Philosophy and general requirements in the gas industry

The rules and requirements in the gas industry are stringent, ensuring safety, efficiency and environmental sustainability. These requirements cover various aspects of gas production, transportation, storage and distribution.

The functions of the cargo Emergency Shutdown (ESD) system are to stop cargo liquid and vapour flow in the event of an emergency and to bring the cargo handling system to a safe, static condition.

The current edition of the IGC Code lays down core requirements for an ESD system. These comprise manual trip points and automatic fire sensors that can initiate remote closure of emergency shutdown valves «for shutting down liquid and vapour cargo transfer between ship and shore» and require that this emergency trip, when activated, must also stop cargo pumps and compressors. However, these provisions do not necessarily provide adequate protection, particularly against overflow, during other operations involving the transfer of liquid and vapour on board. It must be recognised that operations such as reliquefaction or cargo tank spraying may be routine operations at sea. These deficiencies will be addressed in the new updated IGC Code and are described in this article.

The IGC Code has no jurisdiction over activation of ESD systems at shore installations, but it is recommended that linked systems are installed such that activation of an ESD trip on the ship will send an ESD signal to shore and vice versa.

However, it is important to remember that the scope of the IGC Code effectively ends at the ship’s manifold and it has no mandate over the design of the terminal’s equipment. Although the Code requires cargo transfer procedures to be agreed and loading rates to be adjusted to limit surge pressures on valve closure, the impact of shipboard emergency shutdown on the shore is not otherwise covered.

The legal framework of the IGC Code means that its language is necessarily prescriptive but, with little or no explanation to the reasoning behind its statements, problems with interpretation sometimes occur. One area where opinion has sometimes been divided is in LNG carriers, where gas burning is normally carried out concurrently with cargo loading. However, a solution to this problem is discussed in the article «ESD Functions and Associated Safety SystemsEmergency Shutdown Systems».

The relevant paragraphs from the 1993 IGC Code together with explanatory notes are see point «1993 IGC Code Requirements for an ESD System» below. This is intended to help clarify the areas of the IGC relating to ESD that are seen as unclear.

The core requirement of the IGC Code are that an ESD shutdown is initiated by manual trips or by thermal devices. However, there may be valid reasons to supplement these core initiators with others to suit actual operating requirements. Similarly, in some cases additional shutdown actions may be necessary to stop liquid and vapour flow. As well as these ESD functions, the Code requires trips designed to protect the ship and its cargo system against damage. As these trips often require one or more cargo pumps or compressors to be stopped, in many ships the actions are combined such that a trip due, say, to low tank pressure, will be activated via the ESD system or vice versa.

There are, therefore, differences between the core ESD trips defined by the IGC Code that are common to all gas carriers and those that may be in place on a particular vessel. Although this distinction may not be of great consequence when the vessel is at sea, it could be important when considering cargo operations in port, particularly when the ship’s ESD system is linked to the terminal’s system.

For the purposes of this article, the acronym «ESD-1» will be used when referring to the emergency shutdown of the transfer of cargo during loading or unloading. Depending on the context, the term may apply to an ESD-1 trip signal, event or condition. Readers should be aware that although the term «ESD-1» is used by many operators and is found in several guideline documents, it is not universally recognised throughout the industry. SIGTTO use it here only to provide a clear distinction between the various trip functions within the overall cargo ESD system. Other cargo system trips required by the Code will be discussed in the article «ESD Functions and Associated Safety Systems».

During transfer, stopping the flow requires the pumps and compressors or blowers to trip and, isolating the ship and shore from each other, requires the intervening valves to close.

There have been a number of well-publicised instances where wind has blown a Contingency Plans for Liquefied Natural Gas Carriergas carrier off the berth while still connected to the loading arms. Ship break-out must therefore be seen as a credible event and both the LPG and the LNG industries are under obligation to do all that they can to mitigate the risk of escalation to a major incident.

The cargo transfer emergency shutdown process at the majority of terminals where these systems are implemented is divided into two stages:

• 1^st stage – shuts down the cargo transfer process in a controlled manner («ESD-1»);
• 2^nd stage – activates the Emergency Release System installed on transfer arms («ESD-2»).

This second stage function is primarily to protect the transfer arms and ship’s manifold should the vessel drift out of a predetermined operating envelope, which will typically be detected by sensors on the transfer arms. Emergency release may also be manually initiated from ashore but it is not designed to be initiated from the ship. The emergency release system is designed to be an entirely independent and separate function and its operation is not dependant on the presence of a linked ESD system. As such it is outside the scope of this document and no attempt will, therefore, be made to cover the subject in anything other than general terms (the article «ESD Functions and Associated Safety Systems»).

If investigations reveal that, under normal and emergency operating conditions, the risk of damage by surge is judged by all parties to be tolerable, then transfer with an unlinked shutdown system could be considered acceptable. Operators should be aware that changes to plant design or to operating procedures may invalidate the original studies that led to the decision not to fit a linked system. A formal review should be performed if changes have taken place.

