by means of a hot tap clamp and drilling assembly, which should be suitably designed and tested for containing full pipeline pressure. This stack-up should also incorporate a suite of valves to facilitate the future tie-in. These should be arranged in a double block and bleed configuration which, on completion of the hot-tapping operation, should be subjected to full test pressure to confirm suitability as a permanent isolation.

4.1.1.2.4 Pigs

Pigs are not considered an appropriate form of subsea isolation. The utilisation of a pig or a series of pigs (separated by slugs of nitrogen, diesel, glycol, water, etc.) does not provide a reliable form of static isolation which can be fully tested

14 IMCA D 044

and accepted in the terms and recommendations of these guidelines. The ‘isolation’ properties previously offered by pigs have now been superseded by those of pipeline isolation plugs (see ii), above).

4.1.1.3 Specialised Isolation Methods

Techniques for directly isolating the pipeline or hydrocarbon reservoir from the subsea equipment, such as pipe freezing, hydrostatic column1, bridge plug, cement plug or other such specialised methods, are considered to be outwith the scope of these guidelines and are therefore excluded.

Should it be necessary to utilise any of these as effective isolations (through the services and supporting expertise of a specialised vendor) then their incorporation into the isolation scheme would need to be subject to detailed review through the appropriate risk assessment processes of both the client and the diving contractor.

The following valve-type is not considered suitable for intervention isolations:

Choke valves – the seats on flow-control elements of these valves are not designed to be pressure-retaining when fully closed. During interventions, the choke should be previously set to at least 25% open to reduce possibility of a potential pressure differential (e.g. due to restriction within choke).

The following valves are not normally considered suitable as intervention isolations:

i) Down-hole safety valves – these valves have the potential to self-equalise/ open if pressure develops in well-bore column above valve obturator. However, exceptionally, it may be permissible to accept this type of valve as a suitable isolation, but only if it has been possible to prove the sealing properties of the valve to at least the maximum anticipated pressure differential.

ii) Check valves – the condition and status of a ‘check’ valve cannot be guaranteed. However, exceptionally, it may be permissible to accept this type of valve as a suitable isolation, provided:

a) the valve can be positively locked closed throughout the workscope;

b) the valve is only utilised in conjunction with other proven valves in the bulk system isolation scheme; and

c) it has been possible to prove the sealing properties of the valve to at least the maximum anticipated pressure differential. Caution is required for smaller size check valves (e.g. in chemical injection lines) as a blockage may mask the test.

4.1.2 Considerations for Flowline/Manifold/Tree and Wellhead Isolations

4.1.2.1 Requirement to Flush

Before any intervention operations are conducted, consideration should be given at the planning stage to the contents of the relevant subsea pipework/tree-cavity. Applicable details regarding the bulk systems pressure, volume quantity, temperature, flowrates and chemical composition should be obtained for the risk assessment.

To provide a safe worksite for the diver and to minimise damage to the environment, it may be necessary to flush the subsea pipework/tree-cavity to remove harmful contents prior to placing isolations. These operations are usually required when hydrocarbon inventories are involved; it is recognised industry

1 The utilisation of a column of fluid in the well-bore of sufficient specific gravity such that its weight exceeds the up-thrust due to the formation pressure below – thus having the effect of forming an ‘isolation’. Key aspects to the reliability of this technique are: a) typically the overbalance pressure margin should be greater than 14 bar (200 psi); b) fluid level in the isolation column should be capable of being monitored continuously; and c) gas migration through the isolation column (from the reservoir) may occur, therefore any such inventory should be safely managed.

IMCA D 044 15

practice to reduce the hydrocarbon content to less than 40 parts per million (<40ppm) prior to any breaking of containment.

Flushing operations can either be conducted by the topside installation connected to the subsea system or remotely by the DSV when suitable tie-in points are available.

Typical flushing agents include nitrogen, treated water, monoethylene glycol (MEG), methanol, diesel or gel slug with other mediums. The suitability of the flushing agent should be confirmed prior to work commencing.

4.1.2.2 Pre-determined Tree Valve Status

The initial setting of tree and/or flowbase valves to either the open or closed position (or some percentage thereof for a choke valve) are usually pre-established by the client and applied through the workover equipment of the tree/wellhead installation contractor.

Subsequent hook-up and pre-commissioning activities by the subsea system installation contractor may favour altering the settings of some of these valves, invariably to conduct pigging routine(s) or carry out the pipeline pressure-testing programme.

Such adjustments are not recommended by these guidelines, for the following three reasons:

i) Tree valves are likely to have been pressure-tested by the drilling/workover rig and left in a particular position to suit the tie-in intervention work and the operational start-up programme;

ii) It is normal practice for the drilling/workover rig to ‘pre-condition’ the various cavities within the flowbase/tree/wellhead combination to benefit initial start-up flowing conditions. Any subsequent intervention by way of altering the status of valves during pre-commissioning may result in the introduction of undesirable fluids/gases into these cavities. This may hinder start-up;

iii) The adjustment of tree valves further to a well having been perforated and prior to operation by the host installation may incur damage to tree valves. This would be likely to result in some form of tree intervention or may even require recovery to surface.

All efforts should be made to maintain the tree in the status and condition in which it was found and expected to be left. This is usually recorded in the handover certificate received from the tree/wellhead installation contractor.

4.1.2.3 Location of Isolation

In certain instances, the large scale of a subsea field layout, combined with interconnecting pipeline lengths (possibly measured in tens of kilometres) may necessitate the point of isolation (e.g. topside, or at an onshore landfall) to be some considerable distance from the actual subsea work location.

Such field layouts raise areas of specific concern with respect to diver intervention which need to be considered on a case-by-case basis. These are:

i) Care needs to be taken to ensure that inadvertent de-isolation cannot take place at one end of a pipeline system whilst work is still progressing at the other end. Such circumstances reinforce the requirement for tangible isolations, adequate security (e.g. at onshore location, if necessary), plus the maintenance of effective monitoring and communications throughout the entire work;

ii) Confirmation that the remote isolation/vent-down has been implemented and is effective by conducting a series of checks local to the subsea worksite, should be undertaken before any diver intervention activities commence. The possibility of only a small pressure differential supported by a large volume

16 IMCA D 044

(either from within the pipeline or by the surrounding seawater) can present considerable potential hazard to diving personnel;

iii) Checks for the existence of a specific gravity differential between the pipeline contents and that of the surrounding seawater should be undertaken. The absence of a local isolation combined with a significant differential in specific gravities can present a potential hazard to diving personnel located in the vicinity of a high volume pipeline discharge.

Each intervention of this nature therefore should be reviewed with particular regard to the key parameters given above. Consideration should also be given to other important pipeline aspects such as – inventory type, overall topography, size, history and present condition.

Should the applicable risk assessment/review process determine that certain features of the intended isolation scheme are inadequate, or the pipeline inventory presents a potential hazard to diver or the environment, then the work should not be allowed to proceed until an appropriate alternative local isolation scheme is proposed, or an increased isolation envelope/vent-down method is identified.

4.1.3 Testing Flowline/Manifold/Tree and Wellhead Isolations

Two independent subsea isolations should be established before intrusive works can commence. Where possible, both should be tested in the direction of design-flow or in the direction of potential hazard flow (i.e. in the direction of the expected pressure differential).

The procedures for installing, testing and implementing these isolations should clearly specify the following four key items:

i) Valve alignment requirements, including subsequent operating system isolations, to both prove and maintain the isolation. To achieve this, a thorough understanding of the system process flow diagrams (PFDs), all relevant piping and instrumentation diagrams (P&IDs) and subsea control system schematics is essential. An appreciation of the operating principles of the overall subsea system and any associated topside operational preferences or limitations is also required;

ii) Technique(s) to regularly monitor the integrity of the isolation scheme throughout the intervention work;

iii) The test method(s) to be implemented and the test pressure(s) to be applied;

iv) The acceptable leak rate for each valve forming the isolation – see section 4.1.4.

It is important that detailed information regarding the valves to be subjected to test is obtained at an early stage during the onshore phase of the project, and certainly prior to commencement of the offshore programme as this will determine their test parameters and hence their acceptance criteria.

Typically, such information will consist of – valve design (globe, gate, etc.), size, specification, sealing type and classification, actuator type, operating mechanism, operating pressure (for hydraulic-type actuator), original (or previous) valve test data, pipeline service (liquid or gas) and pipeline rated working pressure. It is also important to obtain knowledge of the valve history and frequency of operation.

The essential features of the test equipment and the principles of the various test methods which may be applied are outlined in the following sections.

4.1.3.1 Test Down-Line

In order to correctly test isolations, confirmation is required that there is actual flow – or ‘communication’ – into the pipework/tree-cavity containing the isolation such that the test is in fact acting on the isolation.

IMCA D 044 17

This is normally carried out as part of initial subsea intervention works by the attachment of a test down-line from the DSV to a suitable block and bleed assembly on the subsea pipework and valve arrangements (see Figure 3).

REEL

GAUGE

M

POWER PACK

VENT

TB

LV

TBLK2 TBLK1

DSV DECK

GAUGESUBSEA

CAPPED

C/W ISOLATION& VENT VALVES

CHART- RECORDER &

TCV1TCV2

OR

TLIV

FROM DSVTEST DOWNLINE

SUITABLE FITTINGFOR EXISTING SYSTEM

CONNECTION POINT

Figure 3 – Typical test downline configuration – DSV to subsea worksite

Prior to attachment of the test downline into the bulk system, consideration should be given to the contents of the subsea pipework/tree-cavity and the pressure anticipated. Divers should be made aware of the potential of a pressure differential when removing any plug or cap from the bleed facility and should have confirmed previously that the pipework/tree-cavity block and bleed assembly is in the closed position.

The test downline should be deployed complete with a double block and bleed assembly and – where the potential for ‘returns’ to surface exists (or is unwanted) – a double check-valve arrangement incorporated. The test downline configuration should be pressure-tested on the DSV prior to deployment.

On attachment of the test downline onto the subsea pipework/tree-cavity block and bleed assembly, a leak test should be conducted against the closed bleed valve to confirm the integrity of the test line connection.

Any block and bleed assembly on subsea pipework/tree-cavity needs to be proven to operate correctly. It should not be assumed that ‘communication’ has been achieved through the pipework block and bleed assembly into the void just because the block and bleed is open. Debris, wax, hydrates2, asphaltenes etc. can readily restrict or block small-bore bleed facilities.

To confirm communication through and into the pipework/tree-cavity, it is necessary to have an open flow path that can be registered through the test downline. Ideally this would involve flow into, and out of, the cavity.

This is normally achieved by ‘locking in’ pressure in the test downline and opening up the bleed-and-block valve into the cavity. This should register as a pressure-drop on the topside gauge, thus confirming communication.

2 A mixture of hydrocarbons and water forming an ice-like solid under certain conditions of pressure and temperature. These can mask isolation testing results as the hydrate itself may be forming the isolation (rather than the requisite valve), or may be blocking the route to a test port. Furthermore, the hydrate creating the blockage may melt, resulting in an unexpected release of trapped pressure.

18 IMCA D 044

Generally, valves are designed such that the in-line pressure will actually assist in ‘activating’ their sealing mechanism(s). Thus, increasing the magnitude of the pressure difference across the valve (i.e. pressure differential) provides optimum test conditions. Tests should therefore be specified with as high a pressure differential as is reasonably possible.

Careful consideration, however, should be given in the various stages of the testing programme to determine whether the possibility will exist for the test acting on one side of a valve to ‘unseal’ (and thus negate) a previously successful test obtained on the opposite face of the same valve. It is therefore important to obtain detailed information regarding the various valves intended to form the isolation, and to correctly select test pressures relevant to the status of immediately-surrounding system components.

The application of test pressure should be carried out in a controlled manner. Typically, the pressure should be increased in gradual increments until at least 50% of the test pressure is reached. Thereafter, the pressure may be increased in steps of approximately one-tenth, or less, of the required test pressure, until the final value is reached.

The actual testing of isolations may be carried out using several different methods – depending upon the system type, architecture and the most suitable (or available) means of access. These are further detailed for flowline, manifold, tree and wellhead applications in section 4.1.3.2 to 4.1.3.5, inclusive and for hydraulic and instrumentation applications in section 5.1.4.2.

The integrity of a tested isolation should be determined with reference to the acceptance criteria given in section 4.1.4.

Note; Isolation and bleed components on subsea systems may remain inactive over extended periods of time. As a consequence they may become stiff and difficult to operate. Care should be taken when functioning block and bleed valves or removing plugs and similar fittings.

There is a possibility that captive pressure may remain locked-in between block valves, plugs and other small bore fittings even if the pipework has been depressurised (e.g. due to the presence of a hydrate).

At all times, divers should be aware of the potential for a pressure differential – a negative pressure (vacuum) may exist.

4.1.3.2 Positive Test Method

When the valve forming a part of the isolation scheme between the energy source and the workface is accessible for test in the direction of design/potential hazard flow then this technique is described as the ‘positive test’. This is the preferred test arrangement as it enables a controllable test to be carried out (typically via the test downline), resulting in a high degree of confidence in the properties of the isolation (see Figure 4).

Pressure differential should exist across the isolation, with the expected positive side of the isolation being monitored for any decrease in pressure.

IMCA D 044 19

REEL

CHART- RECORDER &GAUGE

TO REST OF SYSTEM

SUBSEA

TBLK2 TBLK1

CAPPED

TB

LV

GAUGE

VENT

TCV2 TCV1

OR

TLIV

TEST DOWNLINEFROM DSV

DIRECTION OF DESIGN /POTENTIAL HAZARD FLOW

CLOSEDVALVENo.2

CLOSEDVALVENo.1

PRIMARYSIDE

( "UPSTREAM" )

SECONDARYSIDE

( "DOWNSTREAM" )

PR

ES

SU

RIS

E

INTENDEDWORKFACE

ZONE

M

POWER PACK

DSV DECK

C/W ISOLATION& VENT VALVES

Figure 4 – Positive test method

Reference should be made to section 4.1.4 for determining the integrity of the isolation thus tested.

4.1.3.3 Negative Test Method

When it is not possible to gain test-access on to the upstream face of the isolation valve then an alternative test is feasible, provided it is possible to gain access to the inventory on the opposite side of the valve. This technique, being effectively in the direction of flow also, is described as the ‘negative test’ or ‘in-flow leak-off test’. The test downline requires to be attached into the downstream side of the isolation scheme, such that with upstream flow acting on the isolation valve, then any possibility of leakage may be monitored as a pressure build-up in the test downline system (see Figure 5).

Pressure differential should exist across the isolation, with the expected negative side of the isolation being monitored for any increase in pressure.

20 IMCA D 044

M

DSV DECK

REEL

PRESSURISEDBULK SYSTEM

GAUGECHART- RECORDER &

C/W ISOLATIONPOWER PACK

& VENT VALVES

SUBSEA

TBLK2 TBLK1

CAPPED

TB

LV

GAUGE

VENT

TLIV


DIRECTION OF DESIGN /POTENTIAL HAZARD FLOW

PRIMARYSIDE

( "UPSTREAM" )

SECONDARYSIDE

( "DOWNSTREAM" )

DEPRESSURISECLOSEDVALVE

INTENDEDWORKFACE

ZONE

CAPPED OUTLET, ORCONNECTED INTERFACETO REST OF SYSTEM

Figure 5 – Negative or in-flow leak off test method


4.1.3.4 Volume Calculation Test Method

Where subsea inventory or architecture limitations dictate (e.g. unpredictable pressure/flow conditions, or no safe access port between both isolation valves), then it may be the case that the only feasible form of pressure test which can be achieved is that both isolation valves have to be pressure tested against the direction of design/potential hazard flow.

This method of isolation-proving requires that testing is supported by the volumetric calculation technique, whereby the difference between the volumes of test fluid required to raise the two valve inventories to test pressure is computed – thus checking for the possibility of a leaking valve (see Figure 6).

Note that this form of test can only be realistically performed if there is a significant and therefore measurable volume between the valves, otherwise the two valves need to be treated as effectively forming a single isolation only.

IMCA D 044 21

& VENT VALVES

POWER PACKC/W ISOLATION

CHART- RECORDER &GAUGE

REEL

DSV DECK

SUBSEA

TBLK2 TBLK1

CAPPED

TB

LV

GAUGE

VENT


TCV2 TCV1

OR

TLIV


DIRECTION OFDESIGN / POTENTIALHAZARD FLOW

PRIMARYSIDE

( "UPSTREAM" )

SECONDARYSIDE

( "DOWNSTREAM" )

VALVENo.1

VALVENo.2

INTENDEDWORKFACE

ZONE

CAPPED OUTLET, ORCONNECTED INTERFACETO REST OF SYSTEM

M

Figure 6 – Volume calculation test method


Note: This particular test method is dependent on the volumetric calculation. Any procedural requirement to open/re-close a proven isolation subsequent to the test thus obtained will invalidate any isolation properties established for that valve.

4.1.3.5 Topsides Test Methods

Due regard should be given to the ability of the topside installation to assist in the process of proving the isolation properties of subsea valves, particularly in terms of either the positive or negative test methods.

For example, positive pressure testing into the cavity between two designated subsea isolation valves may be possible where there exists a chemical injection point directly supplied from the topside chemical pumping skid, via a line in the umbilical. Subsea pressure-sensing instrumentation integral to the inventory under test should also be available. This is in addition to any pressure-monitoring capability provided by the topside skid.

Similarly, negative pressure testing may be conducted by performing an in-flow leak-off test in respect of a designated subsea isolation valve, in conjunction with associated subsea system pressure sensors, any other subsea or topside valves and topside instrumentation.

Note: The validity of an isolation obtained by either of these topside methods is highly dependent on the reliability, accuracy and in-situ track-record of subsea sensors and the associated control system.

Consideration should therefore be given during the onshore engineering phase and in applicable risk assessment processes, as to whether the permanently installed instruments may be exclusively relied upon for the testing of isolations.

22 IMCA D 044

In those instances where there exists a known possibility of inaccuracy or fault in the permanent subsea instrumentation system then local supplementary pressure gauges should be incorporated by diver(s) at suitable locations in the isolation scheme. This is essential to establish confidence at the subsea intervention worksite for any isolation which has been subjected to remote topside testing only.

See section 4.1.4 for determining the integrity of the isolation tested.

It should be noted that operations of any isolation valve after testing will invalidate the test and a subsequent test will have to be re-applied prior to any intrusive operations.

Note; It should not be assumed that subsea valves are closed. All isolations should to be considered open or (partially open) until proven and confirmed otherwise by conclusive test. Such testing may consist of either:

Topsides to command in-line valve closed, perform in-flow test and monitor for pressure increase/decrease; or

Diver attachment of test downline into system from DSV and monitor for pressure increase/decrease.

Note: For intervention work, diver (or ROV) visual checking for movement of a valve to the known closed position by observation of its indicator/actuator stem does not constitute confirmation that the valve has actually closed. This is due to the fact that the valve actuation mechanism may have become separated from the valve closure element within the valve body.

(The visual checking method is only appropriate for valve position confirmation checks during non-intrusive work, e.g. commissioning tests.)

4.1.4 Integrity of Flowline/Manifold/Tree and Wellhead Isolations

During the onshore phase of a project every effort should be made to determine agreed isolation integrity acceptance criteria for the various devices which it is intended to incorporate in an isolation scheme. This will considerably reduce the problem of unexpected delays to schedule during the offshore phase.

The pressure integrity of all aspects of an intended isolation scheme set within a flowline, manifold, tree or wellhead system should be proven to ensure that they are effective, prior to the commencement of any intrusive intervention work by diver.

This may typically be achieved by implementing an appropriate test for each of the given isolations, followed by a review of the results obtained. This review is extremely important in determining whether the integrity of the device under test meets the key isolation requirements of being both effective and reliable for the duration of the required intervention.

Review and interpretation of test results are normally conducted with reference to industry standards, or alternatively, require to be considered on a case-by-case basis.

There are no applicable international industry standards in place which provide guidance in the interpretation of test results for an in-situ isolation device intended to be utilised in the provision of a safe isolation scheme for diver intervention, prior to the breaking of containment subsea. Whilst several standards do exist which address testing, leakage rates, repair/replacement criteria, etc. for subsea valves, these have been written with respect to either – tests which need to be conducted at various stages during the factory-assembly process, or, the maintenance-testing of a valve to determine its capability (or otherwise) as an integral safety component within a complete pipeline-to-topside production system.

In the absence of any relevant industry standards these guidelines set out isolation integrity criteria, against which the results of an in-situ pressure test on a subsea isolation device should be reviewed on an individual basis.

IMCA D 044 23

These criteria are outlined below. The inherent potential hazards of the subsea hyperbaric environment, combined with the implicit trust which divers place in their work instructions, require that the isolation criteria are more stringent than the equivalent for onshore or offshore (topside) plant and equipment. The principles, however, are identical.

Note: Test pressures should be at least equal to, or slightly above (but no greater than 1.1x), the highest system pressure which the valve may be expected to withstand throughout the duration of the intervention activity.

It is not necessary to perform an isolation integrity pressure test to 1.1xMAOP if the system operating pressure is a reduced figure (i.e. has been lowered from the original design pressure value, for operational reasons, during the life of the field). In such instances, the test criteria maximum may be modified to 1.1x highest ‘anticipated’ operating pressure.

The fundamental isolation integrity criteria of a subsea isolation is that, following the implementation of a pressure test, and on completion of an appropriate stabilisation period, there should be no flow or loss of pressure across the device under test for the duration of a further 15 minute (minimum) recorded ‘test hold’ period (see Figure 7 below).

In the event of an initially unsatisfactory test result then the procedure may be continued by extending the recorded ‘test hold’ period in 15 minute increments up to a maximum of 60 minutes. This will provide opportunity to, either:

i) extend the stabilisation period and so possibly obtain a ‘test hold’; or

ii) determine the isolation device leakage rate.

Note: The test should be extended to at least 60 minutes in the case of a leaking isolation device associated with a gas inventory.

Unless a specific set of isolation integrity acceptance criteria limits has been previously calculated and approved by project management during the onshore engineering phase, then any leakage, evidenced as flow or pressure depletion, during the 15 minute ‘test hold’ period, should be treated as a loss of isolation integrity, requiring some form of remedial action (see Figure 8 below).

Note: When the integrity of an intended isolation fails to meet the required criteria, then a series of extended tests should be carried out to enable the leakage rate to be measured, such that the possibility of utilising any suitable additional (or alternative) facilities to mitigate and manage the leak may be reviewed in specific detail through risk assessment (see Figure 7).

When required to conduct a task-specific risk assessment, as a consequence of unacceptable field test results, key project data should be gathered and made available for review. This is essential in the process of determining, based on impartial engineering judgement, whether a safe means for proceeding with the work can be identified.

Typically, in the case of a leaking valve in an isolation scheme, the following list of detailed data should be obtained and reviewed:

i) valve type (e.g. gate, expanding gate, ball, double seal ball, plug, etc.);

ii) manufacturer’s original specification;

iii) assembly and factory test documentation;

iv) valve sealing design – elastomeric, or metal-to-metal;

v) current operating parameters versus original design values;

vi) associated line – size, history and present condition;

vii) line pressure(s) and temperature(s);

viii) line inventory – liquid (e.g. hydrocarbons, water), gas or multiphase;

ix) potential for system to form hydrate blockages;

x) accurate estimate of actual valve leakage rate;

xi) calculated pressure drop-off versus capacity of any available vent;

24 IMCA D 044

xii) proposed method of routing and venting the leaking inventory;

xiii) all relevant engineering drawings.

When it is not possible to obtain a satisfactory isolation then the additional potential hazards arising should be assessed with a view to either proposing an appropriate alternative isolation scheme, or, identifying an increased isolation envelope.

Consideration should be given on any change in temperature which could have an influence on the slope of the leakage test.

Figure 7 – Integrity test graph – acceptable

Figure 8 – Integrity test graph – unacceptable

4.2 Intervention

4.2.1 Types of Intervention

In these guidelines, any system of hoses, tubes, flexibles or pipelines which is inter-linked by piping and valves within a subsea installation, and which is designed to convey hydrocarbons, treated water, gases, gels, chemicals, etc., or any combination of these inventories, is categorised as ‘subsea equipment’ on which divers may be required to intervene.

The typical internal-diameter dimensions associated with such equipment generally range from 3/8” (9.5mm) for chemical injection systems up to at least 36” (914.4mm) for inter-connecting trunk pipelines.

IMCA D 044 25

Prior to all intervention works on hydrocarbon systems, careful consideration should be given to the contents of the bulk system pipework/tree-cavity and whether flushing operations are necessary. Even when flushing operations have been conducted, there may still be the potential for hydrocarbon entrapment at the intrusive worksite, especially if the pipework includes sections of complex geometry.

Any potential for release of small volumes of hydrocarbons which may be unavoidably trapped within cavities following the setting of requisite isolations should be identified in advance, such that mitigating measures are applied. Typically this may occur during the removal and replacement of a choke valve, from either a manifold or tree system.

The outline requirements and precautions for diver intervention on flowline/manifold/tree and wellhead, and chemical injection systems, are outlined in the sections below.

4.2.1.1 Flowline/Manifold/Tree and Wellhead

Interventions on subsea systems invariably produce unique areas of concern regarding isolations, even when the scope may appear very similar to some previous work carried out on the same (or even identical) hardware.

