GENERAL SPECIFICATION SAFETY

Transcription

1 GENERAL SPECIFICATION SAFETY GS EP SAF 226 Completed wells safety systems and safety rules 03 01/2011 General Review 02 10/ /2003 Revised issue Addition of EP root to document identification, rewording of chapters 4 and 6 and modified Appendix /2001 Old TotalFina SP SEC 226 Rev. Date Notes Owner: EP/HSE Managing entity: EP/SCR/ED/ECP

2 Contents 1. Scope Purpose of the specification Applicability Reference documents Terminology and definitions Activation of safety barriers Down-Hole Safety Valve (DHSV) Surface Safety Valve (SSV) Wing Valve (WV) De-activation of artificial lift Surface lines integrity Production flow-lines Injection flow-lines Active safety systems Safety valves Logic Instrument functional requirements Wellhead control panel General arrangement Minimum distances Layout Hazard prevention and mitigation Gas detection Fire detection Active fire-fighting Prevention of escalation Hazardous area classification Simultaneous operations Page 2/37

3 9.1 Hazard analysis Risk Assessment & Responsibilities Operations management and organisation Specific provisions for SIMOPS Criteria to maintain or to shutdown production (drilling SIMOPS) Bibliography Appendix 1 Completed well barriers general description Appendix 2 Typical instrumented flow-line Appendix 3 Typical instrumented injection lines Appendix 4 Typical causes & effects matrix Appendix 5 Typical wellhead platform shutdown logic diagram Appendix 6 Wellhead control panel typical schematic Page 3/37

4 1. Scope 1.1 Purpose of the specification The purpose of this general specification is to define the safety requirements applicable to completed wells surface equipment (including flow-lines and injection lines) and to safety devices. Neither safety requirements for servicing of well equipment nor safety considerations incorporated in the design of the well X-mas tree and completion are covered in this specification. In accordance with the hazard tree for production installations as per API RP 14J, these measures contribute to the fulfilment of the following objectives: Containment of hydrocarbon - Provide the completed wells with adequate safety barriers, and means of activation if necessary, - Provide flow-lines and injection lines with adequate isolation and safety devices. Preventing hydrocarbons ignition - Provide gas detection devices, - Define hazardous areas and classify hazardous zones around wells. Mitigation - Provide fire detection devices, - Minimise the effects of a fire, either by position or by protection, - Provide means for active fire fighting. This document follows the normal chronological activation of the different safety devices: Requirements for completed wells safety barriers activation means (section 4), Requirements for completed wells surface lines integrity (section 5), Requirements for the safety and control systems (section 6), Requirements for wellhead general arrangement for operations and well servicing activities (section 7), Hazard prevention and mitigation devices (section 8), This GS does not cover the safety of simultaneous operations (SIMOPS), involving drilling or work-over operations with a rig close to other live wells. However SIMOPS principles are outlined in section Applicability This specification is not retroactive. It shall apply to new installations (including new wells) and to major modifications or extensions of existing installations (including existing wells), onshore, and offshore. This specification is not applicable to sub-sea wells. This specification is limited to highlighting safety considerations applicable to completed development wells (exploration wells are excluded). Page 4/37

5 This GS is applicable to conventional production and injection HC or water wells, onshore and offshore. For the particular case of subsea wells, contact TDO/TEC/SBS. The particular case of air injection wells, CO 2 sequestration wells, etc. can be subject to additional considerations which are not detailed in this GS. In such cases, a specific auditable document shall be produced. 2. Reference documents The reference documents listed below form an integral part of this General Specification. Unless otherwise stipulated, the applicable version of these documents, including relevant appendices and supplements, is the latest revision published at the EFFECTIVE DATE of the CONTRACT. Standards ISO Reference Title Testing of valves Fire type-testing requirements Professional Documents Reference ASME B 16.5 Pipe Flanges and Flanged Fittings NPS 1/2 Through NPS 24 Metric/Inch Standard ASME B 31.3 API SPEC 6A API RP 14C API RP 14J Process Piping Title Specification for Wellhead and Christmas Tree Equipment Recommended Practice for Analysis, Design, Installation, and Testing of Basic Surface Safety Systems for Offshore Production Platforms Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities Regulations Reference Not applicable Title Codes Reference IP Code, Part 15 Title Area classification code for petroleum for installations, part 15 of the Institute of Petroleum Model Code of Safe practice (March 1990) Page 5/37

6 Other documents Reference Title Statement of Requirements (SOR) Safety Concept Operating Philosophy Total General Specifications Reference GS EP INS 146 GS EP INS 147 GS EP PVV 142 GS EP SAF 021 GS EP SAF 216 GS EP SAF 228 GS EP SAF 253 GS EP SAF 261 GS EP SAF 262 GS EP SAF 311 GS EP SAF 312 GS EP SAF 321 GS EP SAF 322 GS EP SAF 337 Title Design of generation and distribution of hydraulic energy Design and supply of wellhead control panels Valves Layout Area classification Liquid drainage Impacted area, restricted area and fire zones Emergency Shut-Down and Emergency De-Pressurisation (ESD & EDP) Pressure protection relief and hydrocarbon disposal systems Rules for the selection of fire-fighting systems Fire and gas detection systems Fire pump stations and fire water mains Fixed fire water systems Passive fire protection: Basis of design Page 6/37