The LNG industry has recognised the safety benefits of adopting linked ship/shore shutdown systems but currently it is not as widely adopted in the LPG trade. SIGTTO recommends that any LNG, LPG or chemical gas ship that does not have the ability to link its ESD system to shore is modified to make this possible. Similarly, any new terminal handling the bulk transfer of these cargoes or such terminals that are undergoing major refurbishment should be fitted with linked ESD systems.

The primary concept of a linked ESD system is that the party receiving liquefied gas, ie the ship in the loading port and the shore in the discharge port, can shut down the transfer process in a safe and controlled manner and so remain in control of events at its location. The receiving party should never arrive at the situation where the only option is to shut valves against the incoming full flow of liquid. Furthermore, should any failure leading to leakage or fire be discovered, either party may initiate a controlled shutdown of the transfer process without risk of exacerbating the situation by the generation of unacceptable surge pressures anywhere in the pipework on ship or on shore.

1993 IGC Code Requirements for an ESD System

The IGC Code specifies that an Emergency Shutdown System (ESD) is to be fitted for the Cargo System – Tank Constructioncargo system, but the requirements are rather fragmented throughout the Code. The purpose of this point is to clarify the intention of the current IGC Code requirements for ESD systems, pending the review of the IGC Code now in progress. To aid understanding, the wording from the IGC Code is replicated in shaded boxes. Where appropriate, SIGTTO recommendations are in italics to differentiate from explanatory text.

The main purpose of the ESD system is to stop cargo flow in the event of an emergency and to return the system to a safe, static condition so that any remedial action can be taken.

In port, with cargo flowing between ship & shore, the emergency situations considered include, for example, fire, leakage from hoses or hard arms, cargo tank overflow aboard the vessel and an emergency on the jetty.

For cargo flows within the ship, the scenarios envisaged include, for example, emergencies involving boil-off reliquefaction, cargo liquid recirculation operations (such as re-heating or cargo co-mingling) and boil-off supply as fuel to the engine room. These situations can arise either in port or at sea.

A primary consideration when designing the ESD system must be to avoid the potential generation of surge pressures within cargo transfer pipework if a valve closes during transfer.

The basic principle is that, for cargo systems with low-pressure containment, the system should stop any cargo machinery that is running (eg cargo pumps or compressors) and, in port, close any valve connections to shore to isolate the ship and shore systems. In addition, for cargo systems with Type C pressurised containment, tank dome valves should also be closed by the ESD system in recognition of the potentially higher leakage rates should a pressure system fail.

As a minimum, the IGC Code requires that the ESD system shall be activated by the manual and automatic inputs identified within this point. Designers should only incorporate any additional inputs into the ESD system if it can be shown their inclusion does not reduce the integrity and reliability of the system overall.

SIGTTO recommends that all gas ships ESD systems should incorporate a standard ship-shore link, in accordance with SIGTTO guidelines, to enable ship and shore ESD systems to be linked when transferring cargo.

Specific Requirements of the IGC Code for Equipment & Control Systems. For clarity, the IGC Code requirements will be set out, paragraph by paragraph, with explanatory notes. To assist the present review, the paragraphs are separated into bullet points and re-ordered slightly. Although each entire paragraph is included here, parts that are less relevant to the topic under discussion are shown in a lighter colour for clarity.

Valve requirements for «low pressure» ships (eg fully refrigerated LPGCs or LNGCs).

5.6.1.1:

• For cargo tanks with a MARVS not exceeding 0,7 bar gauge, all liquid and vapour connections, except safety relief valves and liquid level gauging devices, should have shutoff valves located as close to the tank as practicable.
• These valves may be remotely controlled but should be capable of local manual operation and provide full closure.
• One or more remotely controlled emergency shutdown valves should be provided on the ship for shutting down liquid and vapour cargo transfer between ship and shore. Such valves may be arranged to suit the ship’s design and may be the same valve as required in 5.6.3 and should comply with the requirements of 5.6.4.

This section specifies that all tank dome connections on «low pressure» ships must be fitted with at least manual closing valves, except for level gauges and relief valves which are covered in 5.6.2 and 8.2.8 respectively. It is optional to fit these manual closing valves with remote-actuation devices. However, it is mandatory to fit remotely operated valves in the liquid and vapour systems to stop cargo transfer with shore. This paragraph introduces the concept that one purpose of the ESD system is to stop cargo transfer between ship and shore.

Valve requirements for «pressure» ships (eg pressurised or semi-refrigerated LPG or ethylene carriers).

5.6.1.2:

• For cargo tanks with a MARVS exceeding 0,7 bar gauge, all liquid and vapour connections, except safety relief valves and liquid level gauging devices, should be equipped with a manually operated stop valve and a remotely controlled emergency shutdown valve. These valves should be located as close to the tank as practicable.
• Where the pipe size does not exceed 50 mm in diameter, excess flow valves may be used in lieu of the emergency shutdown valves.
• A single valve may be substituted for the two separate valves provided the valve complies with the requirements of 5.6.4, is capable of local manual operation and provides full closure of the line.