To define workscope isolation limits for intervention on flowlines, manifolds, trees and/or wellheads, it is essential to identify:

i) each type of energy source within the system;

ii) the various locations where this energy may appear throughout the system; and

iii) the intended means of securely isolating such energies from the diver at the workface.

Basic information such as system schematics, flow schematics, process and instrumentation diagrams, and specifications, drawings, and test documentation in respect of selected isolation components needs to be obtained for review in detail, during the onshore phase of the project.

Some examples of key items for consideration when conducting isolation pre-engineering for diver intervention are listed in Table 2 below.

What energy forms will be encountered?

Is there stored energy to be released/discharged before breaking containment?

Can the energy source be reduced to seabed ambient pressure?

Is there a potential for sub-hydrostatic pressures (i.e. vacuum)?

Does the pipework require flushing?

Are there any other potential energy sources tied-in to the process pipework/ tree-cavity (e.g. chemical injection)?

Can the topside installation provide a tested isolation by conducting an in-flow leak-off test?

How will each identified isolation be made secure, and subsequently monitored and maintained?

Has confirmation been obtained that any associated pressure sensors are reliable, accurate, and functioning correctly?

Can any valve actuators be viewed for correct open/close operation?

If risers are involved, has consideration been given to the hydrostatic head, and is an open vent in place topside?

Have details of valve type, test data, history and usage been obtained and reviewed?

Can the divers actually access the considered test points on the pipework/tree-cavity?

What type of vent-fitting arrangement has been pre-installed in any pressure-

26 IMCA D 044

retaining blind-flange?

Are check-valves required on the deployed test down-line hose(s) to ensure no ‘returns’ are possible to the deck of the DSV?

Table 2 – Isolation and intervention considerations

When all the required isolation conditions have been achieved, it is still essential that the removal of a cap or plug, or the operating of a bleed valve, or the initial releasing of a flange or joint connection is performed in a controlled manner in accordance with good diving working practices. Appropriate techniques for initial intrusive operations by diver are well established and include the following:

Diver to be positioned to one side of any small bore plugs or caps during removal;

Where possible, leave open any block and bleed valves which are located between the two tested isolations required for blind flange/spool-piece removal, or pipework disassembly;

During flange de-tensioning (to a pre-determined bolt order), ensure that the retaining nuts and bolts are never completely removed until the actual sealing joint has been broken.

4.2.1.2 Chemical Injection

All isolation principles and intrusive operations on subsea chemical injection pipework should to be treated under the same terms as for subsea pipeline/flowline work.

Subsea chemical injection systems also require careful consideration as they may be subjected to energy sources at either end of their inventory, i.e. by design the lines will be pressurised by injection pumps on the topside installation, however, these lines are invariably connected into the subsea production system at locations which are also being pressurised from the reservoir.

The direction of ‘potential hazard’ flow is therefore likely to be opposite to the direction of ‘design flow’, control of which is entirely dependent on the effectiveness of a combination of flow control valves and check-valves3.

Whilst this presents additional complications in determining the isolation scheme, the selected subsea chemical injection valves should be integrity tested in accordance with these guidelines.

When it is not possible to obtain a satisfactory isolation then the additional potential hazards arising should be assessed with a view to either proposing an appropriate alternative isolation scheme or, identifying an increased isolation envelope.

Contamination of divers and/or the environment is also a significant hazard factor which should be considered when conducting intrusive operations on chemical injection systems.

Prior to the commencement of any intrusive work on chemical injection systems it is essential that the data sheets for any and all chemicals currently (and previously)

3 Note: Check-valves are associated with chemical injection systems which inject into hydrocarbon lines. These are aligned such as to prevent any reverse-migration from the reservoir or flowline into the chemical injection system (and hence, ultimately, to the topside installation). These check-valves are not normally considered as an appropriate form of isolation device for the following three reasons: 1) It is unlikely to be able to determine their condition or state (i.e. by any manual opening/closing operation); 2) They may be permanently ‘frozen’ in the open position due to the low viscosity or high density of injected fluids; 3) It is unlikely to be able to ‘positively’ lock them into a known safe (e.g. closed) position. Exceptionally, however, it may be possible to utilise a check-valve as an isolation device, when: a) the sealing properties of the obturator can be proven; b) the closed status of the valve can be maintained; and c) the valve is only utilised in conjunction with other proven valves in the bulk system isolation scheme.

IMCA D 044 27

conveyed within the system architecture are identified and the relevant safety information made available to the DSV.

4.3 Installation of Subsea Equipment

4.3.1 General

The deployment to subsea depth of items capable of retaining pressure (and resisting collapse) has the potential for either of two significant pressure-equalisation hazards. These are:

i) the possibility of locked-in atmospheric pressure resulting in a negative pressure differential at seabed location; or

ii) the possibility of high pressure inadvertently locked-in to pipework during the onshore testing programme resulting in a positive pressure differential at depth.

These are of concern for diver intervention activities as the rapid equalisation of pressure through an aperture may not be readily observed and, depending on direction, can cause either body-part entrapment or sudden component release at high velocity. Both have the potential for very serious consequences.

Careful consideration should therefore be given to ensure any components/structures which contain free-flooding internal cavities are deployed subsea with suitable in-built facilities to enable safe and controlled pressure equalisation at depth.

The following lists some key examples:

Flange protection – Pipework in a manifold structure should be deployed with simple free-flooding flange protectors on either end, where possible;

Blind flanges – Pipework ends requiring to be pre-sealed with blind flanges should be fitted with at least double block isolation valves, preferably also incorporating a bleed valve. In the absence of a bleed then a diffuser or T-piece should be pre-fitted to the outlet port (especially if the possibility of a negative pressure differential exists);

Valves – Pipework, manifolds, and spools should be deployed with any integral valves set in the open position, wherever possible;

Pressure differential – A hydrostatic pressure differential is preferable to a gas differential, therefore consideration should be given to cavity flooding prior to deployment, where possible;

Flexible flowlines – In certain circumstances, these may require to be sealed at atmospheric pressure, either empty, or pre-filled with a specific liquid. Consideration should therefore be given to post-installation diver intervention requirements, especially with regards to negative pressure differentials;

Risers – When working on installation caissons and risers consideration should be given to the combination of tidal and meteorological factors (e.g. wave height) which can cause subsea (or topside) pressure differentials. Provision should therefore be made for ensuring a pre-determined positive head-height can be established. Typically, caissons/ risers should be filled until flooded, at topside hang-off level, which will provide a nominal positive pressure release when flange stud-bolts are de-tensioned at the subsea work location;

Tubular sections – Sealed tubular sections within a subsea structure which are required to remain un-flooded until deployment to the seabed should be fitted with a minimum of two manual vent-valves. The external venting port of these valves should be fitted with a diffuser to prevent hand entrapment due to negative pressure differential during the flooding operation. The valves should be set as far apart as possible along the long axis of the tubular section. See typical arrangement in Figure 9 below;

28 IMCA D 044

FIRST BLOCK

V2 V1

BLEED VALVE (DOUBLE BLOCK & VENT)

TO ATTACH HOSE

DIVER INTERVENTION REQUIRED

V3

PIPELINE

SECOND BLOCK

EITHER:

CAPPED OUTLETOR

FOR PRESSURISED PIGGING / TESTING REQUIREMENTS

FOR FLOODED PIGGING AT AMBIENT PRESSURE

DIFFUSER

SMALL BORE MANUALVALVE

Figure 9 – Typical valve arrangement for post-installation flooding

Pig launcher/receiver – Diver intervention on new pipeline systems should be carefully managed. One of the more hazardous activities associated with pipelines involves pigging operations – in particular pig launcher/receiver isolation, inserting/removing pigs and pig launcher/receiver removal. In such workscopes the pig launcher/receivers (particularly where dry pipelines form part of the system), should incorporate the minimum recommended double block and bleed facilities. See recommended valve configuration in Figure 10 below.

Figure 10 – Minimum valves on typical pig launcher/receiver

IMCA D 044 29

5 Subsea Control and Umbilical Systems

5.1 Isolation

5.1.1 Types of Subsea Control and Umbilical System Isolations

Two independent isolations are required for compliance with the isolation philosophy given in these guidelines. For subsea control and umbilical systems this should comprise a preliminary and a final isolation (see section 2).

Preliminary – Initial isolation. Set as a precursor to facilitate the obtaining of the final isolation local to the worksite. In almost all cases this should be a physical separation;

Final – This should be a subsea isolation, local to the worksite (where by design it is possible to do so). This isolation should consist of a secure physical separation. It is a readily understood way in which prevention of the uncontrolled release of energy can be confirmed to diving personnel tasked with carrying out the actual work.

The operating techniques utilised in subsea control and umbilical systems are varied in their design – ranging from simple direct-hydraulic to complex close-looped software-based electro-hydraulic.

In all cases, such systems become further complicated when they are modified to account for the control of an additional new field development, which is to be connected-in as an extension to the existing infrastructure.

Regardless of apparent system complexities, the process of identifying and obtaining two independent and secure isolations can always be reduced to the basic terms of their being applied as either switch or valve isolations. These are set, in the conventional manner, between the item(s) being installed, worked on, or removed and the potential energy source. Dual control valves having the ability to be activated from two different external sources of energy should be carefully considered in the assessment.

The main types of subsea control and umbilical system isolations, namely switch, valve or mechanical, are listed in the following three sections. The various combinations of these devices and their suitability (or otherwise) to form preliminary or final isolations, in compliance with the recommendations given in these guidelines, are considered in some detail throughout the rest of this section.

5.1.1.1 Switch Isolation

Switch-type devices considered suitable for isolating electrical, communication, instrument signal, and optical (laser) energy include (numbering refers to Figure 11):

1 supply circuit breaker;

2 isolators (input and output);

3 switch disconnector;

4 removable link/terminal connections;

5 plug and socket jumper connections;

5 fuse link;

6 master control station (MCS) software inhibit4.

4 Depending on the intended work and limitations in the associated system architecture, an MCS software instruction to apply a device inhibit, or activate/deactivate a solenoid, may be utilised to form a preliminary isolation if no alternative is available. In such circumstances, specific isolation management controls should apply – see later, this section. With regard to the ‘two isolations’ principle defined in these guidelines and for safety reasons (see later, this section) the setting of the final isolation by MCS software instruction is not recommended.

30 IMCA D 044

5.1.1.2 Valve Isolation

Valve-type devices considered suitable for isolating hydraulic energy include (numbering refers to Figure 11):

A manually operated valve;

B solenoid valve (the device being remotely actuated, or, inhibited (set ‘off-scan’) by the topside MCS software);

C self-sealing coupling.

Figure 11 below, identifies, in simplistic form, the various types of key isolation components available in a subsea control and umbilical system. The indicated numbering/lettering codes adjacent to certain items correspond to the switch or valve isolation types given in sections 5.1.1.1 and 5.1.1.2, above.

LEGEND

Figure 11 – Typical subsea control and umbilical system isolations

5.1.1.3 Mechanical Isolation

Note the inclusion of the guillotine/weak-link in Figure 11. Depending on the selected mechanism, this ‘isolation’ device is designed to activate under snagging-load so as to sever either the umbilical or the subsea control system jumper assemblies. This irreversible isolation initiates a rapid local venting of hydraulic power, resulting in a shut-down of the associate bulk system flowline/manifold/tree valves. The physical severance may also contribute to a reduction in gross damage to the fixed subsea equipment.

Such mechanical isolation device(s) – being neither a switch nor a valve isolation type – cannot be formally categorised as providing a controlled isolation. Instead, these result in an uncontrolled isolation, the associated energy release having the potential for serious harm to divers working in the vicinity.

It is important therefore that these isolation devices and their disarming are included within this section of the guidelines.

IMCA D 044 31

5.1.1.3.1 Switch Isolation

Due to variations in the design and architecture of subsea control and umbilical systems, the suitability, or otherwise, of the following switch-type methods/ devices to provide an isolation, should be thoroughly reviewed on a case-by-case basis as they will often not provide a suitable level of security:

i) residual current devices (RCDs) or earth-leakage circuit breakers (ELCBs) (either voltage or current operated);

ii) remote disabling/inhibiting of electrical power unit input and/or output by software command from master control station;

iii) remote disabling/inhibiting of hydraulic power unit motors by software command from master control station;

iv) remote disabling/inhibiting of a subsea instrument input/output (connected via subsea control module) through software command from master control station or fibre optic system processor;

v) subsea wet-mateable conductive or optical connector;

vi) subsea electrical isolator switch.

5.1.1.3.2 Valve Isolation

Due to variations in the design and architecture of subsea control and umbilical systems, the suitability or otherwise of the following valve-type methods/devices to provide an isolation should be thoroughly reviewed on a case-by-case basis:

i) remote disabling/inhibiting of hydraulic power unit output supply solenoid valve by software command from master control station;

ii) remote disabling/inhibiting of a subsea control module solenoid valve hydraulic function by software command from master control station;

iii) self-sealing diver-mateable coupling;

iv) non-return/check-valve.

Note: Where double-isolation on a hydraulic supply line is not possible, then a topside isolation and vent-down of the line should be conducted.

5.1.2 Electrical/Communication/Signal Isolations

Evaluation of the potential hazards of direct and consequential injury from electric shock in the subsea environment can be more complicated than on land, therefore additional care needs to be taken to ensure correct electrical protection.

For this reason, a minimum of two independent and tested isolations should be established for diving personnel engaged in any subsea task where the presence of a potential hazard from electrical energy at potentially hazardous levels5 exists. At least one of these isolations (i.e. the preliminary isolation) should be located on the topside installation. The final local isolation should therefore be set in the subsea domain (where by design it is possible to do so).

This latter (local isolation) provides an increased level of safety and confidence for diving personnel since it is often not possible to conduct reliable electrical safety checks at the subsea worksite, in the conventional manner.

Note: The isolation principles set out above may only be waived when it is possible to set local isolations subsea, by disconnection of inductive couplers (see section 5.1.2.1.2).

5 Note: With regard to the term ‘… potentially hazardous levels…’ (above), the definition of the maximum safety levels – below which, divers may work without potential hazard – is based upon the two key parameters of safe body current and time duration for the actual shock experienced. This is explained in more detail in IMCA D 045/R 015 – see section 8.1.

32 IMCA D 044

In relation to the key electrical-shock parameters (safe body current and time duration), the associated safe values have been derived for shocks of potentially unlimited duration. These are given below:

Maximum safe body current for potentially unlimited duration assuming no ‘active’ fail safe method of protection against electric shock exists in the circuit is:

for alternating current (AC at 50-60 Hz) = 10 mA;

for direct current (DC) = 40 mA

(Ref. IMCA D 045/R 015 – see section 8.1)

Note: The safe voltage limits may be obtained by utilising Ohms Law (V = I x R). Thus, multiply applicable safe body current (I) limit value (from above) by the recommended value for divers’ body resistance at low voltages R, i.e. R = 750 ohms to give ‘safe’ voltages of up to 30V DC or 7.5V AC.

The safe alternating current (AC) limit given above is at such a low level as to determine that preliminary topside isolation(s) should be set in place before diver intervention work can commence on virtually all AC circuits in a subsea system (with the exception of isolations utilising inductive-couplers).

The safe direct current (DC) limit (given above) should be considered as being applicable to either low-power subsea instrumentation or subsea communication circuits only (i.e. not main DC high-power supply circuits). Whilst these defined limits may be interpreted as being not hazardous, thus permitting diver work to take place whilst low-voltage circuits remain live (i.e. with no isolations in place), this practice is should be carefully considered at the time of the risk assessment. There may in fact be technical reasons dictating that preliminary isolations need to be applied, even for such ‘safe’ voltages (see 5.1.2.1.2.1, 5.1.2.1.2.2, , 5.2.2.1, and 5.2.2.3.2).

Higher levels of AC or DC voltage may be considered ‘safe’ for divers for certain power circuits if protected by a reliable and proven means of fail-safe protection (e.g. RCD operating within a few milliseconds). In such instances, however, a detailed risk assessment review on a case-by-case basis (taking into consideration the operating principles of the applicable circuit protection and the conducted power levels) should be carried out. This approach introduces a dependency on automatic electrical circuit-breaking equipment, some of which is not fail-safe, hence this method may not be an appropriate form of planned isolation.

5.1.2.1 Applying Electrical/Communication/Signal Isolations

The common fundamental principle for topside and subsea electrical isolations within these guidelines is that the physical disconnection should be both adequate and secure.

The topside isolation(s) need to be installed by competent and authorised personnel only.

The subsea isolation should be, of necessity, installed by ‘non-electrically authorised’ personnel (i.e. divers). They are, however, ‘approved’ to implement such isolation as they operate strictly under the control and instruction of their supervisory personnel, who are directly responsible for diver safety by working to company-approved project procedures, at all times.

In witnessing the application of these isolations, project engineering personnel should be aware, in general terms, of certain criteria relating to the topside and subsea components of the subsea control system as detailed below (dual redundancy) and in the following sections 5.1.2.1.1 and 5.1.2.1.2.

Dual redundancy – As subsea control systems are generally installed in multiple-well applications then the electrical power/communication system is invariably configured in a dual-redundant (‘A’/’B’) circuit arrangement (to ensure production up-time optimisation in the event of circuit failure). Such dual-redundancy may be used to

IMCA D 044 33

advantage, by avoiding the electrical isolation of the complete electrical/ communication system, when required to remove/replace a critical electrical component (e.g. SCM). Thus, for example, by applying a preliminary topside isolation to only the ‘A’ circuit (but continuing to maintain electrical power/communication through the ‘B’ circuit), it is possible to disconnect appropriate ‘A’ supply jumpers at the subsea worksite without loss of electrical power/communication to the remainder of the field. Further to the fitting of proprietary caps to the relevant subsea connector(s) it is then normally acceptable and safe for topsides to re-instate the ‘A’ circuit supplies. The procedure is then repeated for the ‘B’ system. On completion of this independent twin-isolation procedure, the subsea worksite is safely isolated locally, whilst the operation of any associated subsea field and infrastructure remains fully operational.

5.1.2.1.1 Applying Topside Isolations

5.1.2.1.1.1 Electrical Power Unit (EPU)

For adequate electrical power supply isolation, the disconnecting devices within the EPU should have an isolating gap sufficient for the voltage levels present or likely to occur.

Switches used for disconnection should be secure such that they can be locked in the ‘off’ position using a multi-key ‘safety’ lock device (e.g. a lock-out hasp secured by individual-user padlocks). All keys should be withdrawn to a central location of authority, to be kept under the control of a signed isolation certificate, as set out in the company permit to work system.

If a fuse is removed as part of the isolation, precautions should be applied to ensure that it, or a similar device, cannot be re-inserted. The aperture should be locked-off or the fuse removed from the worksite.

5.1.2.1.1.2 Topside Umbilical Termination Unit (TUTU) Junction Box

Although not a recommended method of isolation, it is possible (dependant on the applicable hazardous area zone classification) for low-power terminal connections located within the TUTU electrical junction box to be separated (e.g. a ‘knife-edge’ connector set to open position, or cables removed from terminals). For this method of isolation, precautions should be applied to ensure that any exposed connections are securely separated and isolated within the junction box(es). The TUTU should be locked such that it is not possible for the electrical supply to be inadvertently reconnected whilst work is taking place on the subsea equipment.

Note: High-voltage supply circuits to the umbilical power cores should not be simply disconnected for isolation in the above manner. A more safe and secure form of topside preliminary isolation (incorporating a physical separation) should be obtained at a higher level in the electrical distribution system.

5.1.2.1.1.3 Master Control Station (MCS)

Very low-voltage communication signals are transmitted and received to/from subsea by the MCS modem(s). Such signal links may be safely disabled (if required), for the purpose of setting isolations, by switching off at the circuit-breaker local to the modem sub-unit within the MCS. Alternatively, the isolation may be applied at the appropriate terminal rail connection point within either the MCS cabinet, or the TUTU panel in the manner defined in 5.1.2.1.1.2 above.

34 IMCA D 044

5.1.2.1.1.4 Remote-Set Isolations (via MCS)

Generally, a selection of components within the subsea control system electrical architecture (e.g. power supply units in EPU, pump motors in HPU, solenoid valves in HPU, solenoid valves in SCM), can be operationally ‘disabled’/ ’inhibited’/set ‘off-scan’, by remotely setting software ‘isolations’ from the topside MCS. If no other method of preliminary isolation is possible then this technique may be considered at the risk assessment phase for the application of preliminary isolations, but is not recommended for providing final subsea isolations. This is on account of the potential for software malfunctions (MCS is not SIL rated) and/or operator error.

Additionally, software-generated ‘switch-type’ isolations are not recommended as a means of setting a final form of subsea isolation as they do not provide a tangible (circuit) disconnection which may be physically witnessed/confirmed by diver. For example, it is not possible to carry out any local testing to determine whether an electrical supply circuit is dead at, or within, an SCM prior to the actual intervention.

In particular, the setting of preliminary isolations for high-power electrical circuits to subsea components (e.g. SCM power-supply, subsea pump power-supply, etc.) should not be provided through MCS software. Instead, a more safe and secure form of preliminary isolation (incorporating a physical separation) should be obtained at a high level in the topside electrical distribution system.

Any dependence upon software for the remote setting (via MCS) of electrical/ communication/signal isolations requires that the specific combination of isolation management controls given in i) to iii) below, should be applied:

i) It is an essential requirement that the system hardware being disabled/ inhibited is able to positively report (back to the MCS) in real time that the expected change of operational status takes place when the software ‘isolation’ is applied. Bulk system hardware operational checks should also be conducted to the subsea worksite to further confirm the security of the preliminary isolation. (The setting of a final isolation locally at the subsea worksite should be implemented immediately thereafter by physical disconnection of the communication, or instrumentation, electrical supply);

Note: This process accounts for any possible software malfunctions which may subsequently occur within the MCS, or any inter-linked system(s) – such as DCS, or ESD. In this regard, both the status of the MCS and the continued validity of software ‘isolations’ should be monitored for any unpredicted condition change, immediately prior to the commencement of control system reinstatement activities at the subsea worksite.

and

ii) For reasons of management responsibility and approval, any such isolation being set via the MCS should only be conducted by authorised personnel at a higher level of supervision than the normal operational level;

Note: Password and isolations: The utilisation of either a generic or personal log-on/password combination, as the authorised means of applying an isolation should not be accepted as the sole method whereby a software isolation, remotely set via the MCS, is considered to remain securely in place throughout the work.

and

IMCA D 044 35

iii) Following the setting of any such software ‘isolations’, access to MCS keyboard(s)/screen(s)/panel(s) should be restricted by physical locking6. Key(s) should be withdrawn to a central location of authority, to be kept under the control of a signed isolation certificate, as set out in the company permit to work system. This provides an increased level of isolation-security by preventing any inadvertent, or unauthorised, removal of software ‘isolation(s)’, throughout the subsea work.

Note: MCS isolations for subsea instrumentation. The specific isolation management control measures outlined in i) to iii) above do not necessarily apply to interventions associated with subsea instrumentation devices. This is on account of the relatively low power levels involved – typically, 4-20mA at +24 Volts DC – (see sections 5.1.2 and 5.2.2.1). These are not considered to be potentially hazardous levels of electrical energy for diver intervention work, therefore preliminary instrument isolations (‘inhibits’) may be remotely set (if required) via the MCS without the requirement for device-reporting, or the limiting of personnel access to the MCS.

For various technical reasons, however, care should be taken at the MCS to ensure that an isolated subsea instrumentation circuit is not inadvertently re-energised whilst still disconnected/open-circuit at the SCM (see sections 5.1.2.1.2.2 and 5.2.2.3.2).

Note: The various isolation techniques denoted above will prevent the equipment to be worked on from becoming charged (powered) by connection to its own or normal supply. Depending on the inter-connecting cable type and service, however, these alone may not be sufficient to prevent residual electrical charge remaining within the component.

The possible presence of potentially harmful levels of electrical energy, either existing, or accumulating, as a result of latent charge (for example in the dielectric of high-voltage power supply cables to subsea) should therefore be considered, through a risk assessment process.

Where applicable, it is recommended that topside earthing connections are attached to the conductors of the cable system which has been set ‘open-circuit’ as part of the isolation scheme for low and medium voltage levels. This earthing should be applied at least 60 minutes before the subsea work commences. For high and ultra-high voltages it is recommended that an extended discharge period is determined. This topside connection should remain in place for the duration of the work.

5.1.2.1.2 Applying Subsea Isolations

5.1.2.1.2.1 Inductive Couplers

It is uniquely possible, due to the specific design and properties of the wet-mateable inductive coupler, that local subsea isolations (and re-connections) may be performed whilst the electrical power/signal supply system remains live.

The inductive coupling is effectively a transformer assembly which has been divided in two parts, one half being permanently mounted into the bulk item

6 Note: In the absence of any physical locking facility, such that restricted access to the MCS operator-interfaces cannot be implemented, an alternative method of ensuring the security of the preliminary isolation should be obtained. For example, this may be achieved by: routing MCS control to an ‘engineers workstation’ located in a securely lockable 19” rack panel; or physical isolation of communications between the MCS and the SCM. Such alternatives, being tangible isolations, provide confidence to diving personnel that local and final physical isolation(s) can be safely implemented.

36 IMCA D 044

of subsea hardware, whilst the other half is ‘free’ and connected to the output cable assembly in a fully potted housing. Electrical energy can only be transmitted (by completion of the electric field) when both halves of the transformer circuit in the couplers are brought close together in a specific face-to-face orientation. The external mating faces of the couplers are coated with an insulating varnish hence it should not be possible for diver or seawater to make contact with any metallic parts associated with the enclosed electric circuits.

