(a) You must design, install, use, maintain, and test production safety equipment in a manner to ensure the safety and protection of the human, marine, and coastal environments. For production safety systems operated in subfreezing climates, you must use equipment and procedures that account for floating ice, icing, and other extreme environmental conditions that may occur in the area. Before you commence production on a new production facility:

(1) BSEE must approve your production safety system application, as required in § 250.842.

(2) You must request a preproduction inspection by notifying the District Manager at least 72 hours before you plan to commence initial production, as required under § 250.880(a)(1).

(b) For all new production systems on fixed leg platforms, you must comply with API RP 14J (incorporated by reference as specified in § 250.198);

(c) For all new floating production systems (FPSs) (e.g., column-stabilized-units (CSUs); floating production, storage and offloading facilities (FPSOs); tension-leg platforms (TLPs); and spars), you must:

(1) Comply with API RP 14J;

(2) Meet the production riser standards of API RP 2RD (incorporated by reference as specified in § 250.198), provided that you may not install single bore production risers from floating production facilities;

(3) Design all stationkeeping (i.e., anchoring and mooring) systems for floating production facilities to meet the standards of API RP 2SK and API RP 2SM (both incorporated by reference as specified in § 250.198); and

(4) Design stationkeeping (i.e., anchoring and mooring) systems for floating facilities to meet the structural requirements of §§ 250.900 through 250.921.

(d) If there are any conflicts between the documents incorporated by reference and the requirements of this subpart, you must follow the requirements of this subpart.

(e) You may use alternate procedures or equipment during operations after receiving approval from the District Manager. You must present your proposed alternate procedures or equipment as required by § 250.141.

(f) You may apply for a departure from the operating requirements of this subpart as provided by § 250.142. Your written request must include a justification showing why the departure is necessary and appropriate.

(a) SPPE equipment. You must install only safety and pollution prevention equipment (SPPE) considered certified under paragraph (b) of this section or accepted under paragraph (c) of this section. BSEE considers the following equipment to be types of SPPE:

(1) Surface safety valves (SSV) and actuators, including those installed on injection wells capable of natural flow;

(2) Boarding shutdown valves (BSDV) and their actuators. For subsea wells, the BSDV is the surface equivalent of an SSV on a surface well;

(3) Underwater safety valves (USV) and actuators;

(4) Subsurface safety valves (SSSV) and associated safety valve locks and landing nipples; and

(5) Gas lift shutdown valves (GLSDV) and their actuators associated with subsea systems.

(b) Certification of SPPE. SPPE that is manufactured and marked pursuant to ANSI/API Spec. Q1 (incorporated by reference as specified in § 250.198), is considered as certified SPPE under this part. All other SPPE is considered as not certified, unless approved in accordance with paragraph (c) of this section.

(c) Accepting SPPE manufactured under other quality assurance programs. BSEE may exercise its discretion to accept SPPE manufactured under a quality assurance program other than ANSI/API Spec. Q1, provided that the alternative quality assurance program is verified as equivalent to API Spec. Q1 by an appropriately qualified entity and that the operator submits a request to BSEE containing relevant information about the alternative program and receives BSEE approval. In addition, an operator may request that BSEE accept SPPE that is marked with a third-party certification mark other than the API monogram. All requests under this paragraph should be submitted to the Chief, Office of Offshore Regulatory Programs; Bureau of Safety and Environmental Enforcement; VAE-ORP; 45600 Woodland Road, Sterling, VA 20166.

(a) All SSVs, BSDVs, USVs, and GLSDVs and their actuators must meet all of the specifications contained in ANSI/API Spec. 6A and API Spec. 6AV1 (both incorporated by reference in § 250.198).

(b) All SSSVs and their actuators must meet all of the specifications and recommended practices of ANSI/API Spec. 14A and ANSI/API RP 14B, including all annexes (both incorporated by reference as specified in § 250.198). Subsurface-controlled SSSVs are not allowed on subsea wells.

(c) Requirements derived from the documents incorporated in this section for SSVs, BSDVs, SSSVs, USVs, GLSDVs, and their actuators, include, but are not limited to, the following:

(1) You must ensure that each device is designed to function in the conditions to which it may be exposed; including temperature, pressure, flow rates, and environmental conditions.

(i) The device design must be tested by an independent test agency according to the test requirements in the appropriate standard for that device (API Spec. 6AV1 or ANSI/API Spec. 14A), as identified in paragraphs (a) and (b) of this section.

(ii) You must maintain a description of the process you used to ensure the device is designed to function as required in paragraphs (a) and (c)(1) of this section and provide that description to BSEE upon request.

(iii) If you remove any SPPE from service and install the device at a different location, you must have a qualified third party review and certify that each device will function as designed under the conditions to which it may be exposed.

(2) All materials and parts must meet the original equipment manufacturer specifications and acceptance criteria.

(3) The device must pass applicable validation tests and functional tests performed by an API-licensed test agency.

(4) You must have requalification testing performed following manufacture design changes.

(5) You must comply with and document all manufacturing, traceability, quality control, and inspection requirements.

(6) You must follow specified installation, testing, and repair protocols.

(7) You must use only qualified parts, procedures, and personnel to repair or redress equipment.

(d) You must install and use SPPE according to the following table.

(e) You must retain all documentation related to the manufacture, installation, testing, repair, redress, and performance of the SPPE until 1 year after the date of decommissioning of the equipment.

(a) You must follow the failure reporting requirements contained in section 10.20.7.4 of ANSI/API Spec. 6A for SSVs, BSDVs, GLSDVs and USVs. You must follow the failure reporting requirements contained in section 7.10 of ANSI/API Spec. 14A and Annex F of ANSI/API RP 14B for SSSVs (all incorporated by reference in § 250.198). Within 30 days after the discovery and identification of the failure, you must provide a written notice of equipment failure to the manufacturer of such equipment and to BSEE through the Chief, Office of Offshore Regulatory Programs, unless BSEE has designated a third party as provided in paragraph (d) of this section. A failure is any condition that prevents the equipment from meeting the functional specification or purpose.

(b) You must ensure that an investigation and a failure analysis are performed within 120 days of the failure to determine the cause of the failure. If the investigation and analyses are performed by an entity other than the manufacturer, you must ensure that the analysis report is submitted to the manufacturer and to BSEE through the Chief, Office of Offshore Regulatory Programs, unless BSEE has designated a third party as provided in paragraph (d) of this section. You must also ensure that the results of the investigation and any corrective action are documented in the analysis report.

(c) If the equipment manufacturer notifies you that it has changed the design of the equipment that failed or if you have changed operating or repair procedures as a result of a failure, then you must, within 30 days of such changes, report the design change or modified procedures in writing to BSEE through the Chief, Office of Offshore Regulatory Programs, unless BSEE has designated a third party as provided in paragraph (d) of this section.

(d) BSEE may designate a third party to receive the data required by paragraphs (a) through (c) of this section on behalf of BSEE. If BSEE designates a third party, you must submit the information required in this section to the designated third party, as directed by BSEE.

(a) In zones known to contain hydrogen sulfide (H2S) or in zones where the presence of H2S is unknown, as defined in § 250.490, you must conduct production operations in accordance with that section and other relevant requirements of this subpart.

(b) You must receive approval through the DWOP process (§§ 250.286 through 250.295) for production operations in HPHT environments known to contain H2S or in HPHT environments where the presence of H2S is unknown.

For wells using dry trees or for which you intend to install dry trees, you must equip all tubing installations open to hydrocarbon-bearing zones with subsurface safety devices that will shut off the flow from the well in the event of an emergency unless, after you submit a request containing a justification, the District Manager determines the well to be incapable of natural flow. You must install flow couplings above and below the subsurface safety devices. These subsurface safety devices include the following devices and any associated safety valve lock and landing nipple:

(a) An SSSV, including either:

(1) A surface-controlled SSSV; or

(2) A subsurface-controlled SSSV.

(b) An injection valve.

(c) A tubing plug.

(d) A tubing/annular subsurface safety device.

All surface-controlled and subsurface-controlled SSSVs, safety valve locks, and landing nipples installed in the OCS must conform to the requirements specified in §§ 250.801 through 250.803.

