A Technical Overview of Design, Safety, and Corrosion Considerations of Severn’s Butterfly Valves In Fire Water Systems

Butterfly valves in Fire water systems are critical safety infrastructures on offshore oil rigs, onshore coastal facilities and floating production, storage, and offloading (FPSO) vessels. Unlike inland-based systems that rely on municipal water supplies, offshore, vessels & coastal facility fire systems draw seawater directly from the surrounding environment. This requires specialised equipment and robust corrosion control strategies to ensure long-term reliability (and minimise potential critical safety risks). These safety systems are designed with multiple layers of defence to address a range of fire scenarios—from minor hydrocarbon spills to large-scale fires that can potentially threaten life and cause large scale environmental impact. The integrity of each component is vital to the system’s performance during emergencies.

Key Components of Firewater Systems

• Firewater Pumps: The heart of the system, these pumps draw in large volumes of seawater and pressurise it into the firewater ring main. Offshore facilities typically use two or more pumps for redundancy, powered by independent diesel engines or hydraulic units to ensure operation during power loss.
• Jockey Pump: A smaller pump that maintains system pressure during standby conditions, preventing unnecessary cycling of the main pumps.
• Pump Configurations: Options include submerged caisson-type pumps and dry-mounted diesel-hydraulic pumps, depending on platform design and operational requirements.
• Firewater Ring Main: A looped network of large-diameter piping that distributes pressurised seawater across the facility. Constructed from corrosion-resistant materials such as copper-nickel (Cu-Ni), glass-reinforced plastic (GRP), or titanium, the ring main ensures water delivery even if part of the system is compromised.
• Deluge Systems: Automatically activated by fire and gas (F&G) detection systems, these systems release water or foam through open nozzles to suppress fires in high-risk zones.

• Foam Systems: Used for flammable liquid fires, foam is mixed with water in a proportioning device and delivered via deluge systems or foam monitors. Fluorine-free foams (FFF) are increasingly adopted for environmental compliance.
• Monitors and Hydrants: High-capacity water cannons and strategically placed hydrants enable manual firefighting and localised response.

Emergency Operation of Firewater Systems

In the event of a fire, the firewater system is automatically activated through a sequence of coordinated actions:

• Fire Detection: Sensors within the integrated Fire and Gas (F&G) detection system identify heat, smoke, or flame signatures.
• Alarm and Response: Upon detection, the system triggers an alarm and initiates the firewater pumps, drawing seawater and pressurising the ring main.
• Deluge Activation: Deluge valves open rapidly, often before the pumps reach full pressure. The system is designed to accommodate this pressure surge to prevent pipework damage.
• Fire Suppression: Water, or a water-foam mixture, is discharged through nozzles or monitors to suppress the fire, cool surrounding equipment, and prevent escalation.
• Emergency Shutdown (ESD): In severe incidents, the Emergency Shutdown system isolates hydrocarbon sources and halts processing operations to contain the hazard.

The Importance of Fire-Safe Certified Isolation Valves

While pumps and piping are vital, the reliability of Isolation valves is equally critical. These valves must maintain integrity under extreme heat to ensure uninterrupted water delivery during a fire.

The reality is that some fire water systems were (are) built and specified with either rubber lined valves or non-fire safe certified valves meaning that either costs have been prioritised over safety, or criticalness of the application hasn’t been appreciated, and although the chances of an incident are small, the consequences could be fatal. Rubber lined valves are often specified as they can significantly reduce costs, cheaper body materials such as cast iron and carbon steel can be used as the rubber prevents the seawater contacting this, these valves will function correctly until an emergency occurs and the rubber melts or burns away. The valves are then rendered useless and will not perform the function they are needed to perform during this crucial time. This can lead to loss of system pressure, or leaks, meaning the relevant sections of pipe cannot be isolated, the water pressure isn’t high enough or the water cannot be directed to where is needed to extinguish the fire. This is not just for rubber lined valves, but it is also the same for other non-firesafe designed and certified Butterfly valves. 

