We can get the 3rd degree when we start poking around a facility’s safety instrumented systems(s). It seems that there are those who believe they can build a SIS that no human can screw up and oh how wrong they are! Even OSHA was smart enough to require us to consider the consequences of the failure of engineering and administrative controls (1910.119(e)(3)(iv) in our PHA’s. Here is a PERFECT EXAMPLE of how reliance on a SIS that is not under strictly controlled access or set up properly can leave us with an unsafe degree of confidence that “all is well”. Emergency Shutdown (ESD) safety instrumented systems (SIS) are the LAST LINE of defense and SHOULD NEVER be relied upon without the proper LAYERS of PROTECTION in place before it. This means it is intended to be used ONLY when all else that comes before it has FAILED US! Here is a how a SIS can fail…
Description of Incident:
In the early morning hours a remote separator at a wellsite went into emergency shutdown (ESD). The shut-down of the separator created back-pressure on the system, which subsequently activated a hydraulic ESD on the pipeline.
- The high-pressure shut-down switch on the well was tied into the pump-off-controller; however the program logic controlling the shutdown of the pump-jack appeared to have been erased, thereby eliminating the ability to automatically shut down the motor (driving the pump-jack) on high pressure.
- The pump-jack continued to run and build up pressure within the tubing/wellhead until the 1500 psi rated rod blowout preventer failed. The BOP released a small amount of oil and gas into the air and onto the surrounding lease area.
- The release of product from the well was noticed by a worker from one of the adjacent companies, who was driving by. The worker reported the incident, by calling the Company 24 Hour Emergency number.
The failed BOP was sent to a materials lab to undergo a failure analysis. The findings were that the BOP unit had been over pressured and subsequently catastrophically failed.
What Caused It:
- The High-Pressure Shutdown Switch was wired through the pump off the controller and then to the pump-jack motor.
- When the logic programming was inadvertently/unknowingly erased in the controller, the shutdown signal sent by the Presco switch (when its high pressure shut down point was reached) failed to reach the motor
- The pumpjack was allowed to continue to operate, building up a very high internal pressure, thereby causing the ratigan to overpressure and fail.
Contributing Factors:
- The Presco switch designed to ESD the pumpjack motor on high pressure was wired through the pump off controller system, rather than being wired directly to the motor.
- Logic programming in the pump off controller had been modified/erased, thereby preventing the ESD signal to shut down the motor.
- Operators did not perform a functional ESD test on the Presco switch, following a rod packing failure the previous week.
- A functional ESD test may have identified a problem with the logic controller, and (if addressed) would likely have prevented the subsequent failure of the ratigan.( Fig. 1)
Corrective/Preventive Actions:
Investigation identified the following preventive recommendations:
- Check all wells with Pump Off Controllers (POC’s) that use Program Logic Controllers (PLC’s), to activate shutdowns, ensuring that Presco switches are operational.
- Consider installing solenoids on Presco switches in order to bypass the PLC and directly shut down the motor on the pumpjack.
- Install appropriate security level clearance in POC’s, to reduce or eliminate the chance of accidental programming removal.
- Implement a procedure for rod packing changes that include verification of the functionality of the Presco switch, to ESD the motor, over and above the regular maintenance program for Presco checks.
CLICK HERE to see the Enform Safety Alert PDF