You must equip all tubing installations open to a hydrocarbon-bearing zone that is capable of natural flow with a surface-controlled SSSV, except as specified in §§ 250.813, 250.815, and 250.816.

(a) The surface controls must be located on the site or at a BSEE-approved remote location. You may request District Manager approval to situate the surface controls at a remote location.

(b) You must equip dry tree wells not previously equipped with a surface-controlled SSSV, and dry tree wells in which a surface-controlled SSSV has been replaced with a subsurface-controlled SSSV, with a surface-controlled SSSV when the tubing is first removed and reinstalled.

You may submit an APM or a request to the District Manager for approval to equip a dry tree well with a subsurface-controlled SSSV in lieu of a surface-controlled SSSV, if the subsurface-controlled SSSV is installed in a well equipped with a surface-controlled SSSV that has become inoperable and cannot be repaired without removal and reinstallation of the tubing. If you remove and reinstall the tubing, you must equip the well with a surface-controlled SSSV.

You must design, install, and operate (including repair, maintain, and test) an SSSV to ensure its reliable operation.

(a) You must install the SSSV at a depth at least 100 feet below the mudline within 2 days after production is established. When warranted by conditions such as permafrost, unstable bottom conditions, hydrate formation, or paraffin problems, the District Manager may approve an alternate setting depth on a case-by-case basis.

(b) The well must not be open to flow while the SSSV is inoperable, except when flowing the well is necessary for a particular operation such as cutting paraffin or performing other routine operations as defined in § 250.601.

(c) Until the SSSV is installed, the well must be attended in the immediate vicinity so that any necessary emergency actions can be taken while the well is open to flow. During testing and inspection procedures, the well must not be left unattended while open to production unless you have installed a properly operating SSSV in the well.

(d) You must design, install, maintain, inspect, repair, and test all SSSVs in accordance with ANSI/API RP 14B (incorporated by reference in § 250.198). For additional SSSV testing requirements, refer to § 250.880.

(a) You must equip all new dry tree completions (perforated but not placed on production) and completions that are shut-in for a period of 6 months with one of the following:

(1) A pump-through-type tubing plug;

(2) A surface-controlled SSSV, provided the surface control has been rendered inoperative; or

(3) An injection valve capable of preventing backflow.

(b) When warranted by conditions such as permafrost, unstable bottom conditions, hydrate formation, and paraffin problems, the District Manager must approve the setting depth of the subsurface safety device for a shut-in well on a case-by-case basis.

You must install a surface-controlled SSSV or an injection valve capable of preventing backflow in all injection wells. This requirement is not applicable if the District Manager determines that the well is incapable of natural flow. You must verify the no-flow condition of the well annually.

(a) You may remove a wireline- or pumpdown-retrievable subsurface safety device without further authorization or notice, for a routine operation that does not require BSEE approval of a Form BSEE-0124, Application for Permit to Modify (APM). For a list of these routine operations, see § 250.601. The removal period must not exceed 15 days.

(b) Prior to removal, you must identify the well by placing a sign on the wellhead stating that the subsurface safety device was removed. You must note the removal of the subsurface safety device in the records required by § 250.890. If the master valve is open, you must ensure that a trained person (see § 250.891) is in the immediate vicinity to attend the well and take any necessary emergency actions.

(c) You must monitor a platform well when a subsurface safety device has been removed, but a person does not need to remain in the well-bay area continuously if the master valve is closed. If the well is on a satellite structure, it must be attended by a support vessel, or a pump-through plug must be installed in the tubing at least 100 feet below the mudline and the master valve must be closed, unless otherwise approved by the appropriate District Manager.

(d) You must not allow the well to flow while the subsurface safety device is removed, except when it is necessary for the particular operation for which the SSSV is removed. The provisions of this paragraph are not applicable to the testing and inspection procedures specified in § 250.880.

(a) You must equip all tubing installations that have a wireline- or pumpdown-retrievable subsurface safety device with a landing nipple, with flow couplings or other protective equipment above and below it to provide for the setting of the device.

(b) The control system for all surface-controlled SSSVs must be an integral part of the platform emergency shutdown system (ESD).

(c) In addition to the activation of the ESD by manual action on the platform, the system may be activated by a signal from a remote location. Surface-controlled SSSVs must close in response to shut-in signals from the ESD and in response to the fire loop or other fire detection devices.

All wellhead SSVs and their actuators must conform to the requirements specified in §§ 250.801 through 250.803.

You must install, maintain, inspect, repair, and test all SSVs in accordance with API STD 6AV2 (incorporated by reference in § 250.198). If any SSV does not operate properly, or if any gas and/or liquid fluid flow is observed during the leakage test as described in § 250.880, then you must shut-in all sources to the SSV and repair or replace the valve before resuming production.

(a) If your facility is impacted or will potentially be impacted by an emergency situation (e.g., an impending National Weather Service-named tropical storm or hurricane, ice events, or post-earthquake), you must:

(1) Properly install a subsurface safety device on any well that is not yet equipped with a subsurface safety device and that is capable of natural flow, as soon as possible, with due consideration being given to personnel safety.

(2) You must shut-in (by closing the SSV and the surface-controlled SSSV) the following types of wells:

(i) All oil wells, and

(ii) All gas wells requiring compression.

(b) Closure of the SSV must not exceed 45 seconds after automatic detection of an abnormal condition or actuation of an ESD. The surface-controlled SSSV must close within 2 minutes after the shut-in signal has closed the SSV. The District Manager must approve any alternative design-delayed closure time of greater than 2 minutes based on the mechanical/production characteristics of the individual well.

(a) For wells using subsea (wet) trees or for which you intend to install subsea trees, you must equip all tubing installations open to hydrocarbon-bearing zones with subsurface safety devices that will shut off the flow from the well in the event of an emergency. You must also install flow couplings above and below the subsurface safety devices. For instances where the well at issue is incapable of natural flow, you may seek District Manager approval for using alternative procedures or equipment, if you propose to use a subsea safety system that is not capable of shutting off the flow from the well in the event of an emergency. Subsurface safety devices include the following and any associated safety valve lock and landing nipple:

(1) A surface-controlled SSSV;

(2) An injection valve;

(3) A tubing plug; and

(4) A tubing/annular subsurface safety device.

(b) After installing the subsea tree, but before the rig or installation vessel leaves the area, you must test all valves and sensors to ensure that they are operating as designed and meet all the conditions specified in this subpart.

All SSSVs, safety valve locks, and landing nipples installed on the OCS must conform to the requirements specified in §§ 250.801 through 250.803 and any Deepwater Operations Plan (DWOP) required by §§ 250.286 through 250.295.

You must equip all tubing installations open to a hydrocarbon-bearing zone that is capable of natural flow with a surface-controlled SSSV, except as specified in §§ 250.829 and 250.830. The surface controls must be located on the host facility.

You must design, install, and operate (including repair, maintain, and test) an SSSV to ensure its reliable operation.

(a) You must install the SSSV at a depth at least 100 feet below the mudline. When warranted by conditions, such as unstable bottom conditions, permafrost, hydrate formation, or paraffin problems, the District Manager may approve an alternate setting depth on a case-by-case basis.

(b) The well must not be open to flow while an SSSV is inoperable, unless specifically approved by the District Manager in an APM.

(c) You must design, install, maintain, inspect, repair, and test all SSSVs in accordance with your Deepwater Operations Plan (DWOP) and ANSI/API RP 14B (incorporated by reference in § 250.198). For additional SSSV testing requirements, refer to § 250.880.

(a) You must equip all new subsea tree completions (perforated but not placed on production) and completions shut-in for a period of 6 months with one of the following:

(1) A pump-through-type tubing plug;

(2) An injection valve capable of preventing backflow; or

(3) A surface-controlled SSSV, provided the surface control has been rendered inoperative. For purposes of this section, a surface-controlled SSSV is considered inoperative if, for a direct hydraulic control system, you have bled the hydraulics from the control line and have isolated it from the hydraulic control pressure. If your controls employ an electro-hydraulic control umbilical and the hydraulic control pressure to the individual well cannot be isolated, a surface-controlled SSSV is considered inoperative if you perform the following:

(i) Disable the control function of the surface-controlled SSSV within the logic of the programmable logic controller which controls the subsea well;

(ii) Place a pressure alarm high on the control line to the surface-controlled SSSV of the subsea well; and

(iii) Close the USV and at least one other tree valve on the subsea well.