7 3. Terminology and definitions There are five types of statements in this specification, the shall, should, may, can and must statements. They are to be understood as follows: Shall Should May Can Must Is to be understood as mandatory. Deviating from a shall statement requires derogation approved by Company. Is to be understood as strongly recommended to comply with the requirements of the specification. Alternatives shall provide a similar level of protection and this shall be documented. Is to be understood as permission. Is to be understood as a physical possibility. Expresses a regulatory obligation Note that will is not to be understood as a statement. Its use is to be avoided, unless it is necessary to describe a sequence of events. For the purpose of this specification, the following definitions shall apply: Active Fire-Fighting Annulus 0 Area (desert) Area (hazardous) Area (inhabited) Area (restricted) ASV (Annulus Safety Valve) Barrier Same as Fire Protection, Active. First annulus between the production tubing and the production casing. Any area, larger than 500 km 2 and where it is ensured that, over the project life-time, there will be no permanent agricultural activity, no fishery, no forest, no wild life reservation, no permanent population settlement, no road transport with traffic larger than 200 vehicles per day, no passenger transportation by railway and no industrial facility (Company). A hazardous area is defined as a three dimensional space in which a flammable atmosphere may be expected to be present at such frequencies as to require special precautions for the control of potential ignition sources (IP Code, Part 15). All other areas are referred to as non-hazardous areas in this context. All areas that do not match the criteria applicable to desert areas. Area within the boundaries of the installation and hence under the control of Company, that is affected permanently by normal operation of the installation or exceptionally by the consequences of an emergency situation caused by a major failure (Company). ASVs are high integrity safety valves installed on some gas lifted wells in the annulus 0 This safety valve as a similar function as a DHSV. They are controlled by the WellHead Control Panel (WHCP) and linked to the safety system (ESD). A barrier is an element of the envelope located on a potential leak path able to stop any fluid flow. Each barrier shall be designed with regard to fluid characteristics, maximum pressure and extreme temperature constraints expected at the considered barrier location. Page 7/37

8 Choke Choke (Fixed) DHSV (Down Hole Safety Valve) Emergency De- Pressurisation (EDP) Emergency ShutDown (ESD) Emergency Shutdown System ESDV (Emergency ShutDown Valve) Fire and Gas (F&G) system Fire Protection, Active (AFP) Fire Protection, Passive (PFP) Fire zone Fuel source Ignition source Manual or remote operated valve used to control the well production flowrate. Remote chokes are controlled by the Process Control System. A fixed choke is a flow restriction equipment used to limit the well maximum production flowrate. DHSV is a generic term that includes the following type of valves: SCSSV and SSCSV. Control actions undertaken to depressurise equipment or process down to a pre-defined threshold (generally 7 barg or 50 % of design pressure) in a given period of time (generally 15 minutes) in response to a hazardous situation (ISO+Company). Control actions undertaken to shutdown equipment or process in response to a hazardous situation (ISO). System of manual stations and automatic devices which, when activated, initiate installation shutdown (Company). High integrity shutdown valve, handling a hazardous fluid or a fluid having an essential function, and located at the limit of a fire zone or within a fire zone to limit hydrocarbon inventory (Company). ESDVs are controlled by the Emergency ShutDown system (ESD). Safety system which monitors the temperature or the energy flux (fire), the concentration of flammable or toxic gases (gas), and initiates alarm and Shutdown functions at pre-determined levels (Company). Any fire protection system or component which requires the manual or automatic detection of fire and which initiates a consequential response (API). Coating, cladding arrangements or a free standing system which in the event of fire will provide thermal protection to the substrate to which it is attached or to the protected area and does so independently of a requirement for human, mechanical or other intervention to initiate a response (Company from ISO and API). Areas within the installation where equipment are grouped by nature and/or homogeneous level of risk attached to them. The partition into fire zones is such that the consequences of a flammable gas leak, an explosion or a fire corresponding to the worst credible event likely to occur in the concerned fire zone shall not impact other fire zones to an extent where their integrity could be put at risk (Company). Same as ISO definition of "source of release" (API). Source of temperature or energy sufficient to initiate combustion (API). Page 8/37

9 LMV (Lower Master Valve) Pressure-containing envelope SCSSV (Surface Controlled Sub-surface Safety Valve) SDV (Shutdown Valve) Source of release SSCSV (Sub-Surface Controlled Safety Valve) SSV (Surface Safety Valve) UMV (Upper Master Valve) Well (air injector) Well (eruptive) Well (gas) First manual valve of the X-mas tree. Always opened, the valve is closed when maintenance on the SSV or downstream equipment is required. A pressure-containing envelope is an assembly of barriers tight and strong enough to prevent any unwanted external release and to hold effluent at maximum WHSIP (Wellhead Shut-in Pressure). SCSSVs are controlled from the surface by the WellHead Control Panel (WHCP) and linked to the safety system (ESD). - Tubing-Retrievable TR-SCSSV: the valve is attached to the tubing, and a workover is required for replacement. - Wire-line Retrievable WL-SCSSV: the valve is latched into a landing nipple and can be replaced by wireline operation. Automatically operated valve (generally fail to close) used for isolating a process station (API). SDVs are often referred to as Process ShutDown Valves (PSDV). The acronyms SDV and PSDV are equivalent but SDV is used in this specification because SDVs may not always be attached to a process system. Point from which a flammable gas, vapour or liquid may be released into the atmosphere (ISO). SSCSVs are stand-alone valves that are not linked to the surface safety system (ESD). These valves are either controlled by the flow (e.g. velocity valves or storm chokes) or by the pressure (e.g. gravity check valves or absolute pressure controlled safety valves). SSVs are high integrity safety valves located on the X-mas tree (Upper Master Valve) and are controlled from the WellHead Control Panel (WHCP) and linked to the Emergency ShutDown system (ESD). See SSV definition above. Used to inject air into the reservoir to achieve in-situ combustion. For safety purposes, steam wells and air injector wells are considered to be equivalent to gas wells with the exception that flammable gas detection is not required. In the absence of accurate information any well, either abandoned or belonging to another party or out of stream, shall be regarded as the most demanding in term of safety measures. Well which cannot satisfy the non-flowing well criteria defined below is named eruptive. Well which produces or injects with a Gas/Liquid Ratio larger than 500 (vol./vol.). Page 9/37

