Document No.
W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 1 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
Client: DHAMRA LNG TERMINAL PRIVATE LIMITED
Project No: DLTT
Project Title:
LNG STORAGE TANKS FOR LNG TERMINAL AT DHAMRA
EMERGENCY SHUTDOWN PHILOSOPHY
Client Document Number
2340-E-TNK-GEN-DP-H-E-006
PMC : AMEC FOSTER WHEELER
EPC CONTRACTOR : L&T HYDROCARBON ENGINEERING LIMITED
DEC : LTHE ENGINEERING SERVICES / WHESSOE ENGINEERING LIMITED
OWNER/PMC APPROVAL
Date (DD-MM-YY)
Signature
Rev Description Date Prepared Checked By Approved
By By
C Issued for Approval 1 3 Sep 1 8 JF BT BT
B Issued for Approval 1 3 Jul 1 8 JM BT BT
A Issued for Review 1 2 Jun 1 8 GB BT BT
P1 Planned Deliverable 02 May 1 8 GB BT BT
This document is the property of L&T Hydrocarbon Engineering. It must not be copied, loaned or transferred, nor must the information it contains be disclosed to any Third
Party without the written consent of L&T Hydrocarbon Engineering.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 2 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
REVISION HISTORY SHEET
Sr. Rev. Page Clause
Brief Description/Reason for Revision Remarks
No No. No. No.
1 C 4 2.0 Abbreviation added
2 C 9 6.0 Push button location changed
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 3 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
CONTENTS
1 .0 SCOPE 4
2.0 ABBREVIATIONS 4
3.0 OBJECTIVES OF THE EMERGENCY SHUT-DOWN SYSTEM (ESD) 4
3.1 GENERAL REQUIREMENTS 5
3.2 EMERGENCY SHUT-DOWN VALVES REQUIREMENTS 6
3.2.1 ESD valves characteristics 6
3.2.2 ESD valves location 6
4.0 DEFINITION OF ESD SEQUENCES 7
4.1 Individual equipment trip 7
4.2 Partial Terminal shutdowns 7
4.3 Process sub-systems 7
4.4 Process systems 7
4.5 Terminal shutdown 8
4.6 Terminal and utilities shutdown 8
4.7 Truck Loading 8
5.0 ESD3 – SEND-OUT SYSTEM 9
6.0 ESD4 – GENERAL TERMINAL SHUTDOWN 9
7.0 ESD6 – TRUCK LOADING SYSTEM 10
8.0 EFFECT OF EARTHQUAKE 10
9.0 LOGIC SEQUENCE 11
9.1 ESD 1 11
9.2 ESD 2 11
9.3 ESD 3 12
9.4 ESD 4 12
9.5 ESD 6 13
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 4 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
1 .0 SCOPE
This document defines the philosophy for the design of the Emergency Shut-Down (ESD)
system for the Dhamra Regasification Terminal, Dhamra, Odisha, India.
Functional links between the Fire and Gas System and the ESD system are presented but
the detailed description of the fire, gas and spill detection philosophy is out of the scope
of this document.
This ESD Philosophy only applies to the LNG Storage Tanks, but is part of and consistent
with the rest of the Terminal.
2.0 ABBREVIATIONS
CCR Central Control Room
DCS Distributed Control System
ERS Emergency Release System
ESD Emergency Shutdown
ESDV Emergency Shutdown Valve
FGS Fire and Gas System
JCR Jetty Control Room
LNG Liquefied Natural Gas
PLC Programmable Logic Controller
SCS Safety Control System
UPS Uninterruptible Power Supply
3.0 OBJECTIVES OF THE EMERGENCY SHUT-DOWN SYSTEM (ESD)
The main objectives that the Emergency Shut-Down system shall achieve are:
· The protection of personnel,
· The prevention and/or minimisation of pollution of the environment,
· The protection of unit and equipment,
· The prevention of hydrocarbon inventory losses.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 5 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
The Emergency Shut-Down system shall detect any abnormal process situation on the
unit and bring the installation back to a safer configuration in a controlled manner. It
shall also bring the unit to a safe configuration in case of confirmed detection of fire or
gas hazard by the Fire and Gas system.