There does, however, remain the possible hazard of the coupler or its cables being damaged. Such deterioration will often be able to be checked using a line insulation monitor or similar device. If damage or malfunction is suspected then primary isolation should be carried out in the normal manner.

The inductive coupler is therefore uniquely considered to be safe and valid for the purposes of applying both preliminary and final isolations by the diver, at the subsea worksite location. The action of disconnecting the coupler thus equates to the two fundamental requirements of an isolation:

i) Provide an isolating gap sufficient for the voltage levels present, or likely; and

ii) Physical isolation is secure7 such that re-connection can not be made inadvertently.

5.1.2.1.2.2 Conductive Connectors

Whilst many designs of conductive (pin-to-pin) wet-mateable connectors are intended to be capable of being disconnected live, this is also not considered to be entirely safe or good economic practice. Utilising the conductive wet-mateable connector to provide a preliminary electrical isolation, at the subsea location, is therefore also not recommended.

Reasons in support of this are as follows:

Connector internal self-isolating mechanism may be, or become, faulty, without diving personnel being aware of this condition;

Gender identification terminology for connectors is not straightforward. For example, documented information may identify a removable connector-half as being ‘female’ thus expected to be furnished with ‘safe’ sockets. Caution is required as the connector may, in fact, contain protruding pins within a ‘socket’ body. It is therefore possible that diving personnel could be exposed to the hazard of live pin contacts at the end of a connector/cable system, whilst carrying out a disconnection operation;

Several varying designs of pin-to-pin connectors exist, each with differing (or no) internal isolation mechanism. This may lead to possible confusion in accuracy of supplier information, especially for connectors which have been installed for some considerable time;

Connectors with pin contacts which (inadvertently) remain live when exposed to seawater will be likely to incur permanent damage to the high-conductive coating on the pins in a period of very short duration for certain types. This may only be several hours;

Total recommended number of live disconnections throughout life of connector is a finite value. Improved up-time reliability is therefore

7 By working to appropriate disconnection/re-connection procedures.

IMCA D 044 37

achieved by preceding any disconnections with suitable isolations at a higher level in the subsea control system.

Note: The above applies to wet-mateable cable connections for both the high-power input (supply) and the low-power output (communication or instrumentation) circuits of the subsea electrical architecture.

Though not recommended as a preliminary isolation, the disconnection of a wet-mateable connector/jumper assembly is, however, appropriate as a final local isolation since the preliminary isolation8 will already be in place and thus the wet-mateable connector should not be energised.

An additional benefit of applying a final local isolation, specific to the duration of the actual intervention work, is that any associated requirement to perform a main circuit power-down (with resultant implications for other systems components) may be kept to a minimum.

The action of disconnecting the subsea connector, to provide the final isolation, thus equates to the two fundamental requirements of an electrical isolation, i.e.:

Provide an isolating gap sufficient for the voltage levels present, or likely;

Physical isolation is secure such that re-connection can not be made inadvertently.

5.1.2.1.3 Subsea Isolator Switch

The subsea isolator is designed to either totally disconnect electrical power which is being supplied through an umbilical to items of subsea equipment, or, it may contain several contactors such that it is capable of routing power from one end-user to another (or several others). Control and setting of the isolator/diverter switch should only be capable of being performed remotely, by the topside installation.

In the simplest form of subsea switch design, it is unlikely to be able to discern (or test) the condition or status of internal contactors. It will not, therefore, be possible to demonstrate that an isolating gap sufficient for the voltage levels present (or likely) exists, nor that the physical isolation is secure such that it can not be re-connected inadvertently. In principle, this method of subsea electrical disconnection is therefore not considered suitable for intervention work involving divers, hence is not recommended for either preliminary or final isolation duties.

More advanced isolator/diverter designs, however, which are designed to provide subsea status-reporting may be appropriate as a final form of isolation, provided the following two key facilities exist:

i) Monitoring instrumentation within the subsea isolator/diverter provides detailed information to the topside installation regarding the status of input and output circuits. This information, as a minimum, should be reported from two separate sources such that it can be independently confirmed that supply power to, and output power from, a particular subsea switch device has been fully isolated and the associated circuit fully discharged; and

ii) In conjunction with the setting of any such subsea isolation, the topside power supply to the subsea switch circuit should also be confirmed as isolated. Operation of the subsea isolator topside control panel should then be disabled by secure locking using a ‘safety’ lock device (e.g. a lock-

8 This should be a physical-break type isolation for high-power supply circuits.

38 IMCA D 044

out hasp secured by individual-user padlocks). Key(s) should be withdrawn to a central location of authority, to be kept under the control of a signed isolation certificate, as set out in the company permit to work system.

Note: For reasons of management responsibility and approval, the setting of any such isolation should only be conducted by authorised personnel at a higher level of supervision than the normal operational level.

5.1.2.1.4 Subsea Fuses (in SDU)

Certain designs of subsea distribution units (SDU) contain fuse assemblies which can be removed subsea. These are primarily intended for removal/replacement by ROV but may also be removed/replaced by diver.

It is not considered appropriate to utilise such fuses as a means of setting the preliminary isolation. Diver safety will be compromised as it is not possible to locally test the isolation-prior-to-disconnection properties of the fuse release mechanism.

Though not appropriate as a preliminary form of electrical isolation the removal of a subsea fuse assembly (to form a circuit disconnection) is, however, appropriate as a final subsea isolation, provided the setting of a preliminary topside physical isolation has previously been implemented for the circuit. The local subsea isolation facility is then of value in minimising the power-down implications for other associated circuits within the same subsea architecture.

Unless protected by an automatic shutter mechanism, the socket vacated by the removed fuse should immediately be occupied by a proprietary dummy-fuse. This is to ensure inadvertent re-installation of the fuse can not occur and that any exposed electrical contacts are suitably insulated and protected from the seawater environment.

5.1.2.2 Testing and Confirming Electrical/Communication/Signal Isolations

5.1.2.2.1 Testing and Confirming Topside Isolation

Topside testing for confirmation of a valid electrical isolation at the requisite subsea electrical intervention point should utilise conventional industry-recognised techniques (e.g. front-of-panel lamps and gauges, and display mimic screens, all indicating loss of input and output as appropriate) in conjunction with test equipment connected to output terminals.

5.1.2.2.2 Testing and Confirming Subsea Isolation

Subsea testing for confirmation of a valid electrical isolation, which has been implemented at the topside facility, should not be carried out by diving personnel9. For example, the connection of test equipment between the circuit to be isolated and a marinised read-out device (or similar, connected back to the DSV) should not be performed by a diver. The conductive properties of salt water may present an inherent hazard to divers (dependant on the voltage involved) should they be required to work in close proximity to exposed live electrical conductors.

It is therefore important that documentation is completed which confirms and records that the topside isolation is securely in place, and that all relevant circuits have been proven as dead, prior to any intervention by a diver. This confirmation paperwork should be exchanged (by an agreed technique) for

9 With the unique exception of suitable subsea test methods for an isolation which has been locally applied by the disconnecting of inductive couplers.

IMCA D 044 39

authorisation between responsible parties on both the topside installation and the DSV.

5.1.3 Optical Isolation

A minimum of two independent and tested isolations should be established for diving personnel engaged in any subsea task where the presence of a potential hazard from optical laser energy at potentially hazardous levels exists. At least one of these isolations should be located on the topside installation.

With regard to the term ‘…potentially hazardous levels…’ (above), the setting of the maximum safety levels below which divers may work without the requirement to set any fibre-optic system isolation is based upon the classifications of laser power as defined in BS EN 60825-1:1994 ‘Safety of laser products’ – Part 1: Equipment classification, requirements and users guide. (See also Laser Classifications Summary, section 8.3). The laser categories which are considered to be ‘diver safe’ are those in which the transmitted laser light is of low-power and visible to the human eye. These are – Class 1, Class 1M, Class 2, and Class 2M.

Categories of laser which are found to be above the industry standard safety level and for which isolations should be set are – Class 3R, Class 3B and Class 4. These are considered potentially hazardous due to their operating at high-power levels, with the light being transmitted at wavelengths not visible to the human eye. These categories have the potential for eye hazard and skin burning. Appropriate isolation techniques for these classifications are given in the following sections.

5.1.3.1 Applying Optical Isolations

The energy source for the laser beam in a fibre-optic signal communication system is electrical and thus these isolations should only be conducted by authorised personnel. The common fundamental principle for the isolation of the laser beam is that the electrical power supply disconnection should be adequate and secure.

In witnessing the application of preliminary isolations, personnel should be aware of the following criteria relating to the applicable topside and subsea components of the subsea fibre-optic system.


5.1.3.1.1.1 Electrical Power Source/Isolator Panel

For adequate electrical power supply isolation, the disconnecting devices within the electrical power source or main isolator panel should have an isolating gap sufficient for the voltage levels present or likely to occur.

Switches used for disconnection should be secure such that they can be locked in the ‘off’ position using a ‘safety’ lock device (e.g. a lock-out hasp secured individual-user padlock).

If a fuse is removed as part of the isolation, precautions should be applied to ensure that it, or a similar linking device, cannot be re-inserted. The aperture should be secured with a ‘safety’ lock or the fuse removed from the worksite.

All keys (or fuses) forming part of a secure isolation should be withdrawn to a central location of authority, to be kept under the control of a signed isolation certificate, as set out in the company permit to work system.

5.1.3.1.1.2 Optical Processor

Category 4 and (optionally) Category 3B laser control panels are fitted with a master key-switch to facilitate a controlled local isolation. For the specific

40 IMCA D 044

isolation requirements of subsea work, this facility should not be utilised as the preliminary isolation alone. It may, however, be employed in addition to the fundamental electrical isolation requirements given in 5.1.3.1.1.1 above.

5.1.3.1.1.3 Topside Umbilical Termination Unit (TUTU) Junction Box

Due to the safety limits given in 5.1.3 and the highly specialised nature of fibre-optic connectors, the preliminary topside isolation should not be implemented by simply opening, or separating live optical connectors in the TUTU.


5.1.3.1.2.1 Subsea Optical Couplers

These are capable of being disconnected subsea due to their being fitted with an integral and automatic mechanism which covers the exposed optical surfaces of the coupler halves during the de-mating process. This mechanism ensures the coupling surfaces are fully protected from physical damage or the entry of foreign matter.

The reliability, however, of the protection mechanism can not be confirmed (by observation) until the coupler halves are fully de-mated, hence this method of fibre-optic signal disconnection should not be utilised as a preliminary form of laser beam isolation.

Though not appropriate as a preliminary form of isolation the disconnection of a subsea optical coupler/jumper assembly is, however, appropriate as a final local isolation provided the setting of a topside preliminary isolation has previously been implemented for the circuit.

The additional benefit of applying a final local isolation is that it may assist in minimising the isolation implications on other items/circuits within the same subsea architecture.

The action of disconnecting the subsea coupler, to provide the final isolation, thus equates to the two fundamental requirements of an optical isolation, i.e.:

Provide an isolating gap sufficient for the laser power levels present, or likely.

Physical isolation is secure such that re-connection can not be made inadvertently.

5.1.3.2 Testing and Confirming Optical Isolations

5.1.3.2.1 Testing and Confirming Topside Isolations

Confirmation of the non-transmission (isolation) of the actual laser signal output from the optical processor is not feasible in the conventional manner of accessing inter-panel connection points with ‘test probes’. Therefore the only form of appropriate isolation testing is that which can be applied to the processors’ topside electrical power source (see 5.1.3.1.1.1).

Thus, topside testing to confirm a valid preliminary (electrical) isolation, in preparation for implementing the subsea final isolation, should follow normal techniques. Typically these are: check front-of-panel indicators for loss of input and output, confirm loss of data-communications, and confirm zero voltage on the electrical power supply input/output terminals.

IMCA D 044 41

5.1.3.2.2 Testing and Conforming Subsea Isolations

Subsea testing methods to confirm that a valid fibre-optic laser system isolation has been implemented by the topside facility should not be conducted by diving personnel. The transmitted laser light, being of high-power and invisible to the human eye, is considered to be potentially hazardous for diver approaches.

It is therefore important that documentation is completed which confirms and records that the topside isolation is securely in place, and that relevant electrical power supply circuits have been proven dead, prior to any intervention by diver. Confirmation paperwork should be exchanged (by agreed technique) for sign-off between responsible parties on the topside installation and the DSV.

5.1.4 Hydraulic and Instrumentation Isolations

A minimum of two independent and tested isolations should be established for diving personnel engaged in any subsea task where the presence of a potential hazard from a pressure source, or vacuum, exists. At least one of the isolation tests should take the form of a ‘positive test’, in the direction of flow.

The control, venting and isolation of pressure in both the subsea and sub-surface domains involve inter-connected systems of considerable complexity.

The primary pressure source for subsea hydraulic fluid power/control systems is provided by controllable pumping units on the topside installation. In contrast, the primary pressure (or vacuum) source requiring to be controlled and monitored by subsea valve and instrumentation systems respectively, is the variable-pressure hydrocarbon reservoir.

Additional retained pressure (or vacuum) sources are also likely to exist in these systems. Examples are: accumulator banks attached to the hydraulic system; inherent pressure-retaining properties of new thermoplastic umbilical hoses; and potential for locked-in differential pressure behind blockages (e.g. a hydrate) in instrument lines.

Each of these energy (pressure) sources will present specific concerns which should be thoroughly reviewed in order to apply the safest and most effective form of isolation. Consequently, normal recommended practice determines that a combination of topside and subsea isolations should be implemented, prior to commencement of the work.

Note: The isolation principles set out above may only be waived when it is possible to set local isolations at the subsea worksite, by either i) the physical disconnection of stab-plate halves (see section 5.2.4.1.3.4), or ii) the operating of manual isolation and vent valves (vent port should be fitted with ‘diver-safe’ pressure-relief cap), in combination with the physical disconnection of self-sealing hydraulic coupler halves (see sections 5.1.4.1.2 and 5.1.4.2.2).

The expression ‘instrument isolation’ in this section of the guidelines refers to those isolations required in respect of obtaining safe separation from the bulk system pressure/flow inventory. Isolation of instrumentation in respect of safe separation from the electrical power supply and signal/data transmission systems is addressed separately in sections 5.1.2 and 5.2.2.

Unless otherwise specified, the term ‘hydraulic’ is used in a generic manner in these guidelines in relation to the safe isolation requirements of either hydraulic fluid power equipment, or bulk system pressure/flow impinging upon instrumentation devices.

The valve and line (fixed tube or flexible hose) internal-diameter range applicable to such hydraulic or instrumentation systems is generally based on the standard dimensions – ¼” (6.3mm), ⅜” (9.5mm), ½” (12.7mm), ¾” (19mm), up to a maximum of 1” (25.4mm). Larger dimension systems should be considered solely under section 4.

Note: All tubing and valves (regardless of bore size) which transport chemicals in liquid form should be treated with the same isolation, test and intervention requirements as applicable to pipelines and bulk system pipework (see section 4).

42 IMCA D 044

5.1.4.1 Applying Hydraulic and Instrumentation Isolations

The topside isolation(s) should be installed by competent and authorised personnel only.

The subsea isolation(s) should, of necessity, be installed by ‘non-isolation-authorised’ personnel (i.e. divers). They are, however, ‘approved’ to implement such isolation(s) as they operate strictly under the control and instruction of their supervisory personnel, who are directly responsible for diver safety by working to company-approved project procedures, at all times.

Recommended topside and subsea isolation techniques for the various energy sources and their associated containment systems, as noted above, are detailed below (dual redundancy), and in further detail in sections 5.1.4.1.1, and 5.1.4.1.2).

Dual redundancy – Subsea control systems are generally installed in multiple-well applications, therefore the hydraulic supply system is invariably configured in a dual-redundant (‘A’/’B’) circuit arrangement (to ensure production up-time optimisation in the event of circuit failure). Depending on the design detail of the subsea hydraulic architecture, such dual-redundancy may be used to advantage, by avoiding the vent-down of the complete hydraulic system. For example, when required to remove/replace a critical hydraulic component it is possible to vent and isolate only the ‘A’ supply (but continue to maintain operating pressure through the ‘B’ circuit) and thus remove appropriate ‘A’ supply couplers at the subsea worksite without loss of hydraulic supply to the remainder of the field. With the proviso that the ‘A’ system can then be safely re-pressurised (with the given couplers disconnected), the procedure is then repeated for the ‘B’ system. By this independent twin-isolation procedure, the necessary final isolations are safely implemented locally at the subsea worksite, whilst the operation of any associated subsea field and infrastructure continues uninterrupted.


5.1.4.1.1.1 Hydraulic Power Unit (HPU)

The preferred location for implementing subsea system hydraulic isolations and the associated umbilical hose vent-downs is at the manual valve assemblies to be found within the HPU on the topside installation.

Total vent-down isolations set in this manner provide the most robust and secure form of isolation. SCM hydraulic pressure (both supply and output) is depleted to the extent that the system is rendered completely inoperable, with all spring-return solenoid and actuated valves taking up their fail-safe position.

Hydraulic output supply valves in the HPU should be arranged to provide a double block and bleed isolation, and locked-off. Following vent-down of the requisite umbilical lines, the HPU ‘return-to-tank’ valves should, conversely, be set to the locked-open position. This is to ensure that the umbilical lines (particularly thermoplastic hoses) remain free to continuously deplete residual stored hydraulic pressure and, importantly, to ensure that the umbilical ‘return’ facility for those subsea control systems which operate on a closed-loop exhaust/vent architecture remains in place, as part of the isolation.

Valve status should be indicated local to the HPU by attaching ‘isolation’ tag-labels, and these recorded through associated isolation certificate paperwork, as set out in the company permit to work system. In the event that individual isolation valves can not be locked in position, then access door(s) to the HPU (if fitted) should be locked. In the event that the HPU has not been constructed as an enclosed item, and it is not possible to lock

IMCA D 044 43

individual isolation valves, then additional access-limiting measures should be applied to maintain the security of the isolations.

Note: ESD vent-down solenoids incorporated in the HPU output circuits should not be utilised for the purpose of preparing planned isolation(s)/vent-down(s).

In the event that all hydraulic supply lines to the subsea location require to be isolated and vented-down as part of the same work, then it is recommended that the HPU start/stop motor controllers for the HPU pumps should also be locked-off and labelled accordingly. Supporting isolation certification should be raised in respect of the electrical isolations applied. (These steps ensure that pumps in the HPU do not continually attempt to start as a result of low hydraulic pressure being detected throughout the system.)

5.1.4.1.1.2 Topside Umbilical Termination Unit (TUTU)

In certain circumstances, depending on whether a suitable double block and bleed isolation valve architecture is provided within the TUTU, it may be possible to apply tested hydraulic isolations within this unit rather than at the HPU. The standard industry practice of locking valves, attaching ‘isolation’ labels and completing isolation certification apply.

5.1.4.1.1.3 Master Control Station (MCS) Remote-Set Isolations

Certain hardware components within the subsea control system hydraulic architecture (e.g. motors/pumps in HPU, solenoid valves in HPU or solenoid valves in SCM) can be operationally ‘disabled’/’inhibited’/set ‘off-scan’ by remotely setting software ‘isolations’ from the topside MCS. This technique may be considered for the application of preliminary isolations when no alternative is available. It is not recommended for providing final subsea isolations. This is on account of the potential for software malfunctions (MCS is not SIL rated) and/or operator error.

In addition, such software-generated ‘valve-type’ isolations are not recommended as a means of setting a final form of subsea isolation as they do not provide a tangible valve closure/hydraulic disconnection which may be physically witnessed/confirmed by diver. For example, it is not possible to visually determine the position status of an electro-hydraulic solenoid valve internal to an SCM, hence further checks should be implemented prior to the actual intervention (see section 5.1.4.1.2.3).

Any dependence upon software for the remote-setting (via MCS) of hydraulic isolations and associated vent-downs requires that the specific combination of isolation management controls given in i) to iii) below, should apply.

i) It is an essential requirement that any system hardware being vented-down and disabled/inhibited has some associated means (e.g. pressure monitoring transducers) to be able to positively report back to the MCS, in real-time, that the expected change of operational status takes place when the software ‘close’ (open to vent) and ‘inhibit’ (set isolation) commands are applied (see section 5.1.4.2.1).

It is also essential that bulk system hardware function checks (e.g. valve operations) are conducted from the MCS, and concurrently witnessed at the subsea worksite, to further confirm the security of the preliminary isolation. (The setting of a final isolation locally at the subsea worksite should then be implemented immediately thereafter by physical disconnection of the valve hydraulic supply.)

44 IMCA D 044

Note: This process accounts for any possible software malfunctions which may subsequently occur within the MCS, or any inter-linked system(s) – such as DCS or ESD. In this regard, both the status of the MCS and the continued validity of the software ‘isolations’ should be monitored for any unpredicted condition change, immediately prior to the commencement of the control system reinstatement activities at the subsea worksite.

ii) Any such isolation being set via the MCS should only be conducted by authorised personnel at a higher level of supervision than the normal operational level.

Note: Passwords and isolations – The utilisation of either a generic or personal log-on/password combination as the authorised means of applying an isolation should not be accepted as the sole method whereby a software isolation, remotely set via the MCS, is considered to remain securely in place throughout the work.

iii) Following the setting of any such software ‘isolations’, access to MCS keyboard(s)/screen(s)/panel(s) should be restricted by physical locking10. Key(s) should be withdrawn to a central location of authority, to be kept under the control of a signed isolation certificate, as set out in the company permit to work system. This provides an increased level of isolation-security by preventing any inadvertent, or unauthorised, removal of software ‘isolation(s)’, throughout the subsea work.


5.1.4.1.2.1 Manual Valves

Subsea isolations necessary for removing an instrumentation device from a pressurised pipeline, or disconnecting a pressurised hydraulic fluid line, should be applied at relevant small-bore manual valves. These are usually incorporated as close as possible to the point of intervention and are normally arranged in a combination which provides a safe and testable isolation for diver intervention purposes. The combination may be housed in a single machined stack-up (or casting/forging) or consist of a series of separately located valves which are flange-bolted together.

Such manual isolation valve combinations exist in various configurations throughout subsea systems. Those of minimal and basic design are invariably of such little value for subsea intervention purposes (see Figure 2) that a risk assessment should be conducted to determine whether, or not, it will be safe to proceed with the intended work. Alternatively, complicated multi-valve designs may have the potential for isolation-setting error when being aligned for an intended task. Also their larger/more complex bulk, when located within a compact subsea structure, may present problems for diver access.

The industry–recognised configuration of isolation valves which incorporate safety and reliability and minimal size envelope consists of two in-line block valves together with a bleed valve. The bleed valve may be located in one of two positions, either between the block valves (preferred) or on the downstream side of both block valves. Also, the vent port on the bleed valve should be fitted with a ‘diver-safe’ type pressure-relief cap as this is the intervention location for test purposes

10 Note: In the absence of any physical locking facility, such that restricted access to the MCS operator-interfaces can not be implemented, an alternative method of ensuring the security of the preliminary isolation should be obtained. For example, this may be achieved by: routing MCS control to an ‘engineer’s workstation’ located in a securely lockable 19” rack panel; or physical isolation of communications between the MCS and the SCM. Such alternatives, being tangible ‘isolations’, provide confidence to diving personnel that local and final physical isolation(s) can be safely implemented.

IMCA D 044 45

As both such valve configurations are found in subsea systems, their effectiveness in providing isolations for diver intervention purposes are outlined in 5.1.4.1.2.1.1 and 5.1.4.1.2.1.2 and below.

5.1.4.1.2.1.1 Block-Bleed-Block Valve Configuration (Double Block and Bleed)

The optimised manual subsea isolation valve configuration for instrumentation/ hydraulic intervention consists of an in-line double block valve arrangement with a bleed valve and vent port combination set between the two blocks. This valve combination is generically termed double block and bleed (DBB). See Figure 2, Figure 12 and Figure 14a).

BLOCK

BLEED

VALVE 2

VALVE

BLOCK

VALVE 1

INSTRUMENT

PRODUCTFLOW

PRESSURE

VENT PORT&

RELIEF CAP

Figure 12 – Double block and bleed (DBB) valve manifold for instrument device

In principle, the DBB configuration provides the facility for two tested isolations (block valve 1 and block valve 2) between the bulk system pressure/flow and intended workface. In practice, it should be noted that this may not always be the case, therefore caution is required. Two principal reasons for such limitations are:

i) The sealing properties of the individual block valves may be difficult to determine with accuracy before the workface is opened. This is due to the fact that the workscope interface (e.g. instrument mounting or hydraulic coupling) is normally situated very close to block valve 2 where there is no dedicated bleed valve/vent port outlet for this particular cavity; and/or

ii) A physical blockage (e.g. due to a hydrate) may exist within both the DBB valve assembly and the inter-connection to the workface such that it may be difficult to correctly determine the sealing properties of block valve 1 and block valve 2. In this case, tests on block valve 1 (at least) may be obtained after ‘melting’ the blockage by suitable techniques applied through a DSV downline connected into the bleed/vent port (see section 5.1.3.1).

Taking the above limitations into account, the DBB configuration is capable of enabling at least one tested preliminary isolation (block valve 1) to be initially established against the bulk system pressure/flow prior to opening the work interface (e.g. instrument to be removed).