10 Well (injector) Well (non-flowing) Well (oil) Well (steam) Well (water) WHSIP WV (Wing Valve) Zone 0 hazardous area Zone 1 hazardous area Zone 2 hazardous area Well where fluids are flowing from surface facilities to reservoir(s). A well is considered as non-flowing if once the injection/activation system has been de-activated, once injecting/producing bore had been bled-off to atmospheric pressure and once well mean temperature is stabilised, no flow liquid or gas can be observed at surface. Well which produces or injects with a Gas/Liquid Ratio smaller than 500 (vol./vol.). Water well where the water temperature is such that it will be in vapour phase at atmospheric pressure. Well which produces or injects gas-free water, and which is perforated only in a water bearing zone with no risk of oil/gas breakthrough from a remote oil/gas bearing zone or from overlaying/underlying reservoirs. Well-head Shut-in Pressure. WVs are safety valves, they connect the production flowline to the X-mas tree and are controlled from the WellHead Control Panel (WHCP) and linked to the Emergency ShutDown system (ESD). Part of a hazardous area in which a flammable atmosphere is continuously present, or present for long periods. Part of the hazardous area in which a flammable atmosphere is likely to occur in normal operation. Part of the hazardous area in which a flammable atmosphere is not likely to occur in normal operation and, if it occurs, will exist only for a short period. 4. Activation of safety barriers This specification assumes that completed wells are designed in compliance with the Company well department design requirements as described in Appendix 1. This chapter specifies the safety requirement for the activation of completed well safety barriers. The principal requirements relate to the number of pressure containing envelopes and safety barriers. Eruptive wells shall at all times be equipped with two envelopes (external and internal) between the reservoir and the atmosphere. Non-flowing wells shall be equipped with one (external) envelope between the reservoir and the atmosphere. Eruptive wells shall be operated with two independent automated active barriers on tubing leak path, one on each envelope, capable of operating independently and simultaneously. Non flowing wells will be operated with one active barrier (manual or automated). The following table 1 provides the minimum envelopes and barriers required for each type of well. Page 10/37

11 Table 1: Wells envelopes and barriers 1 Ext. & 1 Int. Envelopes 1 Ext. Envelope HC PRODUCERS ERUPTIVE WELL without Activation X X X X ERUPTIVE WELL with Gas-Lift X X 1 X X X X ERUPTIVE WELL with ESP X X X X ERUPTIVE WELL with Rod Pump X 7 8 X NON FLOWING WELL with Gas-Lift X X At least SSV or WV NON FLOWING WELL with ESP X X 3 NON FLOWING WELL with Rod Pump X 9 X WATER PRODUCERS ERUPTIVE WELL X 11 X 3 NON FLOWING WELL with ESP X 3 GAS INJECTORS X X X X X WATER INJECTORS ERUPTIVE WELL X 4 3 NON FLOWING WELL X 3 Notes: (1) Where applicable: Acid Gas (H 2 S) or Presence of Living Quarter (< 50 m) or Urban Zone (2) Non Flow ing Wells the external envelope barrier may be manual. (3) If required for SIL system qualification or by Operation (see Operating Philosophy) (4) A SCSSV or a Flapper type Injection Valve is required (5) Annulus Safety Valve not stricly considered as a safety barrier (6) SSCSV is a contingency solution only, subjected to derogation (7) The DHSV shall be installed below the rod pump (8) Surface BOP to close the w ell in case of leak at polished rod dynamic seal, (9) Double sealing system shall be fitted at the polished rod. (10) GL SDV shall be installed w here no SSV barrier is installed (11) As required Rev 4, 07/01/2010 DHSV (SCSSV type) (6) ASV (ESDV type) (5) SSV (ESDV type) (2) WV (SSV type) (2) GL SDV type GL Manifold SDV type 4.1 Down-Hole Safety Valve (DHSV) DHSV(s) shall be of SCSSV type only. Fail safe DHSV(s), SCSSV types are activated by the Safety System (ESD system). DHSV(s), SCSSV type shall close upon ESD-1 (fire zone ESD) or ESD-0 if any. 4.2 Surface Safety Valve (SSV) The Surface Safety Valve (SSV) is part of the wellhead X-mas tree, typically consisting of an automatically operated Upper Master Valve. Page 11/37

