Isolation planning I: selecting the isolation standard

HSE-332 described the levels of process isolation, from a single closed valve to positive isolation by blind or spool removal, and explained why valves pass and pressure gets trapped. HSE-221 showed how an isolation standard links each level to the hazard and task. This lesson goes one step further for oil and gas sites: how a planner decides which level each isolation point needs, what does and does not count as an isolation device, how isolations work on wells and pipelines where the source cannot be stopped, and what to do when the standard cannot be met.

Why selection must be risk-based

Using positive isolation for every job would be very safe but impractical: installing blinds requires breaking containment, which has its own risk, takes time and may need lifting equipment. Using single valves for everything would be fast but would expose workers to passing valves on high-hazard lines. A risk-based isolation standard, of the kind described in the UK HSE's guidance on safe isolation of plant and equipment (HSG253) and used by many oil and gas companies, sets the minimum isolation for each combination of hazard and task. Planners then apply it consistently instead of deciding job by job.

The factors that set the isolation level

Most oil and gas isolation standards consider the same factors, though they weight them differently:

• The hazard of the fluid: toxic or sour fluids, such as H2S-bearing gas and acid gas, sit at the top; flammable hydrocarbons next; hot fluids, steam and high-pressure water; then low-hazard fluids such as instrument air or fresh water.
• The pressure and the amount that could be released, which together set how bad a leak past the isolation would be.
• The nature of the task: whether people will enter the equipment, break containment, do hot work, or only work on the outside.
• The duration of the isolation, because a valve that holds for an hour may pass after a week, and long isolations are more likely to be disturbed.
• The condition and history of the valves, including whether they have been leak tested and whether they are known to pass.
• Whether the isolation can be proven, for example by a bleed between two valves.

An illustrative selection matrix

The table shows the kind of minimum isolation a company standard might set. It is illustrative; each company sets its own levels, and many add rules for specific services such as acid gas, amine or methanol.

Look at the pattern in the right-hand column: whenever people will be inside equipment or doing hot work inside it, the answer is positive isolation regardless of the fluid. And for sour service, even breaking containment usually needs positive isolation, which is itself installed while the equipment is protected by double block and bleed. The blind goes in under a temporary isolation and then becomes the isolation for the rest of the job.

Writing the rule down as logic

Because the matrix is applied many times a day, some companies build it into their electronic permit systems so that the system proposes the minimum isolation and flags any plan that falls short. The program below shows the idea with simple rules based on the matrix above. It takes each isolation point in a job and returns the minimum method, adding a step up for long durations and for valves known to pass.

# Propose a minimum isolation method for each point (rules based on an illustrative matrix).
LEVELS = ["single valve", "double block and bleed", "positive isolation"]

def minimum(fluid, high_pressure, task, days, valve_passes):
    if task == "entry or hot work inside":
        return LEVELS[2]
    if fluid == "sour":
        level = 2 if task == "break containment" else 1
    elif fluid == "hydrocarbon":
        level = 1 if (task == "break containment" or high_pressure) else 0
    elif fluid == "hot":
        level = 1 if task == "break containment" else 0
    else:  # low hazard
        level = 0
    if days > 7 and task == "break containment":
        level = min(2, level + 1)        # long isolations step up
    if valve_passes:
        level = min(2, level + 1)        # a known passing valve cannot be relied on
    return LEVELS[level]

points = [
    ("fuel gas to treater burner", "hydrocarbon", False, "break containment", 1, False),
    ("sour inlet to test separator", "sour", True, "break containment", 2, False),
    ("separator outlet to tank", "hydrocarbon", False, "entry or hot work inside", 3, False),
    ("instrument air to level valve", "low", False, "break containment", 1, False),
    ("compressor suction, 10-day overhaul", "hydrocarbon", True, "break containment", 10, False),
    ("glycol reboiler hot oil supply", "hot", False, "outside only", 1, True),
]
for name, fluid, hp, task, days, passes in points:
    print(f"{name:<38} -> {minimum(fluid, hp, task, days, passes)}")

fuel gas to treater burner             -> double block and bleed
sour inlet to test separator           -> positive isolation
separator outlet to tank               -> positive isolation
instrument air to level valve          -> single valve
compressor suction, 10-day overhaul    -> positive isolation
glycol reboiler hot oil supply         -> double block and bleed