This initial single isolation is appropriate as the bleed valve and vent port, being located downstream of the valve nearest to the bulk system (i.e. block valve 1), can be configured to provide a continuous monitor of the status of

46 IMCA D 044

the preliminary isolation, during ‘opening’ of the workscope interface. Further, any contained inventory between the block valve 2 and the workscope interface should be of sufficiently small quantity that controlled release may be safely managed, through normal good working practice methods.

Having proceeded to ‘open’ the workscope interface, the DBB valve configuration may then be further utilised to establish a second tested final isolation (block valve 2) from the bulk system, such that the work may proceed in complete safety at the time or, if required, at some later stage in the project schedule.

These isolations are to be implemented by diver according to a series of logical steps, utilising either internal line pressure or a suitably configured DSV test downline. Such instructions should be provided through a combination of project work procedures and dive plans. The isolations, being applied and tested local to the subsea worksite, should ensure that, under normal circumstances, it is not an essential requirement to isolate and depressurise an adjacent or larger segment of the associated bulk system.

Note: Double block and bleed valve assemblies should be incorporated as the minimum isolation configuration at each diver intervention location in a subsea pressure-containing system. This is an industry-recognised safety and time-saving investment, enabling local depressurisation and integrity-testing of isolations in discrete segments. The bleed access port, for vent and test purposes, should be fitted with a ‘diver-safe’ type pressure-relief cap.

5.1.4.1.2.1.2 Block-Block-Bleed Valve Configuration (Block-Block and Bleed).

The only alternative configuration of manual isolation valves and vent which may be considered appropriate for instrumentation outlets (or lines of length less than 25 metres and internal diameter not exceeding 1” (25.4mm)) is the in-line double block valve with a bleed valve and vent port combination set after the two block valves and before the device/connection-point interface. This valve combination is generically termed block-block and bleed/vent (BBB or BBV) (see Figure 13).

BLOCK

BLEED

VALVE 2

VALVE

BLOCK

VALVE 1

INSTRUMENT

PRODUCTFLOW

VENT PORT&

RELIEF CAP

PRESSURE

Figure 13 – Block-block and bleed (BBB) valve manifold for instrument devices

This valve configuration may appear to be safer than the double block and bleed configuration outlined in 5.1.4.1.2.1.1 above, on account of

IMCA D 044 47

there being three in-line valves (rather than two) between the energy source and the vent port. Note, however, the absence of a test facility between any of these valves. It will therefore be difficult to independently determine the reliability of the isolation provided by each of block valve 1 and block valve 2. It is feasible that only one of these valves is actually providing the (tested) isolation.

It may also be noted that opening of block valve 2 (for example) to perform a test on block valve 1 invalidates any test previously completed on block valve 2. Thus block valve 1 can only be tested by selecting to leave block valve 2 open throughout the test programme or, conversely, choosing to test against block valve 2 and thus obtaining no isolation value from the function of block valve 1.

Alternatively it may be possible to test both block valve 1 and block valve 2 independently by the ‘volume calculations method’ (see section 4.1.3.4). Generally, this is not a reliable technique for small-bore tubing in which both valves are likely to be in very close proximity to each other.

This block-block and bleed valve configuration is therefore reduced to a preliminary isolation facility only. It is not able to provide a second tested final isolation (from the bulk system energy source) even after opening the workscope interface.

Although not a recommended isolation valve arrangement (see examples in Figure 2, section 4.1.1.1.1), it remains appropriate for small-bore manual valves only, as it is considered unlikely that block valve 1 and block valve 2 will both fail concurrently.

When required to utilise this valve configuration, a detailed safety review, to include the following two significant limitations, should be considered during the project risk assessment process.

i) In the event that an internal leak-path should exist (e.g. within the instrument housing) then it will not be possible to establish any tested isolation against the bulk system pressure/flow prior to ‘opening’ the workface. In such instances, it will be an essential requirement to identify and specifically assess all possible increased hazards with a view to amending the intervention procedure, or, obtaining an increased isolation envelope.

ii) In the event that any leakage should suddenly develop through block valve 1 and block valve 2 (after opening of the device/ connection-point interface), then, due to the absence of a monitoring bleed capability, the only vent route will be the workscope interface aperture. The existing bleed valve and vent port is unlikely to be capable of providing an alternative vent route of sufficient capacity in the event of a high-pressure/flow-rate leakage. Particular consideration should therefore be given with regard to the product contained within the bulk system, should it begin to vent in such an uncontrolled manner.

5.1.4.1.2.2 Non-Return (or Check) Valves

Depending on the intended service (e.g. chemical injection) an isolation valve combination may also incorporate at least one, possibly two, in-line non-return valve(s) (check valve(s)).

These are not normally recognised as an appropriate form of isolation, but exceptionally may be utilised, provided: the sealing properties of the obturator can be proven; the closed isolation status of the check-valve can

48 IMCA D 044

be positively11 maintained throughout the work; and the valve is only utilised in conjunction with other proven manual valves in the isolation scheme.

5.1.4.1.2.3 Solenoid Valves within Subsea Control Module (SCM)

Operational constraints within the architecture of a subsea control system may require that the hydraulic supply and distribution circuits are to remain at full operating pressure throughout an intervention programme. This may be further complicated by the absence of any local manual isolation/vent valves for use by diving personnel at the worksite.

In such circumstances the appropriate solenoid valves within an SCM may be utilised to provide the necessary preliminary isolation and venting facilities. Final isolations are obtained through the subsequent removal by diver of self-sealing coupling/jumper-hose assemblies at the SCM outputs.

Whilst not a recommended isolation technique for diver intervention work, the above method may be utilised provided the isolation management controls given in section 5.1.4.1.1.3 are adhered to, and the confirmation checks given in section 5.1.4.2.2.1 are applied.

5.1.4.1.2.4 Self-Sealing Diver Mateable Coupling

To achieve a tangible isolation (by hose disconnection) in a pressurised hydraulic subsea control system, two recognised diver mateable valve/ coupler configurations are applicable. These are illustrated in Figure 14a) and Figure 14b) below.

BLOCK BLOCK

BLEED

VALVE 2VALVE 1

HYDRAULIC SYSTEM

SELF-SEALINGCOUPLING

CAP,

CONNECTED HOSE

PRESSURE

VALVE

OR

SOURCE

VENT PORT&

RELIEF CAP

BLEEDVALVE

PRESSURESYSTEMHYDRAULIC

VALVE

BLOCK

SELF-SEALINGCOUPLING

OR

CAP,

CONNECTED HOSE

SOURCE

VENT PORT&

RELIEF CAP

14a) Double block and bleed with self-sealing diver coupling 14b) Single block and bleed with self-sealing diver coupling

Figure 14 – Block and bleed valves with self-sealing diver coupling

Figure 14a) represents the conventional double block and bleed valve isolation arrangement. Figure 14b), though not consisting of two valves in series (the standard ‘second block’ valve having been substituted by a self sealing coupling), is compliant with the isolation recommendations for small-bore manual valves, as contained in these guidelines. In both cases the bleed facility, an essential feature of the design, should be fitted with a ‘diver-safe’ type pressure-relief cap and incorporated as shown. It should also be proven as the operational vent, prior to coupler disconnection.

Note: The configuration in Figure 14b) is ‘acceptable’ on account of the following features: i) incorporated vent and ‘diver safe’ relief cap; ii) the ability to in-flow test the preliminary isolation block valve; iii) reliable sealing-whilst-disconnecting properties12 of the hydraulic coupling (i.e. the

11 Certain types of non-return valves incorporate a manually accessible over-ride facility which, if operational, should be utilised. 12 A representative self-sealing diver-mateable coupling design has been tested at 853bar (12,370psi) when completely un-mated, to demonstrate zero-passage of fluid (see ‘Qualification Test Report for the MEL ¼’ NB Diver Mateable Coupling’ – Reference 20).

IMCA D 044 49

final isolation); iv) pre-determined fluid volume and pressure/flow release; and v) dispersal of known fluid-type into a large pressure-absorbing environment. It therefore provides an effective, and subsequently testable, combination of two independent isolations (see section 5.1.4.2.2.1 for test methods).

For complex subsea hydraulic systems with interdependent circuits, it may be considered that full hydraulic depressurisation for disconnection/reconnection of the applicable circuit(s) is impractical. Where such complications exist, and self-sealing diver-mateable couplings have been utilised in the inter-connecting hoses, then the subsea industry de facto maximum pressure value for live disconnection/reconnections, namely 70 bar (1000 psi) should be applied as the safe depressurisation datum. This may therefore assist in reducing the impact of any associated hydraulic system vent-down/re-pressurisation requirements.

Note: No such datum may be applied for work involving straight-through non-self-sealing) hose connections. See also sections 5.1.4.1 and section 5.2.4.1.2.1.

Irrespective of valve/coupler designs and combinations, the recommended fundamental isolation procedure for diver intervention work on hydraulic systems is to fully depressurise the system to some nominal value above seabed ambient. This should be implemented prior to disconnecting/re-connecting any self-sealing diver-mateable couplings – see section 5.2.4.1.3.1.

For certain other subsea interventions involving diver disconnection/ reconnection of a self-sealing hydraulic coupler, it may be that the associated isolation valves (as detailed in Figure 14a) and Figure 14b) above), are not ‘local’ to the fitting (i.e. located at a distance greater than 25 metres from the fitting. It is therefore unlikely that the relevant vent port can be concurrently monitored during the coupler disconnection/reconnection activities. Thus, an unexpected isolation status change (e.g. sudden increase in fluid flow at the vent port) may remain unnoticed by worksite personnel

In such long-length inter-connections, it is therefore an essential requirement that the hydraulic pressure should be vented and securely isolated at some other location, further back in the system. The status of the hydraulic isolation should then be regularly monitored throughout the work, e.g. topside at the HPU or MCS.

5.1.4.1.2.5 Vented Diver Mateable Coupling

Most subsea control system isolation and intervention work will rely on the self-sealing properties of hydraulic couplings. It should be noted that certain system-architectures may have incorporated an alternative coupler design, known as the ‘vented-coupler’13. This type of coupler will not self-seal on de-mating, therefore at line pressures greater than 10 bar above seabed ambient it is considered hazardous for uncoupling by divers. For this reason, and safety concerns for persons onshore/on-deck (and similar personnel), a thorough type-check of all the hydraulic couplers to be encountered in the work should be carried out.

13 The vented-coupler is a variant of the diver-mateable self-sealing coupling. These have been manufacturer-modified to provide rapid vent-down of pressure at the coupler in long-length hydraulic jumper assemblies (typically greater than 100 metres). For example, with this type of coupling, the hydraulic supply line to a safety critical shut-down valve will self-depressurise (independent of the subsea control system) when disconnected by some accidental or unforeseen disturbance.

50 IMCA D 044

5.1.4.2 Testing and Confirming Hydraulic and Instrumentation Isolations

Hydraulic system or instrumentation isolations, whether applied topside or subsea, require to be rigorously proved and subsequently monitored to ensure that an effective and secure isolation has been achieved prior to any commencement of intervention works by a diver.

The fundamental aspects of isolation ‘test’ and ‘confirmation’ which personnel responsible for observing/witnessing should follow are detailed in the following sections.

5.1.4.2.1 Testing and Confirming Topside Isolations

Topside testing for confirmation of valid isolation and venting, implemented at either the HPU, the TUTU, or via the MCS, for the subsea hydraulic architecture should be conducted at both the front-of-panel gauges on the HPU, and at the various MCS mimics for the HPU and SCM(s). See examples in i) and ii) below:

i) For MCS isolation inhibits applied to HPU pumps, pressure gauges or vent-facilities in the HPU architecture should be utilised to physically demonstrate that pumps are not able to operate and re-pressurise the (previously) vented supply lines to subsea. Confirmation should also be obtained at the MCS mimics that the pressure sensors in both the HPU output supply lines to the umbilical and the SCM input supply headers, report in real time that hydraulic pressure has depleted below all SCM solenoid valve ‘latch-in’/’drop-out’ values, throughout the entire hydraulic system.

ii) For MCS isolation inhibits applied to SCM solenoid valves, separate pressure sensors should exist internal to the SCM hydraulic architecture for i) the main header supply line; ii) the output function lines; and iii) the return-line (if applicable). These sensors are required to independently report that, following the MCS commanding the appropriate solenoid valves to their vented (‘closed’) position, the requisite lines have been vented-off (below their solenoid hydraulic-latch ‘drop-out’ values) and therefore can not be re-pressurised.

Note: For those SCM designs where the output function line pressure sensor facility does not exist (or is faulty) then it is essential that the subsea confirmation checks given in section 5.1.4.2.2.1.1 should be applied, with any deviations being managed as noted therein.

Topside tests should provide independent confirmation that a hydraulic supply-line requiring to be made safe subsea has been securely isolated and fully vented-down to some nominal value above seabed ambient pressure.

The testing process should demonstrate that with ‘inhibits’, vent-downs and isolations in place, it is not possible to re-pressurise the line under any normal operational condition. Any pressure testing to confirm the integrity of isolations should be conducted and recorded at the highest operating pressure which is to be expected throughout the system for a defined minimum test ‘hold’ period of 15 minutes. Any failure to maintain isolation ‘hold’ pressure should be considered an unsuccessful test (see Figure 7 and Figure 8 for typical pressure-test profiles).

Additional confirmation that isolations have been completed successfully should be conducted at the subsea location by opening appropriate vent facilities in the hydraulic circuit(s), and monitoring for pressure/flow decay until any residual line pressure has equalised to an agreed nominal value above, or close to, seabed ambient.

IMCA D 044 51

The system isolation status should be supported by documented confirmation which records that the relevant topside isolations are securely in place, and all relevant hydraulic supply lines proven as vented, prior to any intervention by a diver. Confirmation paperwork should be exchanged (by agreed technique) for sign-off between responsible parties on the topside installation and the DSV.

Subsea instrumentation is generally interfaced to bulk liquid/gas equipment through manual isolation valve manifolds. Topside testing for confirmation of a valid local-to-instrument ‘process’ isolation, prior to diver intervention, is therefore not normally implemented (or feasible). Instead, tests are conducted locally by divers at the instrument valve-manifold interface (see section 5.1.4.2.2).

Note: In the event that this local testing is unsuccessful, such that it is necessary to isolate and vent a larger section of the liquid/gas bulk system, then topside-assisted isolation and testing methods (see section 5.1) should be applied.

5.1.4.2.2 Testing and Confirming Subsea Isolations

Pressure containment testing for confirmation of a valid hydraulic or instrument isolation at the subsea intervention point generally requires to be conducted according to the principles and methods given in sections 4.1.3 and 4.1.4.

Additional specific guidelines for testing and confirming hydraulic line and instrumentation manifold isolations at the subsea location are given in sections 5.1.4.2.2.1 and 5.1.4.2.2.2.

5.1.4.2.2.1 Hydraulic Lines

The isolation principle of ‘two tested isolations, with one of the tests in the direction of flow’ is generally achieved for the subsea hydraulic system by maintaining pressure from the topside pumping source, through the existing infrastructure. This testing (for confirming the integrity of subsea hydraulic line isolations) should be conducted and recorded at the highest operating pressure which is to be expected throughout the system for a defined minimum test ‘hold’ period of 15 minutes. Any failure to maintain isolation test ‘hold’ pressure should be considered an unsuccessful test (see Figure 7 and Figure 8 for typical pressure-test profiles).

On establishing the required isolations, it is also necessary to confirm by observation (and recording) that the hydraulic pressure on the intervention side of the isolation has been vented to either 70bar (1,000psi) maximum, or some agreed nominal value above seabed ambient prior to coupler and hose disconnection/re-connection activities.

Note: In the event that the hydraulic system isolation integrity testing programme is inconclusive, or unsuccessful, then the specific potential hazards arising should be assessed with a view to either proposing an appropriate alternative isolation scheme or identifying an increased isolation envelope. This may require the entire system to be vented-down from the topside pressure supply source (see section 6).

The following three examples of isolation types, and associated test methods, outline the recommended methodology which should be followed to confirm that the necessary subsea isolations have been implemented. These are given in sections 5.1.4.2.2.1.1 to 5.1.4.2.2.1.3 below.

5.1.4.2.2.1.1 Solenoid Valves in Subsea Control Module (SCM)

Utilisation of solenoid valves within an SCM, in conjunction with topside-issued MCS software commands, to obtain hydraulic output

52 IMCA D 044

function line isolation and vent-down should be confirmed by diver or ROV observation of status change at the subsea worksite.

Diver/ROV observations should be conducted concurrently (where possible) at both the actuator of the valve being functioned and the vent port of the associated SCM (see note regarding SCM types below).

These physical isolation integrity checks are an essential and basic requirement, in addition to utilising any MSC facility to record/trend the depletion of hydraulic ‘input’, ‘output’ (if available) or ‘return’ (if applicable) line-pressure transducer data, from within the SCM.

It is also important to note that such confirmation of MCS-set isolations, vent-downs and ‘inhibits’ should be conducted in parallel with the process of the MCS transmitting the valve commands. Further these cross-checks (see below) should be conducted both before and after setting the isolation through the MCS, thus ensuring implementation has been successful.

The minimum recommended cross-checks are outlined as follows:

i) Valve actuator supply circuit should be energised to the open position and then de-energised to the closed position by the MCS. Simultaneously observe valve actuator/indicator movement aligns with the MCS-issued commands and during closure control fluid discharge (proportional to actuator swept-volume) from the SCM vent port (see ‘SCM types’ note below). This is to confirm that the hydraulic pressure in the selected SCM output line has been depleted and that the SCM vent port is not blocked.

Note: Whilst movement of the valve actuator/indicator provides confirmation of hydraulic supply status (for the purposes of control system isolations), it does not confirm that the valve obturator has correctly sealed to form the required bulk system process isolation. Such isolations should be proven independently (see section 4).

ii) On completion of the checks at i), above, isolations (‘inhibits’) should then be applied at the MCS, following which repeat attempts should be made to command the valve open, then closed again. Simultaneous observations subsea should confirm no valve actuator/indicator movements, and no indication of control fluid being exhausted at the SCM vent port.

Thus, on successful completion of checks i) and ii), above (i.e. testing of the SCM solenoid valve to provide an isolation and proving the vent port as operational), the self-sealing hydraulic coupler may be removed from the SCM output function line connection, whilst full operating pressure is retained throughout the rest of the system.

Note: SCM types. Certain types of SCM design do not have an external vent/exhaust port. These operate on a closed-loop subsea control system architecture, whereby ‘vented’ fluid is returned to the topside HPU tank directly from the SCM, via a dedicated hose in the umbilical. In such configurations it may not be possible to accurately monitor the quantity of vented fluid ‘returns’ received topside from one cycle of open/close tests due to any of the following: low pressure values in the return line; low fluid volumes (e.g. from small actuators); or long lengths of umbilical hose. Thus the only available method for ascertaining whether hydraulic output and vent lines are correctly pressurising and depressurising (i.e. to check for any evidence of line blockages and therefore trapped pressure) is to carry out several repeated open/close tests of the SCM solenoid valve(s). Such tests

IMCA D 044 53

should be conducted in conjunction with visual confirmation by diver/ROV that the actuator on the bulk system is fully stroking successfully to both the open and close positions.

5.1.4.2.2.1.2 Double Block and Bleed Valves plus Self-Sealing Coupling

The utilisation of double block and bleed valve combinations which are located within the subsea hydraulic architecture, through which it is intended to obtain local input supply-line isolations (or vent-downs), should be proven through diver functioning and observation. Such testing is an essential pre-intervention requirement.

A typical double block and bleed configuration is given in Figure 15.

BLOCK BLOCK

BLEED

VALVE 2VALVE 1

VALVE

JUMPERHOSE

SUBSEA CONTROLMODULE

(OR SIMILAR)

SELF-SEALINGCOUPLINGS

BULKHEAD

HYDRAULIC SYSTEMSUPPLY PRESSURE

SOURCE

VENT PORT&

RELIEF CAP

Figure 15 – Isolation testing double block and bleed plus self-sealing coupling

The minimum recommended checks for the above arrangement are outlined as follows:

To prove block valve 1 is a preliminary isolation:

i) Close block valve 1 and block valve 2;

ii) Open ‘diver-safe’ relief vent cap at the vent port followed by opening the bleed valve. Confirm brief pressure/flow, reducing rapidly to no pressure change/flow. This is an essential check to establish correct operation of the vent port;

iii) Briefly open block valve 1 and obtain new pressure release/flow at vent port, thus confirming ‘communication’ through valves;

iv) With block valve 1 closed, conduct recorded (at MCS) in-line leak-off ‘hold’ test at highest system operating pressure for duration of 15 minutes (minimum), checking for no change in pressure/no flow at vent port.

The successful completion of the above checks confirms the validity of block valve 1 as a preliminary isolation.

To prove block valve 2 is a final isolation:

Whilst fundamental to the double block and bleed combination, it should be noted that block valve 2 cannot be conclusively tested as a final isolation. This is the case, regardless of the test method applied i.e. whether by internal hydraulic system pressure, or externally supplied hydraulic pressure (e.g. via DSV Test Downline). The reasons for this limitation to the test are outlined below:

54 IMCA D 044

i) Internal hydraulic system pressure. The downstream internal system pressure may be locked-in to test block valve 2 – i.e. by in-line leak-off (block valve 1 closed, block valve 2 closed, bleed valve and vent port open, check for no change of pressure/no flow at vent port). This test, however, will subsequently be invalidated, or superseded, by the subsequent requirement to either open block valve 2, or MCS command the SCM input-supply solenoid valve to the ‘local vent-down’ position (if facility available). Either action is essential to the worksite-venting of the jumper hose internal pressure to 70bar (1,000psi) or lower, for safe disconnection by a diver (see section 5.2.4.1.3.1.

ii) Externally supplied hydraulic pressure. The introduction of an ‘external’ hydraulic pressure-test source, such as a DSV test downline (or similar) connected to the vent port, does not guarantee a conclusive result due to the relatively small pressurisation volume of the valve cavity. Further, should this test be carried out (i.e. block valve 1 closed, block valve 2 closed, bleed valve open) then it is an essential prerequisite that the jumper hose be vented to a safe value, to allow diver disconnection at some later stage14. However, should block valve 2 by-pass in this test, then the jumper hose would become re-pressurised. The potential for such a complication occurring in the block valve 2 test may be difficult to observe, even on a locally installed subsea test-gauge assembly, such that the associated potential hazards remain unnoticed.

Thus, with block valve 1 proven as a valid preliminary isolation, together with the confirmation of a suitable flow-path through the bleed valve/vent port then, on account of the untested isolation status of block valve 2, the self-sealing properties of the associated in-line hydraulic coupler-half are relied upon to provide an appropriate final isolation.

Following the local venting of downstream pressure (as outlined in a)/b) above) the ‘free-half’ of the self-sealing hydraulic coupler may be backed-off (thus achieving the final isolation) such that the jumper hose is made safe for removal, full operating pressure having been retained in the rest of the hydraulic system.

5.1.4.2.2.1.3 Single-Block and Bleed Valves plus Self-Sealing Coupling

The utilisation of single-block and bleed valve combinations which are located within the subsea hydraulic architecture, through which it is intended to obtain local input supply-line isolations (or vent-downs), should be proven through diver functioning and observation. Such testing is an essential pre-intervention requirement.

A typical single-block and bleed configuration is given in Figure 16, below. It is important to note, for this arrangement in particular, that the vent port should be fitted with a ‘diver-safe’ type pressure-relief cap (see Figure 2). Should any other type of cap be fitted then the increased potential hazard to the diver will require to be assessed, with a view to either amending the intervention procedure or obtaining an increased isolation envelope.

14 If the hose was not vented in advance, then it would require venting at some later stage (to permit safe removal), thus any ‘test’ obtained on valve 2 would be invalidated.

IMCA D 044 55

BLOCK

BLEED

VALVE 1

VALVE

HYDRAULIC SYSTEMSUPPLY PRESSURE

SOURCE

VENT PORT&

RELIEF CAP

JUMPERHOSE

SUBSEA CONTROLMODULE

(OR SIMILAR)

SELF-SEALINGCOUPLINGS

BULKHEAD

Figure 16 – Isolation testing single block and bleed plus self-sealing coupling

The minimum recommended checks for the above arrangement are outlined as follows:

To prove block valve 1 is a preliminary isolation:

i) Close block valve 1;

ii) Open ‘diver-safe’ relief cap at vent port followed by opening of the bleed valve. Confirm initial pressure release/ flow – depleting to no pressure change/flow. This is an essential check to establish correct operation of the vent port, in conjunction with depressurisation of the downstream line;

iii) Following exhausting of pressure/flow from SCM (or similar), briefly open block valve 1 and obtain new pressure/flow at the vent port. This confirms ‘communication’ through valves and the correct operation of block valve 1;

iv) With block valve 1 closed, conduct a 15 minute (minimum) in-line leak-off ‘hold’ test (at MCS). This should be at the highest system operating pressure, checking for no change of pressure/no flow at the vent port.

The successful completion of the above checks confirms the validity of block valve 1 as a preliminary isolation.

Thus, with block valve 1 proven as a valid preliminary isolation, together with the confirmation of a suitable flow-path through the bleed valve/vent port then, on account of the absence of any additional in-line isolation valve, the self-sealing properties of the associated hydraulic in-line coupler-half is relied upon to provide an appropriate final isolation.