12 SSV(s) are fail safe and shall be activated by the safety system. SSV(s) shall close upon ESD-0 (if applicable), ESD-1, SD-2 and SD-3. SSV is considered as an ESDV and thus a local reset is mandatory. Production motorised chokes cannot be considered as safety valves. 4.3 Wing Valve (WV) An automatically operated Wing Valve (WV) shall be provided to supplement the X-mas tree SSV (automatically operated Upper Master Valve ). The automatically operated WV shall be fitted with an actuator linked to the ESD system following the same logic as the SSV. Additionally the WV can be closed voluntarily by operator via telemetry; in that case, remote opening of the WV is allowed. The non application of automatically operated WV(s) shall be justified in the Safety Concept based on the type of well(s) (e.g. non application could be anticipated for a nonflowing (non-eruptive) well or for a water well) and supported by documents. 4.4 De-activation of artificial lift Any artificial lift system shall be connected to the safety system, which will de-activate it in case of an emergency. The specific causes and effects for each type of artificial lift are listed here below: Gas-lift: In the case of direct gas-lift (injection in the annulus 0), the first surrounding annulus (annulus 1) shall be fitted with PAH and PSHH sensors. The PAH is provided for early warning purpose and is fitted with local and visible alarm. The PSHH shall trigger the well SD-3. The gas injection-line to the well shall be equipped with a surface gas injection SDV that shall close in case of SD-3. Down hole centrifugal pump: These wells should generally be fitted with a PSHH sensor, pump overload and underload, high temperature and vibration trips, which shall trigger the well individual shutdown (SD-3) and open the circuit breaker in the MCC. The list of inputs triggering SD-3 may nevertheless vary and shall therefore be determined together with the pump Vendor. Positive displacement pump: Same principles as for a centrifugal pump, plus a local emergency push button that shall trip the motor or engine. For personnel protection purposes, the area around the pump and its motor/engine shall have a restricted access. 5. Surface lines integrity The design of surface lines shall comply with the minimum requirements of API RP 14C, offshore and onshore. The hereafter requirements are intended to clarify or complement use of API RP 14C by Company. The number of instruments which are considered as weak points shall be minimised in accordance with TDO/TEC/INS. Page 12/37

13 5.1 Production flow-lines Refer to Appendix 2 for illustration. The recommended configuration is to design flow-lines rated for the WHSIP up to the production and test manifolds. For the specific case of wells activated with Electrical Subsurface Pump (ESP) the WHSIP shall be determine in collaboration with TDO/FP Full rated HC production flow-lines The safety of flow-line operation shall be ensured by the implementation of the features and adherence to the rules listed below: Instruments For analysis purposes and assignment of safety devices, flow-lines are divided into flow-line segments. A flow-line segment is any portion of the flow-line that has an assigned operating pressure different from the other segments of the flow-line. One single PSHH shall be installed on the final segment of the flow-line. The PSHH sensor shall initiate SD-3 of the well, through the wellhead control panel. A PSLL sensor shall be installed for leak detection or line rupture. The PSLL sensor shall initiate an SD3 of the well through the WHCP. It shall always be installed downstream of the first choking device. Where the segment length upstream the choke valve is greater than three meters an additional PSLL sensor with the same logic shall be installed on that segment PSVs Refer to GS EP SAF 262 for further details on PSVs and TSVs. If necessary, a TSV shall be installed by application of GS EP SAF 262. It is especially applicable in places where the wellhead effluent GOR is low and sun radiation high enough to significantly increase the temperature and hence the pressure of the flow-line exposed to it Piping ASME B 31.3 with either API flanges or hub and clamp connectors shall form the basis of flowline design between X-mass tree and production/test headers. For diameters greater than 8, chapter 9 of ASME B 31.3 may be used to determine flowline wall thickness. If pressure temperature ratings permit, connections downstream of the choke valve may be ASME B 16.5 flanges (Refer to Appendix 2). As a minimum, one check valve shall be installed in the final flow-line segment so that the entire flow-line is protected from backflow. In case a flow line is connected to a production header and a test header, each connection shall have its own block valve (3-way valves are forbidden) and its own check valve (common check valve upstream branch-off is also forbidden). If corrosion issues that can jeopardise safety are identified, fixed corrosion monitoring devices should be considered on all flow-lines. Page 13/37

14 The risk of flow-line erosion shall be assessed, and where deemed necessary, elbows arrangement should be avoided. Elbows arrangement shall be prohibited where high fluid velocity and/or sand production is anticipated. Tees shall be given preference instead. Instrument flanges between WV and choking device with NPT connections are allowed on piping whose rating is less than 5000 # API; for rating 5000 # API or higher, welded spools shall be used with flanged connections for instruments. Note that this requirement can be fulfilled by the typical use of combined Weldolet / Weldoflange type connections. The Weldolet side is directly welded on the wellhead instrument flange. The Weldoflange side is fitted with a flange allowing the instrument connection. A double block and bleed type integral manifold with a flanged connection to fit the top of the Weldoflange is installed, in order to enable positive isolation of the concerned instrument when necessary Flow control Where possible the first choking device provided to control the well flow-rate shall be less than 3 meters from the X-mas tree. The installation of a block valve downstream of the choking device is not compulsory but is strongly recommended in case of erosive wellhead effluent that could require frequent choke maintenance Drainage The flow line shall be connected to the closed drain system at the low point with standard connections as per GS EP SAF 228. Flow-lines shall be depressurised prior drainage to the closed drain system Non full rated HC production flow-lines The safety of non full rated flow-line operation shall be ensured by the implementation of the same features and rules listed in section In addition the pressure protection of the flowline shall be re-enforced by: A full flow PSV shall be installed on the flow-line in accordance with GS EP SAF 262. A total of at least two PSHH sensors shall be installed on the entire flow line, with a one out of two (1oo2) logic as a minimum although a two out of three (2oo3) can be used if required for availability reasons. These PSHH sensors shall initiate SD-3 of the well, through the wellhead control panel. Note: Full flow is defined as the well potential at a flowing pressure equal to the PSV set pressure, and for the specified fixed choke if any, and the full mechanical opening of the adjustable choke Water production flow-lines The undesirable events that can affect a flow-line are overpressure and leak. Therefore water production flow-line design is not different from the HC production flow-rate and sections and should be used. Page 14/37