These safeguarding objectives are achieved by providing an ESD system that
automatically performs the following actions in case of detection of hazardous abnormal
conditions:
· Isolation of hydrocarbon flows and inventory to limit the loss of containment and
mitigate any consequential effects of the abnormal condition,
· Shut-down of equipment that may upset abnormal situation and/or of equipment
that may be damaged if it continues to run,
· Isolation of the process equipment so that depressurisation and/or drainage can
be initiated if required.
Shutdown functions shall be limited to those required for safety based on the upset
condition detected. The production process shall not be unnecessarily interrupted.
The ESD system shall also provide audible, visual and recordable information on the
status of the shutdown system in the Central Control Room (CCR) and on site as
appropriate.
3.1 GENERAL REQUIREMENTS
The ESD system is mainly provided to prevent process conditions exceeding design values
when, for whatever reason, the process control devices have failed to maintain these
conditions within the normal working range. The emergency shutdown loops shall
consequently be fully independent from the “normal” process control system. So,
· the ESD system shall be independent from the Distributed Control System (DCS)
and from Fire and Gas System (FGS),
· field transmitters initiating trips and isolation actions from the ESD system shall
be from dedicated transmitters or switches,
· all isolation valves involved in ESD actions shall be dedicated valves,
· some control valves can be connected to the ESD system in order to be actuated
to safe position in case of ESD of the concerned unit/area.
The ESD system interface with the DCS is limited to the supply of information on trip
status and on emergency valves position.
The ESD system interface with the Fire and Gas System (FGS) is limited to the exchange
of information from the FGS through hardwired links in order to initiate proper shut-
down and isolation actions.
As a general rule, the ESD system does not suppress requirement for ultimate
mechanical Pressure Release devices.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 6 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
An ESD trip signal shall never auto-reset. Reset of a trip output can only be done
manually by the Central Control Room operator, once the input variable that has
initiated the trip has returned to a safe value.
Override of critical trips from system shall not be possible. Means to override some less
critical trips from system may be provided. List of these “overridable” trips shall be
carefully studied during detailed engineering and strict override procedures shall be
defined.
The preliminary results of Override or Non-Override analysis will be included in Cause
and Effect Chart corresponding to each individual interlock/trip.
ESD field instrument shall have the same SIL class requirement to meet the ESD SIL
requirement.
3.2 EMERGENCY SHUT-DOWN VALVES REQUIREMENTS
3.2.1 ESD valves characteristics
As a general rule, the ESD valves shall have the following characteristics :
· Actuators shall be fail safe type. Isolation valves shall close on air failure and
blow-down or emergency drain valves (if applicable) shall open.
· Valves shall be equipped with open/close position limit switches connected to
the DCS.
· Valves shall be of fire-safe design.
· Valve type shall be ball valve or butterfly valve according to piping class and
diameter of line
· Valves shall be tight shut-off.
· Valves shall not have hand wheel nor bypass line
· Closure time shall be not more than 5 seconds for valves up to 4” and not more
than 2 second per inch for greater size valves. For large size valves (over 20”),
when special conditions required a very quick action, a stroking speed down to 1
second per inch may be applied. This high closure speed shall be chosen on a
case by case basis and after a hammer effect study has been performed if
required.
· Where local commands are provided on ESDV, care shall be taken that these local
commands cannot inhibit automatic safety actuation of the valve.
3.2.2 ESD valves location
Emergency Shut-Down Valves are used to isolate sections of the facility so that
potentially hazardous flows of process fluids are minimised. So ESDVs location on
streams shall be selected in order to minimise the hydrocarbon inventory that may be
affected by a hazardous process condition, an accident or a fire hazard.
ESDVs pertinent to the tank shall be installed at the following locations:
· on tanks inlet lines,
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 7 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
· on in-tank pumps common discharge lines
On each stream to be isolated, the exact location of the ESDV shall be carefully studied
to find a compromise between the following aspects:
· the hydrocarbon inventory to be affected should be minimised,
· the valve location should be located far enough and/or protected enough to
avoid any damage to the valves in case of fire and/or explosion,
· the location and/or protection of ESDV shall ensure that they cannot be exposed
to radiation levels leading to damage to the safety function,
· the location of the ESDV shall provide a maximum mechanical protection.
4.0 DEFINITION OF ESD SEQUENCES
As shutting down the Terminal may result in undesirable conditions and long restarting-
up period of time, the ESD logics have been divided into several levels corresponding to
partly shut-down of the Terminal without compromising the general safety of the
Terminal.