Having previously vented downstream pressure (as outlined in ii) above) the ‘free-half’ of the self-sealing hydraulic coupler may be backed-off (thus achieving the final isolation) such that the jumper hose is made safe for removal, full operating pressure having been retained in the rest of the hydraulic system.

The similarities and limitations in the three methods outlined above (5.1.4.2.2.1.1 solenoid valves in SCM, 5.1.4.2.2.1.2 DBB plus self-sealing coupling, and 5.1.4.2.2.1.3 SBB plus self-sealing coupling) are such that the testing techniques for a preliminary isolation are, in effect, identical. Also, in all cases the final isolation is only obtained during the process of actually disconnecting the self-sealing coupling from the fixed system.

56 IMCA D 044

It is therefore important that flow through the vent port should be conclusively proven prior to the uncoupling operation.

This ‘transitional’ isolation approach for obtaining double isolation in a system which may remain pressurised (to a permitted maximum value of 70 bar/1,000 psi) is an industry-recognised technique for small-bore valves/tubing in subsea systems which utilise diver-mateable self-sealing couplings.

These methods should not be applied to subsea systems fitted with open-bore threaded fittings on inter-connecting jumper assemblies (e.g. JIC-type fittings in chemical-injection system jumpers).

Note: When using pressure measuring devices (such as gauges) to confirm depressurisation of a line it is necessary to be aware of the following:

Pressure measuring devices are reliable indicators of the existence of pressure but not of complete depressurisation. Final confirmation of obtaining ambient pressure before intrusive work commences should always be conducted by opening an appropriate vent valve.

Pressure measuring devices will normally only give accurate indications over the middle part of their range.

A device designed to measure high-pressure values is unlikely to be accurate for measuring at low-pressure values.

It is recommended that at least two independent pressure measuring devices are utilised to demonstrate a line has been fully de-pressurised.

5.1.4.2.2.2 Instrumentation Manifold

The isolation principle of ‘two ... tested isolations ... with one of the tests ... in the direction of flow’ is generally achieved for subsea instrumentation devices by accessing the instrument valve manifold assembly through a test downline from the DSV deck. The test downline should be capable of operating at the maximum permitted test pressure which may be tolerated throughout the system (see section 4.1.3.1 for downline configuration(s) and test preparations).

Tests to confirm the integrity of any subsea instrumentation valve isolation should be conducted (and recorded) at the highest anticipated bulk system operating pressure which may arise throughout the duration of the intervention activity.

Further to the implementation of the pressure test and on completion of an appropriate stabilisation period there should be no flow, or loss of pressure, across the valve(s) under test for the duration of a further 15 minute (minimum) recorded test ‘hold’ period.

In the event of an initially unsuccessful test then the procedure may be continued by extending the test ‘hold’ period in 15 minute increments, up to an overall maximum of 60 minutes. This is to enable either extension of the stabilisation period to obtain a suitable 15 minute (minimum) test ‘hold’, or opportunity to determine the isolation device leakage rate, with a view to conducting an isolation risk assessment (see Figure 17).

The integrity of a tested instrument valve isolation should be determined with reference to the typical pressure-test profiles (see Figure 7 and Figure 8) and acceptance criteria, given in section 4.1.4.

IMCA D 044 57

Unless a specific set of isolation integrity acceptance criteria has been previously calculated and approved by project management, then any pressure depletion recorded during the 15 minute (minimum) test ‘hold’ period should be treated as a loss of isolation integrity, requiring some form of remedial action.

Note: When the integrity of an intended isolation fails to meet the required criteria (see section 4.1.4) it is recommended that a series of extended tests are carried out to enable the leakage rate to be measured, such that the possibility of utilising any suitable additional (or alternative) facilities to mitigate and manage the leak may be reviewed in specific detail through risk assessment (see Figure 17).

The basic stages involved in subsea testing to prove isolation integrity for the optimum instrument valve configuration (i.e. double block and bleed – see Figure 12, section 5.1.4.1.2.1.1) are as given below.

5.1.4.2.2.2.1 Proving ‘Communication’

With all three DBB valves set to the closed position, it is essential to initially prove that the vent port and associated bleed valve are not flow-restricted and will therefore operate as intended. The following ‘communication’-proving checks are recommended:

i) Initially, the ‘diver safe’-type combined vent relief/cap should be activated/ backed-off. This is to ensure any pressure trapped between the bleed valve and the vent port has been safely dissipated;

ii) Completely remove the vent/relief cap and connect-in the test downline from the DSV;

iii) Apply appropriate positive communication ‘test’ pressure to the DBB instrument manifold. All three DBB valves remaining closed at this stage;

iv) Proceed to open the bleed valve, observing for a brief pressure drop on the local-to-diver subsea gauge, integral to the DSV test downline.

Successful completion of these checks confirms ‘communication’ through the vent port, via the bleed valve, into the DBB cavity (and thus the application of communication ‘test’ pressure against block valve 1 and block valve 2 valves respectively).

5.1.4.2.2.2.2 Proving Isolation from Process Flow/Pressure-Source

Having confirmed ‘communication’ through the vent port and bleed valve, then block valve 1 (bulk process flow/pressure-source side) of the DBB valve arrangement should be in-line leak-off tested as an effective isolation, in the direction of flow, as follows:

i) Commence by leaving block valve 1 and block valve 2 (i.e. instrument side) set to the closed position;

ii) The bleed valve should be set to the closed position and the DSV test downline assembly (attached to the vent port) depressurised;

iii) The DBB bleed valve should then be opened, resulting in minimal-to-zero pressure increase observed on the local-to-diver subsea gauge, with the similar result recorded on the DSV deck test equipment. Proceed with 15 minutes (minimum) test programme, according to parameters and criteria above.

Successful completion of these checks confirms a valid isolation integrity test on block valve 1.

58 IMCA D 044

Note: Block valve 2 is not able to provide a tested isolation at this stage. Therefore, on completion of the above test it should be opened to allow venting of any (possible) entrapped pressure. It then should be reclosed, prior to the intervention work taking place.

Finally, an isolation integrity monitoring facility should be installed for the duration of the intervention workscope. This may take the form of a local subsea gauge (incorporating a vent facility) connected to the DBB vent port via a whip-line such as to be available for regular monitoring by diver (or ROV). Alternatively, the DSV test downline may remain in place.

5.1.4.2.2.2.3 Alternative (Limited) Test for Block Valve 1 and Block Valve 2

As an alternative to 5.1.4.2.2.2.2 above, it may be possible to check the functionality of both block valve 1 and block valve 2 through ‘positive’ test pressurisation, as follows. Continuing-on from 5.1.4.2.2.2.1 above, and with the DSV test downline remaining attached to the vent port, apply maximum permitted test pressure from the DSV deck to the DBB instrument manifold with block valve 1 and block valve 2 both set to the closed position. There should be minimal-to-zero flow, or change in applied pressure recorded on the test equipment. Proceed with 15 minutes (minimum) test programme, according to parameters and criteria given above.

Successful completion of this check confirms a valid integrity test on block valve 1 and a limited test on block valve 2 (see Note below).

Note: The above alternative test method, 5.1.4.2.2.2.3, is limited in validity due to the minimal volume which typically exists in the cavity between block valve 2 and the actual instrument housing. Thus it may be difficult to detect or measure any possible leakage past block valve 2 during the pressurisation test. Consequently caution is required as this cavity may have become pressurised.

Note: The subsequent opening of block valve 2 to deplete (possible) entrapped test pressure invalidates any test established for that valve.

Note: The presence of a hydrocarbon by-product blockage (e.g. hydrate, asphaltene, etc.) in any, or all, of the cavities in an instrument valve-block may provide an apparently acceptable set of test results. These may be seriously misleading, therefore consideration should be given in the early stages of the work programme to determine whether measures will be required to ‘dissolve’ any such blockage before proceeding with tests for suitable intervention isolations.

In the event that it is not expected or possible to obtain, or prove, any local subsea isolations at the instrument-to-bulk-system interface, then specific risk-assessed consideration should be given to isolating and venting an alternative, or larger, section of the bulk flowline/manifold/tree system.

In such instances, proof that this has been completed successfully should be observed by accessing an alternative suitable test point in the bulk flowline/manifold/tree system and monitoring for any pressure build-up through the DSV test downline and/or (if available) through other associated instrumentation in the subsea control system. These monitor(s) should remain active throughout the intervention.

The operational and applicable isolation status of the relevant bulk system(s) requiring diver intervention should be supported by written documentation. This records that all necessary isolations and vent-downs have been securely established, and proven according to these and any

IMCA D 044 59

other applicable industry guidelines. Such paperwork should be exchanged (in an appropriate format) for sign-off between responsible parties on both the topside installation, and the DSV, prior to commencement of any intrusive work by a diver.

5.1.5 Mechanical Isolations

Isolations of an unplanned and purely reactionary nature are not intended to fulfil the normal isolation and intervention requirements for a control and umbilical system. Instead, these come into effect when the possibility of major equipment failure and loss of control/containment occurs, due to an external gross damaging force (e.g. snagging by fishing trawl-board).

Such isolations are installed as either ‘guillotine’ mechanisms enclosing cable/hose jumper assemblies of the subsea control system, or ‘weak-link’ mechanisms integral to the overall umbilical. When activated, these ‘isolations’ devices cause an irreversible separation of the subsea control system services. Specifically, this will result in the rapid local venting of hydraulic power, with the consequential shut-down of associated bulk system flowline/manifold/tree valves.

Unexpected activation of mechanical ‘isolation’ devices has serious consequences in terms of hazard to divers, permanent damage to equipment, loss of production, and possible hazard to the environment. An awareness of the applicable safety and operational precautions are therefore outlined in the following sections.

5.1.5.1 Applying Mechanical Isolations

5.1.5.1.1 Guillotine Device

This device consists of a set of fixed and parallel-sliding plates which have a through-drilled pattern of oblique-cut holes. It is generally15 positioned such that the individual jumper hoses and cables, which connect between the umbilical termination unit and other subsea control system items, are routed through the various holes in the device cutting plates.

In the event that the field umbilical is snagged close to the subsea structure, then a link to the guillotine devices causes the cutting plate to slide and sever all the enclosed cables and hoses. Severe potential hazard due to the rapid and uncontrolled venting of all contained liquids at high flow-rates and under high pressure will result. This will primarily come from the hoses connected to the main length of umbilical but the possibility of pressurised well-bore products in any chemical injection hoses connected to the subsea system should also be considered.

It is therefore essential that for any activities involving diver access adjacent to guillotine devices that all manufacturer-recommended locking bolts/pins are installed into the mechanism prior to commencement of the work. Disarming the device in this manner provides a tangible isolation for the diving work.

5.1.5.1.2 Weak-Link Device

This device consists of an in-line bolted mechanical joint contained within the umbilical strength (armour) structure.

The in-line joint assembly is weakened to a pre-determined snag-load level by substituting a proportion of the fixing bolts with those of a lower load-rating. Excessive snagging-forces applied to the umbilical (in the vicinity of the assembly) will cause it to separate, resulting in the services contained within to

15 Umbilical structural-strength elements generally preclude the use of the guillotine as an effective cutting mechanism for the main cross-section.

60 IMCA D 044

sever or part also. The consequences are identical to those described in 5.1.5.1.1 above. To apply a tangible ‘isolation’ such that the assembly is made safe for the duration of the work, all the weakened bolts should be replaced (in turn) with maximum-load rated items. These bolts should be colour-coded to avoid confusion during subsequent removal and replacement operation, at completion of the diving work.

5.1.5.2 Testing and Confirming Mechanical Isolations

It is not practically feasible to in-situ test and confirm the effectiveness of either of the above-described ‘isolations’, as applied to such devices. Their installation, however, should be witnessed and recorded by authorised personnel on the DSV prior to commencement of the associated work.

5.2 Intervention

5.2.1 Types of Subsea Control and Umbilical System Interventions

The subsea elements of a subsea control and umbilical system, by their design and purpose, tend to be complex and located in a harsh operational environment. This means that throughout the lifetime of any subsea development there is a high likelihood that certain components of the system will fail, and thus of necessity, require intervention.

Also, a subsea control and umbilical system may exist in any combination of three age-related conditions – either i) completely new subsea installation, or ii) new subsea system connecting into an existing system, or iii) an existing system. Consequently, the workscope and intervention requirements may vary considerably. These conditions and requirements are outlined as follows:

5.2.1.1 New Subsea Control and Umbilical System

For diver activities associated with the installing and commissioning of equipment for a completely new development it may be assumed that there will be no requirement to carry out any remedial-type intervention work. All sections of the hydraulic and electrical services to the subsea system should remain isolated from all main topside supplies until subsea tie-in and hook-up is completed.

Pre-commissioning integrity testing phases will involve the application of hydraulic pressure or electrical power to the subsea system from topside test equipment. During such testing (and depending on the test-type), it may be a requirement to separate diving personnel from the worksite by some pre-defined safe distance until the test has stabilised, or been completed.

Should a test be unsuccessful and the newly-installed equipment require investigation by diver, then it remains incumbent upon the project engineering and supervisory personnel to ensure that the appropriate isolation guidelines, as defined in section 4.1, are fully adhered to prior to any subsequent intervention taking place.

5.2.1.2 New Subsea Control and Umbilical System Being Connected to Existing Subsea Infrastructure

Many new subsea developments are designed around the concept of connecting to an existing infrastructure. The vintage of the original systems can vary enormously (e.g. up to approximately 25 years), hence there will be differences in the design principles applied and the developments available in subsea technology. Incorporating extensions to such systems will therefore require careful evaluation on an individual basis prior to the application of isolations and the commencement of any intervention work.

These can be most difficult to assess for several reasons e.g. differences between ‘as-built’ details and actual ‘as-left’ status, non-existence of suitable isolation valving

IMCA D 044 61

subsea (double block and bleed), faulty/inoperative isolation valve actuators, seized manual isolation valves, poor or missing component tag-labels and hose/cable identifications, various alterations to topside facilities resulting in limited ability to apply suitable isolations for subsea extensions, etc.

These variances require that a thorough investigation (often requiring the accessing of archived information) should be conducted by the responsible project engineering personnel to establish the best methods for fully complying with the applicable isolation guidelines as defined in section 4.1 prior to any subsequent intervention taking place.

5.2.1.3 Existing Subsea Control and Umbilical System

On an existing subsea control and umbilical system which has developed a fault, intervention work by diver (usually following visual checks conducted by ROV) will invariably consist of an initial survey of the worksite and an investigation of the external condition of the (failed) component.

Regardless of the technicalities of the fault, the condition of the component under investigation should be presumed to have become suspect in either its pressure-retaining or electrical isolation properties. It is therefore incumbent upon the project engineering personnel that for any further repair/replacement intervention to take place safely, the applicable isolations guidelines, as defined in section 4.1 – are complied with prior to the commencement of any subsea work.

Diver intervention work on these systems may therefore be required for several reasons, such as the installation and hook-up of new (or refurbished) equipment, the retrieval of (faulty) components, general inspection work, general maintenance work, assisting with fault diagnostics or assisting with system testing and commissioning.

To make such work(s) safe for the diver, and for the better protection of the environment and the equipment, the recommended intervention techniques are sub-divided into the four main equipment-type categories, namely:

Electrical (high, medium and low-voltage) and communication/signal systems;

Optical (laser signal/data) systems;

Hydraulic (except chemical injection – see section 4.3), and instrumentation systems;

Mechanical systems.

The best-practice methods, which should be adopted for each of these categories, are detailed in the following sections.

5.2.2 Electrical and Communication/Signal System Interventions

The combined electrical and communication/signal architecture of any subsea control system consists of a variety of individual components (e.g. umbilicals, distribution units, control modules, sensors, etc), linked together by an array of cables and connectors. Their diver intervention requirements are similar in that they all require electrical isolations (of varying complexity) to be set, and the cables and connectors should be correctly handled to ensure diver safety – as well as system integrity. Guidelines for the recommended methods of intervention are given as follows.

The energy being transmitted through these links to/from the components is defined as being in one or other of the following categories:

i) Medium, high or ultra-high -voltage electrical power – For conveying system electrical power or a combination of system electrical power and super-imposed communication signals (ranging from 50 Volts to many thousand Volts at either high alternating current (AC) or direct current (DC) levels depending on system design); or

62 IMCA D 044

ii) Low-voltage electrical power/signals – Normally for conveying electrical communication signals, or electrical data signals to/from instrumentation or for providing small amounts of power (less than 50 Volts at low direct current (DC) levels).

Typical subsea components which either distribute or transmit/receive electrical energy and which may require diver intervention are identified under the two given power categories in Table 3 below (noting that certain items may appear in both categories). Due to constant developments in subsea and down-hole electrical technology, this list should not be taken as definitive.

Medium, High and Ultra-High -Voltage Electrical Power

Low-Voltage Electrical Power

Subsea control module Subsea control module

Subsea control module mounting base Subsea control module mounting base

Power umbilical Communications umbilical

Umbilical end termination Umbilical end termination

Electrical distribution assembly Electrical distribution assembly

Subsea switch module Subsea switch module

Subsea processing module Subsea processing module

Electrical submersible pump -

Electrical valve actuator -

Electrical power jumper -

Electrical pipeline heating -

- Impressed-current cathodic-protection

- Pressure sensor

- Temperature sensor

- Down-hole pressure and temperature sensor

- Valve position sensor

- Chemical injection metering valve

- Sand monitor

- Corrosion monitor

- Single-phase flowmeter

- Multi-phase flowmeter

- Choke position sensor

- Instrumentation jumper

- Electrical communications Jumper

Table 3 – Subsea electrical power categories

5.2.2.1 Defining Safe Distance from an Electrically Live Object

In certain instances involving diver intervention in the vicinity of a subsea electrical component, it may be a requirement to consider the possibility of the component becoming, or remaining, live during the work. Typical reasons for this are given in a) to d), noting that these may not necessarily present a limitation to the work proceeding provided certain recommended checks regarding safe distance have been carried out (see below).

i) The increasing utilisation and associated complexity of electrical power applications subsea (such as those listed in Table 3 above) may result in certain circumstances for which it is not possible to obtain (due to the failure mode), or not necessary to require (due to electrical energy levels not being considered

IMCA D 044 63

hazardous), a confirmed second and final isolation local to the subsea worksite. Consequently, electrical energy may remain ‘present’ or ‘stored’ within the actual faulty component (e.g. umbilical conductors or jumper-cables) which divers are expected to either externally intervene on, or work closely adjacent to.

ii) Subsea control and umbilical systems which have been installed for greater than 20 years may be reaching the end of their design-life. The potential for electrical component failure, whilst a subsea intervention is ongoing, is therefore a possible concern to diver safety.

iii) Divers (rather than a work-class ROV) may be required to approach a worksite for initial non-intrusive investigation purposes whilst the (possibly faulty) electrical system remains live, or is subjected to a series of topside fault-finding/ diagnostic tests.

iv) Many existing subsea electrical distribution systems are becoming increasingly complex due to the tie-in of additional step-out well developments often under the ownership of parties other than the host platform operator. This may result in different preferences and constraints in respect of electrical system isolations for the subsea facility.

Thus, for safe subsea intervention to take place in any of the above or similar instances, the risk-assessment process associated with the work should establish and specify in advance, by calculation, the approximate minimum safe distance to which a diver can approach a subsea system component which may continue to contain electrical energy.

The approximate safe distance in seawater (Ss) in metres is a function of the ratio of the short-circuit fault current in Amps (Io) of the component, to the maximum safe body current in Amps (Ib) of the diver. This is calculated (in metres) for seawater according to the following formula:

Ss = (1 + {(Io x 10-4)/Ib})½ -1

Note: given values are:

AC Ib value = 10 mA

DC Ib value = 40 mA

(see section 5.1.2)

Sources for derived formula – IMCA D 045/R 015 – see section 8.1.

Worked examples:

Example 1: Possible faulty AC power supply cable.

Consider the case where the inter-connecting cable between two umbilical terminations has a fault, such that the given component short-circuit fault current (Io) has been calculated as being 40A;

Now, maximum safe body current (Ib) = 10 mA (from previous),

thus, safe distance (seawater):

Ss = (1 + {(Io x 10-4)/Ib})½ -1

= (1 + {(40 x 10-4)/10x10-3})½ -1

= 0.18 metres

Example 2: Possible faulty instrumentation housing and/or associated DC signal cable harness.

64 IMCA D 044

The given component short-circuit fault current (Io) has been calculated as being 20 mA;

Now, maximum safe body current (Ib) = 40 mA (from previous),


Ss = (1 + {(20x10-3 x 10-4)/40x10-3})½ – 1

= 0.025 millimetres

In this example, the electrical energy is of such low level that the safe distance separation is, for all practical purposes, imperceptible to a diver on making actual contact with the component. This result, however, does not unconditionally imply that it would be electrically safe for the component to remain live during any required diver intervention on the actual device and/or its associated cable/ connector assembly. Instead, consideration should be given to any applicable electrical fault-condition(s) to determine whether the maximum fault values which may be possible are within acceptable limits – see section 5.1.2 (‘Maximum safe body current’). There are also various technical limitations which may apply when reviewing the requirement, or otherwise, to carry out live disconnection/re-connection of conductive connectors, see section 5.2.2.3.2 below.

Example 3: Diver required to approach, or be in the vicinity of, the anode of an impressed current cathodic protection system, whilst it remains operational.

In such instances, the short-circuit fault current (Io) is taken to be equivalent to the impressed current at the anode;

thus Io = 2000A (DC);

Now, maximum safe body current (Ib) = 40 mA (from previous)


Ss = (1 + {(2000 x 10-4)/40x10-3})½ – 1

= 1.45 metres

Note: As a matter of diver-safety awareness, it should be noted that the above results are obtained from the formula derived for seawater. The approximate minimum safe distance formula for fresh water (Sf) is given as:

Sf = (1 + {Io/( Ib x 40)})½ -1.

This yields a much longer minimum safe distance of separation from a faulty component, thus in Example 1, above, the calculated approximate safe distance Sf, for fresh water would actually require to be greater than 9.05 metres (against 0.18 metres for salt water).

Note: The safe distance calculation check is a diver-safety precautionary measure for non-intrusive (i.e. adjacent) work only.

The electrical component in question may have become faulty for a combination of reasons – e.g. internal failure, physical housing damage, loose cable connection or insulation breakdown, such that live electrical parts may be in contact with the surrounding seawater.

Therefore all normal and necessary risk-assessments and isolations as recommended by these guidelines should be conducted and implemented prior to the commencement of the work.

IMCA D 044 65

5.2.2.2 Determining Electrical Isolation Type

Information obtained regarding the short circuit fault current (Io) and the supply voltage (V) for a given component, together with reference to section 5.1.2, should enable selection of the most applicable combination of recommended electrical isolations. The appropriate method and type of preliminary (i.e. topside) and final electrical isolations thus selected should be specified in the project work procedure, in accordance with normal working practices. The preliminary isolation should be applied prior to any diver intervention work commencing at the worksite16.

Following the confirmed and documented application of the topside isolation(s), then appropriate final local isolation (where by design it is possible to do so) is put into effect by diver (or ROV) removal of subsea connector(s) for the relevant component(s).

Note: In accordance with industry working practices for isolations, it is recommended that electrical power to/from a component, on which diver intervention is required, is completely removed by both preliminary (topside)17 and final (subsea if possible) isolation techniques.

5.2.2.3 Connectors

Prior to any connector disconnections by a diver, it is most important that the condition of the cable-harness and associated penetrator entering the back of the connector are thoroughly checked for any signs of external damage. Cable identification tags (located close to the connector) should be confirmed and, where possible, the cable routing checked to be absolutely certain that the correct connector is about to be removed for the required work.

The connectors fitted to subsea cables play a vital role in the reliable performance of any subsea control and umbilical system. It is important therefore that their specific intervention requirements are recognised, and incorporated into work procedures and instructions.

Subsea interconnecting electrical cables are terminated with either of two specific types of connectors. These are inductive couplers or conductive connectors. Their intervention requirements are outlined as follows:

5.2.2.3.1 Inductive Couplers

The design of this connector type is such that all potentially live components are insulation ‘potted’ within a protective housing such that they should be isolated from the surrounding seawater and hence the diver. It is therefore possible in theory to be able to disconnect and re-connect the inductive coupler connector whilst the system remains in a fully powered-up live state.

Electrical power can only be transmitted when the mating halves of the coupler are brought face-to-face with a separation gap less than, or equal to 5mm.

Note: The condition of the coupler assembly and the attachment of the cable to the connector (i.e. cable penetrator) should be visually assessed for integrity and condition prior to any manual disconnection/handling operation by the diver. Should there be any doubt as to their condition, then a preliminary electrical isolation should be put in place by the topside installation, before

16 With the unique exception of those subsea electrical systems utilising inductive coupler connection methods, whereby preliminary and final isolations may both be implemented subsea, by a diver. See further, in section 5.2.2.3.1. 17 Certain types of SCM utilise either hydraulically-latched, or electrically-held control valve(s) for the internal shut-down dump-valve duty. The status of the hydraulic control valve will remain ‘as-is’ when an electrical isolation is applied (due to the hydraulic ‘latch’), however, for the electrical control valve, such an isolation will cause this device to de-energise to the ‘vent’ position (regardless of the continued availability of hydraulic power to the subsea architecture).

66 IMCA D 044

proceeding to disconnect such couplers. This should be done in such a way that the coupler is electrically isolated before the diver disconnects it.