The requirements for pressure systems recognise the increased leakage risk and require duplicated valves at each tank connection; one operated manually the other with remote actuation. It is possible to combine the two valves as long as the single valve can be closed both locally and remotely. Level gauges and relief valves are again exempted. In recognition of the restricted pipe sizes that may be used in pressure systems, «excess flow valves» are permitted in lieu of remote-operated ESD valves for line diameters up to 50 mm (see also 5.6.5).

Valve requirements for excess flow valves.

5.6.5:

• Excess flow valves should close automatically at the rated closing flow of vapour or liquid as specified by the manufacturer. The piping including fittings, valves and appurtenances protected by an excess flow valve should have a greater capacity than the rated closing flow of the excess flow valve. Excess flow valves may be designed with a bypass not exceeding an area of 10 mm diameter circular opening to allow equalization of pressure, after an operational shutdown.

ESD valve requirements for gauging or measuring devices.

5.6.2:

• Cargo tank connections for gauging or measuring devices need not be equipped with excess flow or emergency shutdown devices provided that the devices are so constructed that the outward flow of tank contents cannot exceed that passed by a 15 mm diameter circular hole.

These two paragraphs, 5.6.2 and 5.6.5, are self-explanatory and limit the potential release from failures involving these systems.

ESD valve requirements at transfer connection in use.

5.6.3:

• One remotely operated emergency shutdown valve should be provided at each cargo hose connection in use. Connections not used in transfer operations may be blinded with blank flanges in lieu of valves.

This requirement applies to both «low pressure» and «pressure» systems, and requires ESD valves at the shore connection in both cases. For «low pressure» ships, these manifold valves may be the only ESD valves fitted while for «pressure» ships, the manifold ESD valves are in addition to those fitted at the cargo tank in accordance with 5.6.1.2.

The ship’s manifold pipework outboard of the ESD valve must be designed to withstand the maximum calculated surge pressure at the loading terminal(s) – see IGC 13.3.1. The same pressure rating should be applied to any blank flanges used for blinding manifold connections. Lightweight (weather) blanks should not be used for this purpose.

Manifold connections should be designed in accordance with the relevant SIGTTO/OCIMF Guidelines and should be of adequate strength to withstand the forces imposed by the loading arms. Torsional forces imparted by the separation of emergency release couplers also need to be considered.

SIGTTO also recommends that the section of line between the manifold valve and connection flange is protected by a liquid relief valve in accordance with IGC 5.2.1.6. The relief capacity must be sufficient to handle not just the contents of the ship’s connection but also the parts of any loading arms and emergency release couplers still connected to the ship after an ESD-2 event.

Control systems for ESD valves.

5.6.4:

• The control system for all required emergency shutdown valves should be so arranged that all such valves may be operated by single controls situated in at least two remote locations on the ship. One of these locations should be the control position required by 13.1.3 or cargo control room.
• The control system should also be provided with fusible elements designed to melt at temperatures between 98 °C and 104 °C, which will cause the emergency shutdown valves to close in the event of fire. Locations for such fusible elements should include the tank domes and loading stations.
• Emergency shutdown valves should be of the fail-closed (closed on loss of power) type and be capable of local manual closing operation.
• Emergency shutdown valves in liquid piping should fully close under all service conditions within 30 seconds of actuation. Information about the closing time of the valves and their operating characteristics should be available on board and the closing time should be verifiable and reproducible. Such valves should close smoothly.

The requirements specify that the ESD system may be activated manually from at least two locations, including the cargo control station or room, if installed, or automatically via the melt plugs Also known as thermal fuses, fusible plugs etc.x in case of fire at the liquid or vapour domes of the Gas Freeing of Cargo Tanks on Liquefied Natural Gas Carriers cargo tanks or at the manifolds.

Many types of valve actuators require hydraulic or pneumatic pressure to operate in closing as well as opening directions. The requirement for the ESD valves to fail-closed on loss of power (which means «motive power» in this context) is a safeguard to ensure that the valves will close in the event of loss of pressure in valve remote control systems, for example. The actual arrangement will depend on the specific type of actuator but, without such provision, the valves could stay open even though they received a «close» signal from the ESD system or are in blackout conditions. The requirement for local manual operation is a further safeguard to ensure that the valve can be closed in the event of malfunction of the actuator itself. This topic is further discussed in the article «ESD Functions and Associated Safety Systems».

The requirement for the ESD valves to close within 30 seconds sets an upper limit to the ESD valve closure time, which also cross-refers to the high level shutdown requirements elsewhere in the IGC (see sections 13.3.1 & 18.8.2). The requirement for smooth closure and information about closure times is in recognition that unless the ship and shore systems are linked, the ship’s ESD valves may close against the flow from shore during loading and create a surge pressure. This is addressed in 13.3.1.

Equipment to be stopped by the ESD system.