15 5.2 Injection flow-lines HC injection flow-lines Refer to Appendix 3 for illustration The safety of injection line operation shall be ensured by the implementation of the features and adherence to the rules listed below: Instruments One FSHH sensor shall be installed on each gas-lift injection line. This FSHH sensor shall initiate SD-3 of the well, through the wellhead control panel. A single PSLL sensor shall be installed on each injection line or voting system logic (1oo2 or 2oo3) can be used if required for availability and/or reliability reasons. The PSLL sensor(s) shall initiate SD-3 of the well, through the wellhead control panel(s). A PSLL sensor shall be installed for leak detection or line rupture. The PSLL sensor shall initiate an SD3 of the well through the WHCP. It shall be installed upstream of the first choking device. Where the segment length downstream the choke valve is greater than three meters an additional PSLL sensor with the same logic shall be installed on that segment. For direct gas lifted wells, a PAH and a PSHH are required on the first surrounding casing (annulus 1). This PSHH shall initiate an SD-3 of the well though the wellheads control panel (see above section 4.4) Piping Injection flow-lines are generally protected against overpressure by an upstream protection device. In all cases overpressure protection shall be in accordance with GS EP SAF 262. Piping class de-rating shall be prohibited and the injection line design pressure shall be the same as the header onto which it is connected. A check valve shall be installed on the injection-line as close as possible to the X-mas tree to minimise back-flow to the injection-line. In the case of gas-lifted wells where the gas-lifted stream cannot be shut-off by the SSV, a SDV shall be provided on the gas-lift line as close as possible to the X-mas tree. This SDV shall close on SD-3 signal from the wellhead control panel. See Appendix 3 for illustration. Injection line piping class shall be designed to ASME B 31.3 with API SPEC 6A or hub and clamp connectors (refer to Appendix 2). Instrument flanges between the check valve and X-mas tree with NPT connections are allowed on piping whose rating is less than 5000 # API; for rating 5000 # API or higher welded spools shall be used with flanged connections for instruments (e.g. combined Weldolet / Weldoflange type connections). Gas-lift lines and high-pressure gas injection lines shall be provided with an SDV at their connection with the header. This SDV shall close on SD-3 signal from the wellhead control panel. Page 15/37

16 Drainage The injection line shall be connected to the closed drain system at low point with standard connections as per GS EP SAF Flow control Injection lines should be fitted with a flow control valve (or choke) and a flow meter Water injection flow-lines The safety of injection line operation shall be ensured by the implementation of the features and adherence to the rules listed below: Instruments A single PSLL sensor shall be installed on each injection line or voting system logic (1oo2 or 2oo3) can be used if required for availability and/or reliability reasons. The PSLL sensor(s) shall initiate SD-3 of the well, through the wellhead control panel(s). A PSLL sensor shall be installed for leak detection or line rupture. The PSLL sensor shall initiate an SD3 of the well through the WHCP. It shall be installed upstream of the first choking device. Where the segment length downstream the choke valve is greater than three meters an additional PSLL sensor with the same logic shall be installed on that segment. In case where the maximum water operation injection pressure is greater than annulus 0 design pressure, a PAH and a PSHH are required on that annulus 0. This PSHH shall initiate an SD-3 of the well though the wellheads control panel Piping Injection flow-lines are generally protected against overpressure by an upstream protection device. In all cases overpressure protection shall be in accordance with GS EP SAF 262. Piping class de-rating shall be prohibited and the injection line design pressure shall be the same as the header onto which it is connected. A check valve shall be installed on the injection-line as close as possible to the X-mas tree to minimise back-flow to the injection-line. Injection line piping class shall be ASME up to and including the check valve and API downstream of the check valve and up to the X-mas tree. Instrument flanges between the check valve and X-mas tree with NPT connections are allowed on piping whose rating is less than 5000 # API; for rating 5000 # API or higher welded spools shall be used with flanged connections for instruments (e.g. combined Weldolet / Weldoflange type connections). Water injection lines shall be provided with an SDV at their connection with the header. This SDV shall close on SD-3 signal from the wellhead control panel. Page 16/37