(b) When warranted by conditions, such as unstable bottom conditions, permafrost, hydrate formation, and paraffin problems, the District Manager must approve the setting depth of the subsurface safety device for a shut-in well on a case-by-case basis.

You must install a surface-controlled SSSV or an injection valve capable of preventing backflow in all injection wells. This requirement is not applicable if the District Manager determines that the well is incapable of natural flow. You must verify the no-flow condition of the well annually.

If a necessary alteration or disconnection of the pipeline or umbilical of any subsea well would affect your ability to monitor casing pressure or to test any subsea valves or equipment, you must contact the appropriate District Office at least 48 hours in advance and submit a repair or replacement plan to conduct the required monitoring and testing. You must not alter or disconnect until the repair or replacement plan is approved.

(a) You must equip all tubing installations that have a wireline- or pump down-retrievable subsurface safety device installed after May 31, 1988, with a landing nipple, with flow couplings, or other protective equipment above and below it to provide for the setting of the device.

(b) The control system for all surface-controlled SSSVs must be an integral part of the platform ESD.

(c) In addition to the activation of the ESD by manual action on the platform, the system may be activated by a signal from a remote location.

All USVs, including those designated as primary or secondary, and any alternate isolation valve (AIV) that acts as a USV, if applicable, and their actuators, must conform to the requirements specified in §§ 250.801 through 250.803. A production master or wing valve may qualify as a USV under ANSI/API Spec. 6A and API Spec. 6AV1 (both incorporated by reference in § 250.198).

(a) Primary USV (USV1). You must install and designate one USV on a subsea tree as the USV1. The USV1 must be located upstream of the choke valve. As provided in paragraph (b) of this section, you must inform BSEE if the primary USV designation changes.

(b) Secondary USV (USV2). You may equip your tree with two or more valves qualified to be designated as a USV, one of which may be designated as the USV2. If the USV1 fails to operate properly or exhibits a leakage rate greater than allowed in § 250.880, you must notify the appropriate District Office and designate the USV2 or another qualified valve (e.g., an AIV) that meets all the requirements of this subpart for USVs as the USV1. The USV2 must be located upstream of the choke.

You must install, maintain, inspect, repair, and test any valve designated as the primary USV in accordance with this subpart, your DWOP (as specified in §§ 250.286 through 250.295), and API STD 6AV2 (incorporated by reference in § 250.198). For additional USV testing requirements, refer to § 250.880.

You must install a BSDV on the pipeline boarding riser. All new BSDVs and any BSDVs removed from service for remanufacturing or repair and their actuators installed on the OCS must meet the requirements specified in §§ 250.801 through 250.803. In addition, you must:

(a) Ensure that the internal design pressure(s) of the pipeline(s), riser(s), and BSDV(s) is fully rated for the maximum pressure of any input source and complies with the design requirements set forth in subpart J, unless BSEE approves an alternate design.

(b) Use a BSDV that is fire rated for 30 minutes, and is pressure rated for the maximum allowable operating pressure (MAOP) approved in your pipeline application.

(c) Locate the BSDV within 10 feet of the first point of access to the boarding pipeline riser (i.e., within 10 feet of the edge of platform if the BSDV is horizontal, or within 10 feet above the first accessible working deck, excluding the boat landing and above the splash zone, if the BSDV is vertical).

(d) Install a temperature safety element (TSE) and locate it within 5 feet of each BSDV.

You must install, inspect, maintain, repair, and test all new BSDVs, as well as all BSDVs that you remove from service for remanufacturing or repair, in accordance with API STD 6AV2 (incorporated by reference in § 250.198) for SSVs. If any BSDV does not operate properly or if any gas fluid and/or liquid fluid flow is observed during the leakage test, as described in § 250.880, you must shut-in all sources to the BSDV and immediately repair or replace the valve.

(a) If your facility is impacted or will potentially be impacted by an emergency situation (e.g., an impending National Weather Service-named tropical storm or hurricane, ice events, or post-earthquake), you must shut-in all subsea wells unless otherwise approved by the District Manager. A shut-in is defined as a closed BSDV, USV, GLSDV, and surface-controlled SSSV.

(b) When operating a mobile offshore drilling unit (MODU) or other type of workover or intervention vessel in an area with subsea infrastructure, you must:

(1) Suspend production from all wells that could be affected by a dropped object, including upstream wells that flow through the same pipeline; or

(2) Establish direct, real-time communications between the MODU or other type of workover or intervention vessel and the production facility control room and develop a dropped objects plan, as required in § 250.714. If an object is dropped, you must immediately secure the well directly under the MODU or other type of workover or intervention vessel while simultaneously communicating with the platform to shut-in all affected wells. You must also maintain without disruption, and continuously verify, communication between the production facility and the MODU or other type of workover or intervention vessel. If communication is lost between the MODU or other type of workover or intervention vessel and the platform for 20 or more minutes, you must shut-in all wells that could be affected by a dropped object.

(c) In the event of an emergency, you must operate your production system according to the valve closure times in the applicable tables in §§ 250.838 and 250.839 for the following conditions:

(1) Process upset. In the event an upset in the production process train occurs downstream of the BSDV, you must close the BSDV in accordance with the applicable tables in §§ 250.838 and 250.839. You may reopen the BSDV to blow down the pipeline to prevent hydrates, provided you have secured the well(s) and ensured adequate protection.

(2) Pipeline pressure safety high and low (PSHL) sensor. In the event that either a high or a low pressure condition is detected by a PSHL sensor located upstream of the BSDV, you must secure the affected well and pipeline, and all wells and pipelines associated with a dual or multi pipeline system, by closing the BSDVs, USVs, and surface-controlled SSSVs in accordance with the applicable tables in §§ 250.838 and 250.839. You must obtain approval from the appropriate District Manager to resume production in the unaffected pipeline(s) of a dual or multi pipeline system. If the PSHL sensor activation was a false alarm, you may return the wells to production without contacting the appropriate District Manager.

(3) ESD/TSE (platform). In the event of an ESD activation that is initiated because of a platform ESD or platform TSE not associated with the BSDV, you must close the BSDV, USV, and surface-controlled SSSV in accordance with the applicable tables in §§ 250.838 and 250.839.

(4) Subsea ESD (platform) or BSDV TSE. In the event of an emergency shutdown activation that is initiated by the host platform due to an abnormal condition subsea, or a TSE associated with the BSDV, you must close the BSDV, USV, and surface-controlled SSSV in accordance with the applicable tables in §§ 250.838 and 250.839.

(5) Subsea ESD (MODU). In the event of an ESD activation that is initiated by a dropped object from a MODU or other type of workover or intervention vessel, you must secure all wells in the proximity of the MODU or other type of workover or intervention vessel by closing the USVs and surface-controlled SSSVs in accordance with the applicable tables in §§ 250.838 and 250.839. You must notify the appropriate District Manager before resuming production.

(d) Following an ESD or fire, you must bleed your low pressure (LP) and high pressure (HP) hydraulic systems in accordance with the applicable tables in §§ 250.838 and 250.839 to ensure that the valves are locked out of service and cannot be reopened inadvertently.

(a) If you have an electro-hydraulic control system, you must:

(1) Design the subsea control system to meet the valve closure times listed in paragraphs (b) and (d) of this section or your approved DWOP; and

(2) Verify the valve closure times upon installation. The District Manager may require you to verify the closure time of the USV(s) through visual authentication by diver or ROV.

(b) You must comply with the maximum allowable valve closure times and hydraulic system bleeding requirements listed in the following table or your approved DWOP as long as communication is maintained with the platform or with the MODU or other type of workover vessel:

(c) If you have an electro-hydraulic control system and experience a loss of communications (EH Loss of Comms), you must comply with the following:

(1) If you can meet the EH Loss of Comms valve closure timing conditions specified in the table in paragraph (d) of this section, you must notify the appropriate District Office within 12 hours of detecting the loss of communication.

(2) If you cannot meet the EH Loss of Comms valve closure timing conditions specified in the table in paragraph (d) of this section, you must notify the appropriate District Office immediately after detecting the loss of communication. You must shut-in production by initiating a bleed of the low pressure (LP) hydraulic system or the high pressure (HP) hydraulic system within 120 minutes after loss of communication. You must bleed the other hydraulic system within 180 minutes after loss of communication.

