safety design

Pada 23 Maret .2005 jam 1:20 siang, di BP Texas City refinery terjadi ledakan dan api yang mengakibatkan 15 orang meninggal dunia dan menciderai 180 orang dengan kerugian material melebihi $1.5 billion. Insiden terjadi ketika start-up isomerization unit, raffinate splitter tower meluap. Pressure relief device terbuka yang menyebabkan  flammable fluid keluar dari blowdown stack yang tidak dilengkapi dengan flare. Keluarnya fluid ini menyebabkan ledakan dan api. Fatality terjadi di kantor yang dekat lokasinya. 43.000 orang penduduk diperintahkan tetap didalam ruangan dan ledakan mengakibatkan rumah-rumah dalam radius ¾ mile dari refiney rusak.

Fail Safe Design Maintainability In Remote Platform?

Shutdown platform occurred during my site trip last year in one of the remote offshore wellhead platform. ESD alarm on the operating console showed that the shutdown is triggered  by one of the push button on the cellar-deck.


The the problem comes, every time the operator wants to reset the ESD logic. The push button fail safe  mode which in de-energized status keep sending shutdown command and it cannot be re-setted.
Since the override command is only accessible to authorised maintenance personnel. the operator cannot access the overrides command and he started to panic

The Logic Behind The Magic. “Emergency Shutdown System (ESD) Operating Philosophy 3"

Start-up and Maintenance inhibit/ Override

In order to be able to start-up equipment or sections process, it is necessary to inhibit some inputs to the ESD system, as sensor signal may be in abnormal state prior to start-up and could cause a shutdown. Such inhibits are designated as "start-up inhibits".

While Maintenance inhibits are set from the  maintenance / inhibit console for maintenance purpose

Each inhibit function is reset automatically either by the sensor signal reverting to normal state or after a predetermined time delay. The automatic resets are achieved by the Safety Shutdown System.

The Logic Behind The Magic. “Emergency Shutdown System (ESD) Operating Philosophy 2"

Resetting philosophy

Further to a shutdown, the related ESD levels need to be individually and manually reset by the Operation Console operator. The ESD level can be reset only if the upper ESD level is in normal condition.

Resetting sequence is as follows :

·         The operator is informed on the ESD and process displays that the ESD level can be reset

·         ESD level alarm return to normal conditions only when all ESD causes have disappeared or have been inhibited and the ESD level reset is carried out on the ESD display of theOperation Console

The Logic Behind The Magic. “Emergency Shutdown System (ESD) Operating Philosophy 1"

The Emergency Shutdown (ESD) System is designed to protect the personnel, plant, equipment and the environment against pollution. The purpose of the ESD system is to monitor process safety parameters and activate or shutdown the process system and/or the utilities if these parameters deviate from normal conditions.

Usually there are several levels of shutdown:

·         ESD 0 :                       Total emergency shutdown  with abandon of platform

·         ESD 0.1 :                    Black shutdown

·         ESD 1 :                       Total plant emergency shutdown

·         ESD 2 :                       Total process shutdown

·         ESD 3 :                       Local unit shutdown