17 Drainage The injection line shall be connected to the closed drain system (if existing) at low point with standard connections as per GS EP SAF 228. If no closed drain is available water injection lines can be drained in the open drain system Flow control For operation and reservoir monitoring reasons injection lines should be fitted with a flow control valve (or choke) and a flow meter. 6. Active safety systems 6.1 Safety valves Wellheads and X-mas trees DHSV: Down-Hole Safety Valves (SCSSVs) shall be specified and engineered as ESDVs. Only SCSSV (Surface Controlled Sub-surface Safety Valves)-type DHSVs are considered in this General Specification (see also GS EP SAF 261). SSV: Surface Safety Valves (automatic upper master valves) shall be specified and engineered as ESDVs. - SSVs shall always close before SCSSVs to avoid pressure differential across the SCSSV. - The master SSV shall be designed such as being able to cut the cables that are used for wire-line operations. - SSVs shall meet the fireproof criteria of the ISO or equivalent and GS EP PVV 142. WV: Wing Valves (automatic wing valves) shall be used. They shall be specified and engineered as SDVs. - WVs shall always close before SSVs to avoid pressure differential across the SSV. - WVs may be remotely controlled if their control circuit is fitted with a specific solenoid independent from the safety trip circuits. - Remote WV re-opening through telemetry is authorised only if the concerned well was closed voluntarily and in absence of fault (F&G or PSHH/PSLL). Gas-lift or gas re-injection isolating valves are considered as SDVs. Chokes, even motorised, cannot be considered as safety valves, neither ESDVs nor SDVs. Page 17/37

18 6.1.2 Functional requirements CCR = Central Control Room Wellheads DHSV SSV WV Local reset after ESD-0 or ESD-1 yes yes yes (1) Open from CCR no no no (1) Close from CCR yes yes yes Open/Close local command yes yes yes Open/Close status display in CCR yes yes yes Partial stroking facilities no no no ESD signal test facilities yes yes yes (1): Except if WV w as voluntarily closed from CCR Wellhead safety valves control sequence In order to avoid pressure differential across the safety valves the following sequences shall be implemented: Well closing sequence: WV first to close, then after a timer the SSV closes and finally after a further time delay the SCSSV closes. Well re-opening sequence: the SCSSV shall be re-opened first, then after a time delay the SSV and then finally the WV. 6.2 Logic In general the ESD levels defined in GS EP SAF 261 shall be applied to wells and their associated facilities (e.g. flow-lines, manifolds, test separator, export pipeline ). It is Company philosophy to consider the following shutdown levels: ESD-0 (Total black shutdown), ESD-1 (Fire zone emergency shutdown), SD-2 (Unit shutdown), SD-3 (Equipment/Well shutdown). A typical cause and effect diagram is given for illustration in Appendix 4. Offshore wellhead installation is generally a single Fire Zone. Any confirmed Fire or Gas detection on the wellhead shall trigger a general ESD Instrument functional requirements The rules and recommendations conveyed in GS EP SAF 261 are applicable and shall be adhered to. For the case of remote platforms or well pads, the telemetry system is not regarded as an acceptable safety system, i.e. signal logic treatment cannot be achieved in one location by one safety system and routed to another location through a data highway (optic fibres) or VHF/UHF for safety purposes. As a consequence all units comprising wells shall be equipped with a local and independent safety system capable of undertaking all necessary actions to shut down the units in case of an emergency or a process upset. Telemetry can be used, as an external input to the local safety system, just to increase safety or improve operability. Page 18/37

19 In case the telemetry link is severed (atmospherics, interference, receiver failure, etc.), an alarm is displayed in the CCR but no further action (e.g. force the outputs of the remote facility to their safe positions) will be taken, unless otherwise stipulated in the Operating Philosophy. 6.4 Wellhead control panel This is not the purpose of this specification to describe detailed technological arrangement of the wellhead control panels. Similarly, requirements for transmission of status information from the wellhead platform or well-pad and affecting the internal wiring of the wellhead control panel (pressure switches, etc.) are not addressed. For this item contact TDO/TEC/INS. However some basic principles, impacting safety in a direct manner are developed below and shall be considered at design stage. The WHCP is an integral part of the safety system of the wellheads installation. Hence it is subject to the same safety integrity level (SIL) principles as the other instrumented safety systems of the installation. The wellhead control panel shall be of fail safe design so that in case of loss of power or input signal, all concerned safety valves drift to their safety position (normally closed). DHSV (SCSSV type) control and command circuitry shall be independent from SSV and WV control and command circuitry. Possible contamination of hydraulic oil by reservoir fluid constitutes a common mode of failure. For this reason: The DHSV (SCSSV type), the SSV and the WV command circuits shall be independent and shall draw hydraulic fluid from different tanks, as shown in Appendix 7. Oil hydraulic return from DHSV (SCSSV type) shall be routed to open drain system, this configuration allowing a common HP source for both circuits, pressure being adjusted through pressure regulators. Control fluid to DHSV (SCSSV type) and SSV shall be hydraulic oil. Strong preference is also given to hydraulic technology for actuation of SDVs and ESDVs. Logic signal treatment inside the wellhead control panel shall be preferably electric (conventional relay rack), pneumatic (instrument air if available or instrument gas) or digital. Hydraulic logic treatment is not prohibited but it is emphasised that this technology requires special precautions; in particular as far the quality and design of the components are concerned. It is imposed that low-pressure hydraulic fluid for logic is not produced by pressure reduction of high pressure sources used for safety valve actuation but by independent assembly (pump, accumulator, etc.) specifically designed for this service (max. discharge pressure, flow-rate, PSVs, etc.). Company policy is to avoid instrument gas where ever electricity is available to produce instrument air or hydraulic, if instrument gas is used, it shall undergo most stringent treatment to achieve dew point low enough to avoid possible condensation in the control circuits. The wellhead control panel shall be provided with all by-passes and overrides necessary for maintenance, testing and start-up. These devices shall be always visible, preferably installed on the front of the panel and shall be such that their position (automatic vs. override) can be checked at a glance. Page 19/37