4.1 Individual equipment trip
Individual equipment shutdown will be developed with the relevant vendors. They are
logically handled either by a process Programmable Logic Controller (PLC) dedicated to
equipment or by the Terminal DCS, or by the Terminal SCS. Trip actions dedicated to
individual equipment are controlled either by the equipment PLC or by the Terminal
DCS; ESD actions are controlled by the Terminal SCS.
4.2 Partial Terminal shutdowns
The partial Terminal shutdowns are actuated when the continuation of specific
operation like ship unloading or send-out is potentially unsafe but the potential
consequences are limited to the respective area or system(s).
The above safety sequences stop the running pump(s) and compressor(s), isolate the
major equipment or systems and section the main headers as deemed necessary.
4.3 Process sub-systems
When the hazardous condition is only related to one process sub-system such as one
storage tank, the automatic actions are only limited to this respective sub- system.
4.4 Process systems
Emergency shutdown sequences ESD1 , ESD2, ESD3 which cause partial Terminal
shutdowns and include some of the valves and equipment that are associated within the
individual safety systems.
ESD1 and ESD2 are related to the unloading system where ESD1 stops unloading and ESD2
is dedicated to the emergency disconnection of unloading arms.
ESD3 is related to the send-out system.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 8 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
The ESD logics are implemented in a dedicated safety control system in order to receive
direct signals and transmit direct actions to shut off equipment if hazardous
consequences are expected.
4.5 Terminal shutdown
Emergency shutdown sequence ESD4 is dedicated to a total process shutdown. It is
actuated when the continuation of ship unloading and gas deliveries is unsafe due to
large gas escape or other major incident or process conditions leading to important and
irreversible mechanical damages, such as an earthquake. This can be initiated by push
button in the CCR, by low instrument air pressure, general power failure and seismic
detection. All the process equipment will be actuated to their fail safe condition.
However:
· The control system of the Terminal remains active on an uninterruptible power
supply (UPS).
· The fire-fighting diesel engine driven pump remains on stand-by provided it is not
inhibited by its own safety devices.
· The Terminal utilities (instrument air, nitrogen and potable water) are not
affected by ESD4.
4.6 Terminal and utilities shutdown
As the terminal plot space is limited, one cannot exclude the gas cloud to travel from
process areas to utilities, administrative areas.
On the other hand, all the electrical items of the plant are not classified such as normal
plant lighting, building ventilation, utilities.
Therefore, the total plant emergency shutdown ESD4 has been extended to the non-
classified “utilities” such as normal plant lighting, nitrogen unit, instrument air, and
building ventilation.ESD4 is activated when gas is detected in the process area or tank
area and gas is detected by the inline gas detectors into the direction of the utilities
area.
An earthquake will initiate an ESD 4.
4.7 Truck Loading
Emergency shutdown sequence ESD 6 is dedicated to the truck loading operation. Upon
activation the ESD valves in the truck loading area will close.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 9 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
ESD1 & ESD2 – UNLOADING SYSTEM
The emergency sequence one (ESD1 ) is initiated:
· by push buttons from the unloading area (field), the ship and the central control
room;
· by manual break glasses, gas, LNG or fire detectors in strategic locations;
· by process sensors such as arm displacement proximity switches, high level or
pressure in the LNG storage tank(s) or low nitrogen pressure in the ship/shore
pneumatic back-up system;
The primary action of ESD1 is to stop the unloading operation (including ESD of the ship
system), to close the ESD valves on the unloading and vapour return lines in order to
limit the liquid / gas inventory and to isolate the unloading system from LNG tanks
vapour recovery and send-out systems.
The emergency sequence two (ESD2) actuates the closure of the Emergency Release
System (ERS) valves and the arm emergency disconnection system. This can be required
by the ship or the operator on the jetty, calling the Central Control Room due to severe
storm, leak or other serious event. It is automatically initiated by the arm displacement
proximity switches.
5.0 ESD3 – SEND-OUT SYSTEM
In addition to push buttons (field and in CCR), the emergency sequence three (ESD3) is
activated by abnormal pressure or temperature in the HP send-out header, Terminal
battery limit valves closure and fire-spill-gas detection in the process area.