(3) You must obtain approval from the appropriate District Manager before continuing to produce after loss of communication when you cannot meet the EH Loss of Comms valve closure times specified in the table in paragraph (d) of this section. In your request, include an alternate valve closure timing table that your system is able to achieve. The appropriate District Manager may also approve an alternate hydraulic bleed schedule to allow for hydrate mitigation and orderly shut-in.

(d) If you experience a loss of communications, you must comply with the maximum allowable valve closure times and hydraulic system bleeding requirements listed in the following table or your approved DWOP:

(a) If you have a direct-hydraulic control system, you must:

(1) Design the subsea control system to meet the valve closure times listed in this section or your approved DWOP; and

(2) Verify the valve closure times upon installation. The District Manager may require you to verify the closure time of the USV(s) through visual authentication by diver or ROV.

(b) You must comply with the maximum allowable valve closure times and hydraulic system bleeding requirements listed in the following table or your approved DWOP:

You must design, install, and maintain all production facilities and equipment including, but not limited to, separators, treaters, pumps, heat exchangers, fired components, wellhead injection lines, compressors, headers, and flowlines in a manner that is efficient, safe, and protects the environment.

(a) You must protect all platform production facilities with a basic and ancillary surface safety system designed, analyzed, installed, tested, and maintained in operating condition in accordance with the provisions of API RP 14C (incorporated by reference as specified in § 250.198). If you use processing components other than those for which Safety Analysis Checklists are included in API RP 14C, you must utilize the analysis technique and documentation specified in API RP 14C to determine the effects and requirements of these components on the safety system. Safety device requirements for pipelines are contained in § 250.1004.

(b) You must design, install, inspect, repair, test, and maintain in operating condition all platform production process piping in accordance with API RP 14E and API 570 (both incorporated by reference as specified in § 250.198). The District Manager may approve temporary repairs to facility piping on a case-by-case basis for a period not to exceed 30 days.

(c) If you plan to make a modification to any production safety system that also involves a major modification to the platform structure, you must follow the requirements in § 250.900(b)(2). A major modification to a platform structure is defined in § 250.900(b)(2).

(a) Before you install or modify a production safety system, you must submit a production safety system application to the District Manager. The District Manager must approve your production safety system application before you commence production through or otherwise use the new or modified system. The application must include the design documentation prescribed as follows:

(b) You must develop and maintain the following design documents and make them available to BSEE upon request:

(c) In the production safety system application, you must also certify the following:

(1) That all electrical systems were designed according to API RP 14F or API RP 14FZ, as applicable (incorporated by reference in § 250.198);

(2) That the design documents for the mechanical and electrical systems that you are required to submit under paragraph (a) of this section are sealed by a licensed professional engineer. For modified systems, only the modifications are required to be sealed by a licensed professional engineer(s). The professional engineer must be licensed in a State or Territory of the United States and have sufficient expertise and experience to perform the duties; and

(3) That a hazards analysis was performed in accordance with § 250.1911 and API RP 14J (incorporated by reference in § 250.198), and that you have a hazards analysis program in place to assess potential hazards during the operation of the facility.

(d) Within 90 days after placing new or modified production safety systems in service, you must submit to the District Manager the as-built diagrams for the new or modified production safety systems outlined in paragraphs (a)(1), (2), and (3) of this section. You must certify in an accompanying letter that the as-built design documents have been reviewed for compliance with applicable regulations and accurately represent the new or modified system as installed. The drawings must be clearly marked “as-built.”

(e) You must maintain approved and supporting design documents required under paragraphs (a) and (b) of this section at your offshore field office nearest the OCS facility or at other locations conveniently available to the District Manager. These documents must be made available to BSEE upon request and must be retained for the life of the facility. All approved designs are subject to field verifications.

You must comply with the production safety system requirements in §§ 250.851 through 250.872, in addition to the practices contained in API RP 14C (incorporated by reference as specified in § 250.198).

(a) Pressure vessels (including heat exchangers) and fired vessels supporting production operations must meet the requirements in the following table:

(b) Operating pressure ranges. You must use pressure recording devices to establish the new operating pressure ranges of pressure vessels at any time that the normalized system pressure changes by 50 psig or 5 percent. Once system pressure has stabilized, pressure recording devices must be utilized to establish the new operating pressure ranges. The pressure recording devices must document the pressure range over time intervals that are no less than 4 hours and no more than 30 days long. You must maintain the pressure recording information you used to determine current operating pressure ranges at your field office nearest the OCS facility or at another location conveniently available to the District Manager for as long as the information is valid.

(c) Pressure shut-in sensors must be set according to the following table (initial set points for pressure sensors must be set utilizing gauge readings and engineering design):

(a) You must:

(1) Equip flowlines from wells with both PSH and PSL sensors. You must locate these sensors in accordance with section A.1 of API RP 14C (incorporated by reference as specified in § 250.198).

(2) Use pressure recording devices to establish the new operating pressure ranges of flowlines at any time when the normalized system pressure changes by 50 psig or 5 percent, whichever is higher. The pressure recording devices must document the pressure range over time intervals that are no less than 4 hours and no more than 30 days long.

(3) Maintain the most recent pressure recording information you used to determine operating pressure ranges at your field office nearest the OCS facility or at another location conveniently available to the District Manager for as long as the information is valid.

(b) Flowline shut-in sensors must meet the requirements in the following table (initial set points for pressure sensors must be set using gauge readings and engineering design):

(c) If a well flows directly to a pipeline before separation, the flowline and valves from the well located upstream of and including the header inlet valve(s) must have a working pressure equal to or greater than the maximum shut-in pressure of the well unless the flowline is protected by one of the following:

(1) A relief valve which vents into the platform flare scrubber or some other location approved by the District Manager. You must design the platform flare scrubber to handle, without liquid-hydrocarbon carryover to the flare, the maximum-anticipated flow of hydrocarbons that may be relieved to the vessel; or

(2) Two SSVs with independent PSH sensors connected to separate relays and sensing points and installed with adequate volume upstream of any block valve to allow sufficient time for the SSVs to close before exceeding the maximum allowable working pressure. Each independent PSH sensor must close both SSVs along with any associated flowline PSL sensor. If the maximum shut-in pressure of a dry tree satellite well(s) is greater than 1 1/2 times the maximum allowable pressure of the pipeline, a pressure safety valve (PSV) of sufficient size and relief capacity to protect against any SSV leakage or fluid hammer effect may be required by the District Manager. The PSV must be installed upstream of the host platform boarding valve and vent into the platform flare scrubber or some other location approved by the District Manager.

(d) If a well flows directly to the pipeline from a header without prior separation, the header, the header inlet valves, and pipeline isolation valve must have a working pressure equal to or greater than the maximum shut-in pressure of the well unless the header is protected by the safety devices as outlined in paragraph (c) of this section.

(e) If you are installing flowlines constructed of unbonded flexible pipe on a floating platform, you must:

(1) Review the manufacturer's Design Methodology Verification Report and the independent verification agent's (IVA) certificate for the design methodology contained in that report to ensure that the manufacturer has complied with the requirements of ANSI/API Spec. 17J (incorporated by reference in § 250.198);

(2) Determine that the unbonded flexible pipe is suitable for its intended purpose;

(3) Submit to the District Manager the manufacturer's design specifications for the unbonded flexible pipe; and

(4) Submit to the District Manager a statement certifying that the pipe is suitable for its intended use and that the manufacturer has complied with the IVA requirements of ANSI/API Spec. 17J (incorporated by reference in § 250.198).

(f) Automatic pressure or flow regulating choking devices must not prevent the normal functionality of the process safety system that includes, but is not limited to, the flowline pressure safety devices and the SSV.

(g) You may install a single flow safety valve (FSV) on the platform to protect multiple subsea pipelines or wells that tie into a single pipeline riser provided that you install an FSV for each riser on the platform and test it in accordance with the criteria prescribed in § 250.880(c)(2)(v).

(h) You may install a single PSHL sensor on the platform to protect multiple subsea pipelines that tie into a single pipeline riser provided that you install a PSHL sensor for each riser on the platform and locate it upstream of the BSDV.