5.6.1.3:

• Cargo pumps and compressors should be arranged to shutdown automatically if the emergency shutdown valves required by 5.6.1.1 and 5.6.1.2 are closed by the emergency shutdown system required by 5.6.4.

If the ESD valves described above are activated, the flow of cargo must also be stopped by tripping all cargo pumps and compressors in operation. During cargo transfer in port this means the ESD valves close and any cargo pumps or compressors are also stopped if they are transferring cargo between ship and shore or within the ship (eg reliquefaction). At sea, ESD activation again closes the ESD valves and stops the internal flow of cargo within the ship (eg reliquefaction, cargo re-heating, cargo mixing etc). Note: for some «low pressure» ships, the only valves aboard that close on ESD are at the manifolds, so the only result of activating an ESD at sea may be that the cargo pumps and compressors stop because the manifold valves are closed already.

The reference to «cargo pumps» includes all pumps that transfer liquid cargo, including «primary pumps» (for example, deepwell pumps and submerged pumps), «spray pumps», «booster pumps», etc. Likewise the reference to (cargo) «compressors» includes all machines transferring cargo vapour.

When applying the IGC Code to LNG carriers, the requirements for gas fuel compressors to stop on ESD can require some further consideration. This is in part due to an ambiguity in the requirements for these systems which state:

• 16.4.1:
• All equipment (heaters, compressors, filters, etc.) for making up the gas for its use as fuel and related storage tanks should be located in the cargo area in accordance with 3.1.5.4.
• If the equipment is in a enclosed space, the space should be ventilated according to section 12.1 of the Code and be equipped with a fire-extinguishing system according to section 11.5 and with a gas detection system according to section 13.6, as applicable.
• 16.4.2:
• The compressors should be capable of being remotely stopped from a position which is always and easily accessible, and also from the engine-room.
• In addition, the compressors should be capable of automatically stopping when the suction pressure reaches a certain value depending on the set pressure of the vacuum relief valves of the cargo tanks. The automatic shutdown device of the compressors should have a manual resetting.
• Volumetric compressors should be fitted with pressure relief valves discharging into the suction line of the compressor. The size of the pressure relief valves should be determined in such a way that, with the delivery valve kept closed, the maximum pressure does not exceed by more than 10 % the maximum working pressure. The requirements of 5.6.1.3 apply to these compressors.

The ambiguity centres around the last sentence, which can be taken as requiring all gas fuel compressors to stop on an ESD signal or only those that are «volumetric compressors».

SIGTTO recommends that designers of ESD systems for LNG carriers either include the gas fuel compressors in the ESD system or fit additional safeguards as outlined in the article «ESD Functions and Associated Safety Systems». In deciding between these options designers should consider that, if the gas fuel compressors stop on ESD activation, the possibility exists of a «blackout» if the alternative fuel systems required by 16.5.4 & 16.5.5 fail to operate correctly. It should also be noted that the loss of gas-burning capability makes it more difficult to control cargo tank pressures on those LNG carriers with this system. Similar considerations apply for LNG carriers with GCUs that require compressors to be running before they can operate.

The requirement for gas fuel compressors to trip on low cargo tank pressure is a reference to vacuum protection, which is already a requirement under 8.4.2.

Master gas fuel valve.

16.3.7:

• A master gas fuel valve that can be closed from within the machinery space should be provided within the cargo area.
• The valve should be arranged to close automatically if leakage of gas is detected, or loss of ventilation for the duct or casing or loss of pressurization of the double-wall gas piping occurs.

The primary purpose of a master gas fuel valve is to close off the supply of gas to the relevant machinery space for safety and operational purposes. This valve is not required to be closed by the cargo emergency shutdown system.

Although there is no IGC Code requirement for the master gas fuel valve to fail-closed on loss of actuating power, in view of the valve’s importance SIGTTO recommend that the valve actuator is designed to automatically close under failure mode conditions.

Other initiators of cargo system shutdown. In the IGC Code a number of other requirements make direct or indirect reference to the ESD system. These include:

• Chapter 13 – 13.3 Overflow control.

13.3.1:

• Except as provided in 13.3.2, each cargo tank should be fitted with a high liquid level alarm operating independently of other liquid level indicators and giving an audible and visual warning when activated.
• Another sensor operating independently of the high liquid level alarm should automatically actuate a shutoff valve in a manner which will both avoid excessive liquid pressure in the loading line and prevent the tank from becoming liquid full. The emergency shutdown valve referred to in 5.6.1 & 5.6.3 may be used for this purpose. If another valve is used for this purpose, the same information as referred to in 5.6.4 should be available on board.
• During loading, whenever the use of these valves may possibly create a potential excess pressure surge in the loading system, the Administration and the port state authority may agree to alternative arrangements such as limiting the loading rate, etc.

Note: 13.3.2 exempts some small pressure systems, with tanks below 200 m³ capacity or those that can withstand surge pressures, from these requirements.

The Code permits a number of options for the high level shutoff valve and, although the emergency shutdown valve at the cargo tank or at the manifolds may be the usual choice, another separate valve could be designated for this purpose instead.