Following the separation and removal of power coupler-halves, it is essential that an appropriate dummy-half coupler (termed ‘shunt’) is immediately re-fitted to the fixed-half of the coupler face (especially if it has remained live). This shunt prevents the routing of excessive draw-down of electrical power by the un-mated coupler which would cause internal electrical damage to the main supply circuit. The shunt also protects the exposed fixed-half coupler, face from the possibility of physical damage.

Whilst it is not technically essential to fit a shunt to the smaller signal inductive coupler (utilised for communication and instrumentation), it is recommended that they are also fitted to provide physical protection. Should a proprietary signal-shunt not be available then a plastic protective blanking cap should be fitted.

The separated coupler-half together with its cable harness should only be handled by lifting with the fitted handles (on large couplers) or the coupler body itself (smaller couplers). Under no circumstances should the coupler be allowed to hang ‘free’ on the cable harness as this will damage the penetrator boot-seal. The exposed face of the separated coupler-half should also be fitted with a proprietary plastic protective blanking cap prior to laying down on any adjacent structure, or the seabed.

5.2.2.3.2 Conductive Connectors

Wet-mateable pin-to-pin connectors generally obtain electrical circuit continuity through the mechanical face-to-face contact of a metal pin in a ‘male’ plug assembly with a similar metal pin design in a matched ‘female’ socket assembly. The operation of plugging the one into the other in the subsea environment, without entrapping seawater between the electrical connecting surfaces, is achieved through complex internal sealing mechanism and pressure-balancing components.

Such connectors, although robust in their external construction, should be handled with care. For example the cable entering into the back of the connector should not be flexed or strained beyond the manufacturers specified minimum bend radius. Also avoid applying direct in-line loading to the connector/cable combination.

The conductive connector has limited self-protection, both in terms of internal electrical isolation mechanisms (if fitted) and the fact that on disconnection the exposed ‘pins’ or ‘sockets’ are vulnerable. Examples of possible damaging effects are electrical discharge (pin-to-pin or pin-to-seawater), physical contact with surrounding hardware/seabed and the calciferous and corrosive actions of the seawater environment. For this reason, exposed connector halves should always be protected by having proprietary protective caps fitted immediately after separation. It is also of fundamental importance that the design, type and duty of the protective cap are identified at an early stage in the project. Principal features which should be considered include: keyway orientation, gender, pin/socket count, ‘short-term’ or ‘long-term’ service, and any test applications. It should be noted that ‘short-term’ cap provides protection for limited period only; ‘long-term’ cap matches design-life properties of actual connector.

Prior to mating the connector to either its designated location, or in the fitting of its protective cap, the condition of the pins should be visually checked to ensure that no damage has occurred, or any foreign matter or contamination is present. Transferring this across to the ‘fixed half’ (e.g. on a sensor or on a subsea control module) will usually result in additional complications.

IMCA D 044 67

Prior to de-mating a subsea conductive connector, it is important that an appropriate topside preliminary isolation is implemented. This isolation and intervention requirement applies regardless of the type or operating design of the conductive connector, for the following reasons:

i) The design of the connector may provide an autonomous internal electrical isolation, however, actual verification of any physical internal contact separation can not be visually confirmed, nor electrically tested, by a diver.

ii) Should the connector not achieve its internal electrical isolation during de-mating, then the live conductive pins will become rapidly pitted and corroded in the seawater environment.

In certain instances, the various isolation requirements recommended above may necessitate the isolation (by topsides) of electrical power to the entire subsea field. It should be noted, however, that continued operation and safe control of the field may proceed for a defined/agreed period of time, provided that the ‘dump-valve’ within the SCM is of the hydraulically-latched type. Thus, should a shut-down request at supervisory system level be initiated, then the shutting-down of the subsea field is executed through normal topside hard-wired interface-control measures, ultimately resulting in the venting of umbilical hydraulic pressure, such that the electro-hydraulic control valves in the SCM(s) ‘de-latch’, allowing manifold and tree valves to rapidly fail-safe close.

Note: Following such a topside vent-down of hydraulic power to subsea, it will not be possible to re-open actuated valves until electrical power and communication to/from the subsea facility is re-instated.

5.2.2.4 Cables

Depending on system design and application, subsea cables (whether within an umbilical or broken-out into separate ‘jumpers’) are utilised to conduct electrical energy within the architecture in the two previously defined categories of i) medium, high and ultra-high-voltage electrical power, or ii) low-voltage electrical power or signals (see second paragraph, section 5.2.2). Intervention aspects which should be considered with regard to cables serving either, or both, of these power categories are outlined as follows:

5.2.2.4.1 Cable Terminations

The conductor cores within a cable should always be terminated through proprietary factory-assembled connectors/couplers, hence the requirement should never arise whereby a diver has to work on an un-terminated cable for the purposes of making/repairing a connection.

5.2.2.4.2 Cable Cutting

In certain work, it may be necessary for divers to actually sever umbilical/jumper cable combinations, e.g. during intervention on a snagged or damaged umbilical/cable or, as part of decommissioning activities. Two important electrical parameters applicable to cable(s) requiring to be cut are: i) induced voltage and ii) residual charge. These should be considered at the project engineering stage, and are further outlined below:

5.2.2.4.2.1 Induced Voltage

In any work requiring diver intervention to cut a subsea cable, an initial investigation, during the onshore engineering phase, should be carried out to check for the possibility of other live high-voltage power cable(s) crossing the dead cable at any point(s) along its route.

Should cable-crossings be identified, then an engineering assessment is required to determine whether the possibility exists for electrical power, at

68 IMCA D 044

potentially lethal levels, to be electromagnetically induced within the conductors of the dead cable.

The engineering assessment should take account of such factors as:

Maximum possible fault-condition electric current which may be transmitted through the live operational cable(s);

Cross-sectional and lay-up construction of all cables involved;

Angle of incidence between the cables (note that at 90º crossing, inductive interaction is theoretically impossible);

5.2.2.4.2.2 Residual Charge

Potentially hazardous levels of electrical energy can remain stored in high-power cables after the required topside preliminary isolation has been applied. It is therefore an important safety requirement that this excess energy is rendered harmless and remains so throughout any diving intervention work. This is primarily achieved by applying a topside earth-bond connection to each of the isolated high-power cable cores. For low and medium voltage levels it is recommended that this should be in place at least 60 minutes before the subsea intervention work commences. For high or ultra-high voltages it is recommended that an extended discharge period is determined. This topside connection should remain in place for the duration of the work.

With the earthing connection applied to the topside end of the cable, it may still be possible for the diver to experience an electric shock whilst cutting into the cable. This is due to the fact that residual charge continues to remain present in increasing measure towards the far (subsea) end of the cable. This charge is due to the capacitive effect of the cable insulation. The associated discharge time is primarily dependant on three key parameters:

Dielectric property of the insulation;

Thickness of insulation;

Overall length of cable.

Whilst it is known that only a fraction of the charge remaining in a previously live cable can actually be ‘delivered’ as electric shock to the diver, it should be noted that the magnitude of this value is becoming more significant, due to ever-increasing electrical-power demands for subsea applications. This aspect is therefore of considerable importance to diver safety.

If it cannot be established that the use of topside earth-bond connectors removes this possible hazard to the diver (or lowers it to an agreed ‘safe’ level) then it may be necessary to apply an earth-bond connection at the subsea end of the cable, in addition to the topside earth-bond connection. This would ensure the residual charge stored within the subsea ‘end’ of the cable is also rendered harmless.

The attachment of this subsea earthing connection (where feasible), prior to commencement of actual cutting work, should be made to an appropriate earth-circuit within the parent structure. Connection to the cable termination should be via a proprietary connector, or specifically designed connection tooling, to ensure all possible hazards to the diver are reduced to a safe level.

Should there be any concerns as to the degree of insulation provided at the subsea termination connection point, then the calculation for safe distance (S) from an electrically live object (see section 5.2.2.1) should also be carried out as part of the intervention work pre-engineering.

IMCA D 044 69

Note: In certain circumstances it may not be possible to reduce the stored electrical charge in a cable to a safe level, therefore an alternative method to proceed with the work, without compromising the safety of the divers should be identified through the risk assessment process. This may require specialised intervention tooling, or an increased isolation envelope.

5.2.2.4.3 Adjacent Live Cable

Diver intervention activities may require work to take place adjacent to a main high-voltage electrical power cable which has not been isolated, such as a platform-to-platform feeder, or an offshore island National Grid supply inter-connector.

Whilst all preparations should be made during the project engineering stage to define fault-associated close-proximity working limits (minimum distance in metres for that cable (see section 5.2.2.1)), it remains a possibility that the cable route will deviate from ‘as-laid’ reference information. This may result (particularly in instances of poor visibility) in divers having to work much closer than specified, or even in actual contact with, the power cable.

Such circumstances may raise significant diver safety concerns. To address these, all work should to stop until a thorough assessment of the hazards involved is carried out by the project team, in conjunction with onshore management.

The recommended course of action is that the cable should be powered-down and isolated. This, however, may not be realistically possible, therefore an increased isolation envelope, or an alternative approach to the work may be required.

It should be noted that in some geographical areas there may be land-based regulations and precautions in place to ensure safe working practices are adhered to when working on, or near, live high-voltage buried cable. For similar work activity to be conducted by a diver in the subsea environment, the additional safety implications need to be carefully considered. For this reason, the parameters listed below, as a minimum, should be reviewed as part of the risk assessment process.

Type and design of be cable circuit-breaking/insulation monitoring equipment;

Voltage transmission levels;

Amperage value and type (AC or DC);

Fault-condition minimum seawater safe distance:

[1 + {(Io x 10-4)/Ib}]1/2 -1 (see previous example);

Age of power cable;

Present observed condition of power cable;

Environmental conditions surrounding the cable – e.g. drilling mud (possibility of chemical break-down of cable outer sheath and insulation), cable laid on rocky seabed (possible abrasion damage) or cable buried (condition unknown);

Visibility limitations for diver close-up work, adjacent to the cable;

Types of tools and equipment to be used by diver;

Restrictions for diver access and egress around the cable worksite;

Implications of powering-down the cable;

Alternative (approaches) for the adjacent, or associated, works.

70 IMCA D 044

Technical advice should be sought from both the owners and the party responsible for the operation of the cable to obtain accurate information for certain of the above data.

5.2.2.5 Labels and Identification Tags

In any work requiring diver approach to an electrical component, it is of fundamental importance that a thorough and recorded survey of the associated cable/connector identification labels (located at each end of the assembly) is carried out. This visual check should be performed prior to any intervention work commencing. Labels should be found to match with the labelling/tagging on the component at one end, and the interface connection point at the other end. In the event that a discrepancy is identified, then the work should stop until the matter is unambiguously resolved by diving supervisory personnel and the project engineering team.

Note: Lack of accurate ‘as-built’ data, missing identification labels and increasingly congested subsea worksites have resulted in recorded instances of diving intervention work about to commence at the incorrect subsea location.

5.2.3 Optical System Interventions

The use of optical (laser) power and data transmission via fibre-optic link is a suitable means for conveying signals to/from subsea optical communication modules and associated instrumentation. The method of transmission utilises laser light at high intensity levels, thus requiring specific diver safety measures in any intervention work (see section 8).

Typical subsea components which distribute or, transmit/receive optical energy and which may require diver intervention are listed in Table 4 below. Due to constant developments in subsea control technology this list should not be taken as being definitive.

Umbilical termination

Subsea control module

Subsea control module mounting base

Pressure monitor

Temperature monitor

Flow monitor

Down-hole pressure and temperature monitor

Instrumentation jumper assembly

Data-transmission jumper assembly

Table 4 – Subsea components with optical elements

The intervention requirements for subsea optical couplers fitted on such items as umbilical end terminations, control modules, sensors and individual optical jumper cable assemblies are similar, in practical handling terms, to those required for electrical connectors/couplers and cables. Thus the recommended guidelines given in sections 5.2.2.3, 5.2.2.4, and 5.2.2.5 may be applied in general terms, with the additional specific requirements, as given below.

5.2.3.1 Optical Couplers

Ensure the topside optical processor is electrically powered-down and isolated before making any connections, or disconnections.

Optical couplers are fitted with an automatic mechanism for self-protecting the optical surfaces during any disconnection/re-connection operation. This mechanism should not be manually checked or actuated by a diver as this will reveal the communication surfaces to seawater and foreign matter. Any possibility that the mechanism is suspect or thought to be faulty requires recovery of the whole part to DSV deck.

IMCA D 044 71

Any proprietary outer protective covers, for fitting to disconnected couplers, should:

i) always be fitted on any de-mated coupler (applicable to both fixed and free halves);

ii) only be removed just prior to mating-up of a coupler;

iii) be fitted immediately following the de-mating of a coupler.

The coupler free-half should never be held, lifted or dragged by the cable harness, and should not be laid down on the seabed, unless fitted with an additional protective cover.

5.2.3.2 Fibre Optic Cables

Extreme care should be taken to ensure all handling and final installation radii are never less than the specified fibre-optic cable-assembly minimum bend radius.

5.2.4 Hydraulic and Instrumentation System Interventions

Subsea control and umbilical systems which utilise hydraulic fluid as the medium for motive power rely on a matrix of inter-connecting hoses to link between the main supply umbilical and the final end-component, such as a valve. The hydraulic fluid is invariably at a very high pressure relative to ambient, therefore any intervention requires a properly engineered approach to ensure diver safety as well as maintaining the pressure integrity of the system.

Note: Whilst chemical injection lines in a subsea system are of similar size and pressure ratings as hydraulic control lines, their operation is specified under pipeline requirements. Appropriate diver intervention guidelines are therefore given within section 4 – although, for all practical purposes, much of the methodology given here may be applied, subject to assessment of the specific risks involved.

The instrumentation components of a subsea system, whether intrusively connected into the bulk system or externally attached, require a similarly engineered approach for diver safety and system integrity as for hydraulic system(s). This is primarily on account of the fact that the process connection interface on many subsea devices is high-pressure retaining. In addition, subsea control system instrumentation requires similar intervention precautions as are recommended for electrical isolations.

The diver intervention guidelines for both hydraulic lines and instrumentation connections are given in sections 5.2.4.1 and 5.2.4.2, below.

5.2.4.1 Hydraulic

Subsea hydraulic control fluid, being conveyed and utilised at significantly higher than ambient pressure and over relatively long distances, requires that intervention methods should not compromise diver safety, or affect system integrity. Such methods and practices should therefore take into account the significant pressure-retaining properties of umbilical cores, jumper hoses, accumulator banks, and spring-return hydraulic valve actuators.

Typical subsea hydraulic system operational pressure values are: 207bar (3,000psi), 345bar (5,000psi), 517bar (7,500psi), 690bar (10,000psi) and 1,040bar (15,000psi). Selected value depends on a combination of parameters, such as: field reservoir pressure, flowline-pressure, end-device (actuator break-out forces), step-out distance, and water-depth.

Subsea system components may be categorised as being connected ‘directly’ or ‘indirectly’ to a pressurised hydraulic supply system. Examples of this are given in Table 5 below. Note that components ‘indirectly’ connected will be subjected to the system maximum operating pressure when activated, hence the same intervention principles should apply to both categories.

72 IMCA D 044

Direct Connection to Hydraulic Pressure (Input)

Indirect Connection to Hydraulic Pressure (Output)

Umbilical core Output hose and coupler assembly

Supply hose and coupler assembly Manifold valve actuator

Subsea umbilical termination assembly Tree valve actuator

Subsea accumulator module Down-hole safety valve

Subsea hydraulic distribution panel Down-hole flow control valve

Subsea control module mounting base Chemical injection (metering) valve

Subsea control module Subsea control module (internals)

Pipeline subsea safety isolation valve Choke actuator

- In-line hydraulic pressure intensifier

Table 5 – Hydraulic system connection categories for subsea components

The above-listed subsea hydraulic system components may become inoperative at any stage in the life of a subsea development on account of leakages in the supply circuit(s) or actual hardware component failure. Intervention work to carry out removal/replacement of any such component should be preceded by the preparation of management-approved procedures.

These detailed work procedures may incorporate vendor-specific instructions, however, the common activities of safely disconnecting and reinstating pressurised hydraulic supply lines should be carried out in accordance with the applicable recommendations given in these guidelines.

Following the re-connection, or installation from new, of single-jumper hose lines, or multiple-hose assemblies, the applicable interface(s) should be fully leak-tested to ensure system integrity. Typical leak-testing methods and requirements are outlined in section 5.2.4.1.1 below.

Depending on various criteria, the subsea isolation and/or vent facilities which exist local to the end-connection point for a hose (or panel tubing) may vary from a double block and bleed valve assembly, to no isolation components whatsoever. Additionally, the intervention may be further complicated by the self-sealing properties (or otherwise) of the couplings fitted to the hose-ends. The various subsea isolation hardware components and their suitability for isolation/vent purposes are outlined in section 5.2.4.1.2 and 5.2.4.1.3.

5.2.4.1.1 Hose Leak-Testing

On completion of the subsea installation and hook-up of any item of hose or tubing, the inter-connected system should be leak-tested. This testing and confirmation of system integrity may take place from either the DSV, or the topside installation, depending on available equipment access points and overall project schedule requirements. The testing procedures are virtually identical, however, for reference, both are outlined in this section.

Care should always be taken, irrespective of pumping source, hose or tube type, services conveyed, or other criteria, to ensure that any test factor(s) applied during leak-testing do not exceed18 1.1 x DWP, following installation and hook-up subsea.

18 ISO 13628-5 Subsea Umbilicals

IMCA D 044 73

Note: The age of any previously installed umbilical lines which are both integral and essential to any test boundaries may limit test criteria. It is therefore important to consult with the original umbilical manufacturer to establish, and agree, any age-related pressure-test limits which should be applied.

5.2.4.1.1.1 From DSV

This test should utilise the DSV test downline (filled with a compatible test fluid) by connecting into the vent port of a suitable valve assembly in the existing architecture. To simplify the test programme, any previously existing block valves which are suitably located at either end of the new section under test should be closed.

The DSV test should be conducted at a pressure not exceeding18 1.1 design working pressure (DWP) for both hydraulic and chemical injection systems. The system under test should be pressurised at a controlled rate to the permitted maximum pressure, followed by an appropriate stabilisation period. On completion of stabilisation, the specified test ‘hold’ pressure is to be locked-in and charted. The resultant plot should indicate no evidence of leakage or failure over a 15 minute (minimum) test period, for a successful test19. Any failure to maintain test ‘hold’ pressure (extendable in 15 minute increments to an overall maximum of 60 minutes) should be considered as an unsuccessful test, requiring system depressurisation and further intervention/re-test work. (See Figure 7 and Figure 8 for typical pressure versus time test-profiles.)

The topside MCS (in conjunction with the HPU) and the chemical injection control systems should be utilised, if available, to confirm tests by monitoring and recording trends on appropriate system pressure sensors.

5.2.4.1.1.2 From Topside

In the event that the project work schedule precludes the use of the DSV for the testing programme, or in the absence of any suitable (local) access and isolation valves in the subsea architecture, then the leak test will require to be conducted from a topside pumping source.

This pumping source may be obtained from independent test equipment, or from the permanently-installed system(s). It should be noted that test criteria may be affected by the selected pumping source (e.g. pumps in existing chemical injection skid may not be capable of delivering 1.1x DWP to subsea).

Generally, the topside test should be conducted at pressures not exceeding20 1.1 DWP for the hydraulic system, and 1.0x DWP for the chemical injection system. The system under test should be pressurised at a controlled rate to the permitted maximum pressure, followed by an appropriate stabilisation period. On completion of stabilisation, the specified test ‘hold’ pressure is to be locked-in and charted. The resultant plot should indicate no evidence of leakage or failure over a 15 minute

19 1. Volumetric expansion in recently manufactured and installed umbilical lines may result in a slight initial pressure-decay being evidenced

in the test-plot. This decay should be marginal, tending to zero towards the latter part of the test ‘hold’ period. 2. Hydraulic hose-leakage testing which, in certain instances (on account of subsea system architecture, or installation schedule)

incorporates an SCM may be subject to some pre-determined leakage-rate due to in-line directional control valves (within the SCM). These leakage-rates should be obtained from the SCM supplier during the engineering phase of a project such that these values are factored-in to test-result acceptance criteria in advance of the project offshore phase. [A typical allowable pressure-decay for hose-testing, incorporating an SCM, may be in the region of 1.25% x test pressure, over the minimum 15 minute test ‘hold’ period.]

20 ISO 13628-5 Subsea Umbilicals

74 IMCA D 044

(minimum) test period, for a successful test21. Any failure to maintain test ‘hold’ pressure (extendable in 15 minute increments to an overall maximum of 60 minutes) should be considered as an unsuccessful test, requiring system depressurisation and further intervention/re-test work. (see Figure 7 and Figure 8 for typical pressure versus time test-profiles.)

The topside MCS (in conjunction with the HPU) and the chemical injection control systems should be utilised, if available, to confirm the tests by monitoring and recording trends on appropriate pressure sensors.

ISO 13628-5 recommends, at section 15.20 ‘Post-Hook-up Test’, paragraph (c) ‘hydraulics’; ‘The test pressure for the post hook-up hydraulic tests shall be 1.0 x DWP for control lines, and 1.1 x DWP for chemical lines’. Wherever possible, the ISO 13628-5 recommended test values should be adhered to, however, the test values given in both sections 5.2.4.1.1.1 and 5.2.4.1.1.2 of these guidelines are noted to differ slightly. This is to account for – and accommodate – variations in project-specific test regime requirements which may occur across vendor/contractor/operator interfaces. These are often due to anomalies and practical limitations within the subsea control, or chemical injection systems – especially when connecting-in to an existing infra-structure.

5.2.4.1.2 Valves

5.2.4.1.2.1 Double Block and Bleed Valve (DBB)

This is the optimum isolation and vent arrangement (see sections 5.1.4.1.2.1, 5.1.4.2.2.1 and 5.1.4.2.2.1.2), enabling safe local intervention for depressurising and removing the requisite inter-connecting hose.

To avoid a potentially hazardous ‘jet-effect’ flow at the DBB vent port due to release of the pressurised fluid, a suitable fitting complete with a length of bleed-line should be connected into the vent port. This line should be tied-off at some suitable distance away from the worksite, with a suitable ‘whip-check’ restraint, to a structural strong-point. The vent valve should be kept open throughout the operation of removing (or re-installing) the hydraulic hose.

5.2.4.1.2.2 Single-Block and Bleed Valve (SBB)

As a minimum, a single block valve in conjunction with a downstream bleed valve should be integral to the confirmation prior to commencing any intrusive work to remove or re-install a hydraulic line. It is important to check, for the SBB arrangement in particular, that the bleed valve vent port is fitted with a ‘diver-safe’ type pressure-relief cap (see Figure 2).

Note: Should any other type of cap be fitted the increased potential hazard to diver safety will require to be specifically assessed22, with a view to either, amending the intervention procedure or, obtaining an increased isolation envelope.

21 1. Volumetric expansion in recently manufactured and installed umbilical lines may result in a slight initial pressure-decay being evidenced

in the test-plot. This decay should be marginal, tending to zero towards the latter part of the test ‘hold’ period. 2. Hydraulic hose-leakage testing which, in certain instances (on account of subsea system architecture, or installation schedule)

incorporates an SCM may be subject to some pre-determined leakage-rate due to in-line directional control valves (within the SCM). These leakage-rates should be obtained from the SCM supplier during the engineering phase of a project such that these values are factored-in to test-result acceptance criteria in advance of the project offshore phase. [A typical allowable pressure-decay for hose-testing, incorporating an SCM, may be in the region of 1.25% x test pressure, over the minimum 15 minute test ‘hold’ period.]

22 Aspects which should be considered in the risk assessment are: fluid operational pressure; seabed ambient pressure; volume expected to be released; type of fluid; anticipated vented-flow direction (i.e. review diver access and safe egress routes); fluid dispersal is into large energy-absorbing mass; history, design, and reliability of the given isolation valve; ability of HPU to provide necessary test pressure.

IMCA D 044 75

Further, for this to be an appropriate form of isolation and vent, the hose to be disconnected should be fitted with the self-sealing design of diver-mateable coupling. This provides the second isolation during disconnection (see sections 5.1.4.1.2.4, 5.1.4.2.2.1.3 and 5.2.4.1.3.1). No other design of coupling/connector should be utilised in this configuration, hence full technical details regarding this aspect of the work should be thoroughly checked in the project preparation phase.

In the event that the block valve should become ineffective as an isolation then the released fluid should be free to escape through the open vent. For the SBB, it is therefore an important requirement that the vent valve is kept open throughout the operation of removing (or re-installing) the hydraulic hose. Note that the condition and sealing capability of the fixed-half of the self-sealing coupling arrangement can not be determined (or tested) in any way, whilst in-situ connected up. Thus it does not become fully effective as an isolation until the free-half has become sufficiently un-mated to allow the seal to form.

As with 5.2.4.1.2.1 above, a length of bleed-line should be fitted to the SBB valve vent port and ‘whip-checked’ in place at some suitable distance, as a safety measure.

5.2.4.1.2.3 Single Block Valve

There are many installed subsea hydraulic systems for which the only available isolations relevant to a hose (or length of tubing), requiring to be removed or re-installed, are single in-line block valves at either end with no built-in bleed facility. This does not meet the stated isolation principle ‘two isolations – with one tested – in the direction of flow’, whereby a valve-controlled de-pressurisation could be carried out.