20 In case the wellhead control panel receives a remote ESD-1 signal through telemetry, this input shall be fitted with a specific override that shall not deactivate any local ESD-1 function or signal. The front of the wellhead control panel should be provided with an engraved plate displaying internal wiring schematic and relevant operating instructions. F more details refer to GS EP INS 146 and GS EP INS General arrangement 7.1 Minimum distances Detailed consequence analysis calculations shall be carried out to determine the distances within and between fire zones or the fire/blast protection necessary when adequate distance cannot be provided. In the absence of detailed consequence analysis calculation and for preliminary General Arrangement, refer to GS EP SAF 021, that gives the default well Fire Zone and Restricted Area (2D). In all cases, calculation of distances based on consequence analysis as per GS EP SAF 253 are required to take into account site specific characteristics. Refer to GS EP SAF 253 for Fire zone, Restricted Area and Impacted Area definitions and requirements for HC and HP well. 7.2 Layout Wellheads shall be arranged in such a manner that the operational requirements for security and protection against shocks, drilling or workover rig access, safety of onshore cellars, cleanliness and protection of environment and operability are fulfilled. GS EP SAF 021 provides guidance on spacing between equipment within the well unit. Particular attention shall be paid to the safety of a well servicing (wire-line, coiled tubing, swabbing, snubbing, production logging etc ) or maintenance work close to other live wells Protection against damages Offshore wells Wellheads shall be protected by platforms which ensure restricted access and that are fitted with all regulatory navigation aids. The area around wells and the associated access platforms shall be provided with lighting and always be clearly illuminated. At least 30 % of lighting shall be powered by the essential power system. The routine operational swing zones of cranes and any other lifting devices shall not pass over wellheads and associated flow-lines and injection-lines, unless they have been designed for impact resistance to loads dropped from the crane or lifting device. The recommended solution is to install a plate deck, with removable hatches, above the wellheads and flowlines Onshore wells Wellheads either stand alone or grouped by units, shall be surrounded by a perimeter fence fitted with one main entry/exit upwind and a secondary emergency exit on the opposite side. The perimeter fences shall be away from the main paths of traffic in the installation. Where the risk of traffic damage is important, well units shall be further protected by solid barriers with a Page 20/37

21 preference for embankments. Adequate signs shall be posted to prohibit routine access to any vehicle beyond the perimeter fence. Other fencing requirements may be required by security concerns, however are not specified any further in this GS. No vegetation shall be allowed within 15 metres of the wellhead and only carefully tended grass and trees lower than 3 metres shall be permitted beyond. An area extending 150 m beyond the edge of the fence shall be provided, in which public can be granted access but shall not be allowed to have permanent settlement. For single onshore wells where the distance between the X-mas tree and the trunkline is more than 15 metres, HP gas lines (flow-lines or injection-lines) shall be under-ground, except in desert areas. It is also recommended, but not compulsory, to lay oil flow-lines below-ground. When developing onshore wells in clusters and where the distance is more than 15 m, oil and gas flowlines shall be underground between the X-mas tree and the manifolds, for reasons of drilling/work-over rigs access and mechanical protection Sub-sea wells They shall have their own area of marine traffic and anchoring restriction, marked on plot plans and approved by local authorities Cellars Cellars shall be cemented and their bottom shall be equipped with a low point drainage and arranged in such a way to recover oil and contaminated water. Cellars shall be covered by gratings at grade level, surrounded by handrails or covered with grating, and fitted with fixed stairs or ladders to allow personnel to escape. It is reminded that cellars are classified as Zone 1 hazardous areas and that access by personnel without formal authorisation and suitable protection is strictly prohibited. Warning signs shall be posted Decks and floor Offshore The deck around wellheads and X mas tree shall have grating floors. Where the risk of oil or contaminated water spillage to sea is important, adequate dispersant chemicals shall be available on the platform or on the supply boat, in combination with an appropriate operating procedure Onshore Oil or contaminated water shall be recovered to preclude soil and water pollution. The area around wellheads and X-mas trees should preferably be paved in a radius of 10 metres around the cellar, with a 1 % slope outwards and a spillage collection device (perimetric gutter + collection pit). Page 21/37