This requirement is clarified further in Chapter 18 as follows:

• Chapter 18 – 18.8. Cargo transfer operations.

18.8.2:

• The closing time of the valve referred to in 13.3.1 (ie time from shutdown signal to complete valve closure) should not be greater than:

where:

• U = ullage volume at operating signal level (m³);
• LR = maximum loading rate agreed between ship and shore facility (m³/h).

The loading rate should be adjusted to limit surge pressure on valve closure to an acceptable level taking into account the loading hose or arm, the ship and the shore piping systems where relevant.

Read also: Personal health and safety crew members on board a gas carrier

The purpose of the «overfill protection system» is to prevent damage to the cargo tank in case it is over-filled and to prevent the potential release of liquid cargo from the vent mast. The valve closed by this overfill protection sensor may be at the cargo tank or at the manifold. However, the IGC Code also recognises that if these valves are fitted on the individual cargo tanks, the closure of the final valve is the same as closure of the manifold as far as the shore system is concerned. In other words, the valves are closed against the flow, which is likely to create a surge pressure that could be unacceptably high and rupture cargo hoses or arms. This is addressed by relating the loading rate to the valve closure time. Alternatively this hazard is obviated by the arrangement recommended by SIGTTO, ie namely a linked ship-shore shutdown system.

Chapter 8 – 8.4 Vacuum protection systems:

• 8.4.2. Cargo tanks designed to withstand a maximum external pressure differential not exceeding 0,25 bar, or tanks which cannot withstand the maximum external pressure differential that can be attained at maximum discharge rates with no vapour return into the cargo tanks, or by operation of a cargo refrigeration system, or by sending boil-off vapour to the machinery spaces, should be fitted with:
• 8.4.2.1. two independent pressure switches to sequentially alarm and subsequently stop all suction of cargo liquid or vapour from the cargo tank, and refrigeration equipment if fitted, by suitable means at a pressure sufficiently below the maximum external designed pressure differential of the cargo tank.

The clear intent of the Code here is to prevent potential damage to the cargo tank if liquid or vapour withdrawal reduces cargo tank pressure to the extent that tanks could be damaged. While the requirement is for an alarm followed by tripping of the devices causing the suction, the system is sometimes designed so that the second stage alarm causes an ESD trip. A consequence of this arrangement is that a low pressure signal from one tank can affect other tanks and systems.

Chapter 13 – 13.4 Pressure gauges.

13.4.1:

• The vapour space of each cargo tank should be provided with a pressure gauge which should incorporate an indicator in the control position required by 13.1.3. In addition, a high-pressure alarm and, if vacuum protection is required, a low-pressure alarm, should be provided on the navigating bridge. Maximum and minimum allowable pressures should be marked on the indicators. The alarms should be activated before the set pressures are reached. For cargo tank fitted with pressure relief valves, which can be set at more than one set pressure in accordance with 8.2.6, high-pressure alarms should be provided for each set pressure.

This requirement is to draw the attention of ship’s staff to situations when cargo tank pressures are approaching maximum or minimum limits. The navigating bridge is specified for the alarms because this is always manned when the ship is at sea.

In many cases the designers link these alarms as initiators to the ESD system, and include, for example, trips of the Inert Gas – Definition and Pronunciationinert gas plant aboard being used to gas-free the cargo tank where the cargo tank pressure reaches the high pressure alarm. However, caution should be exercised if high or low pressure alarms are used in this way as tripping all cargo equipment, whatever the circumstances, could be undesirable.

Chapter 3 – 3.6 Airlocks.

3.6.4:

• In ships carrying flammable products, electrical equipment which is not of the certified-safe type in spaces protected by air locks should be de-energized upon loss of overpressure in the space (see also 10.2.5.4). Electrical equipment which is not of the certified safe type for manoeuvring, anchoring and mooring equipment as well as the emergency fire pumps should not be located in spaces to be protected by airlocks.

This method of tripping groups of cargo machinery is frequently seen in ships designed to handle multiple grades, as it would be impractical to trip cargo machinery via their individual control circuits.

Summary. As explained above, the 1993 IGC Code requirements for the ESD system can be rather confusing.

It is very important that ship’s staff are provided with a clear description of the system onboard, explaining how it is designed and the relationship between its inputs and outputs.

This is even more crucial in cases where the system is operated by a programmable logic controller, where the inputs cannot be traced in the same way that is possible with connections to an electro-mechanical control system.

Emergency shutdown systems

The main purpose of this article is to clarify the requirements for emergency shutdown relating to the ship/shore interface but, in doing so, it is also necessary to explain the relationship of other «safety systems» covered by the IGC Code as there is a certain amount of overlap. Therefore, this article will cover:

• ESD-1;
• cargo tank overflow protection;
• cargo tank pressure protection;
• gas burning safety system.

Note that ESD-1 does not necessarily include cargo tank vacuum protection. However, SIGTTO recommends consideration be given to a limited number of additional ESD-1 initiators, discussed in the point «ESD Functions and Associated Safety SystemsCargo Transfer Emergency Shutdown System (ESD-1)».