Each result follows a clear reason. The sour inlet to the test separator needs positive isolation because containment will be broken in sour service. The separator outlet to the tank needs positive isolation because people will be inside. The compressor suction steps up from double block and bleed to positive isolation because the overhaul will last ten days. The hot oil supply to the glycol reboiler would normally need only a locked single valve for outside work, but the valve is known to pass, so the program steps it up to double block and bleed. A rule written this way can be audited and argued about in advance, which is much better than being argued about at the worksite.

What is not an isolation device

Some valves and devices look like isolations but must never be relied on as one.

• Control valves are designed to throttle flow, not to seal, and they can be moved by the control system at any time.
• Check valves stop reverse flow only when flow is moving, and they leak, especially in dirty service.
• Emergency shutdown valves are part of the safety system and may be opened by a reset from the control room; using them as isolations also takes them out of their safety role. Where a company standard does allow an actuated valve to be used, it requires the actuator's power source to be removed and locked, and the valve to be locked mechanically, as Pasadena showed.
• Pressure regulators and relief valves are not isolations.
• Closed valves on instrument and sample lines are easy to forget but can carry full process pressure into an opened system.

Utilities and small connections

Isolation lists often focus on the main process lines and miss the small ones. Every connection to the equipment must be on the list, including instrument impulse lines, sample points, chemical injection lines, nitrogen and steam utility connections, fuel gas to burners and pilots, instrument air to actuators, drains and vents, relief connections and heat tracing. Electrical supplies to motors, heaters, cathodic protection near the work and analyzers must be isolated by a qualified person, and instrument signals that could start equipment, such as an automatic start on low pressure, must be disabled through the override system.

Isolations on wells

A producing well is a source that cannot be switched off. Work on a wellhead or on equipment directly connected to it relies on barriers inside the well and on the wellhead. The industry principle, set out in well servicing guidance in both countries, is to have at least two independent, tested barriers between the reservoir and the work when the well can flow. Examples of barriers include closed and tested wellhead master valves, a back-pressure valve or plug set in the tubing hanger, a downhole plug, or kill-weight fluid in the well. Which barriers are acceptable for which work is set by the operator's well servicing procedures and, for drilling and servicing operations, the bridging document with the contractor. Facility crews working on flowlines and battery equipment usually isolate at the wellhead wing valve and master valve, locked and with the well shut in, and confirm with a bleed and pressure monitoring. HSE-331 covered well control and servicing at awareness level.

Isolations on pipelines

Pipelines bring another problem: the nearest valves may be a long way off, and the line between them may hold a large volume of gas or liquid. Isolating a section of pipeline for repair can mean closing and locking mainline block valves at each end, depressuring the whole section to a flare or into another line, and then confirming isolation with pressure monitoring over time. Where that is impractical, pipeline companies use specialized methods: line stop or stopple fittings, which are installed by hot tapping and insert a plug into the live line; inflatable or mechanical pipeline plugs inserted from a launcher; and in some cases freeze plugs. All of these are specialist activities under their own procedures and are outside routine facility work.

In the US, PHMSA's pipeline safety rules, operator qualification requirements and each operator's procedures govern pipeline isolation work, and API and industry guidance set out practice for hot tapping and plugging.

When the standard cannot be met

Sometimes the plant was not designed for the isolation the standard requires: there is only one valve where double block and bleed is needed, or no blind flange where positive isolation is needed. Good practice is not to quietly accept less. The planner should raise a formal deviation, assess the risk, consider alternatives such as extending the isolation to a point further away where double valves exist, depressuring a larger section or waiting for a shutdown, and if a lower isolation is accepted, add compensating measures such as continuous pressure monitoring on the isolated section, a shorter job, extra protective equipment for the crew and a higher approval level. The deviation should also be recorded so that engineering can add the missing valves or blind flanges in a future modification.