You must ensure that:

(a) All shutdown devices, valves, and pressure sensors function in a manual reset mode;

(b) Sensors with integral automatic reset are equipped with an appropriate device to override the automatic reset mode;

(c) All pressure sensors are equipped to permit testing with an external pressure source; and

(d) All level sensors are equipped to permit testing through an external bridle on all new vessel installations where possible, depending on the type of vessel for which the level sensor is used.

(a) For floating production units equipped with an auto slew system, you must integrate the auto slew control system with your process safety system allowing for automatic shut-in of the production process, including the sources (subsea wells, subsea pumps, etc.) and releasing of the buoy. Your safety system must immediately initiate a process system shut-in according to §§ 250.838 and 250.839 and release the buoy to prevent hydrocarbon discharge and damage to the subsea infrastructure when the following are encountered:

(1) Your buoy is clamped,

(2) Your auto slew mode is activated, and

(3) You encounter a ship heading/position failure or an exceedance of the rotational tolerances of the clamped buoy.

(b) For floating production units equipped with swivel stack arrangements, you must equip the portion of the swivel stack containing hydrocarbons with a leak detection system. Your leak detection system must be tied into your production process surface safety system allowing for automatic shut-in of the system. Upon seal system failure and detection of a hydrocarbon leak, your surface safety system must immediately initiate a process system shut-in according to §§ 250.838 and 250.839.

The ESD system must conform to the requirements of Appendix C, section C1, of API RP 14C (incorporated by reference as specified in § 250.198), and the following:

(a) The manually operated ESD valve(s) must be quick-opening and non-restricted to enable the rapid actuation of the shutdown system. Electronic ESD stations must be wired as de-energize to trip circuits or as supervised circuits. Because of the key role of the ESD system in the platform safety system, all ESD components must be of high quality and corrosion resistant and stations must be uniquely identified. Only ESD stations at the boat landing may utilize a loop of breakable synthetic tubing in lieu of a valve or electric switch. This breakable loop is not required to be physically located on the boat landing, but must be accessible from a vessel adjacent to or attached to the facility.

(b) You must maintain a schematic of the ESD that indicates the control functions of all safety devices for the platforms on the platform, at your field office nearest the OCS facility, or at another location conveniently available to the District Manager, for the life of the facility.

(a) Engine exhaust. You must equip all engine exhausts to comply with the insulation and personnel protection requirements of API RP 14C, section 4.2 (incorporated by reference as specified in § 250.198). You must equip exhaust piping from diesel engines with spark arresters.

(b) Diesel engine air intake. You must equip diesel engine air intakes with a device to shut down the diesel engine in the event of runaway (i.e., overspeed). You must equip diesel engines that are continuously attended with either remotely operated manual or automatic shutdown devices. You must equip diesel engines that are not continuously attended with automatic shutdown devices. The following diesel engines do not require a shutdown device: Engines for fire water pumps; engines on emergency generators; engines that power BOP accumulator systems; engines that power air supply for confined entry personnel; temporary equipment on non-producing platforms; booster engines whose purpose is to start larger engines; and engines that power portable single cylinder rig washers.

(a) You must install a pressure relief system or an adequate vent on the glycol regenerator (reboiler) to prevent over pressurization. The discharge of the relief valve must be vented in a nonhazardous manner.

(b) You must install the FSV on the dry glycol inlet to the glycol contact tower as near as practical to the glycol contact tower.

(c) You must install the shutdown valve (SDV) on the wet glycol outlet from the glycol contact tower as near as practical to the glycol contact tower.

(a) You must equip compressor installations with the following protective equipment as required in API RP 14C, sections A.4 and A.8 (incorporated by reference as specified in § 250.198).

(1) A pressure safety high (PSH) sensor, a pressure safety low (PSL) sensor, a pressure safety valve (PSV), a level safety high (LSH) sensor, and a level safety low (LSL) sensor to protect each interstage and suction scrubber.

(2) A temperature safety high (TSH) sensor in the discharge piping of each compressor cylinder or case discharge.

(3) You must design the PSH and PSL sensors and LSH controls protecting compressor suction and interstage scrubbers to actuate automatic SDVs located in each compressor suction and fuel gas line so that the compressor unit and the associated vessels can be isolated from all input sources. All automatic SDVs installed in compressor suction and fuel gas piping must also be actuated by the shutdown of the prime mover. Unless otherwise approved by the District Manager, gas-well gas affected by the closure of the automatic SDV on the suction side of a compressor must be diverted to the pipeline, diverted to a flare or vent in accordance with §§ 250.1160 or 250.1161, or shut-in at the wellhead.

(4) You must install a blowdown valve on the discharge line of all compressor installations that are 1,000 horsepower (746 kilowatts) or greater.

(b) Once system pressure has stabilized, you must use pressure recording devices to establish the new operating pressure ranges for compressor discharge sensors whenever the normalized system pressure changes by 50 psig or 5 percent, whichever is higher. The pressure recording devices must document the pressure range over time intervals that are no less than 4 hours and no more than 30 days long. You must maintain the most recent pressure recording information that you used to determine operating pressure ranges at your field office nearest the OCS facility or at another location conveniently available to the District Manager.

(c) Pressure shut-in sensors must be set according to the following table (initial set points for pressure sensors must be set utilizing gauge readings and engineering design):

(a) On fixed facilities, to protect all areas where production-handling equipment is located, you must install firefighting systems that meet the requirements of this paragraph. You must install a firewater system consisting of rigid pipe with fire hose stations and/or fixed firewater monitors to protect all areas where production-handling equipment is located. Your firewater system must include installation of a fixed water spray system in enclosed well-bay areas where hydrocarbon vapors may accumulate.

(1) Your firewater system must conform to API RP 14G (incorporated by reference as specified in § 250.198).

(2) Fuel or power for firewater pump drivers must be available for at least 30 minutes of run time during a platform shut-in. If necessary, you must install an alternate fuel or power supply to provide for this pump operating time unless the District Manager has approved an alternate firefighting system. In addition:

(i) As of September 7, 2017, you must have equipped all new firewater pump drivers with automatic starting capabilities upon activation of the ESD, fusible loop, or other fire detection system.

(ii) For electric-driven firewater pump drivers, to provide for a potential loss of primary power, you must install an automatic transfer switch to cross over to an emergency power source in order to maintain at least 30 minutes of run time. The emergency power source must be reliable and have adequate capacity to carry the locked-rotor currents of the fire pump motor and accessory equipment.

(iii) You must route power cables or conduits with wires installed between the fire water pump drivers and the automatic transfer switch away from hazardous-classified locations that can cause flame impingement. Power cables or conduits with wires that connect to the fire water pump drivers must be capable of maintaining circuit integrity for not less than 30 minutes of flame impingement.

(3) You must post, in a prominent place on the facility, a diagram of the firefighting system showing the location of all firefighting equipment.

(4) For operations in subfreezing climates, you must furnish evidence to the District Manager that the firefighting system is suitable for those conditions.

(5) You must obtain approval from the District Manager before installing any firefighting system.

(6) All firefighting equipment located on a facility must be in good working order whether approved as the primary, secondary, or ancillary firefighting system.

(b) On floating facilities, to protect all areas where production-handling equipment is located, you must install a firewater system consisting of rigid pipe with fire hose stations and/or fixed firewater monitors. You must install a fixed water spray system in enclosed well-bay areas where hydrocarbon vapors may accumulate. Your firewater system must conform to the USCG requirements for firefighting systems on floating facilities.

(c) Except as provided in paragraph (c)(1) and (2) of this section, on fixed and floating facilities, if you are required to maintain a firewater system and the system becomes inoperable, you must shut-in your production operations while making the necessary repairs. For fixed facilities only, you may continue your production operations on a temporary basis while you make the necessary repairs, provided that:

(1) You request that the appropriate District Manager approve the use of a chemical firefighting system on a temporary basis (for a period up to 7 days) while you make the necessary repairs;

(2) If you are unable to complete repairs during the approved time period because of circumstances beyond your control, the District Manager may grant multiple extensions to your previously approved request to use a chemical firefighting system for periods up to 7 days each.