It is a mandatory requirement that gas carriers be provided both with high level alarms and overfill protection, each system independent of the other. High level alarms must also be independent of other level indicators. In simple terms The Code also requires the valve to be actuated «in such a manner that will prevent excessive liquid pressure in the loading line».x, the overfill protection system closes a valve to prevent the tank becoming liquid full. Although the IGC Code does not specify a particular level at which the high level alarm should operate, it is commonly set at a level that will warn the operator some fifteen to twenty minutes before the target finishing level is reached while loading at full loading rate. Therefore, in a ship with a normal filling ratio of, say, 98 %, the alarm would be set at around 95 % tank volume.

To suit ship variations the IGC Code allows the use of either the designated «emergency shutdown valve» or «another valve» for overflow protection. Historically most overflows have occurred not during loading but during discharge. This fact needs to be taken into account when designing the system as it is possible to comply with the IGC Code yet not have a sufficient level of protection against an overflow caused, for example, by internal transfer.

Overflow protection is covered in more detail in the point «ESD Functions and Associated Safety SystemsCargo Tank Overflow Protection».

In addition to relief valves, pressure protection of the containment system is provided by a number of manual and automatic trips that shutdown cargo machinery. In some vessels, particularly those without a Ship/shore interface for safe loading and unloading of LNG/LPGship/shore link, the functions of ESD-1 and «cargo tank protection» are combined and this is the source of yet more confusion. This subject is explained in the point «ESD Functions and Associated Safety SystemsTank Protection».

One area of the IGC Code where different interpretations arise concerns the gas fuel compressors in LNG carriers. When the Code was written in the 1970s, although gas burning in dual-fuel mode during loading and while manoeuvring had already become accepted practice, only a relatively small number of vessels were involved. Technical advances and environmental considerations mean that this is now common and gas burning systems have been accepted as complying with the philosophy of the IGC Code. However, the Code is interpreted by some as requiring this compressor to be tripped on ESD-1 without consideration of other factors. The main practical advantage of separating the gas fuel compressor from the ESD system is that a route is always available for the disposal of excess gas in the event of an ESD-1, rather than causing the cargo tank relief valves to lift. This is of particular significance during loading where the rate of cargo tank pressure rise can be particularly rapid. The alternatives are explained in the point «ESD Functions and Associated Safety SystemsGas Burning Safety System».

It is strongly recommended that extreme caution is used when considering further initiators beyond those described in the article «ESD Functions and Associated Safety Systems». This is particularly relevant when considering in service modifications to software, such as may be undertaken when the vessel is on trials. Any such proposals should be subject to rigorous assessment, including a HAZID to ensure that they provide a real benefit and any modifications should be fully documented and «as built» drawings provided.

It is essential that all personnel involved in cargo operations have an understanding of the functions of the ESD system at a depth relevant to their seniority. Consideration should be given to displaying a flow diagram in the cargo control room as a visual aid.

ESD Processing

In older vessels, the ESD system logic was effectively hard-wired but the next step was to use a programmable logic controller (PLC), in a similar manner to the offshore industry. More recently, ESD logic functions on some vessels have been incorporated into the ship’s integrated automation system. The latter offers certain advantages in terms of flexibility but, if this route is followed, the designer must ensure that the principles of adequate redundancy, robust security and system locking are as good or better than that described here for a system based on PLCs.

Inputs to the ESD system are processed and outputs triggered according to the logic implemented. The processing element is considered in terms of the logic solver, its wiring and connections, power supply and user interface.

Logic solver. The ESD system should include a logic solving element that detects the status of input signals, processes the data and initiates necessary actions. This will typically comprise a programmable safety controller, or equivalent, and associated equipment for input and output signal conditioning.

It is recommended that programmable electronic equipment and all associated input and output devices is type approved by an IACS member Classification Society to ensure their suitability for the marine environment.

ESD logic solvers should be of inherently «fail-safe» design such that an ESD is initiated in the event of likely equipment failures.

Although SIGTTO does not recommend a particular safety integrity level (SIL) for ESD functions, it is recommended that programmable electronic equipment, including its operating system and configuration software, should be proven for use in safety applications. Access to the system should be restricted so that software changes can only be made by suitably authorised persons in accordance with point «ESD Functions and Associated Safety SystemsTesting of Linked ESD Systems for Gas Carriers». The system should be arranged so that there is no access to the configuration when the system is in normal use.

The ESD system should provide volt free contacts, or similar simple output types, to initiate alarms for ESD activation and ESD system fault at the cargo control station.

Considering the importance of the ESD system it is imperative that the manufacturer is instructed to provide a comprehensive fault-finding guide for the use of the crew to enable them to undertake logical fault finding in the event of a malfunction of the system.

Power supply. The ESD system should normally be supplied from the main source of electrical power. The incoming main power supply should be monitored and an alarm initiated at the cargo control station in case of failure.