The above limitation does not necessarily determine that the work cannot be carried out. Instead, the practicalities and limitations of the work should be subjected to a task-specific risk assessment22 such that the adaptation of normal diver-intervention techniques may be considered. For example, it may be possible to implement a local depressurisation by closing the in-line valve isolation and then carefully slackening an appropriate fixed downstream system connection (e.g. ‘cracking’ a tube fitting on the inside face of a panel), thus venting internal pressure in a safe and controlled manner. The single block valve should then be immediately proven ‘good’ as an effective isolation by topside application of in-line test pressure.

Note: The recommended maximum permitted separation between the valve and the workface for this technique should be limited to 25 metres line length.

5.2.4.1.2.4 No Block Valve

In the absence of any ‘local’ isolation valve specific to the subsea work (i.e. located at a distance greater than 25 metres from the fitting), isolation and vent-down should be implemented from the topside HPU, for the complete system.

5.2.4.1.2.5 Non-Return (or Check) Valve

The non-return valve (or in-line check valve) is incorporated in a hydraulic system to automatically prevent unwanted internal back-flow of control-fluid above a certain design pressure value. They are generally fabricated in a wholly enclosed assembly without any access for manually setting or confirming the status of the internal obturator. As such, they are not normally intended for use as a tangible isolation for the purposes of diver intervention.

76 IMCA D 044

Exceptionally, however, the non-return valve may require to be incorporated as part of a preliminary isolation scheme. In such instances the isolation properties of the device should be proven by way of conducting both flow, and in-line leak-off tests. To conduct these tests, diver intervention (or ROV observation) should be on-site to confirm flow/no-flow of control-fluid at the relevant valve vent-port. Also, the closed status of the valve should be maintained throughout the work, and the valve is only to be utilised as an isolation in conjunction with another proven valve in the isolation scheme.

5.2.4.1.2.6 Electro-Hydraulic Solenoid Valve in SCM (controlling Output Function Line)

Depressurisation of an SCM individual output-function hydraulic hose (by the MCS commanding the bulk system valve to its closed position) is intended, by design, to vent the given hydraulic line through an electro-hydraulic solenoid valve to some vendor-defined nominal value above seabed ambient. Irrespective of whether the SCM is fitted with line-pressure sensors (input only, or input and output), this ‘isolation’ technique alone, should not be considered to be totally reliable for diver intervention purposes. Additional checks should be carried out, as given in sections 5.1.4.2.1 and 5.1.4.2.2.1.1. This is due to the fact that a blockage may exist in either the output function line, or the return/vent-line. Alternatively, an MCS-SCM system malfunction (see Note below) may be ‘masking’ the effectiveness of the topside valve command. Therefore the hydraulic control line should be assumed to be fully pressurised, until conclusively proven otherwise.

Note: Examples of hydraulic system malfunction are:

Main hydraulic supply circuit solenoid valve(s) (internal to SCM) may be faulty.

Output hydraulic function line solenoid valve (internal to SCM) may be faulty.

Input and/or output function line hydraulic pressure sensing monitor(s) (internal to SCM) if available, may be faulty.

Stepping actuators in the end-device (e.g. choke valve) may be faulty, thus not allowing the SCM output line to de-pressurise.

Topside/subsea communications to/from the SEM may be faulty.

DC power supply within SEM (supplying function-line solenoid valves) may be faulty.

5.2.4.1.3 Couplings

5.2.4.1.3.1 Self-Sealing Diver Coupling

Hydraulic hoses which are intended for individual installation or removal by a diver at the subsea location will normally be fitted with self-sealing ‘diver-mateable’ couplings. These fittings are designed, in principle, to be installed and removed without the requirement to isolate and fully vent-down the conveyed hydraulic pressure. They also assist in minimising contamination of the hydraulic fluid resulting from any seawater ingress, during connect/ disconnect operations.

These couplings may be mated/de-mated (with considerable effort) whilst both halves are still under full system hydraulic pressure, to a typical design-maximum value of 345 bar. For practical reasons, however, the de facto maximum value, as adopted by the subsea industry for this operation, has been set at 70 bar (1,000psi) (see section 5.1.4.1.2.4.

IMCA D 044 77

It is further recommended that the system pressure be locally isolated and vented, on the intervention side of an isolation, to some nominal value above seabed ambient (see sections 5.1.4.1.2.4 and 5.1.4.2.2.1. In specific instances, where it is not possible to obtain a ‘local’ isolation (i.e. located at a distance greater than 25 metres from the fitting, the pressure in the line to be disconnected/re-connected should be isolated, vented and monitored at some other suitable location in the system. These precautions are to take account of the fact that, if not depressurised, there may exist the following potential hazards: during de-mating, any coupler sealing faces which may have become pitted will permit an un-controlled high flow of pressurised fluid, with the potential for premature and violent release of the ‘free’ half; and during mating, coupler sealing surfaces may become unseated prior to adequate thread engagement, resulting in advanced venting of the pressurised fluid, with the potential for the ‘free’ half to ‘blow-off’ in an unpredictable manner.

Suitable ‘whip-check’ restraints should always be fitted on either side of the intended line/hose separation to minimise any uncontrolled movement during release of the free coupler half.

Hydraulic couplings should always be deployed/recovered with their vendor-supplied protective caps fitted. Note that such protective caps should incorporate a small through-hole in the end of the item. This is to enable ease of removal at the subsea worksite, or, vice-versa, safe removal on-deck/onshore (i.e. to allow for pressure-equalisation on deployment to subsea, or recovery to surface).

5.2.4.1.3.2 Vented Diver-Coupling

In certain instances, and to comply with ISO 13628-4 ‘Subsea Wellhead and Tree Equipment’ (at paragraph 6.20.2.7), hydraulic jumper hoses which are inter-connected over a considerable distance (e.g. greater than 100 m) may be assembled with a form of integral ‘weak-link’. This consists of vendor-modified self-sealing couplers which, in the event of an unplanned disconnection, are designed to allow the hydraulic pressure to locally vent-off, thus permitting autonomous valve-closure. Vented couplers may also be installed in certain types of ‘active’ SCMMBs.

This design of coupler will not self-seal on de-mating, therefore, at lines pressures greater than 10 bar above seabed ambient, it is considered hazardous for uncoupling by divers.

Thorough checking during the onshore engineering phase of a project is therefore recommended to determine whether such couplers have been incorporated in the subsea control system architecture.

Worksite precautions should be taken to ensure the hydraulic pressure is vented in a safe and controlled manner, prior to performing any hose disconnection/re-connection interventions (see Note below).

Note: It is normal (and preferred) practice that hydraulic jumper/umbilical hose assemblies are delivered for DSV-deployment with a factory pre-charge pressure of 70 bar (1,000 psi). The retention of such pressure in an assembly which utilises vented-couplers would not be possible without incorporating some type of additional sealing cap. The subsequent removal of these caps (e.g. at the subsea worksite), however, would present a serious pressure-release hazard to diving personnel when preparing to make up system inter-connections. It is therefore recommended that temporary block and bleed valve facilities are pre-fitted to the hose/ umbilical end-couplers at the factory, prior to locking-in the pre-charge pressure. These temporary valves should remain in place until the

78 IMCA D 044

entrapped pressure is released, in a safe and controlled manner, prior to make-up of the required final connections.

5.2.4.1.3.3 Pressure-Balanced Coupling

These self-sealing couplings can be mated and de-mated with reduced force at full line pressure. These tend to be utilised in multiple connector stab-plates, see 5.2.4.1.3.5. For individual hose disconnect/re-connect work, the same diver intervention principles as for 5.2.4.1.3.1 above apply.

5.2.4.1.3.4 Non-Diver Type Coupling

Generally, any subsea systems which are pre-assembled into the bulk structure during onshore construction (such as chemical injection tubing, instrument tubing heads, valve hydraulic tubing and back-of panel tubing-runs) are not intended for diver intervention. They are therefore assembled and interconnected, with hoses or tubing, terminated with conventional small-bore threaded tubing fittings. These are of unrestricted through-bore design, having no in-built self-sealing mechanism for disconnection purposes.

It is not normal to have any such connections dismantled or re-assembled by a diver, however, when required to do so, suitable isolation and vent points in the system should be implemented and tested, in compliance with the recommendations given in these guidelines.

In the absence of any such facilities, then the hazard(s) involved should be risk-assessed and consideration given to isolating and venting larger section(s) of the tubing system. This may require the entire system to be vented-down from the topside pressure-supply source.

Note: Extreme care is required when assembling (or dismantling) ‘small-size’ stainless steel tube fittings in the subsea environment in order to prevent thread-damage or the possibility of entrapping any foreign materials.

5.2.4.1.3.5 Stab-Plate Mounted Couplings

The mechanical engagement/disengagement method employed between multiple-coupler stab-plate halves is of robust design, consisting of distinctly separate moving parts to that of the actual (self-sealing) couplers. This mechanism normally provides sufficient mechanical force and effort to enable plate mate/de-mate operations to take place at full system operating pressure. The individual coupler-halves become separated (or re-engaged) whilst both halves of the stab-plate assembly continue to remain mechanically connected, hence this combination is considered to be safe for live intervention by a diver (see Note below).

For the purposes of significantly assisting in stab-plate de-coupling/re-coupling operations (or subsequent extensive re-positioning/re-locating of the overall hose-jumper assembly), it is recommended that, where possible, the various line pressures are isolated and vented-down. In principle, therefore, the same basic intervention guidelines for individual hoses and coupler assemblies should be applied to multiple-coupler stab-plates.

During the ‘backing-off’ process, the ‘free’ mating-half of the stab-plate should be prepared with ‘whip-check’ restraints. This is to account for any possible sudden mechanical forces which may occur due to the release of high-pressure venting fluid as the plate/hose combination gradually separates from the fixed-half. In the absence of such precautions this release of energy may have the potential to cause diver injury (or coupler damage).

IMCA D 044 79

Re-installing and tightening-down of the free-half to the fixed-half should also be carried out gradually to enable the individual free-floating couplers to correctly align with each other. With both halves of the stab-plates brought close together, correct mating of couplers can be expected when the plate separation gap is equidistant and within manufacturer-defined tolerance.

Note: Specific details regarding the capability of the mechanical clamping arrangement, and that of the coupler-halves within the plate assemblies, to withstand mating/de-mating operation(s) under full system operating pressure, should be checked and confirmed with the original equipment manufacturer at an early stage in the onshore engineering phase of the project.

5.2.4.2 Instrumentation

The requirement to remove, or reinstall, subsea instrumentation components constitutes one of the frequently encountered reasons for which diver intervention takes place on bulk systems (i.e. flowlines, manifolds or trees) containing pressurised and flowing hazardous products. This section of the guidelines addresses the safe intervention requirements and precautions, applicable to subsea instrumentation.

Subsea instruments are typically required to measure the parameters such as pressure, temperature, flow, corrosion, etc. For subsea intervention purposes, their method of interface with the bulk system is generally defined in one or other of two main categories, either ‘intrusive’, or ‘external’. Devices, and their assigned category, are listed in Table 6, below.

Intrusive Device (Measuring interface of the device being a penetration into the actual medium being measured)

External Device (Measuring interface of the device being non-intrusively mounted outwith the bulk system containment)

Pressure sensor (Normally mounted on DBB valve block, or similar)

Valve position sensor

Temperature sensor (Note: See Note in 5.2.4.2.1.1)

Multi-phase flow meter (Gamma radiation type)

Combined temperature and pressure sensor (Not normally mounted on instrument valve block – interfaces directly with medium)

Choke-position sensor

Single-phase flow meter (Venturi type) (Normally mounted on instrument valve manifold)

-

Corrosion monitor (Normally integral to dedicated spool in the bulk-system)

-

Erosion (sand) monitor (Normally interfaces directly with medium)

-

Oil-in-water monitor (Normally mounted on a dedicated isolation valve-block manifold)

-

Table 6 – Subsea instrumentation types and categories

The two given fundamental categories of instrument type require different diver intervention methods. These are outlined below.

80 IMCA D 044

5.2.4.2.1 Intrusive-Type Instrument Intervention

5.2.4.2.1.1 Removal

Intervention to remove an ‘Intrusive-type’ device requires the component to be physically isolated from the presence of direct pressure or flow and electrically isolated from its source of power and ‘intelligence’ (typically an SCM). ‘Hydraulic’ and ‘electrical’ isolation principles will therefore apply.

The isolation methods to enable physical detachment of the instrument from the bulk system hardware are as given in section 5.1.4, whilst the isolation methods to ensure electrical disconnection from the subsea control system are as given in section 5.1.2.

The specifications for instruments which intrude into the pressure or flow of the bulk process-containing subsea system should equal (or exceed) that systems design-parameters and safety-factors.

They should also be capable of being entirely removed without compromising the integrity of the bulk system. This is normally achieved through diver-operated isolation valves, located between the instrument and the bulk system, i.e. typically a double block and bleed valve assembly (see Figure 12). Alternatively, it may be necessary to obtain the required isolation(s) through the closure of relevant bulk system valves (see section 4).

The given isolation valves should therefore be aligned as specified by the work procedure, such that management-approved isolation and integrity-testing requirements, for the breaking of containment, are achieved.

Throughout the various stages of defining, implementing and subsequently proving these isolations, project and diving supervisory personnel should consider the possibility for cavity blockages to have formed (e.g. due to asphaltene or hydrates). Captive positive pressure may therefore exist in the voids between block valves, plugs and other small bore fittings, even after the relevant section of bulk system has been depressurised. Alternatively, there is the possibility for lower-than-ambient pressure to be locked-in to these voids. The potential hazard to diving personnel from the presence of any such negative pressure should be considered as it may, in some instances, be of greater hazard than that due to positive pressure.

At all times, divers should therefore be made aware that when equalising any local internal inventory pressure to ambient (e.g. through an instrument fitting) there may exist a pressure differential which will result in a rapid flow, either in, or out, via the vent port. Typically, the vent port should be fitted with a ‘diver-safe’ integral-vent type plug or cap, which will permit safe equalisation of any initial pressure differential for small voids, before removing the entire plug/cap.

When a local inventory of liquid-flow under pressure is expected to be released (in a controlled manner) from the vent port of a double block and bleed valve then the diver should not be positioned directly in line with the vent aperture when removing the vent port plug/cap, or whilst operating the valve handle. It is also recommended that the vent port is fitted with a proprietary diffuser or a suitable pressure-fitting which is capable of interfacing securely with a bleed-line, prior to opening the bleed valve.

Note: In the case of utilising a bleed-line, it should be routed some distance away from the diver and diving-bell vicinity and should be tied-off along its length to adequate strong-points with ‘whip-check’ restraints.

IMCA D 044 81

Following the implementation of necessary electrical isolations, divers should disconnect the coupler/connector cable assembly (at the instrument or SCM, as appropriate) and immediately protect exposed connector faces.

On completion of the successful and proven implementation of both bulk system and electrical system isolations, removal of the device may then be conducted according to project procedure(s), together with any vendor-specific ‘device-handling instructions’.

Note: When intervention work to remove an intrusive device lacks a double block and bleed type isolation facility, or an intended isolation through an existing double block and bleed valve cannot be established, then additional risk-reducing measures, or an increased isolation envelope, should be applied (see Figure 17). These additional requirements should be identified through assessment of the specific potential hazards involved.

Note: Probe-type temperature sensing instrument. Whilst this instrument is categorised as an ‘intrusive device’, it is not actually designed to interface directly with the bulk product being measured. Instead, the instrument is mounted within a thermowell23, which is a flange-mounted sealed tube (or ‘pocket’), integral to the pressure containment wall of the bulk system. The instrument may therefore appear to be capable of being withdrawn from this sealed tube without any resultant loss of system containment, however, this cannot be guaranteed.

This is due to the fact that the ‘isolation’ of a probe-type temperature sensor (in terms of safe separation from the bulk system pressure), is entirely dependent on the integrity of the thermowell tubing. This cannot be established or proven, due to the inability to incorporate double-isolation valving in the attachment ‘head’ of the temperature sensor. It is therefore not feasible to safely conduct recommended pre-intervention isolation tests.

Thus, when a temperature sensor is reported (via the subsea control system) as faulty, such that subsea intervention is required, then failure of the actual thermowell (e.g. due to erosion, cavitation or corrosion) should be considered as one possibility for the fault occurring. Consequently, it is possible that the temperature probe itself may have incurred similar damage. Bulk-system pressure/flow may therefore be impinging directly behind the fixing collar of the temperature probe. Removal of the probe, or any integral ‘vent’ plug located in the mounting head/collar (even by a gradual slackening process), may result in an uncontrollable loss of bulk-system containment.

Intervention work by a diver on a probe-type temperature sensor therefore requires to be classified within the category ‘intrusive device’. Sensor removal is only to be carried out after the equalisation of applicable bulk-system retained pressure (to seabed ambient), through the implementation of tested isolations, in accordance with the principles and recommendations set out in these guidelines.

In the absence of any means to implement such isolations, then the additional potential hazards arising should be specifically assessed with a view to either proposing an appropriate alternative isolation scheme, or, identifying an increased isolation envelope.

23 The thermowell for a temperature sensor protects the instrument measuring probe from physical wear or damage, due to any abrasive reservoir product being carried in the bulk-system flow. It is not designed to provide a guaranteed isolation from pressure/flow for the purpose of safe diver intervention.

82 IMCA D 044

5.2.4.2.1.2 Installation

The subsea installation of an intrusive-type instrumentation device should follow a safe and logical reversal of the isolation and removal process. In addition, the device-to-bulk-system flange sealing faces should be leak-tested to confirm that pressure-retaining integrity has been fully reinstated.

This should be conducted via connection of a DSV test downline to the vent port of the device double block and bleed, or depending on the instrument design/duty, through a test-access port in the device itself. Alternatively, a suitable intervention point in the bulk system header may require to be utilised. The flange should be subjected to a recorded pressure-test of value not exceeding 1.1x MAOP (or 1.1x any permanently reduced MAOP) of the bulk system to which the device has been attached. It should also be noted that any such test-pressure value should not exceed the test capability of the lowest pressure-rated component in the bulk system (e.g. the instrument device itself).

The system under test should be pressurised at a controlled rate to the permitted maximum pressure, followed by an appropriate stabilisation period. On completion of stabilisation, the specified test ‘hold’ pressure is to be locked-in and charted. The resultant plot should indicate minimal-to-zero evidence of leakage or failure over a 15 minute (minimum) test period, for a successful test. Any failure to maintain test ‘hold’ pressure (extendable in 15 minute increments to an overall maximum of 60 minutes) should be considered as an unsuccessful test, requiring system depressurisation and further intervention/re-test work (see Figure 7 and Figure 8 for typical pressure v time test-profiles).

5.2.4.2.2 Non-Intrusive (External)-Type Instrument Intervention

Intervention for an ‘external–type’ device requires application of the ‘electrical’ isolation principles only, as no part of the component is in contact with the pressure/flow contents of the bulk system. Instead, the sensor data is gathered by external ‘through-wall’ techniques.

For such devices, the isolation methods to enable diver intervention and thus physical detachment of the instrument from the bulk hardware item (e.g. flowline, manifold or tree) are restricted to the electrical disconnection of the instrument from the control system only.

The recommended preliminary and final electrical isolations should be applied, as specified in these guidelines, to ensure safe intervention in conjunction with component protection. On confirmation that all necessary isolations are in place, the coupler/connector cable assembly (at the instrument, or SCM as applicable) should be disconnected and all exposed connector faces should be immediately protected, thereafter.

Removal of the device from the bulk system may then be conducted according to the project procedure(s), together with any vendor-specific device handling instructions.

Guidelines for the re-installation of a non-intrusive device are similar, in principle, to those given for its removal, with the electrical de-isolation/sanction-to-test being the final operation, on completion of diver intervention.

5.2.4.3 Labels and Identification Tags

In any intervention work requiring diver approach to a hydraulic or instrumentation component, it is of fundamental importance that a thorough and recorded survey of the identification labels/tags associated with the applicable hose or instrument-cable is conducted, prior to any work commencing.

IMCA D 044 83

The labels, normally attached at each end of the hose/cable assembly, should be found to match with the similar labelling/tagging on the bulk hardware item to which they are attached. In the event that a discrepancy is identified, then the work should stop until the matter is resolved through further investigation by diving supervisory personnel, in conjunction with the project engineering team.

Note: Lack of accurate ‘as-built’ data, coupled with increasingly congested subsea worksites, has resulted in recorded instances of diving intervention work about to commence at incorrect subsea locations.

Note: Preliminary topside isolation should always be applied prior to disconnection of an instrumentation cable at the subsea worksite.

When applying hydraulic system isolations, and carrying out local subsea line vent-downs, divers should be aware of the following:

Isolation and bleed components on subsea control systems may remain inactive over extended periods of time. As a consequence, they may become stiff and difficult to operate. Excessive force should not be used.

At all times, divers should be aware of a potential pressure differential existing within an enclosed system, hence flow through a vent fitting may occur in either direction.

When a local inventory of liquid under pressure is expected to be released (in a controlled manner) from the vent port of a double block and bleed valve, then precautionary measures should be taken, such that the diver is not positioned directly in line with the vent aperture whilst operating the valve handle.

Bleeds and vents allow the safe depressurisation of parts of the subsea architecture when an isolation has been applied, and enable the integrity of the isolation to be checked. It should be noted that vents can become blocked (e.g. by a hydrate formation) leading to complications when proving ‘communication’, and establishing a bleed route.

It is essential that full details of the double block and bleed valve type, and configuration, are understood. This is to ensure correct alignment of the block valves and to check that the vent port facility is suitable for connecting a test downline (if required).

Check-valves should be incorporated in a test-downline if there is any possibility for hydrocarbon ‘returns’ to DSV deck24 be known to exist.

5.2.5 Mechanical System Interventions

The general intervention requirements for diver approach to the subsea control and umbilical system mechanical ‘isolation’ device-types of either a ‘guillotine’, or a ‘weak-link’ are given in section 5.1.5. Further specific intervention details should be sought from vendor documentation, prior to the offshore phase of a project. These devices, by design, are intended to remain passive until snagged by a large external mechanical force.

For all diver-intervention work intended to take place in the close vicinity of any such ‘isolation’ mechanism(s), it is essential that their armed/disarmed status is considered through a risk-assessment review process. This will assist in determining whether the device will require to be de-activated or, alternatively, topside isolations applied to those subsea control and umbilical system services which actually pass through the device. Diving personnel at the worksite should not be exposed to the potential hazards of either inadvertently causing the device to operate, or the sudden and uncontrolled release of energy from the services

24 Unless the DSV is certified to receive hydrocarbons directly from reservoir or pipeline.

84 IMCA D 044

passing though the device, in the event of it being operated (either accidentally, or due to a genuine snagging-type incident elsewhere along the umbilical/jumper system).

When the subsea work location is planned to be outwith the general vicinity of any such mechanical ‘isolation’ devices, then it is not considered essential to disarm the device (or apply any device-related isolations to the services passing through it).

The work of disconnecting and recovering an umbilical to DSV deck may require a mechanical ‘isolation’ device to be ‘disarmed’ (or entirely removed) by a diver. This will necessitate an ‘all-utilities’ isolation (including hose vent-down and electrical cable discharge) to be in place some time prior to any diver approaches. Such preparations (topside and subsea) require to be completed and confirmed before any physical pull-in loads are applied via the DSV, to recover the umbilical.

Similarly, in the event that a mechanical ‘isolation’ device has been activated, then a complete isolation of all services from topside (if not already in place automatically) should be applied before the commencement of any diver investigation, or intervention.

5.3 Installation and Retrieval of Subsea Components

5.3.1 General

The components of a subsea control and umbilical system invariably contain impact-sensitive and fragile equipment, hence they often require to be installed or retrieved as individual items. Additionally, their external connection interface points tend to contain small parts which may be accidentally damaged at any stage in their transit from factory to subsea installation. Such system components therefore require more careful handling than the larger bulk-system items in a subsea development, and rigorous integration-testing and commissioning, following the hook-up of inter-connecting hoses and cables.

Original equipment manufacturer (OEM) installation, recovery, commissioning and test procedures are therefore important reference documents in relation to any subsea control or umbilical system component which is to be installed or retrieved. These vendor-specific items should always be incorporated into the relevant offshore work procedure(s), as appropriate.

General guidelines regarding the installation or retrieval of typical subsea control or umbilical system components, which may be encountered within diver intervention work, are given in Table 7, section 5.3.2, below.

IMCA D 044 85

5.3.2 Subsea Control and Umbilical System Components – Installation and Retrieval

Component Installation Retrieval

1 Umbilical and subsea termination

a) Hydraulic/chemical injection coupler and electrical connector protection-caps should be fitted.

b) End termination cover, which provides primary protection for all coupler/connector faces, should be securely fitted.

c) Umbilical should be installed with a pre-charge (e.g. 70 bar (1,000 psi) maximum) to avoid potential for core damage during trans-spooling/installation, and to minimise the possibility of sea-water ingress through the hydraulic coupler, prior to connection at depth.

d) Umbilical parameters should be monitored, in accordance with OEM procedures, throughout entire installation programme.

a) Calculate residual pressure(s) and electric charge(s) expected to be retained, in hoses and cables, respectively, following the application of all isolations.

b) Ensure all necessary isolations have been implemented and proved.

c) Following disconnection, protective-caps for hydraulic/chemical injection couplers, and electrical connectors, should be fitted.

d) End termination cover which provides primary protection for all couplers/connector faces should be securely fitted.