For fixed platforms:

(a) On minor unmanned platforms, you may use a U.S. Coast Guard type and size rating “B-II” portable dry chemical unit (with a minimum UL Rating (US) of 60-B:C) or a 30-pound portable dry chemical unit, in lieu of a water system, as long as you ensure that the unit is available on the platform when personnel are on board.

(1) A minor platform is a structure with zero to five completions and no more than one item of production processing equipment.

(2) An unmanned platform is one that is not attended 24 hours a day or one on which personnel are not quartered overnight.

(b) On major platforms and minor manned platforms, you may use a firefighting system using chemicals-only in lieu of a water-based system if the District Manager determines that the use of a chemical system provides equivalent fire-protection control and would not increase the risk to human safety.

(1) A major platform is a structure with either six or more completions or zero to five completions with more than one item of production processing equipment.

(2) A minor platform is a structure with zero to five completions and no more than one item of production processing equipment.

(3) A manned platform is one that is attended 24 hours a day or one on which personnel are quartered overnight.

(c) On major platforms and minor manned platforms, to obtain approval to use a chemical-only fire prevention and control system in lieu of a water system under paragraph (b) of this section, you must submit to the District Manager:

(1) A justification for asserting that the use of a chemical system provides equivalent fire-protection control. The justification must address fire prevention, fire protection, fire control, and firefighting on the platform; and

(2) A risk assessment demonstrating that a chemical-only system would not increase the risk to human safety. You must provide the following and any other important information in your risk assessment:

(d) On major or minor platforms, if BSEE has approved your request to use a chemical-only fire suppressant system in lieu of a water system under paragraphs (b) and (c) of this section, and if you make an insignificant change to your platform subsequent to that approval, you must document the change and maintain the documentation for the life of the facility at either the facility or nearest field office for BSEE review and/or inspection. Do not submit this documentation to the District Manager. However, if you make a significant change to your platform (e.g., placing a storage vessel with a capacity of 100 barrels or more on the facility, adding production equipment), or if you plan to man an unmanned platform temporarily, you must submit a new request for approval, including an updated risk assessment if previously required, to the appropriate District Manager. You must maintain, for the life of the facility, the most recent documentation that you submitted to BSEE at the facility or nearest field office.

When you install foam firefighting systems as part of a firefighting system that protects production handling areas, you must:

(a) Annually conduct an inspection of the foam concentrates and their tanks or storage containers for evidence of excessive sludging or deterioration;

(b) Annually send samples of the foam concentrate to the manufacturer or authorized representative for quality condition testing. You must have the sample tested to determine the specific gravity, pH, percentage of water dilution, and solid content. Based on these results, the foam must be certified by an authorized representative of the manufacturer as suitable firefighting foam consistent with the original manufacturer's specifications. The certification document must be readily accessible for field inspection. In lieu of sampling and certification, you may choose to replace the total inventory of foam with suitable new stock;

(c) Ensure that the quantity of concentrate meets design requirements, and that tanks or containers are kept full, with space allowed for expansion.

For production processing areas only:

(a) You must install fire (flame, heat, or smoke) sensors in all enclosed classified areas. You must install gas sensors in all inadequately ventilated, enclosed classified areas.

(1) Adequate ventilation is defined as ventilation that is sufficient to prevent accumulation of significant quantities of vapor-air mixture in concentrations over 25 percent of the lower explosive limit. An acceptable method of providing adequate ventilation is one that provides a change of air volume each 5 minutes or 1 cubic foot of air-volume flow per minute per square foot of solid floor area, whichever is greater.

(2) Enclosed areas (e.g., buildings, living quarters, or doghouses) are defined as those areas confined on more than 4 of their 6 possible sides by walls, floors, or ceilings more restrictive to air flow than grating or fixed open louvers and of sufficient size to allow entry of personnel.

(3) A classified area is any area classified Class I, Group D, Division 1 or 2, following the guidelines of API RP 500 (incorporated by reference as specified in § 250.198), or any area classified Class I, Zone 0, Zone 1, or Zone 2, following the guidelines of API RP 505 (incorporated by reference as specified in § 250.198).

(b) All detection systems must be capable of continuous monitoring. Fire-detection systems and portions of combustible gas-detection systems related to the higher gas-concentration levels must be of the manual-reset type. Combustible gas-detection systems related to the lower gas-concentration level may be of the automatic-reset type.

(c) A fuel-gas odorant or an automatic gas-detection and alarm system is required in enclosed, continuously manned areas of the facility which are provided with fuel gas. A gas detection system is not required for living quarters and doghouses that do not contain a gas source and that are not located in a classified area.

(d) The District Manager may require the installation and maintenance of a gas detector or alarm in any potentially hazardous area.

(e) Fire- and gas-detection systems must be an approved type, and designed and installed in accordance with API RP 14C, API RP 14G, API RP 14F, API RP 14FZ, API RP 500, and API RP 505 (all incorporated by reference as specified in § 250.198), provided that, if compliance with any provision of those standards would be in conflict with applicable regulations of the U.S. Coast Guard, compliance with the U.S. Coast Guard regulations controls.

You must design, install, and maintain electrical equipment and systems in accordance with the requirements in § 250.114.

You must have a program of erosion control in effect for wells or fields that have a history of sand production. The erosion-control program may include sand probes, X-ray, ultrasonic, or other satisfactory monitoring methods. You must maintain records for each lease that indicate the wells that have erosion-control programs in effect. You must also maintain the results of the programs for at least 2 years and make them available to BSEE upon request.

(a) You must equip pump installations with the protective equipment required in API RP 14C, Appendix A—A.7, Pumps (incorporated by reference as specified in § 250.198).

(b) You must use pressure recording devices to establish the new operating pressure ranges for pump discharge sensors at any time when the normalized system pressure changes by 50 psig or 5 percent, whichever is higher. Once system pressure has stabilized, pressure recording devices must be utilized to establish the new operating pressure ranges. The pressure recording devices must document the pressure range over time intervals that are no less than 4 hours and no more than 30 days long. You must only maintain the most recent pressure recording information that you used to determine operating pressure ranges at your field office nearest the OCS facility or at another location conveniently available to the District Manager.

(c) Pressure shut-in sensors must be set according to the following table (initial set points for pressure sensors must be set utilizing gauge readings and engineering design):

(d) The PSL must be placed into service when the pump discharge pressure has risen above the PSL sensing point, or within 45 seconds of the pump coming into service, whichever is sooner.

(e) You may exclude the PSH and PSL sensors on small, low-volume pumps such as chemical injection-type pumps. This is acceptable if such a pump is used as a sump pump or transfer pump, has a discharge rating of less than 1/2 gallon per minute (gpm), discharges into piping that is 1 inch or less in diameter, and terminates in piping that is 2 inches or larger in diameter.

(f) You must install a TSE in the immediate vicinity of all pumps in hydrocarbon service or those powered by platform fuel gas.

(g) The pump maximum discharge pressure must be determined using the maximum possible suction pressure and the maximum power output of the driver as appropriate for the pump type and service.

You must maintain all personnel safety equipment located on a facility, whether required or not, in good working condition.

(a) You must equip temporary quarters with all safety devices required by API RP 14C, Appendix C (incorporated by reference as specified in § 250.198). The District Manager must approve the safety system/safety devices associated with the temporary quarters prior to installation.

(b) The District Manager may require you to install a temporary firewater system for temporary quarters in production processing areas or other classified areas.

(c) Temporary equipment associated with the production process system, including equipment used for well testing and/or well clean-up, must be approved by the District Manager.

(d) The District Manager must approve temporary generators that would require a change to the electrical one-line diagram in § 250.842(a).

On fixed OCS facilities, you may use non-metallic piping (such as that made from polyvinyl chloride, chlorinated polyvinyl chloride, and reinforced fiberglass) only in accordance with the requirements of § 250.841(b).