The ESD system should be supplied automatically from a standby source of electrical power in the event that the main power supply to the system fails. This may be from the emergency source of power or a dedicated back-up supply. The incoming back-up power supply should be monitored and an alarm initiated at the cargo control station in case of failure.

Ship/Shore Links

At the highest level, the purpose of the ship/shore link (SSL) is to transmit, without delay, a signal from one party to the other, ie ship to shore or vice versa. Various link technologies are currently used in the liquefied gas industry:

• electric,
• fibre-optic,
• radio telemetry,
• pneumatic.

The first three of these systems meet the high level technical requirement and, furthermore, have the capacity to transfer additional information such as telephone links, data for mooring tension monitoring systems etc. These latter attributes are recognised as valuable add-on benefits of linked systems but, since they are not the prime reason for the link, are not discussed further here beyond noting that the provision of these additional features should not jeopardise the primary function of the ESD link system. SIGTTO does not recommend any particular link technology, but provides in the article «Linked ESD Systems at Both LNG and LPG TerminalsESD Terminal» the experiences of operators such that the reader can make an informed decision as to which system, or systems, would be most suitable for his particular installation. Furthermore, suggestions are given for pin configuration of connectors as these are a regular source of problems at the ship/shore interface.

It is also noted that the first generation linked systems were often based on pneumatic technology and many terminals have this facility as a back-up or secondary means of providing a shut-down link. While some small time lag is unavoidable with pneumatic links, they are simple and certainly better than no link in event of non-availability of the main system.

It will be interesting: Hazards of LNG and Relevant Gases

A fundamental principle of complex safety systems, such as the linked ESD system, is that all parts should be capable of being tested in a way that demonstrates positively the good functioning of the total system. Given the criticality of the ESD system it is also vital that it is regularly tested, both for the functionality of the link and for the initiators.

Pendant ESD units. During the development of the SIGTTO intrinsically-safe ship/shore link in 1987 it was recognised that the industry would need time to implement change and for the new equipment to be installed. Pendant units were therefore incorporated into the design, primarily to cover this interim period but also to provide a form of backup. Two types are available:

• one designed to be plugged into the Jetty Assembly, with the pendant box passed to an unequipped ship;
• the other for plugging into the pendant connection on the ship’s junction box, with the pendant passed to the shore.

Although these pendants allow shutdown by the opposite party, they rely on manual intervention and are not a substitute for a system that ensures simultaneous shutdown of ship and shore equipment.

Emergency operation of normally linked systems. The practice of linking ESD ship and shore systems is widespread in the LNG business because it demonstrably reduces risk, principally from that of generating excessive surge in the event of a unilateral shutdown. This implies that the linked system should be viewed as a critical safety system and so operations without a fully functioning linked system should be approached with extreme caution.

It is recognised that, despite testing procedures, circumstances may arise where the ESD link is not available. It is therefore recommended that the terminal and ship discuss contingency planning on how to proceed in these circumstances. Although pre-arrival testing will lessen the chances of a fault with the ship/shore link being discovered only after the ship has berthed, such occurrences are not unknown and contingency planning should cover this eventuality. While the most prudent course of action may be to delay transfer until a repair can be effected, berth scheduling, commercial constraints and tidal or weather conditions will all put limitations on the time available, so a decision may be made to proceed without a working ESD link.

The procedure to adopt in event of failure of the primary link system should be addressed as part of a terminal’s emergency procedures. The following points are pertinent:

1. Provision of a back-up link system capable of providing, as a minimum, linked transfer of the ESD-1 signal. A pneumatic system is acceptable for this, see point «Linked ESD Systems at Both LNG and LPG TerminalsPneumatic ESD Link System».
2. The spare parts holding philosophy for the primary system should be reviewed to ensure that an appropriate level of spares is held to facilitate speedy repair and mitigate against common failures.
3. Notwithstanding the foregoing, it is recommended that each terminal performs a surge calculation on their specific pipeline arrangement to identify the maximum safe transfer rate as this information will be vital if the link system is not available. Without the results of such calculations it is not possible to assess the risks involved in unlinked operations.

Mitigation measures may also include:

• making use of a Pendant ESD unit, if available;
• reducing the loading or discharge rate;
• increasing the number of personnel on duty to monitor operations;
• confirmation of effective and redundant communication links between ship and terminal control rooms. Most types of link include telecoms and well as ESD-1 signals, so it is possible that the former are still available or partially available. If not, alternative communication methods need to be established;
• at many terminals shore personnel are routinely stationed in the ship’s cargo control room to ensure effective communications. Where this is not normal practice consideration should be given to providing such personnel, at least during the most critical periods like starting cargo, ramping up to full transfer rate, topping off etc.

Effect of Non-Core Ship/Shore Services

Certain port states have made local regulations requiring additional services to be supplied to ships from shore when the ship is in normal service:

• on-shore power supply (so-called «Cold-Ironing»);
• ballast and cooling water.

