Canada–Newfoundland and Labrador Offshore Area Petroleum Operations Framework Regulations (SOR/2024-25)

Marginal note:Emergency shutdown system

• 133 (1) An operator must ensure that an installation has an emergency shutdown system that is capable of

  • (a) shutting down all potential ignition sources and potential sources of flammable liquids or gases, including by isolating those sources;

  • (b) depressurizing all potential sources of flammable liquids or gases other than reservoirs;

  • (c) preventing abnormal conditions from escalating and causing major accidental events; and

  • (d) limiting the extent and duration of any major accidental event.

• Marginal note:Studies and assessments — design

  (2) The operator must ensure that the design of the emergency shutdown system is based on studies, analyses and assessments that identify potential hazards and must assess the risks associated with those hazards, including the risk assessment conducted under subsection 107(1) and the risk and reliability analysis referred to in section 108.

• Marginal note:Design

  (3) The operator must ensure that the emergency shutdown system is designed to

  • (a) allow for automated and manual activation to ensure effective shutdown;

  • (b) allow for the shutdown of any system or equipment to bring it to a safe state, unless the system or equipment has been rated to remain operational in the area in which it is located, as that area is classified in accordance with the classification system referred to in subsection 113(2);

  • (c) allow for the selective shutdown of ventilation systems, other than fans that are necessary for supplying combustion air to engines that are required to operate during emergency situations unless gas has been detected in the intake to those engines;

  • (d) allow for the isolation of petroleum and flammable fluid inventories, including reservoirs, wells, production systems and pipelines, from ignition sources;

  • (e) take into account the size and segregation of petroleum and flammable fluid inventories to limit the quantity of substances released on loss of containment;

  • (f) allow for the depressurization and the disposal of hydrocarbon inventories in a safe manner and to a safe location without cold venting;

  • (g) allow for the closure of the installation’s subsea and subsurface safety valves and of pipeline safety valves;

  • (h) take into account, in relation to all essential systems, the necessary timelines to support the safe escape, refuge and evacuation of persons and to maintain the integrity of the installation; and

  • (i) take into account the activation of the fixed fire suppression systems required under paragraph 134(4)(a).

• Marginal note:Shutdown logic

  (4) The operator must ensure that the logic for the emergency shutdown system includes a hierarchy of shutdown levels, action sequences and timelines that are appropriate for the degree of risk posed by the hazards identified in the studies, analyses and assessments referred to in subsection (2).

• Marginal note:Additional requirements

  (5) The operator must ensure, in relation to the emergency shutdown system, that

  • (a) the system is reliable and, as far as is practicable, it is functionally and physically independent of other essential systems or, if that is not practicable, it is arranged so as not to adversely affect or be adversely affected by the operation of those systems;

  • (b) the system includes an alarm system, with audible and visual alarms that are distinct from other types of alarms, that will automatically activate in the main control centre and at other strategic locations so that all affected persons, having regard to the hierarchy of shutdown levels referred to in subsection (4), are alerted to the emergency shutdown;

  • (c) there is continuous monitoring from the main control centre of the system’s status, including, if the system or part of the system is overridden, the extent and duration of the override;

  • (d) the system and its components are protected from mechanical damage and damage caused by fire, explosion and physical and environmental conditions to which they may be exposed so that they remain capable of fulfilling their intended functions under all foreseeable operating conditions;

  • (e) the system allows for all information that is necessary to permit the management of emergency situations to be continuously provided to the main control centre and other strategic locations, including information regarding

    • (i) the shutdown level and the source of activation of the system,

    • (ii) any shutdown effects that failed to execute on activation of the system, and

    • (iii) the status, including failure, of the system’s components;

  • (f) the system is capable of being activated from multiple manual activation points that are

    • (i) clearly marked,

    • (ii) protected against unintentional activation, and

    • (iii) located at

      • (A) in the case of manual activation points for the highest level of shutdown, the main control centre and other strategic locations, including aircraft landing areas and other embarkation stations, and

      • (B) in the case of all other manual activation points, strategic positions, at least one of which must not be in a hazardous area;

  • (g) the activation of the system from a manual activation point triggers the general alarm system referred to in section 130;

  • (h) if any part of the system is operated using a hydraulic or pneumatic accumulator,

    • (i) the accumulator

      • (A) is located as close as is practicable to the part that it is intended to operate, except if that part is part of a subsea production system, and

      • (B) has the capacity for a sufficient number of activations to ensure that shutdown can be achieved, and

    • (ii) the shutdown valves revert to a fail-safe mode in the event of a failure of the accumulator;

  • (i) the system is capable of testing both its input and output signal devices and its internal functions to ensure its functioning;

  • (j) in the event of a failure of the main electrical power supply referred to in subsection 122(4), the system has the capacity to function continuously until the main electrical power supply is restored or all shutdown operations have been concluded;

  • (k) in the event that an impairment of the system or any of its components increases the risk to safety or the environment, any other systems that support the emergency shutdown system reverts to a fail-safe mode;

  • (l) if two or more installations are connected or if there is temporary equipment that has an emergency shutdown system on an installation,

    • (i) the emergency shutdown systems of the connected installations are linked so that emergency shutdown signals are transmitted between those systems,

    • (ii) the emergency shutdown systems of the temporary equipment are linked to the installation’s emergency shutdown system so that emergency shutdown signals are transmitted between those systems, and

    • (iii) the logic for the emergency shutdown system of each of the connected installations and of the temporary equipment is re-evaluated and modified, if necessary, to take into account the fact that the emergency shutdown systems are linked, with the logic of the installation’s emergency shutdown system being given priority over that of any temporary equipment;

  • (m) the system is capable of being overridden or reset only if the cause of its activation has been resolved and there has been local confirmation that the equipment that gave rise to the system shutdown can be safely used; and

  • (n) override commands and functions are not capable of being unintentionally activated.

• Marginal note:Testing and maintenance

  (6) If the emergency shutdown system is capable of being overridden for the purposes of testing and maintenance activities, the operator must ensure that the following requirements are met:

  • (a) override commands and functions must be applied for the shortest amount of time possible and with as few as possible being applied simultaneously; and

  • (b) the testing and maintenance activities must not impair the system beyond what is necessary to undertake those activities and must not impede the system’s functioning.

• Marginal note:Work permit

  (7) A work permit is required for the testing and maintenance of the emergency shutdown system.

• Marginal note:Management of override effects

  (8) The work permit must set out the measures to be taken to manage the effects of overriding the emergency shutdown system.

• Marginal note:Closure — subsurface safety valve

  (9) In the case of a production installation, the operator must ensure that, if the emergency shutdown system is activated, any subsurface safety valve closes not later than two minutes after the tree safety valve has closed unless a longer delay is justified by the mechanical or production characteristics of the well.