22 7.2.4 Operability Access Wellheads shall be accessible from any side for operation and maintenance. Straight escape routes shall be provided around any wellheads unit. This generally requires the flow-lines and injection lines to be either under-ground/deck or above head. The pressure gauge on the casings shall be readable from grade or a permanent and fixed platform. The pitch between the wells shall take into consideration all foreseeable multiple completions. The minimum clearance width around wellheads shall be 0.8 metre; the minimum clearance at grade or platform level shall be 1.2 metre. Where simultaneous drilling, work-over, coiled tubing, snubbing, wire-line, stimulation or other well servicing may take place, sufficient space reservation shall be available for pipe handling, mud handling, chemical delivery, sludge removal, etc. without interfering with production installation or production personnel. Platform cranes where relevant shall be specified based on the need to lift the necessary material onto the deck from a supply vessel Ergonomics Wellheads shall be fitted with an identification panel at each access level, easily readable from the main access ways. X-mas trees shall be painted with an easy-to-interpret colour code, for instance: yellow for gas wells, brown for oil wells, blue for water wells and dedicated colour for steam, air or CO 2 injectors. The identification panels, valves, local instrumentation and wellhead control panel shall be illuminated with the same principles as in section The wellhead control panel shall be visible from the X-mas tree and at a maximum distance of 15 metres; as a consequence, individual control panels dedicated to one well are generally required onshore. All the wellhead control panels in a field shall have a standardised operator interface Valve operation Valves actuators and hand-wheels shall be located so that they may be conveniently reached when standing at grade level or from a permanent platform. Valves with horizontal spindles shall be located with the spindle between 0.75 and 1.5 metre above the grade or platform, and should preferably be at 1 metre. Valves with vertical spindles shall have their hand wheel between 1 and 1.5 metre above the grade or platform, and should preferably be at 1.1 metre Sample points and corrosion monitoring Sample points should be located or extended to 1 metre above grade or permanent access platform. The clearance for the retrievable tools shall be: Retrievable under pressure: 1.83 m mini, 2.5 m vertically maxi, Not retrievable under pressure: 0.5 m mini. Page 22/37

23 Access of well service tools. Annulus valves shall be located and oriented to provide access for use of well service tools such as annulus valve maintenance tool (Valve Removal Plug: so call VRP ). No obstacle (beam, flowline ) shall be present within 1 meter in the axis of the annulus valves to allow installation of the VRP tool. 8. Hazard prevention and mitigation 8.1 Gas detection Toxic and Flammable gas detection systems, if any, shall be designed as per recommendations contained in GS EP SAF 312 and shall activate the ESD system. 8.2 Fire detection Hydrocarbon production or injection wells shall be fitted with a fixed and automatic fire detection system. Fire detection systems, shall be designed as per recommendations contained in GS EP SAF 312 and shall activate the ESD system and the automatic fire-fighting systems, if any. Company policy is to avoid process/instrument gas for fire detection. This solution shall be subject to derogation. 8.3 Active fire-fighting The decision to install fixed active fire-fighting systems shall be in accordance with GS EP SAF 311 and governed by: The need to protect personnel and to allow escape, evacuation and rescue when the wells are located close to places where personnel are frequently present. The Asset Protection Philosophy set forth in the Safety Concept. As a general rule fixed active fire-fighting systems shall be implemented only for wells located on offshore platforms either supporting other equipment and already fitted with a fire water system or linked by bridges to a central complex. Fixed active fire-fighting systems, if any, shall be designed as per recommendations contained in GS EP SAF 321 and GS EP SAF 322 and shall be activated by the ESD system. Wherever fixed active fire-fighting systems are not installed, fire fighting shall be achieved by mobile response means such as fire truck (onshore) or fire-fighting boat (offshore). As a minimum, a dry riser, a fire water main ring in cupronickel shall be provided for any wellhead platform with wells handling hydrocarbons. Two connections shall be provided: one at the boat landing for the supply boat and one at the upper deck for the drilling rig. 8.4 Prevention of escalation The wellheads shall be in one or several dedicated fire zone(s), apart from other units containing hydrocarbon, such as processing, storage and transportation units and from accommodations with high occupancy of personnel. Refer to GS EP SAF 253. Page 23/37

24 Further details about general arrangement within the wellhead fire zone are provided in the general specification GS EP SAF 021. Where passive fire protection systems are required to achieve fire partitioning, they shall be as per recommendation conveyed in GS EP SAF Hazardous area classification Refer to GS EP SAF 216 for extension and type of hazardous area around wells. 9. Simultaneous operations 9.1 Hazard analysis This SIMOPS section outlines general safety rules for conducting Drilling and Construction activities simultaneously with any Production activities and/or well servicing activities. Detailed information for SIMOPS preparation and operation shall be obtained from DGEP/TDO/FP (for rig activities) and DGEP/TDO/EXP (for construction activities). Simultaneous drilling/production or construction/production activities are likely to increase the level of risk. These risks shall be identified (HAZID) and then analysed (HAZAN) so that supplementary safety systems (in conjunction with specific procedures) shall be defined and implemented to minimise the risks as low as reasonably practicable. Simultaneous Operations (SIMOPS) includes offshore moving of the heavy marine units needed in support of well operations. This section does not deal yet with SIMOPS conducted over Subsea templates. 9.2 Risk Assessment & Responsibilities Risk Assessment Company's requirements regarding simultaneous operations shall be stipulated in the Statement Of Requirements and it shall be assessed during the pre-project phase and subsequent engineering phases (FEED, BASIC, detailed engineering) Regardless of these assessments, the risk related to well servicing/production SIMOPS activities shall always be assessed in the Operational phase of the installation Responsibilities SIMOPS operations are managed with the following responsible authorities: The subsidiary General Manager is Responsible for deciding to carry out SIMOPS Drilling and Construction. He appoints a specific Responsible for Safety and Environment on Site (RSES) for the installation under SIMOPS. The authorisation to proceed with the approach of the heavy marine units (offshore), installing and removing the rig (onshore or offshore), and to proceed the SIMOPS is given by the Operations Manager on the basis of an approved SIMOPS dossier and specific offshore procedures (i.e. approach, anchoring anchor-weighing). The RSES is the only person to have the leadership and responsibilities over all Safety & Environment activities when simultaneous operations are conducted. Page 24/37