Operators must ensure that the highest levels of safety are maintained and critical to this, it means ensuring the correct valves are specified for safety critical applications. These choices can stem from cost-saving measures or a lack of understanding of the application’s criticality. However, the consequences of valve failure during a fire can be catastrophic.

Fire Risks and Valve Failure Modes

Standard Isolation valves often use polymer-based components (e.g., PTFE seats and seals) that degrade at fire temperatures (750°C–1000°C). This can lead to:

• External Leakage: Loss of sealing allows pressurised water to escape, reducing firefighting effectiveness.
• Internal Leakage: Through-seat leakage compromises isolation, potentially flooding unintended areas.

Loss of Operability: Heat distortion can jam the valve, preventing manual or remote operation.

Fire-Safe Certification Standards

To mitigate these risks, valves must be tested and certified to recognise fire-safe standards:

• API 607: For quarter-turn valves with non-metallic seats.
• API 6FA: Covers metal-seated valves under fire conditions.
• ISO 10497: International fire type-testing standard.

Typical Fire Test Procedure:

1. Preparation: Valve is pressurised to 75% of its rated pressure and closed.
2. Fire Exposure: Valve is engulfed in flames for 30+ minutes at 750–1000°C.
3. Cooling and Inspection: Leakage is measured post-burn.
4. Operability Test: Valve must be cycled open and closed to confirm functionality.

Severn’s Butterfly Valves in Fire water – Safe Valve Design Options

Several valve designs are available at Severn Butterfly Valves in fire water systems, each with distinct advantages and limitations:

Severn Double Offset Valves

Firesafe certified Double offset valves, these are generally designed with a primary polymer seal and metallic backup metal seal, this means that in the event of a fire the PTFE seal can burn away or melt, and the metal seal will then come into contact sealing face; the risks are that if the polymer doesn’t fully carbonise or flow away from the secondary metal seal it risks becoming jammed between the two sealing faces and can stop the valve from closing fully, causing an internal leak. These valves have graphite packings and gaskets to prevent external leakage in the event of a fire.

Severn Triple Offset Valves

This torque seated valve is the preferred option and provides metal to metal torque seating. This design uses metallic and graphite to provide leak tight sealing in the event of a fire. The negatives of this are that, when used in seawater applications, galvanic corrosion can occur causing premature failure of the valves, further details of what galvanic corrosion is and the issues are explained later in this article. There is however another option:

Severn’s OCT-SW Valve: A Graphite-Isolated Solution

Developed by Severn Glocon, Oblique Cone Technology is a patented triple offset valve design, enhanced further with graphite isolated parts for Sea Water service the OCT-SW valve addresses both fire safety and corrosion resistance:

By using the same principals as a standard Triple Offset valve, but enhancing this further with patented design technology and understanding the headaches galvanic corrosion can cause for operators. With the OCT-SW, all graphite components are isolated from contacting the line media during normal operation, eliminating the risk of galvanic corrosion. But as they remain within the valve design, they provide reliable sealing in the event of a fire.

The OCT-SW design uses a primary metal seal, and polymer back-up seal. By using the metal as a primary seal and torque seating the disc closed, it means that the metal seal does 99% of the valve sealing, meaning that the Polymer seal is only there to provide the last 1% and ensure full zero leakage isolation. What this means is that in the event of a fire, if the polymer, deforms, melts or carburises, the metal-to-metal seal still remains and provides a tight dependable seal.

Adopting a metal-to-metal torque seated design, means that even when exposed to the extreme heat of a fire the polymer seal cannot flow between the two metal sealing surfaces, therefore eliminating the risks that can be seen with Double Offset valves.

For Severn, safety is paramount which is why this valve includes enhanced safety which include dual anti blowout protection and fugitive emission certified packing as standard. Severn’s OCT-SW design combines the best aspects of Double and Triple Offset valves while eliminating their respective weaknesses.

Industry implications and conclusion

For industries with high fire risks, specifying fire-safe certified Isolation valves for firewater systems should be a non-negotiable best practice.

