Do you consider how measures to prevent a leak could cause a leak?

Description of Incident

Sometimes the measures we put in place to prevent a release of flammable or toxic fluids can lead to other problems that just make the situation worse.

A few weeks after the start-up of production on a platform in the North Sea several gas alarms suddenly sounded in the central control room. The alarms came from the module where the main process separators were located. An emergency shutdown was automatically activated including blowdown of the process systems. Three persons were in the module at the time and managed to escape through a fog of oil and gas. The production operator released the deluge and then escaped to safety. Luckily there was no ignition source, and the oil was washed to the drains and the gas eventually dispersed.

The leak came from a flange on the inlet to the test separator. At this point there was a change in piping specification and there was a flange isolation kit installed to prevent electrolytic corrosion between the upstream and downstream pipe sections. Where there are pipes with different material composition a galvanic cell can be formed that will lead to preferential corrosion of the more active material. This is the same process used for anodic protection where sacrificial anodes of, for example zinc, are used to protect steel from corrosion. The isolation kit had an insulating material as the gasket between the flange faces. There is also an isolating washer used in the bolting to provide resistance to any current flow at this point.

The flange isolation kit used was a standard product and had been used on other installations without any problems. Why did it fail this time?

The reservoir being produced from was at the time one of the deepest in the North Sea and the deeper the oil is produced from the higher the temperature of the oil produced. The wells were also highly productive and when they were opened upfully the temperature at the inlet to the test separator exceeded 120 C. This was significantly greater than the specification for the isolation washers on the bolts. The washers thermally degraded and released the tension in the bolts causing the flange to open and gas and oil to escape. The potential for a leak at the flange with the isolation kit had not been identified in the design and the HAZID and HAZOP processes carried out to verify that the design and operation were acceptable. Isolation kits on other flanges on the facility were either redesigned to ensure they tolerated the high temperatures or removed, and other measures put in place to prevent/reduce the galvanic corrosion. Inspection routines were set up to monitor the flanges and any signs of corrosion.

This incident illustrates one the major challenges in risk assessment and management. The identification of potential hazards and the description of how these hazards will manifest themselves. If we fail in this step, then the next steps in the risk management process will be in vain. Do you have people, with the right competence and experience and with enough imagination to carry out an extensive Hazard Identification?

One interesting point that was discussed after the incident was the decision to release the deluge. We will return to this point in a later Reflektion.

To view the orignal Refleckt 'Reflektion' click here.