2 Hydraulic/chemical injection hose and hose assemblies

a) Hoses should be supplied fluid pre-filled by OEM.

b) Ensure all protective-caps are in place.

c) Avoid laying-down of couplers/ stab-plates on the seabed or dragging on structure grating.

d) Avoid damaging identification tags. e) Avoid lifting hose(s) in manner which

excessively loads/bends hose(s) at their interface with the coupler(s)/stab-plate.

f) On completion of hose hook-up between subsea components, the integrity of the connections should be proven (see ‘Hose Leak-Testing’ guidelines, section 5.2.4.1.1).

a) Calculate residual pressure(s) expected to be retained, following application of isolations.

b) Ensure all necessary isolations have been implemented and proved.

c) Ensure all protective-caps are in place following un-coupling.

d) Avoid dragging on seabed or structure grating.

e) Avoid damaging identification tags. f) Avoid lifting hose(s) in manner which

excessively loads/bends hose(s) at coupler(s)/stab-plate.

86 IMCA D 044


3 Cable and cable assemblies

a) Ensure all protective-caps (short, or long-term) are in place.

b) Avoid laying-down of connectors on the seabed, or dragging on structure grating.

c) Avoid damaging identification tags. d) Avoid lifting cable(s) in manner

which excessively loads/bends cable(s) interface at connector.

e) On completion of cable hook-up between subsea components, the integrity of the connections should be proven according to either umbilical vendor, or subsea control system vendor procedures.

a) Calculate residual electric charge(s) expected to be retained, following application of isolations.

b) Ensure all necessary isolations have been implemented.

c) Ensure all protective-caps (short or long-term) are in place following disconnection.

d) Avoid laying-down of connectors on the seabed or dragging on structure grating.

e) Avoid damaging identification tags. f) Avoid lifting cable(s) in manner

which excessively loads/bends cable(s) interface at connector.

4 Subsea accumulator module

a) Conduct visual and (if required) specific vendor pre-deployment checks – paying particular attention to the required Pre-charge pressure values.

b) Ensure all valves are correctly aligned before deployment.

c) Do not subject subsea accumulator module (SAM) to any shock-loadings.

d) Ensure that subsea set-down point is as close as possible to final location.

e) On completion of hose hook-up to/from the SAM, the integrity of all new connections should be proven (see ‘Hose Leak-Testing’ guidelines, section 5.2.4.1.1.

a) Ensure all system and local isolations are in place, before disconnecting.

b) Accumulator module should be located in a ‘quarantine’ area on DSV deck, as several (or all) cylinders may continue to retain high pressure – regardless of the item being considered faulty.

IMCA D 044 87


5 Subsea control module

a) It is recommended that on-deck visual and vendor-defined pre-installation check procedures are conducted, before lift and deployment overboard.

b) Check that all protective-caps are easily removed and suitable for pressure equalisation at depth.

c) Do not subject subsea control module (SCM) to any shock-loadings.

d) SCM to be deployed to subsea location with either vendor-supplied rigging, lifting and running tooling, or in proprietary protection frame/cage.

e) The seabed should not be used as an interim (if required) subsea set-down location for the SCM (e.g. pre-install a small concrete mattress, or similar, on to which SCM may be placed).

f) SCM may have vendor-prescribed lowering velocities. These should be adhered to – allows internal pressure compensation system to operate properly.

g) Thoroughly examine hydraulic couplers and electrical connectors for any ingress of seabed foreign matter before connecting-up.

h) Venting of SCM output functions from topside (if possible) may assist in coupling together of stab-plate halves, if difficulty is being experienced in fully mating-up.

i) On completion of hook-up, all SCM inter-connecting jumpers (hoses and cables), will require to be leak-tested and commissioned according to OEM and client-approved procedures.

a) Set all relevant preliminary isolations for the SCM input supplies at valving in the subsea distribution assembly (or similar). When not available, such isolations (and associated vent-downs) should be implemented at the topside HPU.

b) Ensure all SCM output functions have been commanded ‘closed’ (thus vented) by MCS prior to preliminary electrical isolations being applied topsides.

c) Ensure that a preliminary topside physical isolation has been implemented for the SCM electrical supply circuit(s).

d) Isolate electrical and hydraulic input supplies locally subsea (where by design it is possible to do so), by disconnection of cables and hoses. Also, any associated Accumulators should be isolated, or vented.

e) On removal of all hydraulic and electrical couplers/connectors, ensure proprietary protective-caps are immediately re-fitted.

f) SCM to be recovered to DSV deck with either vendor-supplied rigging, lifting and running tooling, or in a proprietary protection frame/cage.

g) Any vendor-prescribed retrieval-to-surface velocity limitations for the SCM should be adhered to.

h) SCM to be located in a ‘quarantine’ area on DSV deck as high pressures may continue to be retained in certain internal components.

i) SCM to be onward-shipped in proprietary protection frame/cage.

88 IMCA D 044


6a) Pressure sensor/ combined pressure and temperature sensor/ internal flowmeter (i.e. ‘Intrusive’-type devices)

a) For sensor device pre-mounted on a valve-block assembly, ensure all valves/protective-caps/plugs are configured for pressure equalisation at depth.

b) Deploy sensor in proprietary protective housing.

c) Ensure signal connector has protective-cap fitted.

d) Do not lift sensor by cable. e) Avoid any contact with instrument

sensing face/probe/aperture during fit-up at location.

f) On completion of installation – and depending on which interface was ‘opened’ – the integrity of either, a) the flange faces between the instrument and the bulk system, or b) the flange faces between the instrument valve block and the bulk system, or c) the flange faces between the instrument housing and the instrument valve block, should be proven (see sections 4.1.3, 4.1.4, and section 5.2.4.2.1.2.

g) Ensure that all applicable manual valves are correctly aligned for the parameter to be measured – as detailed in OEM instructions – prior to diving personnel departing from the worksite.

h) The integrity of the device cable connections may only be ‘proven’, from topside, according to OEM commissioning procedures.

a) Ensure all necessary bulk-system isolation checks have been implemented and proven through either the sensor DBB (or similar) mounting valve-block assembly, or, through the main system valves.

b) Ensure suitable instrumentation signal isolations have been set via the SCM, prior to cable disconnection.

c) Avoid any contact with instrument sensing face/probe/aperture during removal at location.

d) Ensure signal connector has protective-cap fitted.

e) Do not lift sensor by cable harness. f) Recover sensor to surface in

protective housing. g) Potential Hazard – Be aware that

seabed ambient, or bulk-system operating pressure, may remain entrapped within the sensor housing/body when recovered to DSV deck.

IMCA D 044 89


6b) Temperature sensor (i.e. ‘intrusive’-type devices, cont’)

a) Ensure all necessary bulk-system pressure equalisation(s), and isolation-valve tests, have been completed.

b) Deploy sensor in proprietary protective housing. This is important for this device as both the probe, and the sensing element (in the tip) are easily damaged.


d) Do not lift sensor by cable harness. e) Ensure sensor tip does not get

damaged when being offered into the thermowell.

f) On completion of final fitment of device into the thermowell, conduct leak-test of sealing faces (where possible). Note: In many instances ‘flange’ leak-test capability may not be possible, thus the OEM procedures should provide instruction as to relevant alignment checks, torque-settings, etc., to confirm that the device is correctly seated and tightened into location.

g) Cable-connection integrity may only be ‘proven’ – from topside – through commissioning of the actual sensor in accordance with OEM procedures.

a) Ensure bulk-system vent-downs and valve isolations have been implemented and proven for the associated inventory.

b) Ensure instrument signal isolation has been set prior to cable disconnection.

c) Visually confirm details of device fitment to thermowell (e.g. flange-bolted, or collar-nut mounted), and any integral vent fitting(s). Note: Such a vent facility should not be utilised unless specifically detailed, through risk-assessment, in the project workscope procedure. In the event that thermowell failure has occurred, this vent plug/cap may be released under pressure, presenting a hazard to diving personnel, and a potential loss of bulk-system containment.

d) If practical, utilise a ‘whip-check’, or otherwise physically restrain the possible rapid movement of the sensor whilst slackening the mounting fitment(s).

e) Allow any residual differential pressure to equalise following initial slackening of mounting fitment(s).

f) Following removal, ensure device is installed in proprietary protective housing/tube, to minimise damage.

g) Ensure signal connector has protective-cap fitted.

h) Do not lift sensor by cable harness. i) Potential hazard – Be aware that

subsea ambient, or bulk-system operating pressure, may remain entrapped within the sensor housing/body when recovered to DSV deck.

7 Sand monitor/ clamp-on flow meter/valve position sensor/choke position sensor (i.e. ‘external’-type devices)

a) Deploy sensor in proprietary protective housing. This is especially important as sensor element is often exposed, prior to locating within subsea housing.

b) Ensure signal connector has protective-cap fitted.

c) Do not lift sensor by cable. d) Avoid any contact with instrument

sensing device, or interface, during fit-up at location.

e) Cable-connection integrity may only be ‘proven’ – from topside – through commissioning of the actual sensor in accordance with OEM procedure(s).

a) Ensure suitable instrumentation signal isolations have been set via the SCM, prior to cable disconnection.

b) Avoid any contact with instrument sensor element, or interface, during removal at location.


d) Do not lift sensor by cable harness. e) Recover sensor to surface in

protective housing.

Table 7 – Subsea control and umbilical system components – installation and retrieval

90 IMCA D 044

6 Isolation Flowchart and Isolations Summary Table

6.1 Isolation Flowchart for Subsea System

Figure 17 – Isolation flowchart for subsea system

Requirement for

isolation

Is a unique,or non-routine

isolationrequired?

Select isolationmethod

Install isolation, orapply additional

risk -reducingmeasures

Is a variation of standard isolation

methodrequired?

Stop the work, inform Client,

conduct isolation Risk Assessment

Apply Preliminary isolation

Progress with work

NO

NO

YES

YES

YES

YES

NO

NO

Isolation Flowchart for Subsea System

Conduct Specific Risk Assessment

(SRA)

ONSHORE ACTIVITY

OFFSHORE ACTIVITY

Apply Final isolation

Isolationsuccessfully

proven?

Findings of isolation

Risk Assessment?

Either -

Defer to shutdown, or increase

isolation envelope

ONSHOREREVIEW

OFFSHORE APPROVAL

NO

YES

Isolation, oreffectiveness of

additional risk-reducing measures, successfully

proven?

SRA Findings?

Requirement for

isolation

Is a unique,or non-routine

isolationrequired?

Select isolationmethod

Install isolation, orapply additional

risk -reducingmeasures

Is a variation of standard isolation

methodrequired?

Stop the work, inform Client,

conduct isolation Risk Assessment

Apply Preliminary isolation

Progress with work

NO

NO

YES

YES

YES

YES

NO

NO

Isolation Flowchart for Subsea System

Conduct Specific Risk Assessment

(SRA)

ONSHOREACTIVITY

OFFSHOREACTIVITY

Apply Final isolation

Isolationsuccessfully

proven?

Findings of isolation

Risk Assessment?

Either -

Defer to shutdown, or increase

isolation envelope

ONSHOREREVIEW

OFFSHORE APPROVAL

NO

YES

Isolation, oreffectiveness of

additional risk-reducing measures, successfully

proven?

SRA Findings?

IMCA D 044 91

6.2 Isolations Summary Table – Subsea Control and Umbilical Systems

Isolation Category

Type and Location Preliminary Final Comment

Electrical

Isolator – electrical power unit Yes No -

Links or terminals for power – topside umbilical termination unit

No No

Install preliminary isolation at higher level in supply circuit.

Switch or link for comms – master control station

Yes No -

Link or terminals for comms – topside umbilical termination unit

Yes No -

Remote-set (software) ‘isolation’ – master control station Yes No

Special check and isolation-management conditions apply.

Inductive coupler – subsea at unit Yes Yes Unique capability due to design.

Conductive connector – subsea at unit

No Yes -

Subsea switch – subsea isolator

Yes Yes

Special check and isolation-management conditions apply.

Subsea fuse – subsea distribution unit No Yes -

Hydraulic

Block and vent valves – hydraulic power unit

Yes No -

Block and vent valves topside umbilical termination unit

Yes No -

Remote-set (software) ‘isolation’ – master control station

Yes No Special check and isolation-management conditions apply.

Double block and bleed valve – subsea at unit

Yes Yes Provides local double isolation.

Self-sealing diver mateable coupling – subsea at unit

Yes Yes In conjunction with in-line block and vent valve.

Table 8 – Isolations summarised

Preliminary Initial isolation. Set as precursor to facilitate the obtaining of a further final isolation local to the worksite (where by design it is possible to do so). Generally it is a physical separation or (only exceptionally) a software inhibit.

Final subsea Isolation, local to the worksite. This isolation should consist of a secure physical separation. It is a readily understood way in which prevention of the uncontrolled release of energy can be confirmed to diving personnel tasked with carrying out the actual work.

92 IMCA D 044

7 Typical System Drawings

Figure 18 – Fundamental considerations

PA

PE

R T

ITLE

Do

es t

his

actu

ato

r e

xis

t ?

W

ha

t ty

pe is

it ?

H

isto

ry /

co

nditi

on

?

H

ow

is it

is

ola

ted

?

Do

es t

his

val

ve e

xis

t ?

W

ha

t ty

pe is

it ?

H

isto

ry /

co

nditi

on

?

H

ow

is it

isola

ted ?

Wh

at

is t

he

dir

ecti

on

of

flo

w ?

Is

th

ere

flo

w p

ote

ntia

l fro

mb

oth

dir

ect

ions

?

Fu

nc

tio

nin

g o

f an

actu

ate

d o

r m

an

ua

l v

alv

e:-

D

id v

alv

e m

ove

?

D

id s

tem

only

move

?

Is

ind

ica

tor

mec

ha

nis

m /

sys

tem

fau

lty ?

In

act

ua

ted v

alv

e,

is a

ctu

ato

r bein

g e

ne

rgis

ed

fro

m

contr

ol s

yste

m,

but

rem

ain

ing in

op

era

tive ?

Oth

er

infl

uen

cin

g c

on

sid

era

tio

ns

:-

A

ny

Clie

nt

safe

ty p

refe

rence

s w

hic

h m

ay

influ

en

ce t

he

intr

usi

vew

ork

s ?

C

lient

Up-T

ime

pre

fere

nce

s ?

D

iffic

ulty

in a

cces

sin

g c

ompone

nts

by

div

er

(e.g

. st

ruct

ure

s /

live li

ne

s /

drilli

ng m

ud /

etc

.) ?

W

ea

ther

/ T

ide

/ C

urr

ents

/ V

isib

ility

re

stric

tion

s?

A

ny

3rd

Part

y sy

stem

s adja

cent

?

Ho

w i

s t

his

sen

so

r m

ou

nte

d ?

H

ow

is it

ele

ctrica

lly is

ola

ted ?

P

revi

ous

his

tory

of

rem

ova

l /

repla

cem

en

t ?

Id

entif

ica

tion la

bel s

till i

n p

lace

?

Do

es

th

is D

ou

ble

-Blo

ck

-an

d-B

leed

v

alv

e a

rra

ng

em

en

t e

xis

t ?

Is

it d

oub

le b

lock

only

, o

r si

ngle

blo

ck?

W

ha

t ty

pe o

f ca

p (

if a

ny)

is f

itte

d t

o t

he v

en

t ?

Do

es

th

is i

so

lati

on

/ a

ccess

fa

cilit

y e

xis

t in

th

e b

lin

d f

lan

ge ?

W

hat

vent-

valv

e c

ombin

atio

n (

if any)

is

fitte

d?

Is

only

a p

lug f

itted ?

Is

th

e v

alv

e a

rra

ng

em

ent

(if f

itte

d)

thre

ade

d,

weld

ed,

or

bolte

d in

pla

ce?

Is

th

ere

an

y ve

nt

faci

lity

at

all

?

Is

th

e f

lan

ge

fitt

ed f

or

pre

ssure

-tig

htn

ess

, or

is it

loose

-fitt

ed ?

W

hat

is the

ag

e /

conditi

on

of

the f

lang

e

bolts

?

Wh

at

is t

he

in

ve

nto

ry a

nd

sta

tus o

f th

e p

rod

uct

in q

ue

sti

on

?

W

hat

is t

he c

on

tent

(Oil

/ Wate

r / G

as

/ C

hem

ica

l) ?

C

hem

ical c

onst

itutio

n ?

O

pera

ting t

em

pera

ture

ran

ge ?

O

pera

ting p

ress

ure

ran

ge ?

Do

es t

his

v

alv

e e

xis

t ?

Do

es

th

is h

an

dle

/

wh

eel

exis

t ?

?

?

Isol

atio

n &

Int

erve

ntio

n G

uide

lines

Is

olat

ion

& I

nter

vent

ion

Gui

delin

es ––

Som

e Fu

ndam

enta

lsSo

me

Fund

amen

tals

Po

ten

tia

l fo

r b

loc

ka

ge

?

C

ou

ld t

he

re b

e a

hyd

rate

in t

he

tu

bin

g /

cavi

ty ?

Co

uld

th

ere

be

pre

ssu

re (

+v

eo

r –v

e)

lock

ed

-in

here

?

Is t

here

an

is

ola

tio

n i

n

pla

ce o

r re

qu

ired

he

re?

IMCA D 044 93

Figure 19 – Typical manifold and flowline P&ID

94 IMCA D 044

GU

IDE

BA

SE

/ W

ELL

HE

AD

CO

NN

EC

TO

R IN

TE

RF

AC

E

WE

LLH

EA

D

DH

CI

DH

SV

DH

PT

AM

V

AP

T

AW

V

TC

T

CIV

3

PLM

V

DH

PT

TR

EE

-T

O-W

ELL

HE

AD

CO

NN

EC

TO

R

PU

MV

DH

SV

TR

EE

AA

V

XO

V

CIV

2

PR

OD

UC

TIO

N

PP

T

PW

V

PC

V

CIV

1

PC

PI

eg. G

AS

LIF

T

AC

V

AC

PI

AA

VA

NN

ULU

S A

CC

ES

S V

ALV

E

PR

OD

UC

TIO

N P

RE

SS

UR

E T

RA

NS

DU

CE

R

PR

OD

UC

TIO

N L

OW

ER

MA

ST

ER

VA

LVE

PR

OD

UC

TIO

N U

PP

ER

MA

ST

ER

VA

LVE

DO

WN

HO

LE S

AF

ET

Y V

ALV

E

DO

WN

HO

LE C

HE

MIC

AL

INJE

CT

ION

AN

NU

LUS

CH

OK

E V

ALV

E

CH

EM

ICA

L IN

JEC

TIO

N V

ALV

E

AN

NU

LUS

WIN

G V

ALV

E

AN

NU

LUS

PR

ES

SU

RE

TR

AN

SD

UC

ER

AN

NU

LUS

MA

ST

ER

VA

LVE

DO

WN

HO

LE P

RE

SS

UR

E &

TE

MP

ER

AT

UR

E (

SE

NS

AN

NU

LUS

CH

OK

E P

OS

ITIO

N IN

DIC

AT

OR

PR

OD

UC

TIO

N C

HO

KE

VA

LVE

PR

OD

UC

TIO

N W

ING

VA

LVE

PR

OD

UC

TIO

N P

RE

SS

UR

E &

TE

MP

. TR

AN

SD

UC

E

PR

OD

UC

TIO

N C

HO

KE

PO

SIT

ION

IND

ICA

TO

R

CR

OS

S-O

VE

R V

ALV

E

TR

EE

CA

P T

ES

T

XO

V

TC

T

PLM

V

PP

TT

PW

V

PP

T

PU

MV

DH

SV

PC

V

PC

PI

AP

T

DH

PT

CIV

DH

CI

AW

V

AC

V

AM

V

AC

PI

AB

BR

EV

IAT

ION

S

PP

TT

DO

UB

LE-B

LOC

K-A

ND

-BLE

ED

TE

ST

AC

CE

SS

CA

SIN

G&

TU

BIN

G

AN

NU

LUS

PR

ES

SU

RE

& T

EM

PE

RA

TU

RE

TR

AN

SD

AP

TT

DR

OP

-DO

WN

SP

OO

L T

OS

ER

VIC

EP

IPE

LIN

E

AP

TT

DR

OP

-DO

WN

SP

OO

L T

OP

RO

DU

CT

ION

PIP

ELI

NE

Figure 20 – Typical subsea tree P&ID

IMCA D 044 95

INTERNAL CONTROL

Figure 21 – Typical subsea control and umbilical system schematic

96 IMCA D 044

RE

EL

GA

UG

E

M

PO

WE

R P

AC

K

VE

NT

TBLV

TBLK

2TB

LK1

DS

V D

EC

K GA

UG

ES

UB

SE

A

CA

PP

ED

C/W

ISO

LATI

ON

& V

EN

T V

ALV

ES

CH

AR

T- R

EC

OR

DE

R &

TCV

1TC

V2

OR

TLIV

FRO

M D

SV

TES

T D

OW

NLI

NE

SU

ITA

BLE

FIT

TIN

GFO

R E

XIS

TIN

G S

YS

TEM

CO

NN

EC

TIO

N P

OIN

T

Figure 22 – Typical DSV to subsea worksite test downline

IMCA D 044 97

8 References

8.1 Reference Documentation

8.1.1 IMCA Guidance

IMCA D 019 Diving operations in support of intervention on wellheads and subsea facilities

IMCA D 045/R 015 Code of practice for the safe use of electricity underwater25

8.1.2 Other Documents

Effects of current on human beings and livestock: IEC Publication 60479-1, 2005

The safe isolation of plant and equipment: OIAC, HSE Publication First edition ISBN 0-7176-0871-9 (C50 3/97). Second edition ISBN 0-7176-6171-7, 2006

Electricity at work – safe working practices: UK HSE Publication HS(G) 85

Safety of laser products – Part 1. Equipment classification, requirements and user’s guide: BS EN 60825-1, 1994

Design, installation, repair and operation of subsurface safety valve systems: API Recommended Practice 14B (RP 14B), Fourth Edition, 1 July 1994

Recommended practice for installation, maintenance and repair of surface safety valves and underwater safety valves offshore: API Recommended Practice 14H, Fourth Edition, 1 July 1994

Petroleum and natural gas industries Drilling and production equipment Wellhead and christmas tree equipment: ANSI/API Specification 6A 19th edition, July 2004 (ISO 10423, 2003 (modified))

Petroleum and natural gas industries Design and operation of subsea production systems Part 4: Subsea wellhead and tree equipment : ISO 13628-4, 1999

Petroleum and natural gas industries Design and operation of subsea production systems Part 5: Subsea umbilicals: ISO 13628-5, 2002

Petroleum and natural gas industries Pipeline transportation systems Subsea pipeline valves : ISO 14723, 2002

Qualification test report for the mel ¼’ nominal bore diver mateable coupling: MEL Doc. No. M001405A (Rev. 1 03/11/00)

25 Guidance note AODC 035 – Code of practice for the safe use of electricity underwater – is to be superseded by guidance document IMCA D 045/R 015 on the same subject, expected to be published later in 2009.

98 IMCA D 044

8.2 Applicable Standard Graphical Symbols

Double-block-and-bleed valve with ‘diver-safe’ capped vent

Manual valve

ROV valve

Actuated valve

Check valve

Self-sealing hydraulic coupling

Flow control valve (choke) c/w position sensor

Instrument device

Electrical connection (female half)

Electrical connection (male half)

Electrical connector (multi-pin and socket)

Hydraulic line

Electrical line

Pneumatic line

Figure 23 – Standard graphical symbols

IMCA D 044 99

8.3 Laser Classifications Summary

Note: Due to the wide ranges possible for the wavelength, energy content and pulse characteristics of a laser beam, the hazards arising in its use vary widely. It is therefore impossible to regard lasers as a single group to which a common safety limit can be applied. Instead, the hazards associated with laser power have been internationally categorised, as given in Table 9.

Classification (in increasing order of hazard)

Description

Class 1 laser Lasers which are safe under reasonably foreseeable conditions of operation. These are lasers that are not hazardous for continuous viewing, or are designed in such a way as to prevent human access to laser radiation. These consist of low power lasers or higher power embedded lasers (e.g. laser printers)

Class 1M laser (302.5nm to 4,000nm)

Lasers which are safe under reasonably foreseeable conditions of operation. May be hazardous if user employs optics

Class 2 visible laser (400 to 700nm)

Low power lasers emitting visible radiation which, because of normal human aversion responses (i.e. blink reflex), do not normally present a hazard but would, if viewed directly for extended periods of time

Class 2M visible laser (400 to 700nm)

Lasers emitting visible light not intended for viewing and under normal operating conditions would not produce an injury to the eye if viewed directly for less than 1,000 seconds (e.g. bar code scanners). May be hazardous if user employs optics

Class 3R (302.5nnm to 106 nm)

Lasers that normally would not cause injury to the eye if viewed momentarily but would present a hazard if viewed using collecting optics (e.g. fibre optics equipment or telescope). Direct intra-beam viewing is potentially hazardous

Class 3B Lasers that present an eye and skin hazard if viewed directly. This includes both intra-beam viewing and specular reflections. Class 3B lasers do not produce a hazardous diffuse reflection except when viewed at close proximity

Class 4 Lasers that present an eye hazard from direct, specular and diffuse reflections. In addition, such lasers may be fire hazards and produce skin burns. Their use requires extreme caution

Table 9 – Laser classifications