• Safety and reliability: These valves ensure the firewater system remains operational and can perform its critical function of extinguishing or controlling a fire.
• Regulatory compliance: Many regulatory bodies and industry standards, particularly in the oil and gas sector, mandate the use of certified valves for fire-prone areas.
• Asset protection and business continuity: Protecting the firewater system’s integrity directly protects personnel, high-value assets, and ensures business continuity.

By investing in certified, fire-safe Isolation valves, facility operators can be confident that their firewater system are a resilient and reliable defence against the worst-case fire scenario.

HIPPS (High Integrity Pressure Protection Systems) are rapidly gaining ground in the LNG sector as an alternative to pressure relief systems with ultimate line of defence. Situated between high-pressure upstream and low-pressure downstream sections of an installation, they contain media if over-pressurisation is likely to occur.   

The core benefit of HIPPS is that the system is activated before over-pressurisation, automatically bringing high-risk processes to a safe state. With traditional pressure relief systems, a relief valve is triggered to vent during over-pressurisation. This allows excess gas or fluid to escape into the surrounding environment.  

Superior downstream protection 

A HIPPS is a sophisticated valve-based safety instrumented system (SIS) designed to protect equipment from over-pressurisation scenarios that could result in full emergency shutdown. These systems offer superior protection of downstream assets on any LNG plant, vessel or facility.  

Traditionally, installations facing the strictest environmental regulations were at the forefront of HIPPS uptake as the systems out-perform standard safety regulations. However, associated economic advantages are now more widely recognised and driving further interest.  

As an emergency response solution, HIPPS deployment is far less costly than lengthy emergency shutdowns and all the repercussions they entail. When a relief valve is activated, operators face heavy costs surrounding intervention and lost production. But the benefits of HIPPS go further than simply reducing costs in the event of an incident. Deploying HIPPS in a pipeline unlocks the potential for lower downstream design pressures. So, the required wall thickness for downstream assets decreases, allowing de-rated pipework to be used, which brings potential size, weight and cost advantages, as well as having a positive impact on flow rates and throughput.    

So, while environmental requirements initially drove LNG HIPPS uptake, it’s now widely recognised that there are three scenarios where the systems should be brought to the table. If the surrounding environment needs to be protected, the economic feasibility of a development needs to be improved or the risk profile of a facility needs to be reduced, HIPPS is an attractive and viable alternative to simple relief systems. HIPPS are equally effective in new projects or when adding to or upgrading existing installations. 

The art of HIPPS integration 

HIPPS have a high degree of redundancy to maximise safety for site personnel, the general public and the environment, as well as high-value production assets. They are comprised of integrated technologies arranged in a complete functional loop, with three fundamental components: 

1. Pressure Transmitters monitor pipeline pressure and convey a signal to a logic solver.  

2. The Logic Solver captures signals from the pressure transmitters and performs a 2oo3 voting logic.  

3. The Final Element (normally two shut-off valves) provides corrective action to bring the process to a safe state.  

This configuration maximises performance and reliability. The 2oo3 (two out of three) methodology enhances the systems’ ability to detect problems, while reducing the likelihood of a response being triggered unnecessarily. Should one of the pressure transmitters fail, it won’t compromise functionality as two high pressure readings are required for activation. Likewise, if one of the valves in the final element fails, the second valve acts as a back-up to maintain the isolation of the high-pressure source. 

Clearly, in an ideal world, safety systems would never need to be activated. Plant designers and engineers should continually strive for inherent safety. HIPPS are the last line of defence and shouldn’t be considered an alternative to designing out potential over-pressurisation problems. Holistic thinking and intelligent design reviews are essential to enhance overall safety and get the most out of HIPPS. 

Front-end planning for LNG’s Line of Defence

When projects don’t allow adequate time for detailed assessment upfront, it can result in the installation of HIPPS with an inappropriate safety integrity level (SIL) specified. On an existing plant, this can result in continued reliance on emergency shutdown valves or a failure to realise the full benefits of HIPPS. Ascertaining the correct SIL assignment at the outset is a critical success factor, and it should be a core driver for system design and decision making. 