(a) Surface or subsurface safety devices must not be bypassed or blocked out of service unless they are temporarily out of service for startup, maintenance, or testing. You may take only the minimum number of safety devices out of service. Personnel must monitor the bypassed or blocked-out functions until the safety devices are placed back in service. Any surface or subsurface safety device which is temporarily out of service must be flagged. A designated visual indicator must be used to identify the bypassed safety device. You must follow the monitoring procedures as follows:

(1) If you are using a non-computer-based system, meaning your safety system operates primarily with pneumatic supply or non-programmable electrical systems, you must monitor bypassed safety devices by positioning monitoring personnel at either the control panel for the bypassed safety device, or at the bypassed safety device, or at the component that the bypassed safety device would be monitoring when in service. You must also ensure that monitoring personnel are able to view all relevant essential operating conditions until all bypassed safety devices are placed back in service and are able to initiate shut-in action in the event of an abnormal condition.

(2) If you are using a computer-based technology system, meaning a computer-controlled electronic safety system such as supervisory control and data acquisition and remote terminal units, you must monitor bypassed safety devices by maintaining instantaneous communications at all times among remote monitoring personnel and the personnel performing maintenance, testing, or startup. Until all bypassed safety devices are placed back in service, you must also position monitoring personnel at a designated control station that is capable of the following:

(i) Displaying all relevant essential operating conditions that affect the bypassed safety device, well, pipeline, and process component. If electronic display of all relevant essential conditions is not possible, you must have field personnel monitoring the level gauges (sight glass) and pressure gauges in order to know the current operating conditions. You must be in communication with all field personnel monitoring the gauges;

(ii) Controlling the production process equipment and the entire safety system;

(iii) Displaying a visual indicator when safety devices are placed in the bypassed mode; and

(iv) Upon command, overriding the bypassed safety device and initiating shut-in action in the event of an abnormal condition.

(3) You must not bypass for startup any element of the emergency support system or other support system required by API RP 14C, Appendix C (incorporated by reference as specified in § 250.198) without first receiving BSEE approval to depart from this operating procedure. These systems include, but are not limited to:

(i) The ESD system to provide a method to manually initiate platform shutdown by personnel observing abnormal conditions or undesirable events. You do not have to receive approval from the District Manager for manual reset and/or initial charging of the system;

(ii) The fire loop system to sense the heat of a fire and initiate platform shutdown, and other fire detection devices (flame, thermal, and smoke) that are used to enhance fire detection capability. You do not have to receive approval from the District Manager for manual reset and/or initial charging of the system;

(iii) The combustible gas detection system to sense the presence of hydrocarbons and initiate alarms and platform shutdown before gas concentrations reach the lower explosive limit;

(iv) Adequate ventilation;

(v) The containment system to collect escaped liquid hydrocarbons and initiate platform shutdown;

(vi) Subsurface safety valves, including those that are self-actuated (subsurface-controlled SSSVs) or those that are activated by an ESD system and/or a fire loop (surface-controlled SSSV). You do not have to receive approval from the District Manager for routine operations in accordance with § 250.817;

(vii) The pneumatic supply system; and

(viii) The system for discharging gas to the atmosphere.

(4) In instances where components of the ESD, as listed in paragraph (a)(3) of this section, are bypassed for maintenance, precautions must be taken to provide the equivalent level of protection that existed prior to the bypass.

(b) When wells are disconnected from producing facilities and blind flanged, or equipped with a tubing plug, or the master valves have been locked closed, you are not required to comply with the provisions of API RP 14C (incorporated by reference as specified in § 250.198) or this regulation concerning the following:

(1) Automatic fail-close SSVs on wellhead assemblies, and

(2) The PSH and PSL sensors in flowlines from wells.

(c) When pressure or atmospheric vessels are isolated from production facilities (e.g., inlet valve locked closed or inlet blind-flanged) and are to remain isolated for an extended period of time, safety device testing in accordance with API RP 14C (incorporated by reference as specified in § 250.198), or this subpart is not required, with the exception of the PSV, unless the vessel is open to the atmosphere.

(d) All open-ended lines connected to producing facilities and wells must be plugged or blind-flanged, except those lines designed to be open-ended such as flare or vent lines.

(e) On all new production safety system installations, component process control devices and component safety devices must not be installed utilizing the same sensing points.

(f) All pneumatic control panels and computer based control stations must be labeled according to API RP 14C nomenclature.

(a) You may apply industry standard Class B, Class C, or Class B/C logic to applicable PSL sensors installed on process equipment. If the device may be bypassed for greater than 45 seconds, you must monitor the bypassed devices in accordance with § 250.869(a). You must document on your field test records any use of a PSL sensor with a time delay greater than 45 seconds. For purposes of this section, PSL sensors are categorized as follows:

(1) Class B safety devices have logic that allows for the PSL sensors to be bypassed for a fixed time period (typically less than 15 seconds, but not more than 45 seconds). Examples include sensors used in conjunction with the design of pump and compressor panels such as PSL sensors, lubricator no-flows, and high-water jacket temperature shutdowns.

(2) Class C safety devices have logic that allows for the PSL sensors to be bypassed until the component comes into full service (i.e., the time at which the startup pressure equals or exceeds the set pressure of the PSL sensor, the system reaches a stabilized pressure, and the PSL sensor clears). If a Class C safety device is bypassed, you must monitor the device until it is in full service.

(3) Class B/C safety devices have logic that allows for the PSL sensors to incorporate a combination of Class B and Class C circuitry. These devices are used to ensure that the PSL sensors are not unnecessarily bypassed during startup and idle operations, (e.g., Class B/C bypass circuitry activates when a pump is shut down during normal operations). The PSL sensor remains bypassed until the pump's start circuitry is activated and either:

(i) The Class B timer expires no later than 45 seconds from start activation, or

(ii) The Class C bypass is initiated until the pump builds up pressure above the PSL sensor set point and the PSL sensor comes into full service.

(b) If you do not install time delay circuitry that bypasses activation of PSL sensor shutdown logic for a specified time period on process and product transport equipment during startup and idle operations, you must manually bypass (pin out or disengage) the PSL sensor, with a time delay not to exceed 45 seconds.

All welding, burning, and hot-tapping activities must be conducted according to the specific requirements in § 250.113.

(a) You must equip atmospheric vessels used to process and/or store liquid hydrocarbons or other Class I liquids as described in API RP 500 or 505 (both incorporated by reference in § 250.198) with protective equipment identified in API RP 14C, section A.5 (incorporated by reference in § 250.198). Transport tanks approved by the U.S. Department of Transportation, that are sealed and not connected via interconnected piping to the production process train and that are used only for storage of refined liquid hydrocarbons or Class I liquids, are not required to be equipped with the protective equipment identified in API RP 14C, section A.5. The atmospheric vessels connected to the process system that contains a Class I liquid and the associated pumps must be reflected on the design documents listed in § 250.842(a)(1) through (4) and (b)(3).

(b) You must ensure that all atmospheric vessels are designed and maintained to ensure the proper working conditions for LSH sensors. The LSH sensor bridle must be designed to prevent different density fluids from impacting sensor functionality.

(c) You must ensure that all atmospheric vessels are designed, installed, and maintained to prevent pollution, including the displacement of oil out of an overboard water outlet, as required by § 250.300(b)(3) and (4).

If you choose to install a subsea gas lift system, you must design your system as approved in your DWOP or as follows:

(a) Design the gas lift supply pipeline in accordance with API RP 14C (incorporated by reference as specified in § 250.198) for the gas lift supply system located on the platform.

(b) Meet the applicable requirements in the following table:

(c) Follow the valve closure times and hydraulic bleed requirements according to your approved DWOP for the following:

(1) Electro-hydraulic control system with gas lift,

(2) Electro-hydraulic control system with gas lift with loss of communications,

(3) Direct-hydraulic control system with gas lift.

(d) Follow the gas lift system valve testing requirements according to the following table:

If you choose to install a subsea water injection system, your system must comply with your approved DWOP, which must meet the following minimum requirements:

(a) Adhere to the water injection requirements described in API RP 14C (incorporated by reference as specified in § 250.198) for the water injection equipment located on the platform. In accordance with § 250.830, either a surface-controlled SSSV or a water injection valve (WIV) that is self-activated and not controlled by emergency shut-down (ESD) or sensor activation must be installed in a subsea water injection well.

(b) Equip a water injection pipeline with a surface FSV and water injection shutdown valve (WISDV) on the surface facility.

(c) Install a PSHL sensor upstream (in-board) of the FSV and WISDV.

(d) Use subsea tree(s), wellhead(s), connector(s), and tree valves, and surface-controlled SSSV or WIV associated with a water injection system that are rated for the maximum anticipated injection pressure.