The primary action of ESD3 is to stop the send-out operation, to close the ESD valves in
order to limit the liquid inventory and to isolate the send-out system from the LNG
tanks. It trips the boil-off gas compressors and the high pressure pumps, closes the
associated valves and isolates the recondenser and the STV’s.
6.0 ESD4 – GENERAL TERMINAL SHUTDOWN
The emergency shutdown sequence four (ESD4) is activated:
· By dedicated push button located on the field (tank bottom at a safe distance)
and in the central control room (CCR).
· By seismic detectors. If the recorded acceleration is higher than 50% of OBE in
both directions (one out of two or two out of two in one direction), it gives one
alarm and leads to ESD4.
· By too low pressure in the instrument air distribution network.
· By general power failure (black-out).
It places the Terminal in total shutdown by simultaneous activation of ESD1 and ESD3.
ESD2 remains not activated but can be affected on decision in the central control room.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 1 0 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
ESD4 also has the effect of unlocking of the terminal gates in case of earthquake to
allow safe entrance and escape for personnel
7.0 ESD6 – TRUCK LOADING SYSTEM
The emergency shutdown sequence ESD6 is activated by push button in CCR, manual
break glasses and gas-LNG-fire detectors in the truck loading area.
ESD6 isolates the truck loading area from the Terminal.
8.0 EFFECT OF EARTHQUAKE
The Terminal has been designed to allow easy restart after an OBE without the need for
any repair of vital equipment or re-calibration of instruments. An extensive inspection is
however recommended.
If the earthquake level is 50% of OBE, ESD4 is activated and a plant inspection carried
out prior to restart. If the earthquake level is higher than 50% OBE then a structural
stability and integrity review have to been performed prior plant re-start.
In the event of an SSE, the plant will be left in a safe state with ESD valves closed, all
machinery shut down and LNG in the tank, unloading lines and the absorber confined.
The situation is therefore managed safely following an SSE.
Main process lines and equipment stability must be carefully inspected and tested before
restarting the cold recirculation. In the meantime, the main lines will be vented
regularly on the high points.
After SSE, one pressure transmitter per tank shall still function with a signal fed to the
emergency panel in order to allow the operator to monitor the pressure increase in the
tank and to release the boil-off gas safely through the flare valve.
Critical information such as nitrogen and gas send-out pressure will also be available on
the emergency panel.
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 1 1 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
9.0 LOGIC SEQUENCE
9.1 ESD 1
Cause Effect
Push buttons in unloading area ESD 1 Close unloading line ESD valves
Push buttons in LNG ship Close tank fill line ESD valves
Push button in CCR Stop ship LNG pumps
Manual break glasses in strategic
locations
Gas-LNG-fire detectors in
strategic locations
Failure of ship to shore link
LNG tank level too high
LNG tank pressure too high
Jetty KO drum level too high
9.2 ESD 2
Cause Effect
Push button in CCR ESD 2 Close valve upstream ERS
Push button in JCR Close valve downstream ERS
Arm displacement Activate ERS
Activate ESD 1
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 1 2 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
9.3 ESD 3
Cause Effect
Push buttons in strategic areas ESD 3 Stop HP LNG pumps
Push button in CCR Stop BOG compressors
Manual break glasses in strategic Stop glycol water pumps
locations
Gas-LNG-fire detectors in Close ESD valves of STV
strategic locations
Too high pressure in HP send-out Close ESD valves of recondenser
header
Too low pressure in HP send-out
header
Too low temperature in HP send-
out header
Closure of send-out header
battery limit valve
Trip of all glycol water pumps
9.4 ESD 4
Cause Effect
Push buttons in strategic areas ESD 4 Stop LNG LP pumps
Push button in CCR Activate ESD 1
Too low pressure of instrument air Activate ESD 3
General power failure Unlock terminal gate
(earthquake only)
Utilities failure
Document No. W0060-020-PR-DB-0006 Rev: C Date: 1 3 Sep 1 8 Sheet: 1 3 of 1 3
Title: Emergency Shutdown Philosophy
Client Document No: 2340-E-TNK-GEN-DP-H-E-006
9.5 ESD 6
Cause Effect
Push button in CCR ESD 6 Close ESD valves to truck
loading area
Manual break glasses in truck
loading area
Gas-LNG-fire detectors in truck
loading area