Engaging a HIPPS integrator at an early stage is another crucial step. Ideally, they should be independent, so they have the freedom to draw on the best technologies to meet specific needs of an individual plant application. And they should offer a good depth and breadth of specialist HIPPS expertise so they can devise innovative approaches with a superior level of reliability. For instance, the expert selection of components from various manufacturers can reduce the potential for a ‘common cause factor’ resulting in system failure. It is established good practice to use two valves in the final element of the loop to enhance redundancy. But in many cases two valves of the same type from the same manufacturer are deployed. Opting for two different valve designs, such as a gate valve and a ball valve, from independent suppliers is a more effective way to maximise redundancy, enhancing overall safety and reliability.    

There’s no denying that the deployment of HIPPS can complex and challenging. To counter this, their development and integration should draw on the combined expertise of electronic and software engineers as well as mechanical engineers. These experts need to work cohesively with functional safety management professionals to interrogate the design brief and look in detail at SIL requirements. Typically, an independent integrator will employ all these professionals in-house. They will also have a robust functional safety management system in place, as well as a competency management system ensuring people are trained and certified to exceed the relevant industry standards. 

A further benefit of this model is that all the requirements of HIPPS integration can be put in place via a single point of contact. This eases communication throughout planning, development and delivery, and enhances efficiency by stripping out a layer of third-party liaison and coordination. What’s more, external professional consultation can support the project in a validation role at specific milestones. This consultative ‘one-stop-shop’ approach makes for a structured, cost and time saving solution.  

Collaboration between the end user and an independent HIPPS integrator facilitates the creation of an innovative and effective long term solution. Opting for best-in-class, expert-led protection of equipment that could be susceptible to over-pressurisation brings multiple benefits. 

The eight phases of HIPPS 

Each phase of a HIPPS project is dictated by safety lifecycle standard IEC 61511, including decommissioning at end of life. A partnership approach with clearly defined responsibilities enables operators to benefit from the specialist expertise of HIPPS integrators and other third parties.  

1. Hazard and risk assessment or Hazard and operability study (HAZOP) (end user responsibility) 

2. Allocation of safety functions to protection layers (end user responsibility) 

3. Safety requirements specification (end user responsibility) 

4. Design and engineering of safety instrumented system (HIPPS integrator responsibility) 

5. Installation and commissioning (HIPPS integrator responsibility) followed by validation (certifying body responsibility, e.g. TUV) 

6. Operation and maintenance (end user and HIPPS integrator, shared responsibility) 

7. Modification (HIPPS integrator responsibility) 

8. Decommissioning (end user and HIPPS integrator, shared responsibility) 

Application spotlight: FSRU HIPPS 

Engineers from Severn recently integrated, supplied and commissioned a HIPPS for an LNG Floating Storage and Regasification Unit (FSRU) being built by DSME in Korea. 

The vessel, BW Magna, has a 173,400 cubic metre capacity and the HIPPS has been installed to protect the pipeline during the unloading of gas. This enhances safety for the FSRU itself, as well as the downstream equipment and pipeline in the docking terminals it connects with. 

HIPPS are not mandatory on FSRUs, but it’s increasingly recognised that they provide a superior level of safety and reliability. The system supplied to DSME operates at a working pressure of 117 barg. It comprises two 18” 900-class manual valves, a Sella Controls logic solver and three pressure transmitters. 

Additional safety measures on the FSRU include alarms, a shutdown system, blow down system and safety valves, as per industry-specified standards. The benefit of adding HIPPS is that it is a simple, proven solution which can operate independently of the wider vessel system.  

Conclusion 

The design, build and testing of HIPPS poses many challenges, compounded by a lack of defined standards for design parameters. This calls for a high level of interaction between the end user, HIPPS integrator and other parties throughout the eight phases of HIPPS development and deployment aligning with LNG’s Line of Defence. However, the investment of time, money and effort reaps dividends in the shape of superior safety and environmental credentials combined with associated economic advantages. These three factors are coming under increasing scrutiny in all areas of the energy industry. LNG players who invest in the best safety systems now will be one step ahead.