It is outside the scope of this paper to discuss the reasons for these proposals. However, the issue of whether these additional requirements might impact ESD philosophy in the Safety, Risks and Security Aspects in Liquefied Natural Gas Industryliquefied gas industry certainly needs to be addressed. At the time of writing, there is no consensus on design concepts for these proposals and, without these details, it is difficult to be definitive about the impact on ESD systems. However, given the basic philosophy, it is sensible that the ESD-1 signal should initiate a controlled shut down of these additional services. This is to ensure that the vessel remains in a safe operational condition at all times.

As has already been stated, the industry has developed emergency release systems principally to mitigate against escalation in the event of break-out from the berth. A basic design requirement of any proposed electrical power supply from shore must, therefore, be that the ship’s electrical supply is not interrupted in the event of ESD-2 and that subsequent disconnection of the electrical connection must only be achieved without creating a potential incendive spark in a hazardous area.

With respect to ESD initiators, the most hazardous material being transferred is the cargo. Therefore, it is unlikely that these additional services will generate the need for more initiators than currently recommended by the IGC Code and established practice on shore.

Emerging Gas Trades

The drive to commercialise marginal or stranded gas fields or to develop small scale markets has recently led to the construction of LNG carriers with onboard regasification capability, schemes involving floating LNG liquefaction and proposals for LNG shuttle tankers either to top up regas vessels or to distribute product from floating liquefaction plants. To date, there is little practical experience of these new technologies.

Notwithstanding that these are evolving technologies, the impact on the design of ESD systems needs to be carefully considered at the outset to ensure that the principles of safe shutdown and emergency release, as outlined in this document, are upheld. So far as practicable, all vessels should conform to the basic philosophy for ship/shore ESD set out in this document during periods when they are connected ship-to-ship as well as to loading or discharging terminals. Systems should be developed that will allow depressurizing and quick release of ship-to-ship cargo transfer systems in an emergency without venting gas to the atmosphere.

Key recommendations

To conclude, the key recommendations of these documents are as follows:

1. For all bulk transfer operations involving liquefied gas carriers, including ship to ship transfer, linked ESD systems should be provided and used.
2. All ESD system designs must incorporate the manual and automatic initiators listed in the IGC Code. In case it is intended to include additional initiators, a rigorous examination should be conducted to ensure that such extension of the ESD system results in a real safety benefit.
3. Regular testing is imperative and contingency plans should be in place in the event of non-availability of the ESD link system.
4. System modifications to be subject to strict procedures, including documentation.
5. A functional flowchart of the ESD and related systems should be provided in the CCR.
6. Terminal operators using electric ship/shore links, in particular those using the Pyle-National connection should adopt a standardised pin configuration as outlined in EN1532.
7. For LNG carriers, if it is proposed that the design of the ESD system includes shut down of the gas burning system or gas combustion unit on ESD-1, the consequent problems of pressure rise in the cargo system should be considered. Conversely, if these systems are not to be tripped on ESD-1, then adequate safeguards must be included to ensure that the overall safety of the cargo system is not compromised.
8. All relevant shore initiation signals should be processed by the shore ESD system and passed to the ship as a single ESD-1 trip signal, not as individual signals.
9. All ship/shore links should pass ESD-1 signals in both the shore → ship and ship → shore directions.
10. All terminals should arrange for surge calculations to be performed on their specific pipeline arrangement to establish the maximum safe transfer rate achievable. The results should be retained in their permanent ship/shore reference documentation.
11. Users of electric ship/shore links that incorporate telephone connections should review the system in place to protect against an incendive spark when the cable is connected or disconnected or if the cable is accidentally severed.

Author

Olga Nesvetailova

Freelancer

Literature

1. IMO, «International Code for the Construction and Equipment of Ships Carrying Liquefied Gases in Bulk» (IGC Code), 1993 as amended.
2. IMO, «International Convention for the Safety of Life at Sea», 1974 – SOLAS, as amended.
3. EN 1532 «Installation and equipment for liquefied natural gas – Ship to shore interface and port operations».
4. EN 50020 «Electrical Apparatus for Potentially Explosive Atmospheres».
5. SIGTTO, «Guidelines for Hazard Analysis as an Aid to Management of Safe Operations», 1992.
6. SIGTTO, «Liquefied Gas Handling Principles on Ships and in Terminals», 3^rd Edition 2000.
7. SIGTTO, «Guidelines for the Alleviation of Excessive Surge Pressures on ESD», 1987.
8. SIGTTO, «Recommendations and Guidelines for Linked Ship/Shore Emergency Shut-Down of Liquefied Gas Cargo Transfer», 1987.
9. SIGTTO, «Accident Prevention – The Use of Hoses & Hard Arms».
10. SIGTTO, «Ship Shore Interface – Safe Working Practice».
11. OCIMF/SIGTTO «Recommendations for Manifolds for Refrigerated Liquefied Natural Gas Carriers (LNG)», 1994.
12. MAIB report No. 10/2007 «Major LPG Leak from Gas Carrier Ennerdale».