(e) Consider the effects of hydrogen sulfide (H2S) when designing your water flood system, as required by § 250.805.

(f) Follow the valve closure times and hydraulic bleed requirements according to your approved DWOP for the following:

(1) Electro-hydraulic control system with water injection,

(2) Electro-hydraulic control system with water injection with loss of communications, and

(3) Direct-hydraulic control system with water injection.

(g) Comply with the following injection valve testing requirements:

(1) You must test your injection valves as provided in the following table:

(2) If a designated USV on a water injection well fails the applicable test under § 250.880(c)(4)(ii), you must notify the appropriate District Manager and request approval to designate another ANSI/API Spec 6A and API Spec. 6AV1 (both incorporated by reference in § 250.198) certified subsea valve as your USV.

(3) If a USV on a water injection well fails the test and the surface-controlled SSSV or WIV cannot be tested as required under (g)(1)(ii) of this section because of low reservoir pressure, you must submit a request to the appropriate District Manager with an alternative plan that ensures subsea shutdown capabilities.

(h) If you experience a loss of communications during water injection operations, you must comply with the following:

(1) Notify the appropriate District Manager within 12 hours after detecting loss of communication; and

(2) Obtain approval from the appropriate District Manager to continue to inject during the loss of communication.

If you choose to install a subsea pump system, your system must comply with your approved DWOP, which must meet the following minimum requirements:

(a) Include the installation of an isolation valve at the inlet of your subsea pump module.

(b) Include a PSHL sensor upstream of the BSDV, if the maximum possible discharge pressure of the subsea pump operating in a dead head condition (that is the maximum shut-in tubing pressure at the pump inlet and a closed BSDV) is less than the MAOP of the associated pipeline.

(c) If the maximum possible discharge pressure of the subsea pump operating in a dead head situation could be greater than the MAOP of the pipeline:

(1) Include, at minimum, 2 independent functioning PSHL sensors upstream of the subsea pump and 2 independent functioning PSHL sensors downstream of the pump, that:

(i) Are operational when the subsea pump is in service; and

(ii) Will, when activated, shut down the subsea pump, the subsea inlet isolation valve, and either the designated USV1, the USV2, or the alternate isolation valve.

(iii) If more than 2 PSHL sensors are installed both upstream and downstream of the subsea pump for operational flexibility, then 2 out of 3 voting logic may be implemented in which the subsea pump remains operational provided a minimum of 2 independent PSHL sensors are functional both upstream and downstream of the pump.

(2) Interlock the subsea pump motor with the BSDV to ensure that the pump cannot start or operate when the BSDV is closed, incorporate at a minimum the following permissive signals into the control system for your subsea pump, and ensure that the subsea pump is not able to be started or re-started unless:

(i) The BSDV is open;

(ii) All automated valves downstream of the subsea pump are open;

(iii) The upstream subsea pump isolation valve is open; and

(iv) All parameters associated with the subsea pump operation (e.g., pump temperature high, pump vibration high, pump suction pressure high, pump discharge pressure high, pump suction flow low) must be cleared (i.e., within operational limits) or continuously monitored by personnel who observe visual indicators displayed at a designated control station and have the capability to initiate shut-in action in the event of an abnormal condition.

(3) Monitor the separator for seawater.

(4) Ensure that the subsea pump systems are controlled by an electro-hydraulic control system.

(d) Follow the valve closure times and hydraulic bleed requirements according to your approved DWOP for the following:

(1) Electro-hydraulic control system with a subsea pump;

(2) A loss of communication with the subsea well(s) and not a loss of communication with the subsea pump control system without an ESD or sensor activation;

(3) A loss of communication with the subsea pump control system, and not a loss of communication with the subsea well(s);

(4) A loss of communication with the subsea well(s) and the subsea pump control system.

(e) For subsea pump testing:

(1) Perform a complete subsea pump function test, including full shutdown, after any intervention or changes to the software and equipment affecting the subsea pump; and

(2) Test the subsea pump shutdown, including PSHL sensors both upstream and downstream of the pump, each quarter (not to exceed 120 days between tests). This testing may be performed concurrently with the ESD function test required by § 250.880(c)(4)(v).

No later than September 7, 2018, and at least once every 5 years thereafter, you must have qualified third-party inspect, and then you must repair or replace, as needed, the fire tube for tube-type heaters that are equipped with either automatically controlled natural or forced draft burners installed in either atmospheric or pressure vessels that heat hydrocarbons and/or glycol. If inspection indicates tube-type heater deficiencies, you must complete and document repairs or replacements. You must document the inspection results, retain such documentation for at least 5 years, and make the documentation available to BSEE upon request.

(a) Notification. You must:

(1) Notify the District Manager at least 72 hours before you commence initial production on a facility as required in § 250.800(a)(2), in order for BSEE to conduct the preproduction inspection of the integrated safety system.

(2) Notify the District Manager upon commencement of production so that BSEE may conduct a complete inspection.

(3) Notify the District Manager and receive BSEE approval before you perform any subsea intervention that modifies the existing subsea infrastructure in a way that may affect the casing monitoring capabilities and testing frequencies specified in the table set forth in paragraph (c)(4) of this section.

(b) Testing methodologies. You must:

(1) Test safety valves and other equipment at the intervals specified in the tables set forth in paragraph (c) of this section or more frequently if operating conditions warrant; and

(2) Perform testing and inspections in accordance with API RP 14C, Appendix D (incorporated by reference as specified in § 250.198), and the additional requirements specified in the tables of this section or as approved in the DWOP for your subsea system.

(c) Testing frequencies. You must:

(1) Comply with the following testing requirements for subsurface safety devices on dry tree wells:

(2) Comply with the following testing requirements for surface valves:

(3) Comply with the following testing requirements for surface safety systems and devices:

(4) Comply with the following testing requirements for subsurface safety devices and associated systems on subsea tree wells:

(d) Subsea wells. (1) Any subsea well that is completed and disconnected from monitoring capability may not be disconnected for more than 24 months, unless authorized by BSEE.

(2) Any subsea well that is completed and disconnected from monitoring capability for more than 6 months must meet the following testing and other requirements:

(i) Each well must have 3 pressure barriers:

(A) A closed and tested surface-controlled SSSV,

(B) A closed and tested USV, and

(C) One additional closed and tested tree valve.

(ii) For new completed wells, prior to the rig leaving the well, the pressure barriers must be tested as follows:

(A) The surface-controlled SSSV must be tested for leakage in accordance with § 250.828(c);

(B) The USV and other pressure barrier must be tested to confirm zero leakage rate.

(iii) A sealing pressure cap must be installed on the flowline connection hub until the flowline is installed and connected. The pressure cap must be designed to accommodate monitoring for pressure between the production wing valve and cap. The pressure cap must also be designed so that a remotely operated vehicle can bleed pressure off, monitor for buildup, and confirm barrier integrity.

(iv) Pressure monitoring at the sealing pressure cap on the flowline connection hub must be performed in each well at intervals not to exceed 12 months from the time of initial testing of the pressure barrier (prior to demobilizing the rig from the field).

(v) You must have a drilling vessel capable of intervention into the disconnected well in the field or readily accessible for use until the wells are brought on line.

(a) You must maintain records that show the present status and history of each safety device. Your records must include dates and details of installation, removal, inspection, testing, repairing, adjustments, and reinstallation.

(b) You must maintain these records for at least 2 years. You must maintain the records at your field office nearest the OCS facility and a secure onshore location. These records must be available for review by a representative of BSEE.

(c) You must submit to the appropriate District Manager a contact list for all OCS facilities at least annually or when contact information is revised. The contact list must include:

(1) Designated operator name;

(2) Designated primary point of contact for the facility;

(3) Facility phone number(s), if applicable;

(4) Facility fax number, if applicable;

(5) Facility radio frequency, if applicable;

(6) Facility helideck rating and size, if applicable; and

(7) Facility records location if not contained on the facility.

You must ensure that personnel installing, repairing, testing, maintaining, and operating surface and subsurface safety devices, and personnel operating production platforms (including, but not limited to, separation, dehydration, compression, sweetening, and metering operations), are trained in accordance with the procedures in subpart O and subpart S of this part.