Process Safety · Lesson 47 · 8 min read

Emergency Isolation Must Stop the Inventory Feeding the Fire

Emergency shutdown is not complete when a command is sent or a valve symbol changes colour. The barrier must isolate the hazardous inventory quickly enough, tightly enough and from a location that remains safe during the credible event. If fuel continues to flow after a loss of containment, a manageable release can become a sustained fire or major escalation.

The barrier controls duration and inventory

A loss of containment begins at a failed boundary, but its severity is strongly influenced by what continues to feed it. An emergency shutdown valve can separate a leaking section from a vessel, pipeline, riser or other hazardous inventory. Effective isolation can reduce the release duration and the quantity available to burn, disperse or contaminate the environment.

The complete function includes initiation, logic, motive power, actuator, valve internals, feedback and the pressure boundary. The valve must move under credible duty conditions, reach the required position and limit through-seat flow to the approved criterion. A closed indication does not prove tight isolation.

Closure must be engineered for the system. Too slow may feed the event; uncontrolled rapid closure can create damaging pressure surge. Closure time and leakage criteria must come from the scenario, hydraulic analysis, safety case and performance standard.

HSE findings: test the real isolation claim

HSE's offshore guidance says pipeline-riser ESD valves must adequately block flow and be properly maintained. Inspection findings included unrepresentative test pressures, inconsistent units, unclear pass criteria, limited trending and retesting after initial failure without addressing its meaning.

An HSE safety alert described corrosion of actuator spring-retaining components that left a pipeline ESD valve failed open. Stored spring energy could also release parts at velocity. Inspection must cover the drive mechanism, not only the valve body and control signal.

HSE enforcement records show why generic criteria are insufficient. One warned that a fixed closure-time criterion could miss critical deterioration; another identified valves closing substantially slower than design intent. Site-specific evidence and trend review are essential.

Official incident: the release could not be stopped safely

In its investigation of the 2019 Intercontinental Terminals Company fire in Deer Park, Texas, the U.S. Chemical Safety Board found that a failed circulation pump released butane-enriched naphtha for about 30 minutes before ignition. Once the fire began, the facility could not remotely isolate or stop the release. The fire burned for three days and destroyed fifteen large storage tanks. The CSB identified the absence of remotely operated emergency isolation valves as one factor that increased the severity.

This onshore event does not define the risk or required valve arrangement on an FPSO. Its transferable process-safety lesson is that emergency isolation should be decided, located and tested before a release makes local manual action unsafe.

Hypothetical FPSO example: indication passes, performance fails

Hypothetical example—not a documented incident: During an authorised end-to-end test of an FPSO export-riser emergency shutdown function, the control-room command is received and the display changes to closed. Field measurement shows that the valve stroke is slower than its approved, scenario-specific criterion. The authorised leakage test also fails to demonstrate the required isolation performance.

The team declares the barrier impaired, applies approved operating restrictions and investigates the actuator, internals, utilities and signal path. They review trends and similar valves, repair the defect and retest the complete function before restoration. They do not keep cycling until a favourable result appears. This example supplies no universal test criterion or permission to continue operating.

Critical controls

Define the isolation objective. Connect each ESD valve to its release scenarios and inventories. State closure, tightness, availability and survivability requirements in a measurable performance standard.

Prove the full function. Test initiation, logic, motive power, actuator, movement, feedback and isolation performance. Understand any gap between test and credible operating conditions.

Protect the actuator and utilities. Inspect springs, housings, tie rods, hydraulic or pneumatic equipment, cabling, tubing, fire protection and local environment. Manage stored energy and safe access during inspection and testing.

Trend, do not reset the story. Compare stroke time, leakage and demand history. Investigate first-test failures, intermittent operation and gradual deterioration; repeated cycling must not erase evidence that the barrier is weakening.

Control impairment and restoration. Assess major-hazard exposure, set authorised limits and compensating measures, communicate the impairment and verify repair.

Leadership actions

Leaders should set clear ownership across operations, maintenance, technical authority and verification. Ask whether criteria match the scenario, tests represent the duty, first failures remain visible and changed conditions have been reassessed. Provide shutdown windows when isolation cannot be demonstrated.

Three practical actions

• Trace one scenario: identify the inventory, release path, ESD valve, initiation signal and evidence that isolation occurs within the approved criterion.
• Review the trend: compare recent stroke, leakage and demand results; challenge repeated tests and unexplained variation.
• Inspect beyond the body: include actuator internals, stored-energy components, motive power, feedback and environmental protection.

Official video: Terminal Failure—Fire at ITC

The official CSB video reconstructs the pump failure, release, ignition and prolonged tank-farm fire, including the missing remote-isolation capability. View the official CSB video page.

Takeaway and team discussion

Key takeaway: emergency isolation is proven only when the complete function stops hazardous inventory feeding the event within the approved performance criteria.

Discussion question: which emergency isolation valve on our installation has the weakest current evidence that it will close and adequately block flow under the major-accident conditions it is meant to control?

Continue in the Process Safety hub, and connect this lesson with valve-position evidence, shutdown-system resilience, fire-escalation control and temporary-refuge integrity.

Verified primary references

1. UK HSE: Pipeline riser emergency shutdown valves—inspection issues and recommendations—official offshore guidance on blocking flow, test conditions, pass criteria, trending and first-test failures.
2. UK HSE: Failure of pipeline emergency shut-down valve—official safety alert on actuator corrosion, failure open and stored-energy hazards.
3. UK HSE enforcement notice 315132274—official record on scenario-specific ESD-valve performance criteria and timely actuation.
4. UK HSE enforcement notice 315132167—official record on ESD valves operating substantially more slowly than their original design intent.
5. U.S. CSB: Intercontinental Terminals Company tank fire—official investigation, findings and recommendations on remote isolation and escalation.
6. U.S. CSB: Safety Study—Remote Isolation of Process Equipment—official cross-incident study of escalation where effective remote isolation was absent.
7. U.S. CSB official video: Terminal Failure—Fire at ITC—official incident animation and safety lessons.

Published and sources checked 29 October 2026. Educational discussion only: apply the installation's approved safety case, shutdown philosophy, performance standards, pipeline arrangements, verification, impairment, test and operating procedures. No universal closure time, test pressure, leakage rate or permission to operate with impaired emergency isolation is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates