Hibernia Study (Flare)

HIBERNIA MANAGEMENT AND DEVELOPMENT COMPANY LTD

FLARE SYSTEM REVALIDATION STUDY

TECHNICAL NOTE

DOCUMENT NO

: 8266-HIB-TN-C-0001

REVISION

: B

DATE

: October 2000

8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc

Page 1of 135

Revision: B October 2000

DOCUMENT REVISION RECORD REV

DATE

Draft

21/07/00

A

B

DESCRIPTION

PREPARED

CHECKED

APPROVED

Issued for IDC

M. Goodman

A. Robinson

M. Goodman

23/08/00

Issued for Comment / Final

M. Goodman

A. Robinson

M. Goodman

16/10/00

Final

M. Goodman

A. Robinson

M. Goodman

RELIANCE NOTICE This report is issued pursuant to an Agreement between Granherne (Holdings) Limited and/or its subsidiary or affiliate companies (“Granherne”) and HIBERNIA MANAGEMENT AND DEVELOPMENT COMPANY LTD which agreement sets forth the entire rights, obligations and liabilities of those parties with respect to the content and use of the report. Reliance by any other party on the contents of the report shall be at its own risk. Granherne makes no warranty or representation, expressed or implied, to any other party with respect to the accuracy, completeness, or usefulness of the information contained in this report and assumes no liabilities with respect to any other party’s use of or damages resulting from such use of any information, conclusions or recommendations disclosed in this report. Title:

QA Verified:

FLARE SYSTEM REVALIDATION STUDY TECHNICAL NOTE


Date:

Page 2of 135


CONTENTS FRONT PAGE DOCUMENT REVISION RECORD CONTENTS ABBREVIATIONS HOLDS

1.0 INTRODUCTION 2.0 SUMMARY AND CONCLUSIONS 2.1 Introduction 2.2 Technical Audit of the Design Calculations 2.3 Challenge Process 2.4 As-Building the Flare System 2.5 Risk Management in Relation to Wind Condition and Flaring Events 2.6 Implications for Hibernia 3.0 DESIGN BASIS 3.1 Introduction 3.2 Safety Design Basis 4.0 APPROACH 4.1 General 4.2 Calculation Audit 4.3 Challenge Process 4.4 Risk Management in Relation to Flaring Events and Wind Condition 5.0 TECHNICAL AUDIT OF THE DESIGN CALCULATIONS 5.1 Introduction 5.2 Results of the Technical Audit – Relief and Blowdown System Calculations 5.3 Results of the Technical Audit – Relief Valve Sizing Calculations 5.4 Technical Audit Conclusion Summary 6.0 CHALLENGE PROCESS 6.1 Introduction 6.2 Jet Fire 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc

Page 3of 135


6.3 Blowdown (Depressuring) System Sizing 6.4 Compressor Blowdown Stagger 6.5 Two-Phase Relief 6.6 Design Windspeed and Direction 6.7 Acceptable Flare Radiation Levels 6.8 Challenge Issues Resulting from the Technical Audit of the Design Calculations 6.9 Miscellaneous Issues 7.0 AS-BUILDING THE FLARE SYSTEM 7.1 Introduction 7.2 As-built and Design Capacity 8.0 RISK MANAGEMENT IN RELATION TO FLARING EVENTS AND WIND CONDITION 8.1 Introduction 8.2 Potential Flare Envelope based on Total Blowdown Scenarios 8.3 Results 8.4 Flare Envelope Conclusions 9.0 IMPLICATIONS FOR HIBERNIA 9.1 Introduction 9.2 Flare System Capacity Opportunities 9.3 Impact on the Design Documentation 9.4 Optional Changes 9.5 Miscellaneous Requirements 10.0 REFERENCES


Page 4of 135


ABBREVIATIONS ALARP

As low as reasonably practical

API

American Petroleum Institute

ASME

American Society of Mechanical Engineers

CSE

Concept Safety Evaluation

CBA

Cost Benefit Analysis

DAE

Design Accidental Event

DIERS

Design Institute for Emergency Relief Systems

DPRA

Design Phase Risk Assessment of Potential Accidental Events

DPSEE

Design Phase Safety and Environmental Evaluation

FRA

Fire Risk Assessment

FSRS

Flare System Revalidation Study (i.e. this study)

H&S

Health and Safety

HEM

Homogeneous Equilibrium Model

HSE

Health and Safety Executive (UK government body)

HSW

Health and Safety at Work

HTPT

Hibernia Topsides Process Team

HVAC

Heating Ventilation and Air Conditioning

MEP

Mobil Engineering Practice

N

North

NW

North West

PFP

Passive Fire Protection

PSHH

Pressure Switch High High (a trip function)

QRA

Quantified Risk Analysis

RABS

Relief and Blowdown Study Report Doc. No. CM-E-C-R-M00-RP-3410 Rev C1

RAE

Residual Accidental Event

TSR

Temporary Safe Refuge

VLE

Vapour Liquid Equilibrium


Page 5of 135


HOLDS 1.

No holds.


Page 6of 135


1.0

INTRODUCTION The key Hibernia flare system design documents have remained unaltered since the design phase. In certain areas, the key assumptions are now considered worthy of review particularly to incorporate as-built system details and to assess the potential to remove the Injection Compressor stagger. It has therefore been decided to revalidate the key flare system design documents (principally the Relief and Blowdown Study Report and the Flare System Calculation Volumes). Following from a series of meetings during the period 9–10 May 2000, a scope of work for performing a staged revalidation of the flare system was prepared. The stages envisaged are described below: Stage 1 – Flare System Revalidation Report Stage 1 consists of the following activities: • Review the original documents in light of best practice to ensure a consistent and clear design approach (including a technical audit of the existing flare system design calculations). Analyse the results of any changes in design philosophy and their impact on flare system design capacity. • Based on the above identify the changes required to update the Relief and Blowdown Study Report. • Identify the available capacity in the system against a range of future projects including the avoidance of Injection Compressor blowdown stagger. Prepare a discussion document describing the background and requirement for any changes to the key flare system documents. Stage 2 – Modify the Key Hibernia Flare Design Documentation Based on the results of Stage 1 update the key flare system design documentation. This report covers Stage 1 of the revalidation process.


Page 7of 135


2.0

SUMMARY AND CONCLUSIONS

2.1

Introduction The key design documents relating to the flare system design have not been reviewed for some time. In the intervening period codes of practice have changed, as-built documentation and better analytical tools have become available and future equipment, foreseen at the time of design, is no longer certain to be installed. This report addresses these issues in order to revalidate the flare system design. The results of the report are summarised in the following main sections: •

Technical audit of the design calculations

•

Challenge process

•

As-building the flare system

•

Risk management in relation to wind condition and flaring events

•

Implications for Hibernia

These are described in turn below. 2.2

Technical Audit of the Design Calculations The technical audit of the design calculations was undertaken primarily to identify assumptions which were linked to the relief and blowdown system design basis and because of some concern in HMDC that the calculations did not fully reflect the design. In the event very few important assumptions were contained in design calculations but it was clear that the calculations were not up to date and there were some inconsistencies between the various flare system design documents. Also design methods have improved which indicate certain assumptions are no longer sufficiently conservative (for instance in the low temperature material selection calculations). Otherwise, as would be expected, some of the design bases on which the system was founded have changed since the design phase and an exercise such as this is the ideal way of capturing these changes (for instance the changes relating to the maximum well rate). One last aspect uncovered in the technical audit related to missing work (for instance the LP flare network model which should have been run to calculate the back pressure on relief valves which may be part of a coincident relief). All these types of issue will require the design calculations to be revised and corrected. A summary of the calculations that require revision can be found in Section 2.6.


Page 8of 135


2.3

Challenge Process The challenge process showed the problem of applying, often ambiguous, codes of practice retrospectively. The process also showed that Hibernia has in general used a conservative design basis which has resulted in a robust design when considering new code requirements and current industry design approaches. Generally, this is because newer approaches tend to interpret the codes without incorporating unnecessary features, which reflects efforts to achieve low cost facilities. Only in one area did we believe the design had not been sufficiently conservative and this area was the use of compressor stagger to limit the LP flare system flowrate during blowdown. However, to remove the stagger could present a considerable design challenge because of the problem of increasing the pressure (and inventory) in the LP separator when the blowdown valves opened. This is particularly undesirable if the cause of the blowdown is a fire around the LP separator. The higher pressure and, therefore, higher stress will increase the risk of premature failure. Consequently a brief safety analysis which looked at the ability of the A train injection compressor components (the equipment whose blowdown is delayed) to survive an adverse fire was undertaken. The results demonstrated the equipment is unlikely to fail and, therefore, the staggered system is safe in this situation. Similarly, the challenge process also considered jet fire on lower pressure equipment. Here it was found that thin walled vessels should be considered outside of the API guidance (as suggested explicitly in the API recommended practices). In this case applying modern practices relating to jet fire to this vessel suggests that as long as the insulation remained intact the insulation will ensure the vessel survives a jet fire. One other area, which would have been unknown to the original designers, are the changes which have occurred to the recommended practices; here the only important change relates to new API sizing method for calculating two-phase relief which will need to be applied to the existing system. The outcome of the challenge process is described in Section 2.6.

2.4

As-Building the Flare System The removal of the allowances contained in the design for future equipment ‘frees-up’ approximately 30% of the HP flare capacity in the blowdown case. However there is no impact at all on the LP flare capacity for this case as no future equipment was planned to be connected to this system.


Page 9of 135


2.5

Risk Management in Relation to Wind Condition and Flaring Events We had expected to find some useful work regarding this aspect in the industry but found none. Generally a picture emerged that the industry has no standard approach to windspeed or the operational measures undertaken on a platform during high wind. The outcome of such considerations is therefore undertaken on a case by case basis relying mainly on the judgement of the asset owner. By applying a consistent approach to the selection of design windspeed and the presence of personnel the result changed the design case relatively little. The impact of the design windspeed change, if pursued, is summarised in Section 2.6. One aspect where consideration of wind condition would potentially have a beneficial effect is related to continuous case flaring. In this case, because of the lower allowable radiation levels, wind has a significant effect on what can be produced when the compressors are unavailable. This suggests an allowable flare radiation envelope should be developed such that the production rate can be set (maximised) dependent on the measured (or expected) wind speed and direction.

2.6

Implications for Hibernia

2.6.1

Introduction The implications for Hibernia effectively arise as two types. • Where analysis suggests that some aspects of the design are conservative compared to the application of recommended and best practices, then this implies some apparent spare capacity in the system. The use of such capacity is optional dependent on future plans for the facility and economic benefit. • However, where analysis suggests that some aspects of the design are less conservative than in the recommended or best practices, then this implies that the system capacity is insufficient or marginal in these cases. In this case prudent ownership requires that these issues are addressed and solutions provided.

2.6.2

Capacity Opportunities The flare system revalidation analysis has identified a number of areas where a capacity opportunity is available. Where the capacity opportunity is positive (i.e. the apparent capacity, or capacity available in the flare system appears to rise) then HMDC have the choice of adopting the new philosophy which can be used to allow future platform modifications. However, where the capacity opportunity is negative (i.e. the apparent capacity, or capacity available in the flare system appears to fall) then HMDC should undertake remedial measures to remove the possibility of exceeding the platform flare system capacity. Both types of capacity opportunity are described below.


Page10of 135


Changes that reduce the apparent capacity of the flare system • The new API method for calculating two-phase relief should be applied to the relevant cases. At the same time, a new maximum design well rate together with the number of wells which fail to shut in that need to be designed for will need to become an explicit part of the RABS update. If the existing relief valves are to be retained this may require some method for limiting the maximum well rate to an acceptable value. • The missed design case of a failed open separation train spillover valve should be calculated and measures sought to limit the peak rate experienced to within the capacity of the flare system. Changes which apparently increase the capacity of the flare systems •

Remove the effect of future equipment.

• Change the start pressure of the commencement of blowdown. A robust interpretation of the codes of practice suggests in an automatically initiated blowdown event the start point should be normal operating pressure. Some of the Hibernia systems already follow this philosophy, however some (the compressor systems) begin blowdown from the PSHH pressure (which is significantly in excess of normal operating pressure). Changing this to be more consistent would free-up capacity in the LP flare system. However, in doing so there is the disadvantage of having to use more rigour when considering any changes in normal operating pressures, which affect the blowdown and which the PSHH approach can avoid. • Increase the end pressure for blowdown for the thick walled vessels. The API recommended practice has never required blowdown to 690 kPag for thick walled vessels. Our calculations of vessel heat up confirm these conclusions. Therefore blowdown to 690 kPag is excessive in this case. The end pressure should be 50% of the design pressure unless there are good reasons otherwise. One such situation is the inapplicability of this end pressure for the gas turbine driven HP gas compressors. The blowdown end pressure for equipment in these systems is determined by the requirements of the HP compressors seal oil system and the requirement to be at or near atmospheric prior to the oil running out. • The effects of insulation. If the insulation is the right type and properly attached its effects can properly be considered in the design calculations.


Page11of 135


• Radiation levels. The Hibernia radiation levels did not truly reflect how the platform was constructed. In particular the radiation requirement on the drilling derrick does not reflect the shielding present, nor do the radiation levels on the escape ways reflect international practice or Canadian regulations. The allowable radiation in these levels should be raised to 9.5 kW/m2 and 6.3 kW/m2 respectively. This allows considerably higher flaring rates before the radiation levels are breached. • Windspeed. Using a probabilistic method to select windspeed would lower the design windspeed from 27 m/s to 24.2 m/s. • Gas blowby cases are over conservative. By taking a more realistic blowby case the apparent capacity can be increased. This would pay benefits should the separation train LCV valve coefficients (Cv) ever need to be raised. The detailed analysis which forms the basis for the above can be found in sections 5.0, 6.0 and 9.0. 2.6.3

Impact on the Design Documentation The following table summarises the changes that should be made to the design calculations to improve their integrity and make them consistent and traceable.


Page12of 135


Table 2.1 Calculations Requiring Revision (System 34) Number 34005 / A

006 / A

Title Blowdown Section Inventory Calc (Provides input to blowdown simulations)

Blowdown Summary

Number 34005/1

Description

Action

Are the blowdown volumes used sufficiently accurate?

Locate and review missing calculations

005/3

Were the real settle out pressures ever used?

006/1

HP Blowdown calculation higher than vendor aware of. Radiation level for case is underestimated. Correct isentropic efficiency used?

Compare real settleout conditions with design to ensure blowdown rates are appropriate Update RABS.

006/2

010 / A

Calculation of allowed cooldown before hydrate formation & minimum temperatures achieved in flare gas from critical blowdown sections Review of HP flare KO Drum size

010/1

Was the calculation sufficiently robust?

011/1

015 / A

Calc to review options for reducing HP to MP Separator and MP to LP Separator Blowby Cases

015/1

022 / C

HP Flare Network Sizing (HP Separator - Max Relief Case) 3rd Stage Compressor Max Relief Case - Network Analysis

022/2

A note on the front of calc 34-064 states that Rev 7 of Design Basis gives max well flow of 20,000 bpd + average well of 10,000 bpd, i.e. 30,000 bpd total. The individual well design rate has changed. What are the implications for the platform? Relief & Blowdown Study Report Rev C1 non-concurrent maximum allowable LP and HP Flare loads are 110,874 kg/h and 244,897 kg/h respectively. Rates used in these calculations exceed design. Effect of increased production / production fluid GOR

025/2

Include in updated RABS cases which are not catered for, i.e. consider relief from both compressor trains

Coalescer & LP Separator Heaters Simultaneous Fire Relief - Network Analysis

033/1

Assumption that the header is at zero pressure (I.e. that this is a singular event not coincident with any other releases)

011 / A

025 / C

033 / G


Page13of 135

methodology

An optimistic isentropic efficiency was used to calculate the minimum system temperature. Recalculate the temperatures. See also 34.010/1. There are flaws in the method used to calculate the minimum temperatures in the system. These should be corrected. Use resultant more realistic figure to implement alarms on high pressure areas to avoid low temperatures. Update RABS. Select number and design rate of the well failure to shut in case. Update RABS. Develop operational procedure to cater for time to fill HP flare KO vessel.

Ensure design rates quoted are consistent and reflect the installed control valves. Update RABS.

Update RABS to mention link between GOR and the compressor capacity. Check modifications to avoid injection compressor RVs lifting prevent coincident case. Update RABS to explicitly mention the cases which are not designed for. Construct an LP flare network model to calculate the back pressure on relief valves when the system is depressuring.


Table 2.2 Calculations Requiring Revision (System 31) Number 31.37

Title Relief Valve Calculations - LP Separator

Number 31.37/1

Description Is it possible for the Test Separator manifold to be connected to the LP Separator when operating in high pressure mode?

Action Ensure positive method of ensuring isolation from HP system exists. Update RABS to reflect this.

The tables avoid repetition of the major issues which affect the capacity of the flare system (see Section 2.6.2) and single issues that affect more than one item. The full version of the tables can be found in sections 5.2.1 and 5.3.1. Some minor changes which generally affect consistency are identified in Section 9.4.


Page14of 135


2.6.4

Future Work It is difficult to be precise regarding the activities required in the longer term future as these depend on the outcome of the recalculation work and the decisions made therein. However, it is possible to summarise in general terms the shorter term requirements of Stage 2: Document Changes •

Relief and Blowdown Study Report

Fairly extensive rewrite of the report. •

Design Calculations

For each change prepare a calculation revision which revs up the existing calculation (in other words building on the existing work). This would include: -

Calculations identified in this report requiring change.

-

Flare radiation calculations (for windspeed and allowable radiation levels)

-

Continuous radiation cases. Analysis of allowable production rate vs wind speed and direction. Blowdown inventory calculations (for removed inventory).

• Reliability analysis of the system that controls the compressor stagger, to ensure the system is sufficiently reliable to ensure the design integrity. Implementation Projects In this section there are some projects mentioned which will in all likelihood require hardware changes to be made (resulting from the above there may be more). • Insulation conformance - The explicit ability of the platform to cope with a jet fire hazard requires the insulation around the vessels to remain in place during jet flame impingement. This may require the insulation strength to be improved. •

Modifications to limit peak flaring rate during spillover valve failure.

Instrument modifications to warn operators when the requirement to blowdown compressors is becoming imminent (to avoid low temperature problems). In discussion with HMDC a detailed scope of work to undertake the above has been developed. This is attached in Appendix 2.


Page15of 135


3.0

DESIGN BASIS

3.1

Introduction The review focuses on those aspects and hazards that are directly relevant to the flare system design. In particular these are flare radiation, jet and pool fire and, to a lesser extent, explosion. This naturally excludes issues relating to blowout and iceberg collisions as well as environmental issues. However, before going into the main parts of the analysis, it is worth recapping the safety basis and methodology followed by HMDC now and during the design phase. This will need to be followed should any changes be made to design philosophies.

3.2

Safety Design Basis As was convention at the time, the safety design progressed along two parallel routes. The first was the use of probabilistic analysis to identify the acceptability of various risks. The second was the deterministic design of the various safety systems according to recognised codes and practices. Occasionally there was an interface between the two processes when a risk was considered unacceptable. Where this was apparent the design would be adjusted to mitigate the unacceptable risk. These two processes are described in sections 3.2.1 and 3.2.2 below. The problem of parallel processes is that some information can be lost across the interface. More recently this has led to a concept called risk based design where the key safety issues are resolved during the early conceptual design stages rather than be left for implementation after the conceptual design is complete.

3.2.1

Probabilistic Design Criteria By the time the FRA was commenced the HMDC Damage / Impairment Criteria had been formalised. These were: Criterion 1: Overall Platform Integrity There must be no overall loss of integrity of the platform for at least 2 hours after the initial event. Loss of integrity included: • Structural collapse of more than 50% of the platform topsides, or total collapse of Module M30. The 2 hours is judgementally used for a maximum time to evacuate by lifeboats (i.e. time to respond to emergency, attempt to control, organise evacuation and abandon platform)


Page16of 135


Criterion 2: Integrity of Temporary Safe Refuge (TSR) The TSR (i.e. living quarters) should remain a safe refuge for personnel for at least 2 hours. Loss of integrity may be due to: • Fire within the safe refuge; • Blast damage, in excess of major window breakage; • Collapse of any part of shelter area. The time of 2 hours is derived and defined as for Criterion 1. Criterion 3: Escape Routes Escape routes from all parts of the platform to the TSR or other safe refuge should remain passable for at least 30 minutes from the start of the incident. An escape route may be made impassable by: • Thermal radiation over 12.5 kW/m2 to the outside of the escape route if protected by cladding; • Thermal radiation over 6.3 kW/m2 if unprotected; • Blockage due to blast damage; • Collapse of one or more modules; • Flooding over 1 m deep in the Utility Shaft. The time of 30 minutes is intended to allow the escape of workers who had initially remained at their posts to shut-down the process operation or fight a growing fire. The criterion is violated if an incident results in either: • All escape routes from any module being impassable; • All routes from any one part of the platform to the TSR being impassable. Since there is more than one escape route from any point, an incident must completely involve the total module to violate the criterion.


Page17of 135


Criterion 4: Means of Evacuation The evacuation systems must remain effective for long enough to evacuate all personnel. This requires at least one of the following to be true: • Helideck operable for at least 2 hours. Inoperability may result from one of the following: • tilt over 15° • smoke due to oil fire and wind towards helideck • thermal radiation over 3.2 kW/m2 • blast damage • unignited gas over helideck (due to likelihood of ignition) • collapse of M50 module. • Evacuation systems must be operable with at least 10% spare capacity (to allow for launching partly loaded) and with passable escape routes, from TSR to evacuation system, for at least 2 hours. Inoperability may result from: • tilt over 25° (preventing safe access) • thermal radiation over 12.5 kW/m2 • blast damage (damaging launching gear and access walkways) • collapse of module M40 and M30. The times are judgementally based on the proposed systems for the Hibernia platform. The criterion is only violated if all the means of evacuation are unavailable. In general the following approach was applied: The Damage / Impairment Criteria set out above, give basic criteria which should not be exceeded. It is not possible to ensure that no incidents will exceed the criteria. The intent is that every reasonable and practical precaution is taken to ensure those incidents that exceed the criteria are so unlikely that they can be considered as an acceptable risk because the risk is negligible. These incidents are termed Residual Accidental Events.


Page18of 135


Added to this were Hibernia’s three-tier framework of risk acceptability: For any single incident that might affect the key safety systems (more accurately safety functions from the above), the risk level for the three-tiers are: Intolerable: greater than 10-4 per year. ALARP region: 10-4 to 10-5 per year. Lower bound of acceptability: less than 10-5 per year Whilst it is inconceivable that any of the impairment criteria would change as a result of the considerations in this report, change may affect the QRA upon which these impairment criteria stand. Any changes considered, therefore, will require to be confirmed through QRA. 3.2.2

Deterministic Design Criteria A number of the final requirements for the design would stem from the above. This is not surprising as some of the aspects of the impairment criteria actually have their roots in the recognised international codes and practices, e.g. Allowable Flare Radiation Levels: Escape Ways • Not over 12.5 kW/m2 to the outside of the escape route if protected by cladding; • Not over 6.3 kW/m2 if escape way is unprotected Helideck • Not over 3.2 kW/m2 The remaining requirements are part of the various design guides and codes of practice. These are described in detail in Section 6


Page19of 135


4.0

APPROACH

4.1

General

4.1.1

Flare System Revalidation Process The flare revalidation process is summarised in the flowscheme overleaf. The stage consisting of this report is Stage 1. The results of Stage 1 will form the basis for future Stage 2 studies. The flowscheme indicates the potential range of projects this could encompass.


Page20of 135


Figure 4.1 - Revalidation Process Start

HMDC Internal Audit / Approval

•

Technical audit of the existing design calculations

• •

Challenge process Risk management

Stage 1

Prepare Flare System Revalidation Report Draft and Final Versions

Major impact

Minor impact Impact on the design?

Major changes to flare design calculations. As build and replace the design calculation volumes

Update Relief and Blowdown Study Report. (Rename “Flare System Design Philosophy”)

Build flare network model (for inclusion in the Flare System Design Philosophy)

No Impact

Update Relief and Blowdown Study Report (Rename “Flare System Design Philosophy”)

Build flare network model (for inclusion in the Flare System Design Philosophy) (Optional)

Stage 2 Varies according to outcome of Stage 1

Minor changes to flare design calculations. Rev up affected calculation volumes

Update Relief and Blowdown Study Report. (Rename “Flare System Design Philosophy”)

Build flare network model (for inclusion in the Flare System Design Philosophy) (Optional)

Prepare workscopes for the modifications

HMDC Internal Audit / Approval

End


Page21of 135


4.1.2

Legislative Obligations of HMDC’s Safety Design Philosophy HMDC’s legislative obligations to safety are encompassed in the Newfoundland Offshore Petroleum Installations Regulations (Reference 1), an extract of which follows: 43. (1) Every operator shall…submit to the Chief a concept safety analysis…that considers all components and all activities associated with each phase in the life of the production installation, including the construction, installation, operation and removal phases… (5)… …(g) a definition of the situations and conditions and of the changes that would necessitate an update of the concept safety analysis. (8) The operator shall maintain and update the concept safety analysis referred to in subsection (1) in accordance with the definition of situations, conditions and changes referred to in paragraph (5)(g) to reflect operational experience, changes in activity or advances in technology. HMDC have met these requirements, initially through the preparation of the Concept Safety Evaluation which has, over time, evolved into the Operational Plan which will be issued in the near future. The above very much parallels the type of approach the UK HSE require: 11. The employer…needs to review the risk assessment if there are developments that suggest that it may no longer be valid (or that it can be improved). In most cases, it is prudent to plan to review the risk assessments at regular intervals - the time between reviews being dependent on the nature of the risks and the degree of change likely in the work activity. Such reviews should form part of standard management practice. Management of health and safety at work - Approved Code of Practice (1992) The study will be undertaken in this light.

4.1.3

The Requirements of the Standards, Codes of Practice and Recommended Practices Where a particular design code is used its requirements are mandatory, e.g. the requirements of ASME VIII for a vessel stamped accordingly. Recommended practices are different in that their requirements are not mandatory in law unless they are stated in the regulations; this is the case with Canadian requirements. For those practices not in the regulations, common industry practice and deviation from those would normally require Certifying Authority approval. In dispute, the applicability of the use of the practice would be left to the courts to decide.


Page22of 135


So, although recommended practices are not the same as design codes, their requirements have become almost code like over time. Consider a situation where a failure has occurred and its cause appears to be linked to a situation where a well known, recommended practice was deviated from. There would in effect be an onus to prove the requirement inferred in the practice was inappropriate at the time it was being considered. Otherwise negligence would be very difficult to disprove. This proof would be particularly hard to provide and would require thorough documentation regarding the deviation to be kept for the life of the plant. This study will recognise this reality and, therefore, design code, code of practice and recommended practices, so long as they emanate from a recognised responsible body, are considered equivalent in this study in terms of reliance. 4.1.4

Ambiguities in the Recommended Practices The recommended practices are sometimes (some would say often) ambiguous in their requirements and a study such as this tends demonstrate the problem. Therefore interpretations of the practice’s actual intent often have to be made. This is one of the designer’s challenges and a particular challenge of this report. In the past, presumably to avoid the need for interpretation, owners of facilities have removed the ambiguities by being prescriptive with their requirements. Thus, industry practices, which often have little connection with the original design code intent, have sometimes been established for expediency. The goal today is to apply the codes as intended without unnecessary features that increase cost. The methodology used in this study therefore lies in this latter approach to the application of practices, to apply them as intended. Where there are differences between the various methods of applying practices this will be highlighted in the narrative.

4.2

Calculation Audit The calculation technical audit’s primary aim is to identify key assumptions or queries contained outside the Relief and Blowdown Study Report. A secondary aspect is the high level numerical and methodological check of the existing relief case calculations to ensure their suitability to use as the basis for the revalidated Flare Design Philosophy. This process will identify any areas that require detailed review to be undertaken in future stages of the revalidation study. The audit will use a tabular approach (compiled by calculation volume) to highlight the assumptions or issues which require to be addressed during the challenge and risk mitigation review processes in subsequent sections of the study. Whilst addressing the calculations, secondary objectives such as consistency and methodology have also been revisited and these results can also be found on the detailed audit sheets.


Page23of 135


4.3

Challenge Process The challenge process is a sequential review of individual design parameters that had an effect on the way the flare system was dimensioned. • The process looks first at the requirements of the design codes or practices to place, in an historical context, the requirements for the design. The key codes and practices applicable to this work are those referred to in the RABS, i.e.: ♦ Canada Oil and Gas Installation Regulations ♦ Petroleum Occupational Safety and Health Regulations - Offshore Newfoundland ♦ API RP 520 ♦ API RP 521 ♦ API RP 14C ♦ Mobil EGS 661 ♦ ASME Section VIII, Division 1 • Secondly, how the system was actually designed is considered. This aspect captures the interpretations used when compared to the earlier activity. • Thirdly, the requirements of current codes and practices are then considered. • Fourthly, current best practice is considered to challenge the existing design and determine its suitability for application to Hibernia. Here the best practice applied is Granherne’s own (there is no other convincing way for us to address this issue). This is not to say that other companies do not apply the requirements differently. Where possible some alternative applications will be mentioned where relevant. • Finally, the effect of these stages is considered and a recommendation made for the way the requirements should be applied to Hibernia to give a consistent and easily understood flare system design.


Page24of 135


4.4

Risk Management in Relation to Flaring Events and Wind Condition This issue stems from the technique used occasionally where the capacity of a flare system has been increased when it has been realised that at the design windspeed no personnel would be present on deck, thereby allowing higher incident radiation rates on deck during these events. This would only be the case if a very high wind speed were considered during design. A more pragmatic approach to design windspeed selection would ensure that the coincident conditions were considered, i.e. a realistically high windspeed. Generally two cases are considered: Emergency flaring The methodology used to generate the results of the activity are based on multipliers applied to the flowrates considered in the original flare boom length defining design case, i.e. combined HP and LP blowdown. It should be appreciated that these resultant rates cannot actually occur until the platform is actually modified to incorporate the necessary inventory, in this case, in the same ratio (HP/LP) as design. This is unlikely. The real effects, or real envelope, will therefore depend on the actual modification made. The actual effect should be considered in detail during the particular modification project’s design phase. Continuous flaring Continuous flaring differs from emergency flaring in that the acceptable radiation levels are very much lower than for emergency events. Proportionally, the lower radiation isopleths are more sensitive to wind than the high flow cases. The methodology used in this study has taken a simulation from the recent debottlenecking project (Case 3, a case which included Avalon production) and used this to generate current normal operating input data to generate a new set of profiles. The input data is adjusted up or down using simple multipliers to generate the expected envelope.


Page25of 135


5.0

TECHNICAL AUDIT OF THE DESIGN CALCULATIONS

5.1

Introduction The intent of this review is twofold: • To identify assumptions or items which have affected the design of the relief and blowdown system including any issues which arise as a result of the review (Section 5.2). • To revisit the relief valve calculations to perform a methodological and numerical check to reconfirm the validity of the dimensioning design cases (Section 5.3).

5.2

Results of the Technical Audit – Relief and Blowdown System Calculations In Appendix I the full results of the audit are given. The detailed tables that follow identify a number of issues to be dealt with, either in Section 6, because they can be challenged, or in this section if they are issues which concern the accuracy or soundness of the design conclusions. For completeness, however, both sets of issues are summarised below. Table 5.3 Challenge Issues - Relief and Blowdown System Calculations (System 34) Calculation

Number 34005 / A

Title Blowdown Section (Provides input simulations)

Inventory Calc to blowdown

Issue Rev

Date

06

18-May-93

Number 34005/2

005/4

Description Jet fire scenario not taken into account for the design of the blowdown system Were fire areas used for total blowdown rate? Correct isentropic efficiency used?

006 / A

Blowdown Summary

05

19-May-93

006/2

042 / F

Total LP Blowdown - Initial Conditions - Network Analysis Injection Compressor 'A' Blowdown Initial Conditions - Network Analysis Total LP Blowdown - After 3 mins (stagger point) - Network Analysis

02

18-Mar-93

006/3 042/2

02

18-Mar-93

Is design case too extreme? Validity of staggering blowdown. Were the systems sufficiently independent? See 34-042/2

01

22-Mar-93

See 34-042/2

043 / F 044 / G


Page26of 135


Table 5.4 Technical Audit Issues - Relief and Blowdown System Calculations (System 34) Calculation Number 34005 / A

Issue

Title Blowdown Section (Provides input simulations)

Inventory Calc to blowdown

Rev

Date

06

18-May-93

Number 34005/1

005/3

006 / A

Blowdown Summary

05

19-May-93

005/5 006/1

006/4

010 / A

Calculation of allowed cooldown before hydrate formation & minimum temperatures achieved in flare gas from critical blowdown sections

02

23-Mar-92

006/5 010/1

010/2 011 / A

Review of HP flare KO Drum size

02

06-Feb-92

011/1

012 / A 015 / A

Review of LP flare KO Drum size Calc to review options for reducing HP to MP Separator and MP to LP Separator Blowby Cases

03 01

10-Mar-92 14-Aug-91

015/1

015/2

060 / B 061 / B

022 / C

Indicative Injection Compressor Cooldown Calculation Simplistic Steady State Preliminary Review of the Annulus Rupture Relief Flowrate

01

29-May-92

01

10-Sep-92

061/1

HP Flare Network Sizing Separator - Max Relief Case)

02

22-Mar-93

022/1

(HP

022/2


Page27of 135

Description Are the blowdown volumes used sufficiently accurate? Were the real settle out pressures ever used? Are vessel weights used reasonable? HP Blowdown calculation higher than vendor aware of. Radiation level for case is underestimated. Is constant rate blowdown a valid design method, i.e. not according to API? 'As Built' settleout pressure Was the calculation methodology sufficiently robust?

Should 'troubleshooting' methanol injection points be incorporated? A note on the front of calc 34-064 states that Rev 7 of Design Basis gives max well flow of 20,000 bpd + average well of 10,000 bpd, i.e. 30,000 bpd total. The individual well design rate has changed. What are the implications for the platform? See 34-011/1 Relief & Blowdown Study Report Rev C1 non-concurrent maximum allowable LP and HP Flare loads are 110,874 kg/h and 244,897 kg/h respectively. Rates used in these calculations exceed design. Is considering only one control valve fails open for gas blowby case when 2 installed in parallel realistic / allowable even with provision of independent transmitters and controllers? See 34-010/1 and 34-010/2 This case had the potential to be the defining case for the HP flare system (depending on installed choke valve CV) What happened subsequently? Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C1 Effect of increased production / production fluid GOR


Table 5.2 Technical Audit Issues - Relief and Blowdown System Calculations (System 34) (Cont.) Calculation Number 34023 / C

Issue

Title

Rev

Date

HP Separator Max Spill-off Case Network Analysis

02

22-Mar-93

Number 34023/1

023/2

024 / C

MP Separator Max Relief Case Network Analysis

02

24-Mar-93

024/1

025 / C

3rd Stage Compressor Max Relief Case - Network Analysis

01

27-Jan-93

025/1

025/2

026 / C

Injection Compressor Max Case - Network Analysis

Relief

01

27-Jan-93

026/1

027 / C

MP Separator Max Spill-off Case Network Analysis

02

24-Mar-93

027/1

028 / D

West Test Separator Max Spill-off Case - Network Analysis

02

24-Mar-93

028/1

029 / D

West Test Separator Max Relief Case - Network Analysis East Test Separator Max Spill-off Case - Network Analysis

02

28-Jan-93

02

25-Mar-93

East Test Separator Max Relief Case - Network Analysis 1st Stage Compressor Spill-off Case Network Analysis

02

25-Mar-93

01

29-Jan-93

030 / D

031 / D 34- / E

Total HP Blowdown Initial Conditions (Checks blowdown line sizes for individual system blowdowns)

01

22-Mar-93

LP Separator Max Spill-off Case Network Analysis


01

02-Mar-93

Page28of 135

See also 34-022/2 Is case where valve considered. See also 34-022/2 See 34-022/2

fails

fully

open

fails

fully

open

Is case where valve considered? See also 34-022/2 See 34-022/2

34-/1

Calculated maximum pressure at spill-off valve discharge exceeds value on control valve datasheet Rev C1 Is case where valve fails fully open considered? There is no network analysis run with common HP Blowdown at initial conditions

045/1

045/2 039 / F

Calculated maximum pressure at spill-off valve discharge exceeds value on control valve datasheet Rev C1 Is case where valve fails fully open considered? See also 34-022/2 Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 - Check for later revisions Include in upated RABS cases which are not catered for, i.e. consider relief from both compressor trains Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 See also 34-025/1& 34-025/2 Was failed open control valve considered?

030/1

34-/2 045 / E

Description

039/1

Consistency error in the number and flows in the gas injection flowlines Is case where valve fails fully open considered? See also 34-022/2


Table 5.2 Technical Audit Issues - Relief and Blowdown System Calculations (System 34) (Cont.) Calculation Number 34042 / F

Issue

Title

Rev

Date

Total LP Blowdown - Initial Conditions - Network Analysis

02

18-Mar-93

Number 34042/1

Coalescer & LP Separator Heaters Simultaneous Fire Relief - Network Analysis Injection Stage Suction Scrubber PSV - Network Analysis

01

01-Feb-93

033/1

01

10-Feb-93

036/1

037 / G

HM & CM Expansion Drums Simultaneous Fire Relief Case Network Analysis

02

01-Feb-93

037/1

046 / G

Fuel Gas Cooler / Heater tube rupture relief line size check

01

02-Mar-93

046/1

050 / G

3rd Stage Suction Scrubber A (D3303A) PSV Discharge Line Size Confirmation E-3301 Shell Side PSV Discharge Line Size Confirmation E-3303B Shell Side PSV Discharge Line Size Confirmation HP Manifold Relief - Network Analysis

01

02-Mar-93

050/1

01

02-Mar-93

See also 34-033/1 ''As Built' P&IDs show bursting discs in this service (calc considers PSVs) therefore calc is no longer valid Rev C2 PSV datasheet states set pressure = 8200 kPa(g), 'As Built' P&ID shows set pressure = 7000 kPa(g) See 34-033/1

01

02-Mar-93

See 34-046/1

01

02-Mar-93

Simultaneous Fire Relief Case from Z3701 A/B, Z-3702 A/B & Z6202 A/B (pig launchers and fuel gas package) E-3701 Shell & Tube Side Simultaneous Fire Relief Case - Line Size Confirmation

01

10-Feb-93

01

12-Feb-93

E-6201A/B Tube Side Fire Relief Case Comparative Program check of INPLANT Single Phase Simulation vs ESI

01

10-Feb-93

01

23-Apr-93

033 / G

036 / G

052 / G 053 / G 054 / G

055 / G

057 / G

058 / G 059 / G


Page29of 135

Description Total blowdown rate (initial rate) used in calc less than that in Relief & Blowdown Study Report ( 89,601 kg/h) Assumption that the header is at zero pressure (I.e. that this is a singular event not coincident with any other releases) Inconsistency on datasheet between accumulation and 'Max Relieving Pressure' (should be 10%) Calculated back pressure (for 0152A/B) greater than specified on datasheet - calc considers this OK as less than 10% of set pressure

054/1

Rev C2 PSV datasheet states set pressure = 34,400 kPa(g), 'As Built' P&ID shows set pressure = 34,100 kPa(g) See 34-033/1

057/1

Calculated back pressure exceeds that specified on datasheet for both PSVs See also 34-033/1 See also 34-033/1

059/1

Accuracy of calculations using ESI instead of INPLANT


5.2.1

Technical Audit Issue Discussion – Relief and Blowdown System Calculations The following describes the technical audit issues identified in Table 5.4. However, first the general issues relating to the audit are described.

I.1.1.1

General Issues A number of issues arose which affected many of the calculations in the flare system calculation volumes. These are described below: • Flare network calculations - Whilst the flare network calculations were performed, the results of the calculations were never carried over to the discipline (instrument) data sheets (through which the equipment was purchased). In other words, the control valves and relief valves were all sized with the wrong back pressure. In most cases this has no effect because the relief valves are balanced and the difference in back pressure is low or, for similar reasons, because we know the control valves appear to be doing their respective duties (albeit probably a little more open than planned). Where there is an effect this is noted as an issue below. • Fire zones were used in the calculations but Granherne, so far, have not had access to documents describing them. • Vendor data didn’t make it through to the final calculations. This particularly affected the settleout pressures for the compressors and the calculations of realistic volumes in the system. Because of the aggregate nature of these changes we suspect, but cannot be sure, there would be no material effect on the flare system design.

I.1.1.2

Technical Audit Issues Issue 34-005/1 - Are the blowdown volumes used sufficiently accurate? The majority of the blowdown volume data is summarised and unchanged from an earlier revision of the calculation that used the best available information at the time for piping volumes. The separation train major vessel dimensions appear unchanged from those used for the calculations however the ‘As Built’ dimensions of the E & W Test Separators are greater and these vessels contribute a significant proportion of the HP flare blowdown load. Any increase in HP flare blowdown load from this source can be mitigated against the load incorporated for future equipment that remains uninstalled. No calculation was found to confirm compression train scrubber vessel dimensions used for the blowdown/settleout calculations and therefore it was not possible to check them against the ‘As Built’ vessels. This could have a significant effect on the LP flare blowdown load. The missing calculation should be found and the calculation revised to reflect the as built data.


Page30of 135


Issue 34-005/3 - Were the real settle out pressures ever used? As stated above, the validity of the blowdown/settleout calculations for the compression train could not be confirmed. The ‘As Built’ calculation of these values could have a significant effect on the LP flare blowdown load. The missing calculations should be found and reviewed. If necessary the blowdown calculations should be rerun and the results incorporated in the RABS update, Issue 34-005/5 - Are vessel weights used reasonable? Blowdown section weights stated in the calculation are based on vendor data for vessels. Weight of pipework associated with major vessels appears to have been estimated only. For systems that contain only pipework (e.g. manifold systems) major pipework weight is calculated from the best available information at the time. It is considered that a more accurate calculation of system weights would be unlikely to have a significant effect on the blowdown loads (because of aggregate effects). Issue 34-006/1 - HP Blowdown calculation higher than vendor aware of. Radiation level for case is underestimated Revision 06 of this calculation identified a HP flare blowdown load 5.8% greater than the load used by the vendor for the flare radiation calculations. This increase is not a concern at present because, as stated above, there is a significant allowance included in the total HP flare blowdown load for future equipment. However, the increased HP flare blowdown load should be incorporated into the updated RABS. Issue 34-006/4 - Is constant rate blowdown a valid design method, i.e. not according to API? A constant blowdown rate (i.e. not reducing with time) was used for two items of low pressure equipment, the LP separator and the LP fuel gas KO drum. Though not normally valid, as they operate at low pressure and thus will not contribute a significant proportion of the total LP flare blowdown load the calculation is considered acceptable (see also Section 6.3.5). Issue 34-006/5 - 'As Built' settleout pressure As Issue 34-005/3 above.


Page31of 135


Issue 34-010/1 – Was the calculation methodology sufficiently robust? This calculation identified the minimum allowable temperatures that the process plant could fall to during a process shutdown before potential problems could arise on blowdown. The resulting cool-down temperatures were: Hydrate Formation Cooldown Temperature, oC

61.5

Resulting Blowdown Temperature, oC

-30

Min Design Temp (-45 oC) Occurs in Flare Cooldown Temperature, oC

50.0


-45

The simulations used to generate these numbers were checked and they revealed that the resultant blowdown temperatures were calculated using adiabatic flashes and not using a blowdown model. The adiabatic flash assumes isenthalpic expansion, i.e. the isentropic coefficient is 0, and results in higher downstream temperatures. A blowdown model was run for the ‘Min Design Temp (-45 oC) Occurs in Flare’ case, depressurising from the same settle out pressure and a temperature of 50 oC and gave the following results: Min Design Temp (-45 oC) Occurs in Flare – Blowdown Model Cooldown Temperature, oC

50.0


-59 (Isentropic Coefficient = 0.5)


-63 (Isentropic Coefficient = 0.7)

The results show that the temperature of the equipment must not be allowed to fall to the level as originally calculated (50 oC) and more realistically blowdown should be initiated at around 70 oC.


Page32of 135


This calculation does not give any conclusions on the allowable delay before blowdown should be initiated, this is addressed in calculation 34-060 / B for the Injection Compressor only. 060 / B concludes that for the original model basis there is a huge spread of allowable delay periods depending upon environmental conditions and whether insulation is installed. The results of calculation 060 / B are given below:

Cooldown temp at wh

Hold time for cooldow Current platform design philosophy is to depressurise after 1-2 hours. Given this large spread the difference on calculation of the minimum allowable cooldown may not have a significant effect on the delay allowed before blowdown is initiated. As no firm conclusions were made in this calculation and given the problems in the input data this whole issue should be revisited and re-evaluated using ‘As Built’ / operating equipment and environmental data due to the possible adverse effects on the platform should the minimum temperatures defined above be achieved. Once the new calculations had been completed alarms could be added to the affected equipment (e.g. the gas injection manifold) which would warn that blowdown was necessary. Allowing the temperature to fall below this point would lead to excessively low temperatures and the potential for flare pipework failure through embrittlement. Issue 34-010/2 - Should 'troubleshooting' methanol injection points be incorporated? They actually are installed. Therefore no further concern.

Cooldown temp at wh

Hold time for cooldow 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc

Page33of 135


Issue 34-011/1 – The individual well design rate has changed. What are the implications for the platform? The individual well rates have changed since design rendering the related calculations obsolete. The new well rates need to be included in the RABS revision. Two aspects will need to be addressed: • A final decision regarding the number of wells which fail to shut in, based on the lower expected number of more prolific wells, which need to be designed for. •

The maximum design well rate.

To follow from the above will require a modified procedure to be developed which caters for the reduced time period available before the HP flare KO drum overfills (which will happen in less than 10 minutes should relief occur at the higher well rates). Issue 34-015/1 – Relief & Blowdown Study Report Rev C1 non-concurrent maximum allowable LP and HP Flare loads are 110,874 kg/h and 244,897 kg/h respectively. Rates used in these calculations exceed design. The maximum allowable independent LP and HP flare loads used in these calculations to determine maximum allowable control valve CV for the blowby cases are greater than the quoted figures in the Relief & Blowdown Study Report Rev C1 (i.e. 119,324 kg/h (LP) and 274,878 kg/h (HP) respectively). However the actual installed control valve CVs are less than the calculated maximum. Therefore the system design rates (244,897 and 110,874 kg/h) should not be exceeded. For consistency, the MP and LP Separators relief valves should be checked against the installed control valve CVs. Issue 34-015/2 - Is considering only one control valve fails open for the gas blowby case when 2 are installed in parallel realistic / allowable even with the provision of independent transmitters and controllers? This issue relates to the ability of only one of the LCVs to fail open. The level control systems in question have independent transmitters and the equivalence in DCS terms of duplicated controllers. This has been confirmed by HMDC studies. No further action is required.


Page34of 135


Issue 34-061/1 - Annulus rupture case had the potential to be the defining case for the HP flare system (depending on installed choke valve CV). What happened subsequently? The RABS states that gas lift to Hibernia wells is no longer required. If it becomes necessary in the future then it will be provided by a method which will eliminate the need to design for annulus rupture. The situation with the Avalon wells is less clear. The RABS states that confirmation was required during detailed design of the subsea facilities that annulus rupture need not be considered as a relief case. The need, or lack of, for design of the relief systems for annulus relief in both Hibernia and Avalon wells should be confirmed. Issue 34-022/1 – Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C1 Results of this calculation were taken into account on ‘As-Built’ PSV datasheet, therefore no concern. Issue 34-022/2 – Effect of increased production / production fluid GOR The maximum associated gas capacity of the platform is governed by the capacity of the compressors. This effectively set the required size of the HP separator relief valves. Therefore even though the production GOR changes the relief valve should have sufficient capacity whilst the compressors are able to take the gas. This link should be made clear in the updated RABS. Elsewhere in the system GOR has very little effect on the defining relief cases as these are set by physical characteristics of installed valves, i.e. the gas blowby cases. Should the physical characteristics of either of the above change, i.e. through rewheeling a compressor stage, or through the use of larger control valve trims, the calculations should be revisited. Issue 34-023/1 – Calculated maximum pressure at spill-off valve discharge exceeds value on control valve datasheet Rev C1 The difference in calculated and datasheet valve discharge pressure is small (146 kPa) and is insufficient to affect sizing. Furthermore, the installed CV is greater than that required for the maximum flow (500 compared to 376 calculated for design flowrate). Therefore the valve should be able to do its design duty.


Page35of 135


Issue 34-023/2 – Is case where valve fails fully open is considered? It appears this case was not considered (or, at least, not in the calculations we have seen). This comment appears to be true for all the spillover valve cases. The consequences of failed open spillover valves should form a section in the updated RABS. Returning to this particular case, the normal operation of this valve directs 245,000 kg/h to the HP flare (when the compressors shut down). This is the same flowrate as the design maximum for the HP flare. The calculated valve CV for this flow is 376 and the control valve installed CV is 500 therefore if the valve were to be sent wide open, for any reason, there would be an instantaneous flowrate of around 326,000 kg/h directed to the HP flare, which is well above the HP flare design figure. We are also aware that this valve trim has recently been replaced with a 550 CV trim making the potential overshoot worse. The consequences of this relief case, such as thermal radiation impingement on the platform, together with remedial measures to limit the peak should be investigated further. Issue 34-024/1 - Calculated maximum pressure at (MP separator) PSV discharge exceeds value on PSV datasheet Rev C2 Results of this calculation taken into account on ‘As-Built’ PSV datasheet, therefore no concern. Issue 34-025/1 - Calculated maximum pressure at (3rd stage compressor) PSV discharge exceeds value on PSV datasheet Rev C2 ‘As-Built’ PSV datasheet retains original back pressure of 500 kPa(g) max. However the PSV set pressure is 25,500 kPa(g) and the minor increase in back pressure will have no effect on the PSV capacity. Issue 34-025/2 - Is relief from both compressor trains a valid case? We are aware of events which have caused relief valves to lift on both compressors simultaneously. A modification project was included to avoid this occurrence. The project should be reviewed for its capability to prevent this case and a description should be included in the updated RABS. Issue 34-026/1 - Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 ‘As-Built’ PSV datasheet retains original back pressure of 500 kPa(g) max. However as the minimum PSV set pressure is 45,500 kPa(g) the minor increase in back pressure will have no effect on the PSV capacity.


Page36of 135


Issue 34-027/1 – Was failed open MP spillover control valve considered? The normal operation of this valve directs 94,500 kg/h to the HP flare. The calculated valve CV for this flow is 522 and the control valve installed CV is 600 therefore if the valve were to be sent wide open, for any reason, there would be an instantaneous flowrate of somewhat less than 109,000 kg/h directed to the HP flare. This flowrate is considerably lower than the HP flare design maximum so is tolerable. There may be significant noise associated with this case. Issue 34-028/1 – Is case where west test separator spillover valve fails fully open considered? The normal operation of this valve directs 58,800 kg/h to the HP flare. By inspection, if the valve were to be sent wide open, for any reason, the instantaneous flow to the flare would not exceed the HP flare design maximum so is tolerable. There may be significant noise associated with this case. Issue 34-030/1 – Is case where east test separator valve fails fully open considered? The normal operation of this valve directs 58,800 kg/h to the HP flare. By inspection, if the valve were to be sent wide open, for any reason, the instantaneous flow to the flare would not exceed the HP flare design maximum so is tolerable. There may be significant noise associated with this case. Issue 34-/1 – Calculated maximum pressure at 1st stage compressor spill-off valve discharge exceeds value on control valve datasheet Rev C1 The difference in calculated and datasheet valve discharge pressure is small (50 kPa) compared to the upstream pressure and the installed CV is greater than that required for the maximum flow (320 compared to 231 calculated for design flowrate). The valve will therefore easily pass the desired rate. Issue 34-/2 – Is case where 1st stage compressor spillover valve fails fully open considered? The normal operation of this valve directs 59,800 kg/h to the HP flare. By inspection, if the valve were to be sent wide open, for any reason, the instantaneous flow to the flare would not exceed the HP flare design maximum rate. There may be significant noise associated with this case.


Page37of 135


Issue 34-039/1 – Is case where LP separator spillover valve fails fully open considered? The normal operation of this valve directs 60,200 kg/h to the LP flare. The calculated valve CV for this flow is 3097 and the control valve installed CV is 4145 therefore if the valve were to be sent wide open, for any reason, there would be an instantaneous flowrate of somewhat less than 80,600 kg/h directed to the LP flare. This flow is considerably less than the LP flare design maximum flowrate. The case would be of short duration as the LP separator pressure would immediately begin to fall, lowering the rate experienced. Issue 34-045/1 - There is no network analysis run with common HP Blowdown at initial conditions The calculations for total HP blowdown were all done on an individual basis only to check that the velocity criterion was not exceeded in the laterals (a check for excessive pressure drop was also made). No network analysis for total blowdown was done. This was a valid approach at the time as it could be assumed that all blowdown valves would be operating at sonic velocities and back-pressures that could restrict flow would never be reached in the system. Given that HMDC are considering modifications to the platform, the construction of a network model of the HP flare system would be a useful exercise to determine the effects of any modifications proposed. Issue 34-045/2 - Consistency error in the blowdown flowrate from the gas injection flowlines. This calculation identifies 8 blowdown valves each with an initial blowdown rate of 2250 kg/h (the blowdown simulation gives actual rate is 2233 kg/h). The total blowdown rate for all GI lines given in calc 34-006/A is 8932 kg/h indicating that the HP flare system is designed to accommodate four GI wells. If more than four GI wells are installed in the future, calculation 006 should be revisited. Issue 34-042/1 – Total blowdown rate (initial rate) used in calc less than that in Relief & Blowdown Study Report (89,601 kg/h) This calculation uses 86,709 kg/h for total LP blowdown initial rate, less than that stated in Relief & Blowdown Study Report (89,601 kg/h). The lower blowdown load is in fact a more up to date figure as stated in calculation 34-006 / A Rev 06. The decreased LP flare blowdown load should be incorporated into an updated Relief & Blowdown Study Report.


Page38of 135


Issue 34-033/1 – Assumption that the header is at zero pressure (i.e. that this is a singular event not coincident with any other releases) To calculate the PSV back pressure for these valves, it is assumed that the header the lateral relieves to is at zero pressure. This will not be true for systems which do not blowdown. During a local fire the affecting these systems the blowdown system will be activated. A back pressure only slightly higher than that calculated will be greater than 10% of the PSV set pressure of 700 kPa(g). API RP520 only allows a maximum back pressure of 10% of set pressure for this type of valve (conventional). The valve selection therefore needs to be reviewed and resized as necessary. This will require a flare network model to be constructed. In a number of areas this same inconsistency exists and the valve selection should be reviewed similarly. Issue 34-036/1 – Inconsistency on (injection compressor PSV) datasheet between accumulation and 'Max Relieving Pressure' (should be 10%) Rev C2 PSV-7326 datasheet 'Max Relieving Pressure' is 121% of set pressure therefore inconsistent with stated 10% accumulation. The ‘As Built’ datasheet shows accumulation at 10% therefore no concern. Issue 34-037/1 – Calculated back pressure (for 0152A/B) greater than specified on datasheet - calc considers this OK as less than 10% of set pressure The maximum calculated PSV back pressure is 84 kPa(g); higher than the ‘As Built’ datasheet, which shows 1-35 kPa(g), but less than 10% of the PSV set pressure of 1380 kPa(g). API RP520 allows a maximum back pressure of 10% of set pressure for conventional valves therefore there is no concern. Issue 34-046/1 – 'As Built' P&IDs show bursting discs installed in this service (calc considers PSVs) therefore calc is no longer valid There is no replacement calculation for the installed bursting discs. The bursting disk calculations should be reviewed to identify implications for the flare system. Issue 34-050/1 – Rev C2 PSV datasheet states set pressure = 8200 kPa(g), 'As Built' P&ID shows set pressure = 7000 kPa(g) ‘As Built’ datasheet has 33-PSV-7200 set pressure of 8200 kPa(g). As the item of equipment the PSV is protecting (D-3303A) has a design pressure of 8200 kPa(g) the error is on the P&ID. The P&ID should be corrected at the next revision. This also applies to 33-PSV-7226 protecting D-3303B.


Page39of 135


Issue 34-054/1 – Rev C2 (HP manifold) PSV datasheet states set pressure = 34,400 kPa(g), 'As Built' P&ID shows set pressure = 34,100 kPa(g) The ‘As Built’ datasheet has 31-PSV-7042A/B set pressure of 34,100 kPa(g) therefore the P&ID is probably correct and the design pressure revised downwards since the Rev C2 PSV datasheet issued. No changes are therefore required. Issue 34-057/1 – Calculated back pressure exceeds that specified on datasheet for both (recirculation heater) PSVs The maximum calculated back pressure for each PSV exceeds that stated on the ‘As Built’ datasheet, which shows 1-35 kPa(g). However the calculated back pressure is still less than 10% of each PSV set pressure. API RP520 allows a maximum back pressure of 10% of set pressure for conventional valves therefore there is no concern. Issue 34-059/1 – Accuracy of calculations using ESI instead of INPLANT ESI has been used extensively in the flare calculations. This comparison calculation between ESI and SIMSCI’s hydraulic simulator, INPLANT, showed that ESI gave pressure drops 20% less than INPLANT. There appears that nothing was done to recheck the calculations at the time. Assuming that INPLANT is more accurate (as it is more rigorous) then a 20% difference on pressure drop calculation is significant. All calculations using ESI should be revisited.


Page40of 135


5.3

Results of the Technical Audit – Relief Valve Sizing Calculations In Appendix I the full results of the audit are given. The detailed tables that follow identify a number of issues to be dealt with which concern the accuracy or soundness of the design conclusions. Table 5.5 Technical Audit Issues – Relief Valve Sizing Calculations Calculation

Number 31.35

Relief Valve Separator

Title Calculations

Issue -

HP

Rev C1

Date Nov-91

Number 31.35/1

31.35/2

31.35/3

31.35/4 31.35/5

31.36


Calculations

-

MP

C1

Nov-91

31.36/1

31.36/2 31.36/3

31.36/4 31.36/5

31.36/6 31.36/7


Page41of 135

Description Does 2 phase relief case become the governing case if the calculation new calculation method given in API RP520, Seventh Edition used? Flare network analysis for 2 phase case (Calc 34-064 / G) used total load = 252,372 kg/h (40,000 bpd). Relief & Blowdown Study Report Rev C1 states HP Separator Blocked Outlet (Vapour) relief load is 244,897 kg/h. The two phase calculation feed vapour / liquid split was abnormally low. Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong effective pressure was for the V/L split and property conditions. Does 2 phase relief case become the governing case if the calculation new calculation method given in API RP520, Seventh Edition used? Are 2 x 50% LCVs sufficiently independent? Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong pressure was used to generate the vapour amount and properties. The two phase calculation feed vapour / liquid split was abnormally low. Calculation subsequently superseded but no indication that calculation was subsequently corrected. The gas blowby cases are methodologically flawed. There is an error in the gas rate calculated by the test separator gas blowby case.


Table 5.3 Technical Audit Issues – Relief Valve Calculations (Cont.) Calculation Number 31.37


Title Calculations

Issue -

LP

Rev C0

Date 27-Nov-91

Number 31.37/1

31.37/2 31.38

Inlet Line Size Checking for Relief Valves

05-Dec-91

31.38/1

31.42

HP/MP/LP Separators PSV Inlet Line Sizing

02-Jun-92

31.42/1

31.43

Gas Blowby (Checking Capacity of Downstream System for Gas Blowby from HP to MP Separator and MP to LP Separator)

22-Nov-92

31.43/1

31.43/2

31.43/3

5.3.1

Description Is it possible for the Test Separator manifold to be connected to the LP Separator when operating in high pressure mode? Are 2 x 50% LCVs sufficiently independent? See also 31.36/6 Inlet line sizes should have been recalculated using 'Final' relief data and isometrics. Pressure drop to HP Separator relief valves has not been calculated using maximum relieving capacity of valves See also 31.43/1 & 31.43/2 This calculation considers both upstream LCVs fail open simultaneously. This scenario is not considered in the Relief & Blowdown Study Report Rev C1 (or in any other calculations reviewed), nor is the platform designed for its affects. This calculation considers both upstream LCVs fail open simultaneously. This scenario is not considered in the Relief & Blowdown Study Report Rev C1 (or in any other calculations reviewed), nor is the platform designed for its affects. The calculation identifies the failure of the spillover valve (open) could lead to a relief rate which is higher than the current design.

Technical Audit Issue Discussion – Relief Valve Calculations The following describes the technical audit issues identified in Table 5.3. In this case the issues are grouped by relief valve and then under broad issue headings.


Page42of 135


I.1.1.1

HP Separator Relief Valves Two phase case A series of issues raised by the technical audit can be grouped together under this issue, i.e. Issue 31.35/1 - Does two phase relief case become the governing case if the calculation new calculation method given in API RP520, Seventh Edition used? Issue 31.35/2 - Flare network analysis for 2 phase case (Calc 34-064 / G) used total load = 252,372 kg/h (40,000 bpd). Issue 31.35/4 - The two phase calculation feed vapour / liquid split was abnormally low. Issue 31.35/5 - Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong pressure was used to generate the vapour amount and properties. The calculation of the relief valve area for the two-phase case underestimates the area required. There was a combination of inconsistency, probably incorrect simulation compositions and a flaw in methodology (compared to API RP 520 Sixth Edition) which together would underestimate the orifice area required. However, because of the new sizing method we are obliged now to use (see Section 6.5) and because of well rate considerations these problems will naturally be corrected in the new calculation that will be required. So returning to 31.35/1, the most important of these considerations; the relief valve orifice area required for the original two phase relief case based on the new Leung omega API RP520 calculation method is 8.21 in2. This compares with the originally (incorrectly) calculated value of 3.19 in2 for the same relief scenario. Obviously the new method of calculation has a significant effect on required orifice area for relieving two phase flow. In this particular case, the governing case for the relief valve was blocked outlet – vapour relief only, which required a minimum orifice area of 9.38 in2 whereas the actual installed orifice area is 11.05 in2. On the face of it, therefore, no hardware modifications are required. However, we are aware that the maximum single well rate is now well in excess of the originally considered 40 kbopd case (which represented one large and one medium well failing to shut in). Therefore the relief case must be rigorously recalculated. Using the new sizing method the maximum safe well rate for a single well failing to shut in is approximately 54 kbopd. Measures should be taken to limit the maximum well rate to this value, and to less than this value if 2 wells failing to shut in becomes the selected basis.


Page43of 135


Vapour only case Issue 31.35/3 - Relief & Blowdown Study Report Rev C1 states HP Separator Blocked Outlet (Vapour) relief load is 244,897 kg/h. The rate used in the calculation and to purchase the relief valve was 227,649 kg/h. This appears to be confused in the RABS with the normal maximum associated gas rate when the spillover valve is open during a compressor shut down. This inconsistency should be corrected in the updated RABS. I.1.1.2

MP Separator Relief Valves Two phase case Issue 31.36/1 - Does two phase relief case become the governing case if the new calculation method given in API RP520, Seventh Edition is used? Issue 31.36/3 - Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong pressure was used to generate the vapour amount and properties. Issue 31.36/4 - The two phase calculation feed vapour / liquid split was abnormally low. The same description as above (Section I.1.1.1) is equally valid here (although the orifice areas are different). This case must be calculated rigorously recalculated. Issue 31.36/2 - Are 2 x 50% LCVs sufficiently independent? This issue relates to the ability of only one of the LCVs to fail open. The level control systems in question have independent transmitters and the equivalence in DCS terms of duplicated controllers. This has been confirmed by HMDC studies. No further action is required. See also below. Issue 31.36/5 - Calculation subsequently superseded but no indication that calculation was subsequently corrected. The gas blowby rate was reduced in January 93 (because the valve CV was reduced from 400 to 350). However the valve selection remained unchanged. The required orifice area is therefore higher than it needed to be. Issue 31.36/6 - Are the gas blowby cases methodologically flawed? It is arguable that the gas blowby cases are methodologically flawed. The reasons for this are given below:


Page44of 135


• API RP520 does not allow credit for control valves in their normal position to move to reduce the relief rate, although the requirements are rather vague. Thus there may be a case for considering, irrespective of the control system, the worst case as one valve failed open and one in its normal position. However, as there is also a ESD/PSD between the systems we believe this would a very harsh case to consider. • The 100% gas case is normally considered only in a shutdown situation (otherwise a high component of the feed to the separator must pass with the gas to low pressure system and be relieved). Therefore, in a shutdown situation (where the liquid has dumped for some reason) a calculation method similar to settleout is normally used, i.e. the volume of gas lost from the higher pressure side to raise the pressure of the lower pressure side to the relief pressure is removed from the effective relief driving force. Also in this case the failure open of one valve is more likely to be acceptable because the likelihood of the both LCVs and the isolating ESVs failing is very low • Should a LCV fail open during normal production then the blowby fluid is both vapour and liquid (which will reduce the effective blowby volume rate) and also the normal positions of the downstream control valves could be taken into account thereby dramatically reducing the apparent relief rate. The above assumes the QRA did not identify the possibility of both valves failing open which we understand to be the case. The net effect of the above is to suggest the relief rates designed for are higher than they need be. A note could be added to the updated RABS to reflect this. Issue 31.36/7 - There is an error in the gas rate calculated in the test separator gas blowby case. The calculation of the gas blowby rate from the test separators uses a subcritical formula for the level control valve even though the calculation shows that the flow is critical. By inspection, the error will not affect the sizing of the relief valve as relief rate for this case is considerably less than for the governing case.


Page45of 135


I.1.1.3

LP Separator Issue 31.37/1 - Is it possible for the Test Separator manifold to be connected to the LP Separator when operating in high pressure mode? The test separators are able to operate in two modes, high pressure and low pressure. When operating in HP mode they are connected to the MP Separator and when in LP mode to the LP Separator. This calculation considers that the test separators are in LP mode but the reliability of the installed precautions / interlocks preventing connection of the test separators in HP mode to the LP Separator is not apparent. As the test separators can operate at 4240 kpa the potential gas blowby rate to the LP Separator, if incorrectly lined up, would be significant. This relief scenario should be investigated further. Issue 31.37/2 - Are 2 x 50% LCVs sufficiently independent? See Issue 31.36/2 above.

I.1.1.4

Miscellaneous Issue 31.38/1 - Inlet line sizes should have been recalculated using 'Final' relief data and isometrics. This calculation was done with preliminary data and has obviously been revised as many PSV inlet line sizes shown on the ‘As Built’ P&IDs are different to those calculated here. The inlet line sizes should be checked against ‘As Built’ data and isometrics. Issue 31.42/1 - Pressure drop to HP Separator relief valves has not been calculated using maximum relieving capacity of valves. The relief valve inlet line size has been calculated using the calculated governing case relief rate of 227,649 kg/h. API RP520 Part II states that the inlet line size should be calculated using the ‘maximum rated capacity’ of the installed relief valve which in this case is 262,161 kg/h. It is not expected that the inconsistency will have a significant effect on the inlet line size as a margin of 20% was applied at the time. (See also Issue 31.38/1 above). Issue 31.43/1 and 2 - This calculation considers both upstream LCVs fail open simultaneously. This scenario is not considered in the Relief & Blowdown Study Report Rev C1 (or in any other calculations reviewed), nor is the platform designed for its affects. In view of the description in 31.36/6 this case does not appear feasible. The notes attached to the calculations should have said so.


Page46of 135


Issue 31.43/3 - The calculation identifies the failure of the spillover valve (open) could lead to a relief rate which is higher than the current design. The calculation identifies that the LP Separator spillover valve, if it failed fully open, could generate a flowrate of 121,035 kg/h in the LP flare. This is greater than the current design LP flare capacity of 110,874 kg/h. The maximum flowrate which could be sent to the LP flare system under this scenario should be investigated for the current operation. 5.4

Technical Audit Conclusion Summary In tabular form, the following summarises the actions required to be undertaken in Stage 2. Table 5.6 Technical Audit Conclusion Summary (System 34)

Number 34005 / A


Number 34005/1

005/2 005/3

005/4

006 / A

010 / A

Blowdown Summary

Calculation of allowed cooldown before hydrate formation & minimum temperatures achieved in flare gas from critical blowdown sections

Description

Action



Jet fire scenario not taken into account for the design of the blowdown system Were the real settle out pressures ever used?

Incorporate jet fire calculations and update RABS accordingly Compare real settleout conditions with design to ensure blowdown rates are appropriate No further action

006/2

Were fire areas used for total blowdown rate? Are vessel weights used reasonable? HP Blowdown calculation higher than vendor aware of. Radiation level for case is underestimated. Correct isentropic efficiency used?

006/3

Is design case too extreme?

006/4

Is constant rate blowdown a valid design method, i.e. not according to API? 'As Built' settleout pressure Was the calculation methodology sufficiently robust?

005/5 006/1

006/5 010/1

010/2


Should 'troubleshooting' methanol injection points be incorporated?

Page47of 135

No further action Update RABS.

An optimistic isentropic efficiency was used to calculate the minimum system temperature. Recalculate the temperatures. See also 34.010/1. Select start pressure basis and update RABS. No further action unless staggered blowdown becomes an issue See 005/3 above There are flaws in the method used to calculate the minimum temperatures in the system. These should be corrected. Use resultant more realistic figure to implement alarms on high pressure areas to avoid low temperatures. Update RABS. No further action


Number 34011 / A

Title

012 / A

Review of LP flare KO Drum size Calc to review options for reducing HP to MP Separator and MP to LP Separator Blowby Cases

015 / A

Review of HP flare KO Drum size

Number 34011/1

Description

Action

A note on the front of calc 34-064 states that Rev 7 of Design Basis gives max well flow of 20,000 bpd + average well of 10,000 bpd, i.e. 30,000 bpd total. The individual well design rate has changed. What are the implications for the platform? See 34-011/1

Select number and design rate of the well failure to shut in case. Update RABS. Develop operational procedure to cater for time to fill HP flare KO vessel.

Relief & Blowdown Study Report Rev C1 non-concurrent maximum allowable LP and HP Flare loads are 110,874 kg/h and 244,897 kg/h respectively. Rates used in these calculations exceed design. Is considering only one control valve fails open for gas blowby case when 2 installed in parallel realistic / allowable even with provision of independent transmitters and controllers? See 34-010/1 and 34-010/2


061/1

This case had the potential to be the defining case for the HP flare system (depending on installed choke valve CV) What happened subsequently?

No further action required

022/1

Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C1 Effect of increased production / production fluid GOR


015/1

015/2

060 / B

061 / B

022 / C

Indicative Injection Compressor Cooldown Calculation Simplistic Steady State Preliminary Review of the Annulus Rupture Relief Flowrate HP Flare Network Sizing (HP Separator - Max Relief Case)

022/2

023 / C

HP Separator Max Spill-off Case Network Analysis

023/1

023/2

024 / C

MP Separator Max Relief Case - Network Analysis

024/1


Calculated maximum pressure at spill-off valve discharge exceeds value on control valve datasheet Rev C1 Is case where valve fails fully open considered?

See also 34-022/2 Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2

Page48of 135

See 34-011/1


See 34-010/1 and 34-010/2

Update RABS to mention link between GOR and the compressor capacity. No further action required.

Recalculate case. Assess measures for reducing the peak load during failure. Implement modification project. See also 34-022/2 No further action required.


Number 34025 / C

Title 3rd Stage Compressor Max Relief Case - Network Analysis

Number 34025/1

025/2

026 / C

Injection Compressor Max Relief Case Network Analysis

026/1

027 / C

MP Separator Max Spill-off Case Network Analysis

027/1

028 / D

West Test Separator Max Spill-off Case Network Analysis

028/1

029 / D

West Test Separator Max Relief Case Network Analysis East Test Separator Max Spill-off Case Network Analysis

030 / D

031 / D

34- / E

East Test Separator Max Relief Case Network Analysis 1st Stage Compressor Spill-off Case Network Analysis

030/1

34-/1

34-/2 045 / E

Total HP Blowdown Initial Conditions (Checks blowdown line sizes for individual system blowdowns)

045/1

045/2 039 / F

LP Separator Max Spill-off Case Network Analysis

039/1

Description

Action

Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 - Check for later revisions Include in updated RABS cases which are not catered for, i.e. consider relief from both compressor trains

No further action required.

Calculated maximum pressure at PSV discharge exceeds value on PSV datasheet Rev C2 See also 34-025/1& 34-025/2 Was failed open control valve considered?

/opt/scribd/conversion/tmp/scratch2682/37533791.doc

See also 34-025/1& 34-025/2 Recalculate case. Assess measures for reducing the peak load during failure if necessary.

See also 34-022/2 Is case where valve fails fully open considered.


See also 34-022/2 See 34-022/2

See also 34-022/2 See 34-022/2

Is case where valve fails fully open is considered?


See also 34-022/2 See 34-022/2

See also 34-022/2 See 34-022/2

Calculated maximum pressure at spill-off valve discharge exceeds value on control valve datasheet Rev C1 Is case where valve fails fully open considered? There is no network analysis run with common HP Blowdown at initial conditions


Consistency error in the number and flows in the gas injection flowlines Is case where valve fails fully open considered?

Add a note to the RABS clarifying the injection manifold rate basis. Recalculate case. Assess measures for reducing the peak load if necessary. See also 34-022/2

See also 34-022/2

8266-HIB-TN-C-0001

Check modifications to avoid injection compressor RVs lifting prevent coincident case. Update RABS to explicitly mention the cases which are not designed for. No further action required.

Page49of 135

No further action required. Consider constructing a HP flare network model to assess future modification projects against.


Number 34042 / F

Title Total LP Blowdown Initial Conditions Network Analysis

Number 34042/1

042/2

043 / F

Injection Compressor 'A' Blowdown - Initial Conditions - Network Analysis

033 / G

Coalescer & LP Separator Heaters Simultaneous Fire Relief - Network Analysis Injection Stage Suction Scrubber PSV - Network Analysis HM & CM Expansion Drums Simultaneous Fire Relief Case Network Analysis

036 / G

037 / G

044 / G

046 / G

050 / G

052 / G

053 / G

Total LP Blowdown After 3 mins (stagger point) - Network Analysis Fuel Gas Cooler / Heater tube rupture relief line size check

3rd Stage Suction Scrubber A (D-3303A) PSV Discharge Line Size Confirmation E-3301 Shell Side PSV Discharge Line Size Confirmation E-3303B Shell Side PSV Discharge Line Size Confirmation

Description

Action

Total blowdown rate (initial rate) used in calc less than that in Relief & Blowdown Study Report ( 89,601 kg/h) Validity of staggering blowdown. Were the systems sufficiently independent?

Update RABS

See 34-042/2

Perform safety analysis to satisfactory standard to show the vessels will not fail during jet fire (including the A injection compressor and components). See 34-042/2

033/1


Construct a LP flare network model to calculate the back pressure on relief valves when the system is depressuring.

036/1

Inconsistency on datasheet between accumulation and 'Max Relieving Pressure' (should be 10%) Calculated back pressure (for 0152A/B) greater than specified on datasheet calc considers this OK as less than 10% of set pressure


037/1

See also 34-033/1 See 34-042/2

046/1

''As Built' P&IDs show bursting discs in this service (calc considers PSVs) therefore calc is no longer valid

050/1

Rev C2 PSV datasheet states set pressure = 8200 kPa(g), 'As Built' P&ID shows set pressure = 7000 kPa(g)



See 34-042/2

There is no replacement calculation for the installed bursting discs. The bursting disk calculations should be reviewed to identify implications for the flare system. P&ID set pressure error?

See 34-033/1

See 34-033/1

See 34-046/1

See 34-046/1

Page50of 135


Number 34054 / G

Title

055 / G

Simultaneous Fire Relief Case from Z3701 A/B, Z-3702 A/B & Z6202 A/B (pig launchers and fuel gas package) E-3701 Shell & Tube Side Simultaneous Fire Relief Case - Line Size Confirmation E-6201A/B Tube Side Fire Relief Case Comparative Program check of INPLANT Single Phase Simulation vs ESI

057 / G

058 / G 059 / G

HP Manifold Relief Network Analysis

Number 34054/1

057/1

Description

Action

Rev C2 PSV datasheet states set pressure = 34,400 kPa(g), 'As Built' P&ID shows set pressure = 34,100 kPa(g) See 34-033/1


Calculated back pressure exceeds that specified on datasheet for both PSVs

See 34-033/1

See 34-033/1

See also 34-033/1

059/1


See also 34-033/1

See 34-033/1


Revisit ESI calculations and replace as necessary

Page51of 135


Table 5.7 Technical Audit Conclusion Summary (System 31) Number 31.35

Title Relief Valve Calculations - HP Separator

Number 31.35/1

Description Does 2 phase relief case become the governing case if the calculation new calculation method given in API RP520, Seventh Edition used?

31.35/2

Flare network analysis for 2 phase case (Calc 34-064 / G) used total load = 252,372 kg/h (40,000 bpd). Relief & Blowdown Study Report Rev C1 states HP Separator Blocked Outlet (Vapour) relief load is 244,897 kg/h. The two phase calculation feed vapour / liquid split was abnormally low. Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong effective pressure was for the V/L split and property conditions. Does 2 phase relief case become the governing case if the calculation new calculation method given in API RP520, Seventh Edition used? Are 2 x 50% LCVs sufficiently independent? Methodological problem in calculation (compared to API RP520 Sixth Edition). The wrong pressure was used to generate the vapour amount and properties. The two phase calculation feed vapour / liquid split was abnormally low. Calculation subsequently superseded but no indication that calculation was subsequently corrected. Are the gas blowby cases are methodologically flawed? There is an error in the gas rate calculated by the test separator gas blowby case. Is it possible for the Test Separator manifold to be connected to the LP Separator when operating in high pressure mode? Are 2 x 50% LCVs sufficiently independent? See also 31.36/6

31.35/3

31.35/4

31.35/5

31.36

Relief Valve Calculations - MP Separator

31.36/1

31.36/2 31.36/3

31.36/4

31.36/5

31.36/6 31.36/7

31.37

Relief Valve Calculations - LP Separator

31.37/1

31.37/2


Page52of 135

Action Replace two phase sizing case with new method. Use finalised maximum well design rates. Implement modification project as necessary. See 31.35/1

Correct inconsistency in RABS update.

See 31.35/1

See 31.35/1

See 31.35/1

No further action required. See 31.35/1

See 31.35/1


Add note to RABS update No further action required.

Ensure positive method of ensuring isolation from HP system exists. Update RABS to reflect this. See 31.36/2 See also 31.36/6


Number 31.38

31.42

31.43

Title Inlet Line Size Checking for Relief Valves HP/MP/LP Separators PSV Inlet Line Sizing

Number 31.38/1

Gas Blowby (Checking Capacity of Downstream System for Gas Blowby from HP to MP Separator and MP to LP Separator)

31.43/1&2

31.42/1

31.43/3


Description Inlet line sizes should have been recalculated using 'Final' relief data and isometrics. Pressure drop to HP Separator relief valves has not been calculated using maximum relieving capacity of valves See also 31.43/1 & 31.43/2 This calculation considers both upstream LCVs fail open simultaneously. This scenario is not considered in the Relief & Blowdown Study Report Rev C1 (or in any other calculations reviewed), nor is the platform designed for its affects. The calculation identifies the failure of the spillover valve (open) could lead to a relief rate which is higher than the current design.

Page53of 135

Action Check / redo inlet line sizing calculations as necessary. See 31.38/1

See also 31.43/1 & 31.43/2 No further action required.

Recalculate case. Assess measures for reducing the peak load during failure. Implement modification project. Same action as 34.039/1.


6.0

CHALLENGE PROCESS

6.1

Introduction Before commencing the challenge process the key legislative aspects are introduced

6.1.1

The Principles of the Legislation The general requirements of HSW legislation are neatly summarised in the following extract. Here we use an interpretation supplied by a representative of the relevant UK government department. We believe the requirements of Canadian HSW legislation to be very similar: As a duty holder under HSW legislation, you have a continuing duty to ensure the H&S of employees and other persons who may be affected by the way in which you undertake your business. The legislative regime sets a goal for duty holders to do all that is reasonably practicable. In some areas technological change is so fast that standards of compliance which would have been acceptable 10 years ago, are no longer satisfactory. However the advantage of goal setting is that it keeps pace with technological change, but also allows you to develop solutions which are better aligned with the risks in your workplace. So you will always, and continuously, have to keep an eye on new codes, standards, good industry practice, etc., to ensure you are doing enough to satisfy the law. Where it is reasonably practicable to do so, changes should be made. Nevertheless HSE would accept that for existing installations it may be less reasonably practicable to make a change, than is the case for a new installation - it is a judgement call which the law requires you to make (and be able to justify, if or when challenged). This sets the general principles by which retrospective change can be considered on Hibernia. This advice clearly states that new codes and practices should be applied to the facility unless it can be shown to be unreasonable.

6.1.2

Relevant Canadian Legislation The relevant legislative regulations for Hibernia are those issued under the Canada Newfoundland Atlantic Accord Implementation Act. The key regulations which have relevance for the flare system are as follows: ♦

Newfoundland Offshore Petroleum Installations Regulations

During the design phase the relevant version of the regulations was the 1991 draft. These were revised once again in draft form in 1993. The regulations were finally registered on the 21 February, 1995. During this time there was no substantive change to the documents in relation to the design of the flare system. The key extracts from the 1995 regulations are given below: 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc

Page54of 135


Gas Release System 17. (1) In this section, “gas release system” means a system for releasing gas and combustible liquid from an installation and includes a flare system, a pressure relief system, a depressurizing system and a cold vent system. (2) Every gas release system shall be designed and located, taking into account the amounts of combustibles to be released, the prevailing winds, the location of other equipment and facilities…, so that when the system is in operating it will not damage the installation…, or injure any person. (3) Every gas release system shall be designed and installed in accordance with (a) American Petroleum Institute RP 520, Recommended Practice for the Design and Installation of Pressure-Relieving Systems in Refineries; (b) American Petroleum Institute RP 521, Guide for Pressure -Relieving and Depressuring Systems; (c) American Petroleum Institute Standard 526, Flanged Steel Safety-Relief Valves; (d) American Petroleum Institute Standard 527, Seat Tightness of Pressure Relief Valves; and (e) American Petroleum Institute Standard 2000, Venting Atmospheric and LowPressure Storage Tanks. (4) Every gas release system shall be designed and constructed to ensure that oxygen cannot enter the system during normal operation. (5)… (7) With the exception of water, any liquid that cannot be safely and reliably burned at the flare tip of a gas release system shall be removed from the gas before it enters the flare… (9) Every gas release system shall be designed and installed so that, taking into account the prevailing wind conditions, the maximum radiation on areas where personnel may be located , from the automatically ignited flame of a flare or vent, will be (a) 6.3 kW/m2, where the period of exposure will not be greater than one minute; (b) 4.72 kW/m2, where the period of exposure will be greater than one minute but not greater than one hour; and (c) 1.9 kW/m2, where the period of exposure will be greater than one hour.


Page55of 135


The remainder of the regulations describe requirements relating to ventilation, the selection of electrical components, escape routes, emergency control systems etc. ♦ Petroleum Occupational Safety and Health Regulations - Newfoundland, Draft November 1989. These regulations are referenced in the RABS. Their only influence on the flare system design appears to be to ensure the sound levels are acceptable: i.e. 85 dB but no more than 90 dB for 8 hours exposure 102 dB but no more than 104 dB for 1 hours exposure etc. The other regulations covering certificates of fitness, drilling, and diving have no significant influence on the design of the flare system. 6.1.3

Applying the Legislation With the legislation in mind, the remainder of this section is organised to deal first with the larger issues, which may affect a number of design characteristics of the flare system. Subsequently the lesser aspects are dealt with sequentially as required.


Page56of 135


6.2

Jet Fire

6.2.1

Requirements of the relevant regulations, design codes and practices when Hibernia was designed

I.1.1.1

Canadian Legislation We are unaware of any explicit references in Canadian legislation regarding this particular hazard.

I.1.1.2

Mobil Engineering Guide (EGS 661-1990) We have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. In this case no interpretation is required, as both versions are silent on the subject of jet flame and the design requirements to mitigate against its effects. The guides, however, do mention the maximum time allowed for depressuring is 2 minutes per 3 mm of vessel wall thickness, but shall not be less than 6 minutes. Where depressuring is impractical the use of water sprays or insulation (both applied to Mobil specification) can be considered. Some of these latter methods could be read to take some account of extreme fires (for example jet fire).

I.1.1.3

API 521 (Third Edition, November 1990) The third edition is silent on the issue of jet fire impingement on vessels.

6.2.2

How Jet Fire Was Actually Handled During Design This is a summary of how jet fire was handled in the design phase. The entire subject of its consideration was based in the probabilistic safety related design path. Out of necessity it is an abridged version as the component parts are numerously described in the various project documentation. Here the aim is to capture the essence of the process and its effect on the way Hibernia was designed. This is described below.

I.1.1.1

Legislative Requirements The Canadian draft Production and Conservation Regulations required the submission and maintenance of a Safety Plan for the Hibernia facilities. Part of the Safety Plan would comprise the Concept Safety Evaluation. This document would form the basis for all the risk and hazard related studies on the Hibernia Project.


Page57of 135


I.1.1.2

Concept Safety Evaluation (CSE) The Concept Safety Evaluation (Reference 2) was the first attempt to identify and quantify the major hazards connected with the Hibernia facility. The study also began to define the terms Design Accidental Event (DAE) and Residual Accidental Event (RAE) which would be used for the rest of the project. The definitions would, however, gradually change over time but for the moment it is understood a DAE would only affect those in the immediate vicinity of the accident whereas a RAE would potentially affect the platform population. Of key interest to the Flare Revalidation Study were the aspects identified regarding jet fire. • The study explicitly recognised the potential for vessel rupture caused by short duration jet fires in Module M10. • Deluge was considered ineffective in preventing escalation due to jet fire. The times given for failure from jet fire impingement on various thicknesses of steel were: Table 6.8 Failure Times for Structures Engulfed in Jet and Pool Fires Structure

Jet Fire* (min)

Pool Fire+ (min)

60mm Thickness Steel

12

30


5

13


2.5

6

5mm Thickness Steel

1

2.5

H120 Firewall

60

120

13mm Thickness Steel Tube Coated with Chartek Type III** * + **

>60

2

Based on a jet fire radiation of 300 kW/m Based on a pool fire radiation of 150 kW/m2 Based on research and field trials by Shell Thornton

(CSE Table 6.1) The CSE also recognised the Key Safety Functions defined as follows: • the platform’s primary structure • the escape routes from the central parts of the platform to the Temporary Safe Refuge • the Temporary Safe Refuge (TSR), including the central control room • the availability of the evacuation systems.


Page58of 135


Added to this were Hibernia’s three-tier framework of risk acceptability: For any single incident that might affect the key safety systems (more accurately functions from the above), the risk level for the three-tiers are: Intolerable: greater than 10-4 per year. ALARP region: 10-4 to 10-5 per year. Lower bound of acceptability: less than 10-5 per year The CSE went on then to assess the risk to the Key Safety Functions using consequence analysis and event trees. The CSE demonstrated to a reasonable extent that the effects of jet fire and explosion did not jeopardise the structural integrity of the platform or the availability of the evacuation systems. In this it is implicit in the CSE that jet fire was considered a RAE and more of a risk to structural impairment than explosion. The CSE also indicated that jet fire impingement may cause rapid failure of unprotected structures even if deluge systems are operating. This might be because the intense heating raises the surface temperature above 100°C, prior to application of water, preventing the formation of a protective liquid film. To confirm the above the CSE made various recommendations for future work which included the requirement to conduct a Fire Risk Assessment to review the impact of fire on structural integrity of the H120 walls and the flare boom and the potential for escalation in Module M10. I.1.1.3

Fire Risk Assessment (FRA) By the time the FRA (Reference 3) was commenced the HMDC Damage / Impairment Criteria had been formalised. These can be found in Section 3.2.1: Also outlined in the FRA were the details of the blowdown system. The system considered was, in principle, the same as the system outlined in the Relief and Blowdown Study Report and subsequently built (see Table 6.17 for more detail). The FRA looked at the duration and flame lengths of jet fires with and without blowdown. This is summarised below: Table 6.9 HP Separator Jet Flame Length With and Without Blowdown Hole Size

Without Blowdown (m)

With Blowdown (at the end of the 15 minutes) (m)

5 mm

9

5

50 mm

53

29


Page59of 135


Wherever the possibility of a jet fire impinging on a structural member was identified the FRA recommended the use of PFP and firewalls to ensure the impairment criteria were satisfied. These aspects were studied in the Structural Passive Fire Protection Analysis (Reference 7). The analysis undertaken in the FRA identified the potential for escalation should a jet fire impinge on a vessel, e.g. “Fire water deluge will act to keep the equipment cool, but a jet fire impinging directly on a vessel may cause localised heating and loss of wall strength…” (FRA page 56) “Operation of the blowdown system should not be viewed as evidence of satisfactory vessel response, and may not prevent failure if the vessel is subject to high heat loads such as jet flame impingement...” (FRA page 57) “A HP separator incident could escalate to the LP separator and vice versa. The vessels will be provided with local deluge protection which will provide adequate protection for incident thermal radiation…” (Emphasis added. FRA page 70) The emphasis is added to contrast against protection from jet flame impingement. This was more clearly outlined in the team review (part of the consequence analysis): “The LP separator is likely to fail due to jet flame impingement…” (FRA page B.15) This led to the recommendation to install kerbs to prevent spread of liquid spills or pool fires. Generally the problem of jet fire impingement on vessels was implicitly mentioned on a number of levels in Module M10. Other jet fire consequence analyses identified the problems of jet flame impingement on firewalls, the crude oil coolers, the flare boom and the hydraulic panel on level 5. One of the key conclusions of the FRA was less clear: “The FRA considered a number of potential fire scenarios. In each scenario, except possibly a large blowout, the active systems (isolation, blowdown, F&G detection and protection) will limit the consequences and should prevent escalation.


Page60of 135


Even if the active systems fail to operate, then the passive fire protection should ensure that the Damage / Impairment Criteria are met…” (FRA page 119) The recommendations were to be studied further. I.1.1.4

FRA Update The FRA Update (Reference 4) revisited the key aspects of the FRA in relation to jet fire and began to soften the conclusions. Some of the statements are included below: “The KO drums are provided with deluge. This may not provide complete protection against jet flame impingement…, but the duration would be short and failure is unlikely…” (FRA Update page 20) “A jet flame from the gas scrubbers could impinge the MP separator, but it is unlikely that it would be of sufficient duration to cause failure, provided the blowdown system operates…” (FRA Update page 21) A leak from either the HP or LP Separators could cause either a jet flame or a pool fire…Escalation to the HP and LP Separator is unlikely provided that the deluge operates and the vessels are blown down…” (FRA Update page 21) A related aspect considered in the FRA Update was the use of PFP and particularly Lloyds who stated no credit should be taken for any active fire systems when considering the ability of PFP systems. The study ended with the main FRA conclusions being considered valid.

I.1.1.5

Design Phase Risk Assessment of Potential Accidental Events (DPRA) The DPRA (Reference 5) focused on the different types of accidental events. The concept of contained events being DAE and uncontained events being RAE was formally introduced. The report also contained discussion of how the design was optimised so as to prevent DAEs escalating into RAEs and impairing the main safety functions. The document formalised the selection and differentiation between DAE and RAE. This is shown below:


Page61of 135


Figure 6.2 Method for Determining the Acceptability of DAEs and RAEs Hazard Identification

Hazard Analysis

Comparison of effects with Damage/Impairment Criteria

Criteria Not Exceeded

Criteria Exceeded

Can Design be Improved to Prevent Impairment?

Event Categorised as RAE


Optimise Design if Minimal Impact on Cost and Schedule

Predict Risk of RAE and compare with Risk Acceptance Criteria

Yes

Implement Measures that are Reasonable and Practicable and Reassess Hazards

Event Categorised as DAE

No

No

Is Risk Acceptable/ ALARP?

Page62of 135

Yes

No Further Analysis Required


The report was not completely clear as to which events were RAE or DAE. However the following outlines our understanding: • Some hydrocarbon release events (assumed to be explosion, blowout and smoke) are RAEs. • Otherwise, most fire hazards are DAEs. This includes jet fire impingement on main structural members as this was mitigated against using PFP. Only in a few cases is there potential for the fire scenarios to cause a RAE. These were identified as: • Fire damage to deck plate at el 114.000 allows fire damage to the underdeck and collapse of structures within 2 hours. • Spread of fire from one wellhead to the another exceeds the capability of the fire protection systems. • Failure of the isolation and blowdown systems to contain the inventory of produced hydrocarbons and failure of the fire fighting systems to prevent escalation for both topsides and utility shaft hydrocarbon releases. These are “worst case” scenarios where virtually all the emergency systems have failed to operate as intended. (An Emergency Systems Report would be prepared to look into the possibility of these failures). • Smoke and heat effects could cause impairment of the Temporary Safe Refuge (TSR) if the worst case circumstances occurred, e.g. the wind blows towards the TSR, HVAC systems fails to detect smoke / gas or shutdown and doors and penetrations are open. • Blowout combined with worst case weather conditions, causes impairment of the TSR and evacuation systems. • Large fire on a hydrocarbon deck in the Utility shaft causing significant spalling of the concrete walls and failure of the reinforcing bars. All the above were subjected to further study and CBA (whose requirement that the mitigation measure be undertaken if the cost was less than 10 times the yearly loss) to show the risks were ALARP. In the case of the failure of the safety systems the RAE was considered a DAE after further study: “In exceptional circumstances, individual components might be impaired. However, the system’s redundancy was found to be adequate to perform the intended function” (Reference 8)


Page63of 135


“The Explosion Overpressure Risk Assessment… further assessed the effects of explosions on the vent and blowdown systems and the structural design basis (one of the main safety functions). Both were found to be acceptable. “Thus it is concluded that the basis for the selection of DAE and RAEs, and the assumptions relating to the adequacy of emergency systems preventing DAEs into RAEs, are valid. DPRA page 42 The remainder of the report explains the other types of event which are RAE. These are summarised in the table overleaf:


Page64of 135


Table 6.10 Summary of Risks of Impairment (as they relate to this study) RESIDUAL ACCIDENTAL

RISK OF IMPAIRMENT OF MAIN SAFETY FUNCTION

EVENT

(per year) CSE Estimate Detailed Design Risk

Hydrocarbon Fire Hazards: •

Damage to Underdeck

-

2 x 10-6

•

Spread to Wellheads

-

1.5 x 10-6

•

Heat Impairment of TSR

-

1 x 10-6

-

3 x 10-7

-

4.8 x 10-6

• Crude Oil Fire in Utility Shaft Sub-total for Hydrocarbon Fire Hazards Explosion Hazards •

M10

•

M20

Sub-total for Explosion Hazards Blowout Smoke Dropped Objects Flooding of Utility Shaft External Events: •

1 x 10-4 -4 1.7 x 10 (in QRA of TSR Integrity report) -

Iceberg Collision

Note 2:

Note 3:

1 x 10-6 2 x 10-6 1.5 x 10-5 2.1 x 10-5 <1 x 10-6

5 x 10-7

5 x 10-7

-7

5 x 10-7

•

Ship Collision

5 x 10

•

Helicopter Crash

1 x 10-6

•

Earthquake

(Note 2)

(Note 2)

-

5 x 10-5 (Note 3)

2 x 10-6 2.7 x 10-4

1 x 10-6 1.5 x 10-5

• Wave Slam Sub-total for External Events TOTAL Notes Note 1:

1 x 10-6

-

Negligible (Note 1)

Negligible risk of impairing main safety functions. Risk to occupants of helicopter could be 2.6 x 10-4 per year. Individual risk will be lower (approximately half) because the same individual is not on every helicopter flight. Earthquake design return period is 2000 years (5 x 10-4 per year) but this does not lead to structural failure nor pollution. Risk associated with hydrocarbon events caused by earthquake will be significantly less than other causes. Risk of damaging one essential generator. Risk to main safety functions will be negligible.

Jet fires are mentioned no further in the document.


Page65of 135


I.1.1.6

Design Phase Safety and Environmental Evaluation (DPSEE) The preceding documents were summarised in the DPSEE (Reference 6). There were no fundamental changes of relevance to the analysis herein. It is relevant to mention the process areas in M10 where jet fire impingement was explicitly considered and the mitigating reasons given: • Flare system - It was identified that the LP and HP flare KO drums would be susceptible to jet fire. However this hazard was considered mitigated against by the use of deluge and because the system was open to the flare. • Crude cooler - The loss of crude oil cooler inventory was identified and protection provided using remedial means of isolation. The remaining M10 areas were no longer mentioned in relation to jet fire.

I.1.1.7

Conclusions Clearly, jet fire was considered extensively during the design. Indeed the platform is in some respects designed to resist its effects, i.e. the PFP on the structural members and the flare boom. Within this is the assumption that the jet fire can last significant periods of time. Also implicit in the work is the ineffectiveness of deluge on protecting the affected equipment against jet fire impingement. On the other hand, and of most relevance to this report, there is no indication that jet fire was ever considered in the blowdown system design. In the event the issue seems to have been finally lost when the emergency systems redundancy was deemed sufficient to perform the intended function, which was to prevent escalation of a DAE to an RAE through loss of inventory (jet fire is not explicit but appears to be the cause of the concern). The flaw in the argument is none of the systems were actually included in the analysis of jet fire escalation or could be shown to prevent escaltion (although all would be helpful in the situation). This leaves the platform with the case where a jet fire impinges on a vessel (particularly the LP separator) with no explicit protection to avoid escalation to at least a DAE explosion event. Because of the flaw mentioned above, the FRA did not look at the potential for jet fire escalation to a RAE so no acceptability criteria were ever established. Potentially therefore there was a missed RAE event in the analysis. It would be wrong to read this description believing that Hibernia has some design deficiency. Generally this was the case with all facilities at the time, as the design codes contained no guidance on how to cope with the jet fire hazard. In fact Hibernia is much better than most facilities in this regard as will become evident in the following sections.


Page66of 135


6.2.3 I.1.1.1

Current Requirements of the Design Codes and Practices Mobil (MP 70-P-06, July 1998) The MEP remains silent on the issue of jet fire and its requirements have not materially changed since the versions used during design.

I.1.1.2

API 521 (Fourth Edition, March 1997) The requirements of the API codes has not changed in relation to jet fire since the design phase and there still is no explicit requirement to design for jet fire events. API’s position seems to be that jet fire is a low probability event whose effects are analogous to explosion. These consequences are beyond the ability of a blowdown system to contain. API were contacted to confirm whether this is the case. They have responded the issue will be addressed once again during the API 521 revision planned to commence during 2001. Granherne are pressing API to provide a response within the timescale of this study.

6.2.4

Current Best Industry Practice Once a hazard is identified it does not really matter that the codes of practice are silent on the requirements to mitigate the hazard and this is the situation the industry finds itself in with regard to jet fires. We fully expect future versions of API 521 to consider in more detail the effects of jet fire and we know of at least two other organisations performing research on the subject (Shell and a Joint Industry Project). Current industry practice is tending towards incorporating jet fire into the analysis of new facilities. Granherne know of at least 3 recent projects that were designed with the assumption of jet fire impingement on equipment was a design criteria. However, in the absence of prescriptive methods, the way the available research is used will vary by company although the key aspects are likely to be similar. Granherne’s approach would follow the following lines: In terms of methodology the process follows early work by Gayton and Murphy (Reference 11), who proposed the following methodology: • For each item of equipment define the type of fire (pool, jet, partial engulfment, total engulfment) likely to affect it. •

Calculate rate of heat input appropriate to that type of fire.

•

Calculate the rate of temperature rise of the vessel wall.

•

Estimate the time to rupture.


Page67of 135


• If the time to rupture does not meet safety criteria, then design changes may be necessary to improve the vessel protection. The sense of the above is self-evident. Not all vessels will need fire protection. Current studies by Granherne use a more sophisticated approach than the simple table presented in the QRA, but essentially they confirm the reasonableness of the early work if only by default. If it can be shown that the risk of escalation given blowdown is low, then fire protection may be shown not to be necessary.

Figure 6.3 - Output from a 1-D Heat Up Program RESULTS OF HEATUP CALCULATIONS 700.0

100.0

heat flux (kW/m2), temperature liquid & vapour space (deg C)

Heat Input

80.0

Liq. Temp Gas Temp

500.0

Press. Bar % Yield Stress 20C - Applied % Yield Stress 20C- Strength

400.0

300.0

60.0

40.0

200.0 20.0

pressure (bara), stress (%yield20), yield (%yield20)

600.0

100.0

0.0

0.0 0.0

1.3

2.5

3.8

5.0

6.3

7.5

8.8 10.0 11.3 12.5 13.8 15.0 16.3 17.5 18.8 20.0 21.3 22.5 23.8 25.0 26.3 27.5 28.8 30.0 time (min)

The industry is supporting more detailed analysis of fires offshore and performing experiments to determine how fires behave in confined spaces. These have shown that fires actually fill the upper space in a module. Also the heating fluxes are considerably lower than the 300 kW/m2 originally used for analysis. This is because on a platform the rate of burning is dependent on the ventilation whereas the original figures were from research in the open air. Although there remains the potential for flame impingement and engulfment, the implications are that the airflows around the vessel are not so severe, and deluge systems will still be able to cool the skin. On the other hand, high level pipework may be more at risk (although pipework is normally considered more robust). One last aspect where change is evolving is in the benefit taken for insulation surrounding a vessel. As long as it does not catch fire (which is normally the case), and is clad in steel (rather than aluminium) and the fastening system is secure, the insulation is very effective at protecting the vessel wall from flame impingement.


Page68of 135


Means are now available to calculate the interactions between flame and vessel (and insulation, if appropriate) in 3D. Whilst confirming the general conclusions of the earlier modelling, the detail shows effects such as shadowing, liquid level and the lack of heat removal laterally through the skin.

Figure 6.4 - Temperatures in a Half Filled Vessel Subject to Fire Load - from Heat Up 3D Temp eratu res in a H alf Filled V essel

600-700 500-600 400-500 700 300-400 200-300 600 100-200 500

0-100

400 o

T empe ratureC 300 200 100 0

17

19

S 15 S 13 15

S11 13

S9 9

11

S7

5

7

S5 Lo ng itudinal Ele me nt Around S3 Ve sse l Axis

H e ight E le me nt on Ve sse l Axis

1

3

S1


Page69of 135


The results of these calculations feed into the design requirements for the system. Therefore, current thinking is not so different than in the Hibernia QRA reports in terms the dependency of the effects of heat on wall thickness, in that thin walled vessels are likely to fail in less than 15 minutes. Wall thickness is also related to design pressure, and the flare drums and associated pipework are vulnerable, being low pressure systems having thin walls. This is why the flare system is specifically mentioned in the Hibernia safety work. The problem with the early Hibernia work is these effects were not carried through (in terms of analysis and engineering) to all the areas that were likely to be affected. Blowdown, active fire protection and passive fire protection are complementary means of reducing the risk (loss) from vessel escalation. Primarily this is an asset protection scheme, since the immediate fatalities in the area will occur before escalation, and others are likely to be protected in the TSR. The TSR will limit the impact to the personnel from escalation. Using this method, the link between the blowdown and other means of protection would then be explicit in the quantified risk assessment (QRA). This does not appear to be the case in the Hibernia QRA. 6.2.5

The Effect of Applying Current Best Industry Practise to Hibernia In this section the effect of applying best industry practise in relation to jet fire is reviewed. As has been seen, the issue of jet fire causes 3 related aspects to be considered: • The analysis of jet fire impingement on Hibernia vessels, i.e. what are the consequences of jet fire impingement on various vessels? Dependent on the outcome of this will affect the following considerations. • Should anything be done regarding final blowdown pressure and blowdown duration? •

Should the use of other mitigating means be used?

This would have the following effects on Hibernia. I.1.1.1

Analysis of jet fire impingement on Hibernia vessels


Page70of 135


There are a number of pressure levels on Hibernia. Within these pressure levels there is the potential for leak, leak ignition, jet fire and then the potential for escalation. Usually the worst case scenarios involve the vessels, as these contain the large system inventories. The worst case scenario is also usually considered to be a leak from one of the flanges in the pipework around the vessel impinging on the vessel itself. This means that short jet fire lengths are still severe in effect. One exception to this is where there is the possibility of a jet fire from a high pressure system impinging on a low pressure, thin walled vessel. On Hibernia there is such a case which can be caused by a jet fire somewhere around the HP separator impinging on the LP separator. To analyse the situation the following generic case was selected. The heating of a vessel engulfed by flame was assessed using the package 3-D Heat Up, a Granherne-developed heat transfer program. The program 3-D Heat Up treats a source of heat as a flame as a set of discrete emitting “plates” and the receiver also as a 3-D shape made up of a number of quadrilaterals. The program allows the user to include details of any insulation on the surface of the vessel. The user can place the receiving vessel anywhere with respect to the flame, and for the purpose of this study the vessel was assumed to be engulfed entirely (which would only result from a very large leak size), as this was the worst case. The diagram below shows a cross section of the location of the flame.

Table 6.11 Schematic Arrangement of Flame and Vessel 70

60

Jet Flame 50

(m)

40

Vessel

30

20

10

0 0

10

20

30

40

50

60

70

80

90

100

(m)


Page71of 135


The heat flux within the flame has been found to depend on the wind speed, since greater wind speeds imply more mixing and this will generate more burning and higher fluxes. The heat up was therefore assessed for 3 different wind speeds, 2, 5 and 10 m/s, which were calculated to create fluxes of 120, 160 and 180 kW/m2, respectively. These were thought to be typical of vessels in areas of the platform where ventilation control of the combustion process was expected. Higher localised fluxes have been reported in flames in the open (e.g. up to 300 kW/m2), but are not thought to be applicable in confined spaces. The program has a component that assesses the residual stresses at elevated temperatures. The heat response was modelled for the vessels overleaf:


Page72of 135


Table 6.12 Hibernia Vessel Parameters Summary Area / Equipment

Pressure (kPaA)

Wall thickness (incl. cladding where appropriate)

Gas molecular weight

Insulation thickness

HP Separator

4240

60.2

21

50mm (steel supports)

MP Separator

1240

31.6

26


LP Separator

210

17.3

48


1st Stage Suction Cooler

210

15.9*

48

Personnel protection

1st Stage Suction Scrubber

160

15.9

36

Insulation height (High level = 1130 mm)

2nd Stage Suction Cooler

1125

12.7*

36


2nd Stage Suction Scrubber

1070

31.8

22


3rd Stage Suction Cooler

3900

41*

22


3rd Stage Suction Scrubber

3800

50.8

22


Injection Stage Suction Cooler

17120

102*

22


Injection Stage Suction Scrubber

16940

101.6

22


*Cooler head cylinder thickness.

The heat up was then calculated for each of the vessels for two cases, with and without insulation. Each of the vessels was assumed to be oriented horizontally, but the results have been checked against vessels oriented vertically (particularly for the compressor scrubbers). The results of the analysis were charted. The temperatures do not predict absolutely the potential for vessel failure, since a depressured vessel will have reduced stresses. Sample results for an insulated vessel are shown in the figure. temperatures in the vessel, depicting it as an “unpeeled” skin:


Page73of 135

These show the


Figure 6.5 Sample Output from 3-D Heat Up for Horizontal Vessel Elements

Top, gas side of vessel

295

290

Temp (K)

Dished end of vessel 285

290-295 285-290

280

280-285 275-280 270-275 275

265-270

13

19

Bottom, liquid side of vessel 16

Dished end of vessel270

10 7 4 S2

S1 1

S4

S3

S6

S5

S9

S8

S7

S10

S13

S12

S11

S16

S15

S14

265

This plot distorts the vessel somewhat, as points at the end, which is dished, are closer to each other physically than is represented. As can be seen, the temperatures on the gas side of the vessel are higher than those on the liquid side. This is because the liquid conducts heat better than the gas, and also because the liquid is a bigger heat sink. The kink at the far dished end is due to the modelling of conduction through skin between points that are close together.


Page74of 135


The results for each of the three separator vessels, for 3 different heat loads, with and without insulation are shown below: Table 6.13 Heat Up Calculation - Separator Peak Vessel Temperatures (K) 180 kW/m2

160 kW/m2

120 kW/m2

60 mm with insulation (HP Separator)

358

357

355

60 mm no insulation (HP Separator)

825

786

696

32 mm with insulation (MP Separator)

372

370

366

32 mm no insulation (MP Separator)

1063

1024

903

17 mm with insulation (LP Separator)

397

392

382

17 mm no insulation (LP Separator)

1287

1269

1078

Case

For the compressor train components runs were performed only at the highest heat flux (180 kW/m2). Table 6.14 Heat Up Calculation - Compressor Components Temperatures (K) Area / Equipment

Temperature without insulation

Temperature with insulation


1353

383


1313

343


1460

449


1039

335


1070

448


863

323


747

433


628

313

It can be seen from the above that the temperatures of the MP and LP separators and compressor components up to the 3rd stage suction cooler are well above 500oC if there is no insulation around the vessels. The highest temperatures are recorded on the gas side of the vessel, where there is no liquid to act as a heat sink.


Page75of 135


When the effect of such temperatures on the stresses within the vessels is analysed, it is found that the vessels are vulnerable to differing degrees. The program identifies the residual strength left in the vessel at the final temperature, after 15 minutes of heating. This residual strength takes into account the potential for blowdown of the vessel to 50% of the design pressure. Thus it is defined as the ratio of the applied stresses to the vessel at the end of the blowdown period and the residual strength remaining in vessel at the elevated temperature. Typical results of the model are shown below: Figure 6.6 - Sample Result of 3-D Heat Up Calculation for Stresses (As a percent of Yield Stress at Temperature)

500

500-600

400

400-500

300

300-400

200

200-300

100

100-200

S10 16

19

Vessel Cell No

13

10

7

4

0 1

Stresses (% of remaining strength

600

0-100

S1

Once more the greatest effects are seen on the gas side, which is where temperatures are highest. In the case above failure would occur as the stresses are 5 times the remaining (residual) strength. Information can be extracted from the stress results in several formats, such as time to failure, highest stress and so on. The result format used below shows the ratio of the applied stress and the percentage of residual strength remaining at time t = 15 minutes.


Page76of 135


Table 6.15 - Vessel Stress Analysis - Separators Vessel Stresses at t = 15 minutes as a Percent of Yield Stress at Elevated Temperature Case

180 kW/m2

160 kW/m2

120 kW/m2

Remarks

60 mm with insulation (HP Separator)

31

31

31

Vessel remains intact

60 mm no insulation (HP Separator)

38

34

32


32 mm with insulation (MP Separator)

30

30

30


32 mm no insulation (MP Separator)

145

111

52

Vessel can fail at higher fluxes

17 mm with insulation (LP Separator)

29

29

29


17 mm no insulation (LP Separator)

600

511

204

Vessel fails

The results above show that the HP separator does not heat up significantly even when the effects of the insulation are not included. Consequently the vessel stress as a percentage of yield stress at the temperature is low. The integrity of the MP and LP separators, however, is only guaranteed by the insulation. The heat input is much lower in the insulated case, and given the modest temperature rises in such cases, it can be said that there will be no threat to the vessels.


Page77of 135


Table 6.16 Vessel Stress Analysis - Compressor Components Vessel Stresses at t = 15 minutes as a Percent of Yield Stress at Elevated Temperature Area / Equipment

180 kW/m2 without insulation

Remarks


141

Equipment fails


141

Vessel fails


720

Equipment fails


145

Vessel fails


82

Equipment remains intact


49



<40

Equipment remains intact


<40


The results show that the lower pressure vessel’s integrity is only ensured by insulation. The higher pressure equipment, on the other hand, has wall thicknesses sufficient to survive a jet fire without insulation. By inspection, this suggests that the current system where the A train injection compressor is blowdown 3 minutes after the other systems is acceptable (i.e. the vessels should not fail) even if the A train injection compressor components are engulfed in a jet fire. Also implicit in the ability of the vessel to survive the fire is the necessity for the staggering system to function as designed. Some concern has been expressed that the reliability of the system (software, electronics, ESD/PSD and pneumatics) has not been conclusively demonstrated. Of the failures that could occur, the failure of the blowdown system to initiate at all is the most serious with the potential, during a fire, to allow vessel failure and / or escalation through jet fire or explosion. Even outside a fire situation, the potential for explosion is seriously increased once the contents of the compressor system begins to vent into the module through the seals as the seal oil runs out. Of much less concern would be the failure of the staggering system to pause the A train injection compressor blowdown. In this case the worst event which would be likely would be abnormally high radiation rates on the platform (dependent on the wind condition). However, even this benign failure has the potential to escalate if the initiating cause is an incident involving the LP separator. In this case the coincident blowdown would add inventory to the area as the back pressure on the LP separator would be abnormally high. There appears to be good reason, therefore, to perform a reliability analysis to confirm the system’s ability to function as required.


Page78of 135


6.2.6

Jet Fire Conclusions The integrity of the insulation thus is a key issue for the protection of the lower pressure equipment, namely: •

MP separator

•

LP Separator

•


•


•


•


All of this equipment is insulated in one form or another. If the insulation remains intact on the vessel under conditions of jet flame engulfment, and resists the physical impulse from the momentum of the gas jet, then it is likely that the vessels will not fail. On the other hand, such integrity does not seem to have been designed into the vessel, and so some upgrading of the protection may be necessary. The above does not take credit for the presence of deluge. There is still some debate in the industry on the ability of deluge to mitigate the effects of jet fire, which relate to how quickly it is applied after the jet fire event has commenced. If the vessel is too hot, the deluge has difficulty establishing a cooling skin. However, there are a number of research projects underway which should eventually define the available credit to take for deluge. For the moment it is sufficient to state that a system with deluge is much improved over one without.


Page79of 135


6.3

Blowdown (Depressuring) System Sizing

6.3.1

Requirements of the Codes, Guides, Standards and Recommended Practices When Hibernia was Designed

I.1.1.1

Mobil Engineering Guide (EGS 661-1990) As mentioned previously, we have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. Using this approach we can estimate the following requirements at the design stage. Our interpretation of the requirements of the Mobil guide at the time is: Vessels shall be depressured to 690 kPag (100 psig) or to 50% of the design pressure, whichever is smaller. The maximum time allowed to depressure a system is 2 minutes per 3 mm (1/8 in) of vessel wall thickness. Depressuring time of less than 6 minutes need not be used regardless of vessel wall thickness. Depressuring time shall not exceed 15 minutes, except with Mobil approval. Vapour depressuring may not be practical when the vessel design pressure is less than 690 kPag, as piping and valves may become unreasonably large, or when vapour depressuring load governs the size of the pressure relief and flare headers. When vapour depressuring is not practical, vessels may be insulated to reduce the vapour depressuring load or may be protected by other means such as water sprays. Start pressure for the blowdown was specified as the maximum operating pressure, which presumably was equivalent to the pressure trip setting. These latter forms of protection could also be used in lieu of depressuring if designed according to Mobil guidelines. Excursions from these requirements required approval from Mobil.


Page80of 135


I.1.1.2

API 521 (Third Edition, November 1990) During 1991/2 (when these aspects of the design were being finalised) the relevant version of API 521 was the third edition 1990. This code required the following in regard to depressuring system sizing. These systems should have adequate venting capacity to permit reduction of the vessel stress to a level at which stress rupture is not of immediate concern. For sizing criteria this generally involves reducing the equipment pressure from initial conditions to a level equivalent to 50% of the vessel’s design gauge pressure within approximately 15 minutes. This criterion is based on the vessel wall temperature versus stress to rupture and applies generally to vessels with wall thicknesses of approximately 1 inch (25 millimeters) or more. The required percentage depressuring rate depends on the metallurgy of the vessel, the thickness and initial temperature of the vessel wall… Some operating companies limit the application of vapor depressuring to facilities to facilities that operate at 250 pounds per square inch gauge (1724 kilopascals gauge) and above, where the equipment and the volume of the contents are significant. Other companies provide depressuring on all equipment that processes light hydrocarbons, and they set the depressured level at 100 pounds per square inch gauge (690 kilopascals) or 50% of the design pressure whichever is the lower. The 100 pounds per square inch gauge (690 kilopascals) level is intended to permit somewhat more rapid control in which the source of a fire is the leakage of flammable materials from the equipment to be depressured. On the other hand, in some cases involving relatively high-pressure vessels that contain relatively large inventories of light hydrocarbons, depressuring below the 50-percent level within 15 minutes may not be practical. However, in certain designs this provides an ample margin of safety with regard to vessel safety from overheating… API allows the blowdown to commence with the start pressure at initial conditions.

6.3.2

How the System was Designed The RABS describes the following project philosophy: 1. Blowdown sections will be depressured from their normal operating pressure to 690 kPag (100 psig) or 50% of the vessels design pressure, whichever is lower. The maximum time allowed to depressure a vessel/system shall be 2 minutes per 3mm (1/8 in) of vessel wall thickness. Depressuring time of less than 6 minutes will not be used regardless of vessel wall thickness. Depressuring time shall not exceed 15 minutes. (Emphasis added) RABS page 8


Page81of 135


The emphasis is added to highlight the start pressure considered. Clearly the Mobil requirements were followed except in the case of the start pressure for blowdown. Here the RABS suggests the blowdown commences at normal pressure, whereas the Mobil requirement was from maximum operating pressure. This issue is confused further by the fact that the calculations for the compressor system appears to be based on the pressure trip settings suggesting the RABS contains a typographic error and the design did indeed follow the Mobil guide. However, the RABS goes on: 2. As a seal oil systems are to be used on the turbine-driven compressors. A more stringent depressuring design basis then the basis detailed in 1) is required for blowdown sections which include a compressor. In order to avoid gas escape along the compressor shaft, compressor sections are to be depressurised from their initial settle-out conditions to a pressure less than the static head exerted by the height of the seal oil rundown capacity. This capacity is defined as the seal oil reservoir volume between the liquid level trip switch and an empty reservoir. This volume will be sized to allow for an interval of 15 minutes to depressure all of the compressors to 110 kPa (abs). In order to minimise the peak initial total LP Blowdown flowrate it was agreed that a staggered compressor blowdown should be used…. The motor-driven gas compressor (K-33-1) is now to utilise a dry gas seal arrangement instead of a seal oil system. However as the depressuring rate from this section is low (less than 5% of the peak initial blowdown flowrate) the same depressuring basis as defined above for the turbine-driven compressor blowdown sections has been used for this blowdown section. RABS pages 8 and 9 Due to the selection of the compressor seals, the atmospheric end pressure could not be avoided unless the system was significantly modified. Otherwise the remaining gas in the system would spill through the seals into the module when the seal oil ran out. Of course, more blowdown isolation valves would have avoided the requirement to depressure the entire compressor system to atmospheric. The issue of staggering is described in more detail in Section 6.4. The RABS goes on further: 3. For the production manifolds (HP, MP and test manifolds) and gas injection manifold it has been agreed that a specific exception to the basis detailed in 1) will be taken.


Page82of 135


The reason for this decision is that these sections have very high design pressures (34400 kPag for the HP, MP, and test manifolds and 45500 kPag for the gas injection manifold) and contain only pipework. (Note: Manifold pipe wall thicknesses are in excess of 1 inch.) Therefore, it seems highly conservative to depressure to 690 kPag in 15 minutes and gives high peak blowdown flowrates from these sections which form a significant portion of the total HP blowdown Flowrate. It was agreed that the application of the philosophy basis identified in 1) was not intended for this type of high pressure blowdown section. API RP 521 advises that for high pressure sections including vessels with wall thicknesses of 1 inch or more, the depressuring basis can be to reduce the pressure from initial conditions to 50% of the design pressure within approximately 15 minutes. API RP 521 also notes that on certain high pressure/inventory blowdown sections the depressuring basis may be reviewed more critically to provide both a practical and safe basis. The depressuring basis used for the manifolds is as follows: i)

The gas injection manifold will be depressured to 50% of the design pressure within approximately 15 minutes.

ii)

As the initial pressure of the HP, MP and test manifolds is already below 50% of their design pressure they will be depressured to 50% of their appropriate downstream separators design pressure within approximately 15 minutes.

iii)

As the future gas lift manifold wall thickness will probably be less than 1 inch and the current peak blowdown flowrate from this section is not excessive, this section will still be depressured in accordance with the basis detailed in 1). RABS pages 8 to 10

So, virtually every interpretation of API RP 521 that could have been taken made eventually was. This probably resulted from the ambiguity the recommended practice contained at the time. Notice also the start pressure of the manifold blowdown which is again the normal pressure, further highlighting the inconsistency of approach. Nonetheless, in our view, all of the above interpretations were acceptable as they are generally conservative. Whether the approach could be described as consistent is another matter. This issue is described further in Section 6.3.5. The RABS would also have benefited from a mention of who agreed these issues and the forum and documentation they were agreed in as the audit trail appears to go dead after this time. This result of this approach is shown on the table overleaf.


Page83of 135


Table 6.17 Blowdown Section Summary Blowdown Section No.

Description/Major Equipment

Blowdown Start Pressure (kPa (abs))

Blowdown Final Pressure (kPa (abs))

Blowdown Time (mins)

To Flare

1 2

Test Manifold #1 Test Manifold #2

4241 4241

2751 2751

15 15

HP HP

3 4

Well Clean-up Test Manifold HP Production Manifolds

4241 4241

2751 2751

15 15

HP HP

5 6

MP Production Manifolds Test Separator #1 (D-3105)

1241 4241

1101 791

15 15

HP HP

7 8

Test Separator #2 (D-3107) Well Clean-up Test Separator (D-3106) HP Separator (D-3101)

4241 4241

791 791

15 15

HP HP

4241

791

15

HP

MP Separator (D-3102) 1st Stage Compressor and Suction Scrubber

1241 316

791 110

15 15

HP LP

2046

110

15

LP

2046

110

15

LP

6122

110

15

LP

6122

110

15

LP

24115

110

12

LP

9 10 11

(K-3301 and D-3301) 12

13

2nd Stage Compressor and Suction Scrubber A (K-3302A and D-3302A) 2nd Stage Compressor and Suction Scrubber B (K-3302B and D-3302B)

14

15

3rd Stage Compressor and Suction Scrubber A (K-3303A and D-3303A) 3rd Stage Compressor and Suction Scrubber B (K-3303B and D-3303B)

16

17

Injection Compressor and Suction Scrubber A (K-3304A and D-3304A) Injection Compressor and Suction Scrubber B

Note 3 24115

110

15

LP

(K-3304B and D-3304B) 18 19

Gas Injection Manifold Gas Lift Manifold (Note 2)

45601 13801

22851 791

15 15

HP HP

20

3201

791

12

HP

21

HP Fuel Gas KO Drum and Fuel Gas Filter Separators (D-6201, Z-6201A/B, and Z-6202A/B) HP Fuel Gas Cooler (E-6201)

3201

791

15

HP

22 23

Offgas Manifold LP Fuel Gas KO Drum (D-6202)

4241/1241 621

791 601

15 6

HP LP

24 25

LP Separator (D3103) Lift Gas Dehydrator and Suction and Discharge Scrubbers

211 17300/13700

Note 1 791

Note 1 15

LP HP

(C-3801, D-3801, and D-3802) (Note 2)

6.3.3 I.1.1.1

Note 1:

The LP Separator operating pressure is already below the level which it should be depressured to. Therefore, only a nominal blowdown capacity has been taken for this section.

Note 2:

The Lift Gas Dehydrator and Gas Lift Manifold are future items.

Note 3:

Injection Compressor “A” blowdown is staggered on a 3-minute time delay after other blowdown sections. Therefore, the blowdown time for this section is only 12 minutes.

Current Requirements of the Codes and Recommended Practices Mobil “Pressure Relief and Vapor Depressuring Systems” MP 70-P-06, July 1998


Page84of 135


This Mobil Engineering Practice (MEP) supersedes the earlier engineering guides. The key requirements concerned with the design of the blowdown system are given below: 1. Vessels shall be depressured to 690 kPag (100 psig) or to 50% of the design pressure, whichever is less. The maximum time allowed to depressure a system is 2 minutes per 3 mm (1/8 in) of vessel wall thickness. Depressuring time of less than 6 minutes need not be used regardless of vessel wall thickness. Depressuring time shall not exceed 15 minutes, except with Mobil approval. 2. Vapour depressuring may be impractical when the vessel design pressure is less than 690 kPag (100 psig), because valves and piping may become unreasonably large and costly. It is also impractical when the vapour depressuring load governs the size of the pressure relief and flare headers. When vapour depressuring is not practical, vessels may be insulated (see MP 70-P-05) to reduce the vapour depressuring load or they may be protected by other means, such as water sprays (see MP 70-P-01). The use of either of these alternatives requires Mobil approval. The Mobil practice also gives guidance on blowdown start pressure: 7.2. Depressuring Flowrate To calculate the vapor flowrate that is needed to accomplish depressuring, the maximum expected operating pressure of the vessels under consideration shall be used as the initial pressure and the pressure specified in Section 7.1.1 as the final pressure. The practice refers to the API 521 method with regard to depressuring system sizing for pool fire and the option of controlling the blowdown peak rate by using controlled blowdown (i.e. reducing the peak rate by control). The remainder of the document in relation to depressuring is linked to compositional effects that should be considered during the unsteady state calculations. Comparisons with the earlier versions of the Mobil practices suggest there has been no change that would affect the design of the blowdown system.


Page85of 135


I.1.1.2

API 521 Fourth Edition, March 1997 The relevant part of the Fourth Edition, in relation to the design of the blowdown system, is given below: 3.19.1 GENERAL ...A vapor depressuring system should have adequate capacity to permit reduction of the vessel to a level where stress rupture is not of immediate concern. For sizing, this generally involves reducing the equipment pressure from initial conditions to a level equivalent to 50% of the vessel design pressure within approximately 15 minutes. This criteria is based on the vessel wall temperature versus stress to rupture and applies generally to vessels with wall thicknesses of approximately 1 inch (25mm) or more. Vessels with thinner walls generally require somewhat greater depressuring rate... Where fire is controlling, it may be appropriate to limit the application of vapor depressuring to facilities that operate at 250 pounds per square inch gauge (1724 kilopascals gauge) and above, where the size of the equipment and volume of the contents are significant. An alternative is to provide depressuring on all equipment that processes light hydrocarbons and set the depressured rate to achieve 100 pounds per square inch gauge (690 kilopascals gauge) or 50% of the vessel design pressure, whichever is lower, in 15 minutes..." API 521 pages 24 and 25. There are two issues which derive from the above (and comparison with the earlier version used during design): 1. The subtle change in the form of words regarding the relevant pressure levels. As time has passed the requirement of API 521 has hardened and now represents the clearest idea of the API’s design intent. The practice’s intent can be read as follows: To protect against stress rupture: • Systems with design pressure above 1724 kPag should be depressured to 50% of the design pressure. • Systems with design pressure below 1724 kPag need not be depressured. However, if it is chosen to do so, the final pressure should be 690 kPag or 50% of the design pressure, whichever is less. • Vessels with wall thicknesses below 1 inch should be considered separately.


Page86of 135


API were contacted regarding this issue to confirm the above. API were reluctant to commit to a final response until the meeting of the API 521 Task Force in October 2000. Granherne are pressing them for a more rapid comment. 2.

In this context, what is the meaning of “immediate concern”?

Immediate concern in this instance is 15 minutes. However this hides the fact that once the stress level in a vessel is reduced by half, the time taken in an API 521 pool fire to heat the (1 inch and over) steel to a temperature at which stress rupture is likely of the order of hours. The remainder of the blowdown should have been completed by the time the vessel fails (assuming sufficient fuel to keep the fire going this long). Based on this scenario the depressuring requirement can be seen to be very conservative as is evidenced by the fact that some facilities are allowed to do without depressuring facilities. Again the start pressure for the blowdown is referred to as initial conditions. 6.3.4

Current Best Industry Practice Granherne would apply API requirements as they were intended, i.e: • Systems with design pressure above 1724 kPag should be depressured to 50% of the design pressure (unless there are good reasons otherwise, for example, the equipment in the HP compression systems which requires a lower end pressure due to seal oil considerations – see Section 6.3.5 below). • Systems with design pressure below 1724 kPag need not be depressured. However, if it is chosen to do so, the final pressure should be 690 kPag or 50% of the design pressure, whichever is less. • Vessels with wall thicknesses below 1 inch should be considered separately. The above approach would always lead to the minimum sized flare system, indeed it has the effect of focussing on the most susceptible equipment, thereby applying a high level of safety.


Page87of 135


In passing we should also mention that the API is ambiguous with respect to pipework engulfed in fire, implying that it does not always need to be depressured. Presumably, this is because pipework is considered durable in a fire compared to vessels and the consequences of failure are less than for vessels probably leading to more, fairly minor, jet fires as the flanges fail. Onshore, this sometimes allows the high pressure inlet pipework not to be depressured at all (because it is usually located in an area where fire is unlikely). Offshore this approach is not normally possible and we would select the depressuring approach from the above. Because of recent accidents where pipework has catastrophically failed, Granherne expect pipework systems to become the next target in jet fire analysis and eventually become part of a common methodology. The start pressure we believe most logical to apply is from initial conditions in cases where the blowdown is automatically initiated on fire. The probability of coincidence of high pressure in the system (i.e. just below the PSHH) and fire can be shown to be very low. The requirement to start at the maximum operating pressure stems from the era when fire and gas detection systems were unreliable and, as a consequence, did not initiate automatically. This meant that the fire had the possibility to heat the system, raising the system’s pressure, prior to manual operator intervention. Using this approach care would be needed to adjust the calculations should the pressure profile in the system change significantly. In passing it should also be noted that some companies adjust the blowdown time period to remove the stress on all vessels so that they do not rupture in the event of jet fire impingement. This would normally be required if the vessels were not protected. This is a particularly expensive way of catering for the jet fire hazard. Regarding the time to depressure the vessels. The 15 minutes is selected such that the temperature reached when the stress is halved leaves the vessel not prone to rupture. Once this satisfactory situation is reached, the vessel continues to depressure and the period before escalation should lengthen. In other words, if the initiation of blowdown is timely the period for evacuation should be significantly in excess of 15 minutes (although it cannot be guaranteed). 6.3.5

The Effect of Applying Current Industry Practice to Hibernia Application of the above design practice requirement would significantly reduce the load on the HP flare as the HP and MP separators could be depressured more slowly. The target would instead move to ensuring the stress level in the LP separator fell as quickly as possible as this is the most likely vessel to fail. The existing design case includes only a nominal depressuring rate (at the time, the clause in the API regarding thin walled vessels was less than clear). Satisfying the jet fire calculations in Section 6.2.5 should be the target of the revised calculations.


Page88of 135


The above would certainly simplify the slightly conflicting requirements of the RABS. However, it would have very little effect on the ultimate capacity of the system as most high pressure parts blowdown to the LP flare because of the HP compressors seal oil system and the requirement to be at atmospheric prior to the oil running out. Retrofitting dry gas seals to the compressors, or adjusting the sectioning would be the only ways to significantly increase the latent capacity of the LP flare. Returning to the conflicting requirements in the RABS; it was either acceptable, or it was not, to blowdown to 50% of the design pressure. If it was (as we believe it was) it should have been applied to the entire system except where it could be shown inappropriate, moving the focus to these cases. This was not done, which leaves the impression of some ‘fitting’ of the requirements to the selected flare boom length. Nevertheless, this approach, whilst inconsistent, is generally conservative compared to the intent of the API and therefore a capacity opportunity exists within the system. To take advantage of the opportunity would require some hardware changes to limit the blowdown rate to be compatible with the 50% of design end pressure. As blowdown on Hibernia is initiated automatically there is also a good case for reducing the severity of the calculated load on the LP flare system by reducing the start pressure for the compressor blowdown, thus reducing the inventory removed from the system. This, too, would have the effect of making some spare capacity in the system. If this were to be implemented no hardware changes would be required; the new peak rate with the existing system components would be calculated (which would be less than at the higher pressure), thereby taking up less of the available system capacity. Without making hardware changes the blowdown would reach the end pressure in a little less time than 15 minutes. Prior to agreeing any of the above the permission of Mobil for a deviation to the MEP would need to be sought.


Page89of 135


6.4

Compressor Blowdown Stagger

6.4.1


I.1.1.1

Canadian Legislation There are no requirements specific to this issue as far as we are aware.

I.1.1.2

Mobil Requirements (EGS 661-1990) As mentioned previously, we have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. Using this approach we can estimate the following requirements at the design stage. Our interpretation of the requirements of the Mobil guide at the time is: The Mobil guide allowed the control of the depressuring rate so as not to exceed the maximum allowable rate in the flare system, i.e.: Vapor depressuring valves may restrict the initial depressuring to the capacity of the closed pressure relief system and flare. EGS 661-1985 Whilst not explicit this seems to indicate that the use of staggering to achieve this was acceptable.

I.1.1.3

API (Third Edition, November 1990) The third edition is silent on the issue of staggering.

6.4.2

How the System was Designed Because of the wet seal oil system the compressors were required to depressure to the LP flare system. The end pressure was required to be atmospheric. This placed a large load on the LP flare and by 1992 it was realised that LP flare system was unable to cope with the peak rate (the radiation levels on the platform were too high). The A train injection compressor stage blowdown was therefore delayed 3 minutes to reduce the peak rate experienced. (See Appendix I, calculation 34-006/A Rev 05 for the summary of the loads from the various areas).


Page90of 135


6.4.3

Current Requirements of the Codes and Recommended Practices The material requirements of either the current Mobil guide or API 521 has not changed regarding the acceptability of staggering.

6.4.4

Current Best Industry Practice The concept of staggering or sequentially depressuring plant has been around the industry for many years. Whilst not explicitly allowed by the Mobil guide or API recommended practice nor is it forbidden. Used most carefully, staggered blowdown is usually reserved for situations where plant is sufficiently independent that total plant blowdown is not desirable. A good example of such a situation is a refinery where there are a number of self contained plant areas, sufficiently independent, and sufficiently far apart that blowdown for a plant fire in one area would only be desirable in that area. This is the normal test for the acceptability for staggered blowdown: • The systems should be sufficiently separate such that common mode failure is not a concern (this would normally require separate PLC control systems and instrument air supplies). •

The systems should be in separate fire areas.

We have seen these requirements in another Operator’s design guidelines the logic being self-evident. Generally these requirements defy the application of staggered blowdown to offshore facilities and in Hibernia’s case neither of these criteria are achieved. 6.4.5

The Effect of Applying Current Industry Practice to Hibernia From the above there is clearly concern regarding the staggering of the A injection compressor blowdown. The case where there is a jet fire around the A train injection stage (including scrubbers etc.) causing a blowdown of the remaining plant, which is not on fire is anomalous. In Section 7.2.3 the required blowdown rates required to avoid stagger are described.


Page91of 135


6.5

Two-Phase Relief

6.5.1


I.1.1.1


I.1.1.2

Mobil Requirements (EGS 661-1990) As mentioned previously, we have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. Using this approach we can estimate the following requirements at the design stage. Our interpretations of the requirements of the Mobil guide at the time are: Pressure relief valves shall be sized in accordance with API RP and API STD 526. Pressure relief valves handling vapour and liquid should be sized according to the twophase flowrate from the vessel. Refer to API RP 521 for guidance in determining vapor and liquid loads from various types of equipment. EPG 60-B-05 September 1991 page 13

I.1.1.3

API API RP 14C requires a pressure vessel to have a relief valve sized for full inflow. API 521 requires designers to size the relief valve for closed outlets. The codes are ambiguous on how such an event will occur. Elsewhere, API 521 (vaguely) refers to the following: “The probability of two unrelated failures occurring simultaneously is remote and normally does not need to be designed for.” API 521 Third Edition p. 6 To protect a vessel or system from overpressure when all outlets are blocked, the capacity of the relief device must be at least as great as the capacity of the sources of pressure. If all outlets are not blocked the capacity of the unblocked outlets may properly be considered. API 521 Third Edition p. 8 API 520 also contained various methods for sizing relief valves including a method for sizing for two-phase relief. The two-phase sizing method relied on calculating the required orifice required for vapour relief and liquid relief and adding them together. The API said the following of the method:


Page92of 135


A reasonable, conservative method of sizing for two-phase liquid/Vapour relief is as follows: a) Determine the amount of liquid that flashes by an isenthalpic (adiabatic) expansion from the relieving condition either to the critical downstream pressure for the flashed vapour or to the back pressure, whichever is greater. b) Calculate individually the orifice area required to pass the flashed vapor component, using Equations 2-7 as appropriate, according to service, type of valve, and whether the back pressure is greater or less than the critical downstream pressure. c) Calculate individually the orifice area required to pass the unflashed liquid component using Equation 9. The pressure drop (P1-P2) is the inlet relieving pressure minus the back pressure. d) Add the individual areas calculated for the vapor and liquid components to obtain the total orifice area, A, that is required. e) Select a pressure relief valve that has an effective discharge area equal or greater than the total calculated orifice area… API RP 520 Sixth Edition page 37 6.5.2

How the System was Designed for Two-Phase Relief HP Separator Combining the requirements described above (and effectively ignoring the full flow requirement of API RP 14C) gave rise to the following relief valve sizing case. The HP separator relief valve is dimensioned by the full associated gas rate at design oil production rate. The most credible scenario that might lead to such a case would be blockage of the HP separator vapour outlet. This could occur due to maloperation of an isolation valve or the failure of the pressure control valve in the vapour outlet. Once this occurred the pressure in the vessel would quickly rise and should cause an ESD trip. However as is the case with all relief valve sizing cases this trip is assumed to fail and the relief valve sized for the resulting case. From a methodological standpoint this is supportable.


Page93of 135


The two-phase sizing case was selected to consist of a maximum well and an average well representing the case where two wells fail to shut in (there is a similar case for the test separator which should be read in this light). Here we partly return to an API RP14C type case. There is no description in the RABS of how this case might occur (to us it appears to require the failure of at least 5 ESVs and a high pressure trip). The calculation method used to find the required area was the additive method contained in API RP 520 (Fifth Edition). The calculation showed a very much lower required area than the full associated gas case (3.2 in2 compared to 9.38 in2 for the full associated gas case). The HP flare KO vessel was sized to accommodate the resulting liquids from this case for a 10 minute relief event. Test Separator The test separator relief valve follows the above except the sizing case is the twophase sizing case. 6.5.3 I.1.1.1

Current Requirements Of The Codes And Recommended Practices Mobil Requirements (MP 70-P-06) The Mobil MEP now requires the following: Pressure relief valves shall be sized in accordance with API RP 520 PT 1 or local codes, whichever is the more stringent. MP 70-P-06 page 20 The relevant edition of the API is the Sixth Edition Errata; 1994. This edition retains the API additive calculation method.

I.1.1.2

API 520 (Seventh Edition, January 2000) The API has been extensively rewritten with respect to sizing for two-phase liquid/vapor relief: 3.10.2 A recommended method for sizing pressure relief devices in two-phase service is presented in Appendix D. The user should be aware that there are currently no pressure relief devices with certified capacities for two-phase flow since there are no methods for certification. Page 55


Page94of 135


In Appendix D it goes on to state: D.1.1 The method for two-phase sizing presented in this Appendix is one of several techniques currently in use and newer methods are continuing to evolve as time goes on. It is recommended that the particular method to be used for a twophase application be fully understood. It should be noted that the methods presented in this Appendix have not been validated by test, nor is there any recognized procedure for certifying the capacity of pressure relief valves in two-phase flow service. A series of equations based on the Leung omega method are presented. Finally an alternative method is also mentioned: D.1.4 A more rigorous approach using vapor/liquid equilibrium (VLE) models incorporated into a computerized analytical method based on HEM can be considered. Appendix D page 69 6.5.4

Current Best Practice The issue of the new calculation method has caused concern in the industry. The history of the change stems from some work prepared by DIERS. This group found that the API method undersized relief valves in two-phase relief cases undergoing froth reactions. This led to a certain amount of lobbying to have the DIERS method incorporated in the API. Other groups (presumably aware the DIERS model would not be appropriate for the oil and gas industry) began to work on models which had the capacity to predict two-phase relief flows through orifices. These models have been tested and appear to indicate the API method undersizes orifices in two-phase flow. Granherne take a pragmatic view of this situation based around the following arguments: • The earlier API method defines an effective orifice area, which is used to select the next larger orifice size for installation. The best evidence which recommends this method is API do not know of a single overpressure failure event to have occurred since the method was first incorporated into an API code in July 1990 (although the method has been around much longer than this). Usually a loss event is the precursor to changing a recommended practice or design code. • Leung omega and HEM methods size the (sharp edged) orifice required to pass the flow. As valves are not available in all sizes (only the API STD 526 designations) a designer would have to select the next larger size. The valve is implicitly oversized. • The later Leung omega and HEM work are based around real orifices rather than the API type of effective orifice area which contains a number of correction factors which mean an API orifice is bigger than at first sight it seems.


Page95of 135


• Both the new methods are homogeneous and do not account for phase slip (i.e. the flow through the orifice is sufficiently slow through the orifice to allow the phases to remain in thermodynamic equilibrium) and therefore must be approximations. The additive API method is non-homogeneous and has phase slip inherent in the method, albeit fortuitously. However, Granherne recognise the valuable research undertaken to date and expect it to become the basis of relief valve sizing in the future. We expect the sizing method to adjust as the research is applied to API 526 relief valves when the comparisons will be much clearer (maybe to the extent that the resulting valve selections are not so different from the additive method which, for the moment, they are). None of this, however, protects HMDC (or their advisors) from the difficulties mentioned in Section 4.1.3 and the requirement to prove the new recommended practice is not appropriate if it is proposed not to incorporate it. Clearly, it is feasible to procure a larger relief valve if the calculation check suggests it is necessary. A QRA will not, in this case, show any improvement in risk profile for the facility. Yet, by inspection, a valve that is larger than the existing will cope better if the underlying basis is true and thereby reduce risk in some unquantifiable manner. Granherne will therefore apply the new requirements to new projects as a matter of course. 6.5.5

The Effect of Applying Best Industry Practice to Hibernia Applying the Leung omega or HEM method has no effect on the sizing selection for the HP separator. Based on the 40 kbopd original two-phase sizing cases, the full associated vapour case is still the defining case. The Test separator, however, is a different matter. It seems that to cater for the new sizing method the valve size should increase. The sizing will also depend on the final philosophy selected for the number of wells which fail to shut-in. HMDC have performed some work on this aspect, including taking account of the future number of wells and their corresponding rate, which will need to be incorporated in the updated RABS. This project can be undertaken when feasible. We also believe that no restrictions to production need apply in the time it takes to procure the new valves, as it is arguable that the system is safe by experience.


Page96of 135


6.6

Design Windspeed and Direction

6.6.1

Requirements of the Codes, Guides, Standards and Recommended Practices when Hibernia was Designed

I.1.1.1


I.1.1.2

Mobil Engineering Guide (EGS 661-1990) As mentioned previously, we have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. Using this approach we can estimate the following requirements at the design stage. The 1985 version used a design windspeed equivalent to 93 km/h (57.8 mph or 84.8 fps or 25.8 m/s) if the discharge tip speed was 0.5 Mach. Otherwise MRDC Loss Prevention Engineering were to be consulted. By 1991 this was at the point of changing to: Radiant heat intensities at a design reference point on the platform shall not exceed the values in Table 2 with the wind in an adverse direction and at maximum emergency discharge rates. The design wind speed for determining radiant heat intensities shall be 12.4 km/h (Corrected to 32.2 km/h) (20 mph). The reference point will be selected, subject to Mobil approval, as the nearest point on the platform that cannot be readily shielded. Radiant heat intensities shall also be calculated at 67 percent and 133 percent of design wind speed and at other critical points on the platform to determine what precautions must be taken for flaring during adverse wind conditions. Draft EPG 60-B-05 September 1991

I.1.1.3

API 521 (Third Edition, November 1990) The API is silent on the issue of windspeed to use when designing flare stacks/booms. The only reference anywhere in the document that refers specifically to particular windspeed is in Appendix C that uses two definitions of windspeed to size a flare stack. •

Design wind velocity is 20 mph (or 29.3 feet per second). (8.9 m/s)

•

Normal average windspeed is 20 mph (29.3 feet per second) (8.9 m/s)

There is no suggestion (or otherwise) that these figures should be used for flare system design.


Page97of 135


6.6.2

The Windspeed Used During Design The system was designed on the basis contained in the RABS and subsequent documentation. This is summarised in the following: a)

Windspeed From the Project Environmental Data Summary (PEDS) the maximum 1 hour mean wind speed at 140 m above sea level (i.e. at the flare tip location) is 34.2 m/s based on a 1-year return period. The expected frequency shown in PEDS, is however, less than 0.1% and only quantifiable in directions that would not adversely affect flare radiation levels. Therefore, for the purposes of the radiation calculations, a wind speed of 27 m/s (60 mph), blowing directly towards the platform, will be considered as the worst case in accordance with the agreed composite specification basis. RABS page 22

No basis for this figure was given. 6.6.3 I.1.1.1

Current Requirements of the Codes and Recommended Practices Mobil “Pressure Relief and Vapor Depressuring Systems” MP 70-P-06, July 1998 The reference to design windspeed is lost in the new document. It may now be linked to the GKN Birwelco software recommended for the flare sizing task.

I.1.1.2

API 521 (Fourth Edition, March 1997) The API remains silent on the methodology for selecting design windspeed and retains the 20 mph level for the calculation examples.

6.6.4

Current Best Practice The selection of design windspeed for flare design is usually prescriptively applied by the Operators. This has arisen probably because there is so little guidance elsewhere in the national or international codes. A quick survey of projects that Granherne have been involved with indicates design windspeeds from 10 to 27 m/s (22 to 60 mph) for offshore locations, none of which appear to have been set by using a constant methodology.


Page98of 135


However, if Granherne were to choose a design windspeed it would be selected on a probabilistic basis. In a fairly arbitrary sense (as we have not quantified the effect on a number of facilities of using this method), we too would choose a windspeed based on the maximum 1 hour mean wind speed at the flare tip location with a probability of 0.1% based on a 1-year return period (i.e. in a similar way to the RABS). The reason for selecting this yearly approach is because it seems reasonable. However, we would not necessarily limit the direction to directly onto the platform if a slight deviation produced a significantly higher windspeed. This would be the absolute maximum we would consider. If the resultant windspeed were higher than 27 m/s (60 mph) we would limit consideration to this level and the flare boom would be dimensioned on this case. This windspeed is derived from Granherne experience of the usual limit placed on helideck operations. Beyond this level it is no longer safe to be on deck (see also Section 8). In saying the above, Granherne would also have sympathy for any situation where a less onerous windspeed were selected; the codes could be interpreted to allow it. 6.6.5

The Effect of Applying Best Industry Practice to Hibernia In the event, Granherne’s current best practice would have had a very minor effect on the flare boom length or (as is the case now the platform is constructed) the design rates allowable. Review of the Project Environmental Specification enables the following comparison to be made: Table 6.18 Comparison of Design Windspeed Criteria with Granherne Best Practice RABS (m/s)

Granherne (m/s)

Most Adverse Direction (directly onto the platform)

Not identified

24.2

Most Adverse Windspeed in an on platform direction

34.2 from NW (not analysed)

34.2 from NW (analysed and not as extreme as above)

27

24.2

Design figure

The windspeeds are very similar to the RABS criteria. windspeeds is demonstrated in Section 8.


Page99of 135

The effect of using these


6.7 I.1.1.1

Acceptable Flare Radiation Levels Canada Oil and Gas Installations Regulations (January 1991, Draft) Recapping the requirements: (9) Every gas release system shall be designed and installed so that, taking into account the prevailing wind conditions, the maximum radiation on areas where personnel may be located, from the automatically ignited flame of a flare or vent, will be (a) 6.3 kW/m2, where the period of exposure will not be greater than one minute; (b) 4.72 kW/m2, where the period of exposure will be greater than one minute but not greater than one hour; and (c) 1.9 kW/m2, where the period of exposure will be greater than one hour.

I.1.1.2

Mobil Engineering Guide (EGS 661-1990) As mentioned previously, we have been unable to source a copy of the 1990 version of the above so instead are required to interpret between the 1985 version and the Draft 1991 version. Using this approach we can estimate the following requirements at the design stage. The 1985 version used the criteria given in Table 6.10 in the calculation of flare stack height. Table 6.19 Allowable Radiant Heat Intensities Excluding Solar Radiation (1985) Heat Intensities Allowed, K

Location

W/m2 1580

Areas where personnel must remain at their posts

2365

Storage tanks containing volatile material, and control rooms

4730

Areas where escape of personnel is possible in several minutes

6300

Open areas where refinery personnel can be exposed up to one minute with appropriate clothing

9465

Areas where protection or shielding from the radiant heat is available to refinery personnel in six seconds or less (except for control rooms or for non-combustible equipment and facilities)


Page100 of 135


By 1991 this was at the point of changing to: The flare stack location shall be determined by allowable radiant heat intensities at various critical points on offshore platforms or processing facilities. It shall be calculated in accordance with API RP 521 and as modified by this guide. The modifications to API RP 521 the 1991 guide refers to are given in Table 6.11 below. Table 6.20 Allowable Radiant Heat Intensities (1991) Condition(1)

Heat Intensities Allowed, K W/m2 1580

For continuous flaring operations in areas where personnel must remain at their work stations without shielding but with appropriate clothing

1580

Emergency flaring for several minutes(2) - personnel without appropriate clothing

790

Continuous flaring(2) - personnel expected to wear appropriate clothing

3155

Emergency flaring up to one minute(2) - personnel without appropriate clothing

Notes 1. In areas where personnel can be exposed to higher radiation intensities, heat shielding must be provided and also for equipment and structure as necessary. 2. In areas where personnel are not expected to wear appropriate clothing (i.e. coveralls, boots, gloves, hard hats) allowable radiation levels have been reduced by a factor of two.


Page101 of 135


API RP 521 (Third Edition, November 1990) recommends the following: Table 6.21 Recommended Design Flare Radiation Levels Excluding Solar Radiation (API RP 521) Permissible Design Level (K)

Location

KW/m2

6.7.2

15.77

Heat intensity on structures and in areas where operators are not likely to be performing duties and where shelter from radiant heat is available (for example, behind equipment).

9.46

Value of K at design flare release to any location to which people have access (for example, at grade below the flare or a service platform of a nearby tower); exposure should be limited to a few seconds, sufficient for escape only.

6.31

Heat intensity in areas where emergency actions lasting up to 1 minute may be required by personnel without shielding but with appropriate clothing.

4.73

Heat intensity in areas where emergency actions lasting several minutes may be required by personnel without shielding but with appropriate clothing.

1.58

Value of K at design flare release to any location where personnel are continuously exposed.

The Radiation Levels Used in the Design The design used the following radiation levels, derived from Draft Canadian Legislation, as outlined by the RABS: Table 6.22 Radiation Flux Limits Excluding Solar Radiation

Permissible Design Level (K)

Conditions

KW/m2 6.3

Heat intensity in areas where emergency actions lasting up to 1 minute may be required by personnel without shielding but with appropriate clothing.

4.72

Heat intensity in areas where emergency actions lasting up to several minutes may be required by personnel without shielding but with appropriate clothing.

1.9

Value of allowable radiation level at design flare release at any location where personnel are continuously exposed, i.e. helideck


Page102 of 135


In addition the following statement is included in the RABS: In addition to the above radiation limitations HTPT advised that the maximum radiation level experienced on the platform escape routes is not to exceed 1000 Btu/ft2 h (3.16 W/m2) for periods over 1 minute of exposure. RABS page 22 The design calculations for the worst emergency flaring case (total platform blowdown) and a flare boom length of 115m resulted in the following radiation levels:

6.7.3 I.1.1.1

•

Approximately 3.16 kW/m2 at the north side M10 weather deck

•

Approximately 6.30 kW/m2 at the drilling derrick crown block

•

Approximately 4.72 kW/m2 at the drilling derrick finger board

Current Requirements of the Codes and Recommended Practices Mobil “Pressure Relief and Vapor Depressuring Systems” MP 70-P-06, July 1998 The new document has the following recommendations on thermal radiation levels. Table 6.23 Allowable Radiant Heat Intensities in W/m2 Excluding Solar Radiation Appropriate Clothing*

Without Appropriate Clothing*

1105

790

6 Sec

9465

3150

1 Min

6300

3150

3 Min

4730

1580

No Shelter Available

1580

790

Continuous Release Emergency Releases Travel time to Shelter

Equipment Exposure

Only

15770

Volatile Liquids Tanks, API Separators, CCB

2365


Page103 of 135


I.1.1.2

API 521 (Fourth Edition, March 1997) The recommendations on flare thermal radiation levels in the new addition of API RP521 remain the same as the previous version.

6.7.4

Current Best Practice We have mentioned earlier in this report that best practice is subjective to some extent. Where issues are not subjective are in matters of law. Once a requirement passes into law, as have the Canadian regulations, by meeting those requirements, an owner has effectively discharged their responsibilities. As is also customary in matters of precedence, national regulations always supercede recommended practices. Normally there is actually little difference between the two requirements and this is where we find ourselves in the Hibernia context. This is demonstrated in the following table:


Page104 of 135


Table 6.24 Summary of Flare Radiation Requirements for Hibernia Impairment Criteria

1.9

N/A

1.58

Silent

3.2

Not specifically mentioned

4.72

N/A

4.73

Apply Canadian regulations.

6.3

6.3

6.3


Maximum radiation on areas where the period of exposure will not be greater than a few seconds (In this case the area in question is normally accessible)

Silent

N/A

9.5

Escape routes from all parts of the platform to the TSR… to remain passable for 30 minutes…An escape route may be made impassable by:

Silent

12.5

Not specifically mentioned

Apply API requirements in absence of Canadian regulation. The actual wording of API 521 is: Value of K at design flare release to any location to which people have access (for example, at grade below the flare or a service platform of a nearby tower); exposure should be limited to a few seconds, sufficient for escape only. (Note 1) Not used as a normal radiation level.

Silent

N/A

15.8

Maximum radiation on areas where the period of exposure will be greater than one hour Helideck operable for at least 2 hours. Inoperability may result from…thermal radiation over 3.2 kW/m2 (Impairment Criterion 4) Maximum radiation on areas where the period of exposure will be greater than one minute but not greater than one hour Maximum radiation on areas where the period of exposure will not be greater than one minute And, Escape routes from all parts of the platform to the TSR… to remain passable for 30 minutes…An escape route may be made impassable by:

Equivalent API RP521

Remarks

Canadian Regulations


Not used as a normal radiation level.



Thermal radiation over 6.3 kW/m2 if unprotected: (Impairment Criterion 3)



Thermal radiation over 12.5 kW/m2 to the outside of the escape route if protected by cladding: (Impairment Criterion 3) Maximum radiation on areas where shelter is present. (In this case the area in question is not normally accessible)

Not used as a normal radiation level. The actual wording of API 521 is: Heat intensity on structures and in areas where operators are not likely to be performing duties and where shelter from radiant heat is available (for example, behind equipment). (Note 1)

Notes: 1_) On towers and elevated structures where rapid escape is not possible, ladders must be provided on the side away from the flare, so the structure can provide some shielding when K is greater than … 6.3 kilowatts per square meter.


Page105 of 135


The allowable radiation levels on Hibernia will have to be selected from within these requirements. 6.7.5

The Effect of Applying Best Industry Practice to Hibernia The application of Canadian regulations and interpretation of the guidelines in API RP521 where the Canadian requirements are silent (replicated in Table 6.24) for the Hibernia platform gives the following allowable thermal radiation levels at various parts of the platform: •

Crown Block 9460 W/m2

The crown block falls into the category an area to personnel have access (i.e. a service platform of a nearby tower); where exposure can be limited to a few seconds, sufficient for escape only. It could even be argued that a more extreme limit at this point could be used: The Damage / Impairment criterion No. 3 indicates that a value of 12500 W/m2 may be appropriate for the area under consideration. The criterion is specifically aimed at escape routes protected by cladding but could equally be applied to the drilling derrick which is partially enclosed and offers any operator working in the area the opportunity to shelter behind a clad structure for the duration of the emergency. A reference for the figure of 12500 W/m2 cannot be found in the guides and practices referenced above although a somewhat worse value of 15800 W/m2 can be found in the API which is allowed only in an area where shielding exists. These requirements are included for information only. In the original design it appears an unnecessarily conservative approach, which did not recognise the presence of shielding, was applied to this area which limited the radiation level to 6300 kW/m2. •

Weather Deck

6300 W/m2

The weather deck and monkey board falls into the category of an area where emergency actions lasting up to one minute may be required by personnel without shielding but with appropriate clothing. It is expected that personnel on the weather deck would be appropriately clothed and in the event of an emergency blowdown would be able to leave either leave the deck in a minute or less or alternatively find shelter in the same time period. In the original design, values of 3200 and 4720 kW/m2 respectively were applied to these areas. The former resulted from the HTPT note attached to the table which outlined the explicit design requirements and, from the above, is a radiation level allowable for 2 hours in an emergency. The latter neither recognises the escape ability from the monkey board nor the shielding. Both cases therefore appear unnecessarily conservative.


Page106 of 135


•

Helideck

3200 W/m2

The helideck does not really fall into any specific category as defined in the guides and practices reference above but it could be argued that it loosely falls into the category of an area where personnel are continuously exposed during an emergency (for up to two hours) and therefore the value of 3200 W/m2 is chosen. This corresponds with the Damage / Impairment criterion No. 4 which indicates that a value of 3200 W/m2 is appropriate for the helideck which is based on Canadian regulations. 

Weather Deck (Continuous flaring)

1900 W/m2

For a true (non-emergency) continuous release, e.g. production flaring, a figure of 1900 kW/m2 should be used (again in accordance with Canadian regulations). Of the above, the most important radiation level is likely to be the continuous flaring case as it will be the most persistent (occasionally). The other radiation levels are only approached during a platform blowdown and therefore are short duration (only seconds) and will only be felt if a coincident severe adverse wind occurs during the event. Using this radiation level and location as the design case ensures that the helideck will experience very much lower radiant rates during continuous flaring. The radiation levels used in the flare operating envelope calculations, described fully in Section 8.0 below, have used the above thermal radiation limits to determine the allowable maximum flaring capacity for the ‘As Built’ flare for two windspeeds. The results of these calculations are discussed in detail in Section 8.0 but the principle conclusion is that if the best practice radiation levels are applied as defined above then the flare system capacity would be approximately 200% of the current design load in terms of thermal radiation only. The effect on hydraulics in the system for this capacity increase has not been studied at this time. This section should be read in conjunction with Section 8.4.


Page107 of 135


6.8

Challenge Issues Resulting from the Technical Audit of the Design Calculations Issue 34-005/2 - Jet fire scenario was not taken into account for in the design of the blowdown system. This issue is addressed in Section 6.2. Issue 34-005/4 - Were fire areas used for total blowdown rate? A simple approach to blowdown was used where the entire all equipment to be depressured was assumed to be on fire. This is equivalent to the entire M10 module being on fire, something which is very unlikely and if it occurs will be catastrophic. More conventionally the platform is separated into fire areas. In this case the blowdown valves are sized to cater for the fire case. However, the combined case is not normally the sum of all the areas on fire and some effort is instead focussed at the selection of a realistic worst case. The worst case is represented by the fire occurring in the area which adds most to platform load coincident with the resultant rates from the blowdown valves for the non-fire areas are added. These latter rates are less than the rate that would be experienced in a fire case and the overall blowdown load is more accurately represented. In this case we have been unable to locate fire area drawings which forces the M10 fire case to remain the design case. Issue 34-006/2 - Is correct isentropic efficiency used? The isentropic efficiency specified when performing blowdown simulations affects both the downstream blowdown temperature of gas and equipment but also the upstream vessel wall temperature. An isentropic efficiency of 1 simulates perfectly isentropic expansion of the gas and gives the worst case (i.e. lowest) temperatures. An isentropic efficiency of 0 simulates perfectly isenthalpic expansion of the gas and gives the best case (i.e. highest) temperatures. For blowdown of a vessel or system where the feed to the vessel has been stopped the expansion of the gas is somewhere between isentropic and isenthalpic. The selection of the isentropic efficiency is usually based on project philosophy and experience. The blowdown simulations performed for these calculations used an efficiency of 0.5. There is no indication in the calculations or simulation outputs for the basis of this selection. The selection of an efficiency of 1 is unrealistic, but a more usual figure to use is 0.7 minimum which would lead to lower blowdown temperatures. The impact of lower blowdown temperatures is twofold. The first concerns the materials of construction of the flare system itself. The flare system appears from the ‘As Built’ P&IDs to constructed of LTCS with a minimum design temperature of -45oC. The second impact is in areas of the process where hydrates can form.


Page108 of 135


From the calculations reviewed problems of both hydrate formation and flare design temperature only occur if blowdown is initiated after a delay with of the plant maintained at pressure during the upset. Calculation 34-010 / A and 34-060 / B address this problem but the calculations do not give any specific conclusions on the allowable delay. Calculation 060 / B concludes that for the settleout pressures used there is a huge spread of allowable delay periods depending upon environmental conditions and whether insulation is installed. Current platform design philosophy is to depressurise after 1-2 hours. If lower blowdown temperatures are expected then this philosophy may have to be reviewed. See Issue 34-010/1 for further details. Precautions against hydrate formation can be taken and these are discussed further below. For more discussion regarding this see the related discussion in Section I.1.1.2 item 34.010/1. Issue 34-006/3 - Is design case too extreme? This concern relates to the high start pressure used for the blowdown calculations. See Section 6.3 for the recommended solution. Issue 34-042/2 - Validity of staggering blowdown. Were the systems sufficiently independent? This aspect is covered in Section 6.4. 6.9

Miscellaneous Issues

6.9.1

Insulation The presence of satisfactory insulation on the vessels will allow substantially reduced depressuring rates compared to those used during design. This aspect should be checked in detail when the insulation on the vessels is reviewed.


Page109 of 135


7.0

AS-BUILDING THE FLARE SYSTEM

7.1

Introduction The Hibernia platform was built incorporating features for future equipment; this included future capacity built into the flare system. As some of these projects are no longer foreseen this section looks to remove their effect from the currently installed flaring cases. This, in effect, will result in a system whose design cases are “as-built”. The difference between the design capacity and the “as-built” capacity is the capacity available for future projects, including those that were originally foreseen.

7.2

As-built and Design Capacity The following table summarises the initial relieving capacity by area considered during the design phase as well as the results of removing the requirements for future equipment and potentially the 3 minute stagger on the injection compressor ‘A’ blowdown. Table 7.25 As Built and Design Capacity Case

Scenario

Relief

LP Flare Load

HP Flare Load

kg/h

kg/h

1

Design Blowdown Rate as per Blowdown Study Report Rev C1

&

89,601

133,616

2

‘As Built’ i.e. As Case 1 with Future Equipment Removed

89,601

94,843

3

As Case 2 with 3 min Stagger Removed

126,291

94,843

The table below summarises the effect on thermal radiation impingement at various points on the platform for the cases described in Table 7.1 with the original design wind speed of 27 m/s blowing in a northerly direction. Table 7.2 Thermal Radiation Impingement on Platform Areas Case

Crown Block

Weather Deck

Helideck

W/m2

W/m2

W/m2

1

6152

2911

1034

2

5623

2700

860

3

8838

3146

1314

The capacity of the flare system is essentially decided by the allowable thermal radiation impingement on the platform. The different levels of thermal radiation and their limitations on working and escape routes are discussed in Section 6.7. Based on the original design radiation levels:


Page110 of 135


•

Crown Block 6300 W/m2

•

Weather Deck

•

Helideck

3200 W/m2

1900 W/m2

Then the following deductions can be made from the resulting thermal radiation impingement on the platform for the 3 flare operating cases described in Table 7.1. 7.2.1

Case 1 - Design Blowdown Rate (as RABS Rev C1) The results for this case indicate that the thermal radiation impingement at the crown block is close to the limiting value of 6300 W/m2. This is what we would expect as the flare stack lengths was effectively sized for this flaring scenario. The thermal radiation impingement at the weather deck and helideck are within the limits stated above

7.2.2

Case 2 - ‘As-Built’ - i.e. As Case 1 with Future Equipment Removed The results for this case indicate, as expected, that removing the load assigned for ‘future’ equipment from the HP flare gives some margin for increased flare load generated by future projects / platform modifications. The margin is available for thermal radiation at all platform areas discussed but, by inspection, the limit is expected to occur at the crown block. It should be noted that any projects which generate extra coincident LP blowdown load on the flare will have a greater effect on thermal radiation impingement than that for HP blowdown due to the nature of the flare systems. Therefore capacity, in terms of mass flowrate, liberated from the HP flare is not necessarily available in full for the LP flare system.

7.2.3

Case 3 - As Case 2 with 3 min Stagger Removed This case investigates the effect on the ‘As Built’ flare (i.e. with loads from ‘future’ equipment removed) of removing the 3 minute stagger between blowdown initialisation and the blowdown of the Injection Compressor ‘A’ system. This is potentially a modification that HMDC would consider making in the future. It can be seen from the results, however, that though the thermal radiation levels at the weather deck and the helideck are acceptable, the level at the crown block is greater than the current design limit based on the criteria above. This would likely be acceptable if the shielding around the drilling derrick structure was taken into account.


Page111 of 135


8.0

RISK MANAGEMENT IN RELATION TO FLARING EVENTS AND WIND CONDITION

8.1

Introduction In Section 6.6 the issue of design windspeed was discussed. In this section we look at the various windspeeds to show the effect it has on the radiation envelope on Hibernia. The selected windspeeds are: • The most adverse windspeed (with a probability of 0.1% and a return period of 1 year) in a direction which could influence the radiation levels on the platform. In this case the windspeed = 34.2 m/s from the NW. • The most adverse windspeed (with a probability of 0.1% and a return period of 1 year) directly onto the platform. In this case the windspeed = 24.2 m/s from the N. • The original design windspeed from the RABS. In this case the windspeed = 27 m/s. The results are shown below:

8.2

Potential Flare Envelope based on Total Blowdown Scenarios

8.2.1

Determination of Blowdown Load Basis A basis for constructing an operating envelope for this study had to be developed with no specific modification projects in mind. The task is complicated by the fact that there are two flare systems, the LP flare and the HP flare. An increase in flare load has a different consequence depending upon the particular flare affected, due to the different nature of the flares. The HP flare utilises a sonic tip and therefore has a flame that burns much more efficiently and is stiffer than the flame developed by the pipe flare tip on the LP network. Given the above, the only sensible approach to preparing an operating envelope was to base it on multiples of the radiation case defining case, i.e. total platform blowdown giving coincident LP and HP flare release as defined in the Relief and Blowdown Study Report. The relieving loads on each flare for the design flare capacity case are given as Case 1 in Table 7.1 above. Flaresim calculations were performed for flare loads ranging from 50% to 500% of the design case to enable an envelope to be defined. In reality, the systems would be hydraulically limited long before these higher rates were achieved. The relief rate for each flare was maintained in the same proportion as the design case and fluid properties also remained constant for all capacities considered.


Page112 of 135


8.2.2

Determination of Continuous Load Basis The Relief and Blowdown Study Report identified that the worst case continuous flaring occurs when there is a relief load on both the HP and LP flare systems. This occurs either at start up or when the compression train is lost for any reason. To determine the continuous relief load, we considered the loss of HP and LP compression at 100% production causing the associated gas from the to spill-off to the HP and LP flares, from the HP and MP separators and LP separator respectively. To generate the input data we used a simulation taken from the recent debottlenecking project (Case 3, a case which included Avalon production) with a total production of 200 kbopd (taken in this instance as 100% capacity) and used this to calculate spill-off rates to each flare system if the compression train is disconnected. At 100% production, therefore, the flare loads are 359.2 Te/h (MW 21.3) to the HP flare and 50.4 Te/h (MW 45.0) to the LP flare. Note that in this case the HP flare rate exceeds current capacity. Flaresim calculations were performed for flare loads ranging from 30% to 100% of the above determined rates to enable an envelope to be defined. In reality, the systems would be hydraulically limited before these higher rates were achieved. The relief rate for each flare was maintained in the same proportion as the 100% case and fluid properties also remained constant for all capacities considered.

8.2.3

Determination of Allowable Thermal Radiation Impingement on the Platform The flare capacity envelope for any area on the platform is very much dependent on the maximum allowable thermal radiation impingement at that particular area. For this study the following limiting thermal radiation impingement levels were used to generate the operating envelopes: •

Crown Block 9500 / 12500 W/m2

•

Weather Deck

•

Helideck

3200 W/m2

•

Continuous

*1900 W/m2

6300 W/m2

* API suggests a lower figure (1580 kW/m2) is appropriate. In this case, because of Canadian regulations, this is ignored.

For the areas with two thermal radiation levels given, the lower figure refers to the ‘Best Practice’ value as identified in Section 6.7.5 above and the upper figure is the allowable thermal radiation level in accordance with the Impairment / Damage criteria which is included for information. The reasoning behind the choice of limiting thermal radiation levels and their effect on personnel and structures are discussed in detail in section 6.7 above.


Page113 of 135


8.2.4

Other Calculation Criteria Relief gas compositions for the total platform blowdown design case were taken from the Kaldair Design Data Dossier (Reference 13) and used to generate the fluid properties used in the Flaresim simulations. Windspeeds used for the calculations are 27 m/s (original design) and 24.5 m/s (determined from environmental data). Both these wind are blowing in a Northerly direction, i.e. directly back onto the platform from the direction of the flare boom. The reasoning behind the choice of windspeeds is discussed in detail in section 6.6 above. Also considered was the 34.2 m/s NW wind considered in the RABS. The results of the analysis indicated very similar results as the 24.5 m/s windspeed.

8.3

Results

8.3.1

Emergency Relief - Platform Blowdown The results of the study are presented in graphical form in figures 8.1 to 8.10 below. The curves on each graph represent the distance of the isopleth from the flare tip varies with blowdown rate. The isopleth under consideration depends upon the area of the platform under consideration as described above. The distance of isopleth to flare tip is measured in the direction of the platform area under consideration. For example, Figure 8.1 shows the distance of the 12500 W/m2 from the flare tip in the direction of the crown block. The Horizontal line represents the actual distance of crown block from the flare tip. Where the two intersect gives the blowdown rate, as a percentage of design, which would result in thermal radiation of 12500 W/m2 impinging on the crown block. For information, although not applicable to emergency relief, the radiation distance to the 1900 kW/m2 level is also given. This would be the type of figure that would be considered allowable around the TSR.


Page114 of 135


Figure 8.1 Envelope of Operability for Crown Block with Limiting Thermal Radiation 12500 W/m2 with Northerly Wind 24.5 m/s 140.0 12500 W/m2 Isopleth Distance from Tip Distance from Flare Tip

120.0 100.0 80.0

Crow n Block Minimum Distance from Tip

60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%

% Design Case Blow dow n Rate

Figure 8.2 Envelope of Operability for Crown Block with Limiting Thermal Radiation 9500 W/m2 with Northerly Wind 24.5 m/s 160.0 9500 W/m2 Isopleth Distance from Tip

Distance from Flare Tip

140.0 120.0 100.0 80.0


60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%



Page115 of 135


Figure 8.3 Envelope of Operability for Weather Deck with Limiting Thermal Radiation 6300 W/m2 with Northerly Wind 24.5 m/s 120.0 6300 W/m2 Isopleth Distance from Tip Distance from Flare Tip

100.0

Weather Deck Minimum Distance from Tip

80.0 60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%


Figure 8.4 Envelope of Operability for Helideck with Limiting Thermal Radiation 3200 W/m2 with Northerly Wind 24.5 m/s 200.0

3200 W/m2 Isopleth Distance from Tip


180.0

Helideck Minimum Distance from Tip

160.0 140.0 120.0 100.0 80.0 60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%



Page116 of 135


Figure 8.5 Envelope of Operability for Helideck with Limiting Thermal Radiation 1900 W/m2 with Northerly Wind 24.5 m/s


250.0 1900 W/m2 Isopleth Distance from Tip

200.0


150.0

100.0

50.0

0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%


Figure 8.6 Envelope of Operability for Crown Block with Limiting Thermal Radiation 12500 W/m2 with Northerly Wind 27.0 m/s 140.0



120.0 100.0 80.0


60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%



Page117 of 135


Figure 8.7 Envelope of Operability for Crown Block with Limiting Thermal Radiation 9500 W/m2 with Northerly Wind 27.0 m/s 160.0



140.0 120.0 100.0


80.0 60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%


Figure 8.8 Envelope of Operability for Weather Deck with Limiting Thermal Radiation 6300 W/m2 with Northerly Wind 27.0 m/s 120.0



100.0 Weather Deck Minimum Distance from Tip 80.0 60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%



Page118 of 135


Figure 8.9 Envelope of Operability for Helideck with Limiting Thermal Radiation 3200 W/m2 with Northerly Wind 27.0 m/s 200.0



180.0


160.0 140.0 120.0 100.0 80.0 60.0 40.0 20.0 0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%


Figure 8.10 Envelope of Operability for Helideck with Limiting Thermal Radiation 1900 W/m2 with Northerly Wind 27.0 m/s


250.0 1900 W/m2 Isopleth Distance from Tip

200.0


150.0

100.0

50.0

0.0 0%

50%

100%

150%

200%

250%

300%

350%

400%

450%

500%

550%

600%



Page119 of 135


8.3.2

Continuous Relief The results of the continuous flare relief study are presented in graphical form in figures 8.11 and 8.12 below. The curves on each graph represent the distance of the 1900 W/m2 isopleth from the flare tip varying with continuous relief rate. The distance of isopleth to flare tip is measured in the direction of the platform area under consideration, in this case only the weather deck is considered. The horizontal line represents the actual distance of weather deck from the flare tip. Where the two intersect gives the continuous relief rate, as a percentage of design, which would result in thermal radiation of 1900 W/m2 impinging on the weather deck. The figures in parentheses on the x axis represent the combined LP and HP flare mass flowrate under consideration e.g. the mass of gas flared if the platform is operating at 100% capacity (considered to be 200 kbopd) is 409.6 Te/h with a pseudo molecular weight of 22.8. Note that the mass flowrates stated become invalid if the ratio of HP to LP flare load differs from that considered here (see Section 8.2.2 above for further details).


Page120 of 135


Figure 8.11 Envelope of Operability for Weather Deck with Limiting Thermal Radiation 1900 W/m2 (Continuous) with Northerly Wind 24.5 m/s 1900 W/m2 Isopleth Distance from Tip

Distance from Flare Tip, m

120.0 100.0

Weather Deck Minimum Distance from Tip 80.0 60.0 40.0 20.0 0.0 0% (0)

10% (41.0)

20% (81.9)

30% 40% 50% 60% 70% 80% 90% 100% 110% (122.9) (163.8) (204.8) (245.8) (286.7) (327.7) (368.7) (409.6) (450.6)

% Design Case Continuous Flaring Rate (Total Flare Mass Rate, Te/h)

Figure 8.12 Envelope of Operability for Weather Deck with Limiting Thermal Radiation 1900 W/m2 (Continuous) with Northerly Wind 27.0 m/s 1900 W/m2 Isopleth Distance from Tip

Distance from Flare Tip, m

120.0 100.0

Weather Deck Minimum Distance from Tip

80.0 60.0 40.0 20.0 0.0 0% (0)

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

110%

(41.0) (81.9) (122.9) (163.8) (204.8) (245.8) (286.7) (327.7) (368.7) (409.6) (450.6) % Design Case Continuous Flaring Rate (Total Flare Mass Rate, Te/h)


Page121 of 135


8.4

Flare Envelope Conclusions

8.4.1

General An immediate and obvious conclusion which can be drawn from the results of this study is that a wind speed of 27 m/s gives higher thermal radiation levels on the platform than the 24.5 m/s wind speed for the relief cases considered here. However if we analyse the results given for the wind speed of 24.5 m/s, the Granherne best practice wind speed as defined in Section 6.6, figures 8.1 to 8.5 and 8.11 above, the following conclusions can be drawn for each flaring scenario:

8.4.2

Emergency Relief - Platform Blowdown Maximum allowable thermal radiation at the crown block - 9500 W/m2 For this case the thermal radiation on the crown block is the limiting factor. An initial blowdown rate of approximately 150% of the design rate can be tolerated before the limit of 9500 W/m2 is limit is exceeded in this area. The other cases considered are less onerous, with the 3200 W/m2 isopleth impinging on the Helideck at around 350% of the design blowdown rate and the 6300 W/m 2 isopleth impinging on the weather deck at around 370% of the design blowdown rate. The above suggests considerable capacity is inherent in the system dependent on the final basis selected. However, caution should be exercised as this apparent capacity will change dependent on the detail of the project which actually utilises the apparent capacity. In other words the absolute capacity will only be confirmed once the LP and HP rates are fully defined and detailed calculations are performed for the modification under consideration.

8.4.3

Continuous Relief For this case the maximum allowable thermal radiation of 1900 W/m2 at the weather deck is considered to be the limiting factor. For a northerly wind blowing at 24.5 m/s, a platform production rate of 62% of the design rate (considered to be 200 kbopd) can be tolerated before the limit of 1900 W/m2 is limit is exceeded in this area. Here is an area where consideration of wind condition may provide useful economic benefits. If the regulators allow it, which may depend on flare quota considerations, the actual production rate when the compressors were unavailable could be set based on the measured windspeed and direction for the period in question. In other words when the windspeed was low or in a beneficial direction the flaring rate could be set at 100% of production. Should this prove attractive to HMDC a set of envelopes for a range of wind speeds and directions could be prepared which could be used in an operational procedure to select production rate dependent on wind condition.


Page122 of 135


9.0

IMPLICATIONS FOR HIBERNIA

9.1

Introduction In the foregoing sections the various aspects relating the RABS have been analysed. The intent of this section is to combine the analysis into a form that can be used to make decisions regarding potential capacity opportunities that exist in the flare system, as well as identify the issues that will require resolution irrespective of the exercise of any choices. Generally the potential changes fall into 3 categories: • Capacity opportunities resulting from the application of more modern design practices (not all of these opportunities add apparent capacity). • Areas where the design documentation should be revised to increase the integrity and traceability in the design. •

Optional changes which can be considered to be related to house keeping.

Therefore this section is separated into three main sections; Firstly an outline of the capacity opportunities is given including the apparent capacity effects the changes would have; Secondly, a list and description of the important changes required to ensure the integrity and traceability of the system design documentation is given; Lastly, optional changes are described which will aid the future maintenance and understanding of the design in future years. Finally, a list of items that do not easily fall into the previous sections is included for completeness. In Appendix 2 a proposed scope of work is included which defines, in more prescriptive terms, the work required to revalidate the flare system design assuming HMDC decide to implement the changes described in this section in their entirety. 9.2

Flare System Capacity Opportunities The following summarises the capacity opportunities available in the flare system with respect to new codes and best practices.


Page123 of 135


Table 9.26 Effect of Changing Flare System Design Philosophy on the Apparent Design Capacity (Total Blowdown) Issue

Description / concern

Case

Meets current code req's?

Jet Fire

Described in Section 6.2. Are vessels sufficiently protected from the effects of jet fire?

Design

 Codes do not

Safety analysis not carried through to engineering.

require measures to be included for jet fire (API currently working to change this)

Best practice



Original design did not purposefully include mitigating measures

Reducing the blowdown

Cost

Failure potential

Flare system capacity*

Recommendation



N/A

Rapid escalation.

None

Adopt best practice. Ensure insulation integrity on lower pressure systems during jet flame impulse momentum.





No effect on HP flare.

HMDC have declined this change for now, preferring the more conservative design approach (which avoids changes to blowdown calculations should compressor operating conditions change significantly). The capacity opportunity will be described in an appendix in the updated RABS.



Detailed 3D analysis and prevention measures to ensure vessel will not fail in a jet fire Reducing blowdown start pressure

Safety

Described in Section 6.3. Compressors blowdown from PSHH setting. Rest of system depressures from normal pressure.

Design

Exceeds code requirement

+

N/A

Best practice







Described in Section 6.3 Certain vessels (i.e. with wall

Design

Exceeds RP 521 requirements in some instances.



N/A

As blowdown initiates automatically, design system with normal start pressure

Various components are depressured to either


Page 124 of 135

Rapid escalation prevented unless insulation fails.

N/A In the unlikely event that there was a fire coincident with a shut in situation (that was not caused by trip) the blowdown rate would be higher than anticipated and if the wind were adverse could lead to higher than planned radiation levels on the platform.

N/A

LP flare capacity available is increased by ~ 17,000 kg/h compared to the original blowdown case 89,601 kg/h

No significant effect on LP flare because the HP compressor seal oil

Best practice would require all blowdown calculations to be re-run


Issue


Case

end pressure

thicknesses over 1”) can be depressured to 50% of the design pressure rather than 690 kPag.

690 kPag or 50% of the design pressure Best practice

• Systems with design

pressure above 1724 kPag should be depressured to 50% of the design pressure.


More closely follows the intent of RP 521

Safety

+

Cost



Failure potential

N/A


Recommendation

system requires the compressor and components to depressure to atmospheric pressure.

and new orifice plates in the affected blowdown section. For the moment best practice is declined. An appendix to the updated RABS will be created to identify the capacity opportunity in case it is required in the future.

HP flare capacity available is increased by ~ 70% compared to the original blowdown case 133,316 kg/h (reduces to ~40,000 kg/h)

• Systems with design pressure below 1724 kPag need not be depressured. However, if it is chosen to do so, the final pressure should be 690 kPag or 50% of the design pressure, whichever is less. • Vessels with wall thicknesses below 1 inch should be considered separately. Blowdown stagger

Described in Section 6.4. Stagger not sufficiently independent and equipment is in same fire zone. Fire may affect A train injection compressor, yet blowdown will be held.

Design

Best practice avoids stagger unless the systems can be made sufficiently independent


Ambiguous (although the recommended practices allow controlled blowdown)









1. Stagger fails closed would lead to escalation. 2. Stagger fails open at initiation leads to high radiation levels. 3. Jet fire analysis suggests injection compressor vessels should not fail.

+



(compared to 89,601 kg/h original LP flare blowdown design case. New rate is therefore 123,575 kg/h).

Decline best practice. The A train injection compressor components are not at risk due to their thickness. QRA the software reliability.

1. Difficult problem relating to back pressure on LP separator to overcome. 2.

Page 125 of 135

33,974 kg/h of load is added to the LP flare blowdown case.

Otherwise, very reliable.


Issue


Case


Safety

Cost

Failure potential


Recommendation

HP and LP flare apparent capacity is increased by approximately 7% (i.e. by 9,000 kg/h and 6,000 kg/h respectively).

Best practice declined. For continuous flaring case a risk mitigation procedure could be developed to increase the flaring rate when the compressors were down dependent on the measured wind condition.

HP and LP flare capacity is increased by approximately 50% before new radiation levels are approached during blowdown (i.e. by 60,000 kg/h and 45,000 kg/h for the HP and LP flares respectively).

Adopt and describe best practice in flare documentation. The practice will remove inconsistency compared to Canadian regulations and international standards. Hydraulic considerations may not allow the full use of new capacity.

HP and LP flare capacity is increased by approximately 5% during blowdown case (i.e. by 6,000 kg/h and 4,000 kg/h for the HP and LP flares respectively).

Best practice would require all blowdown calculations to be re-run. For the moment best practice is declined. A note will be incorporated in the revised flare documents to note the

Higher radiation levels designed for. Design windspeed and direction

Described in Section 6.6. The design windspeed is higher than absolutely necessary.

Design = 27 m/s from North

No code requirements.



No code requirements



Design 6.3 kW/m2 at crown block and 3.2 kW/m2 at escape ways

 Over conservative



Best practice - Radiation levels raised to: 9.5 kW/m2 at crown block (shielded) 6.3 kW/m2 at any escape way (no shielding) 3.2 kW/m2 at the helideck 1.9 kW/m2 continuous at the weather deck Design No credit taken for insulation on vessels in blowdown calculations Best practice Credit taken for insulation

 (and meets Canadian regulations)



 Over conservative







Best practice = 24.5 m/s from North

N/A

 



34.2 m/s from North West

Acceptable flare radiation levels

Incorporate the effects of vessel insulation on the vapour rates

Described in Section 6.7. The requirements in the RABS are over conservative.

Described in Section 6.9.1.


If windspeed is higher and design release is occurring the radiation levels on the platform will be exceeded. If windspeed is higher and design release is occurring, the radiation levels for emergency on the platform will be exceeded somewhat. It is highly unlikely that anyone would be on deck without the necessary protection in such a case.

N/A

N/A



N/A

N/A

N/A



N/A









Page 126 of 135


Issue


Case


Safety

Cost

Failure potential


Recommendation capacity opportunity in case it is required in the future.

Remove the effect of future equipment

Described in Section 7.

N/A

N/A

N/A

N/A

N/A

N/A

N/A

N/A

Negl.

N/A

HP flare capacity is increased by approximately 38,000 kg/h during blowdown. LP flare system capacity unchanged.

Incorporate the revised data in the updated RABS. Identify the “spare” capacity for future projects in a suitable section.

 = acceptable - + = most acceptable  = least expensive -  = most expensive * by making change to best practice


Page 127 of 135


Care needs to be exercised when considering Table 9.26 as the values are not additive. What the table does show however is the significant spare capacity in the HP flare when considering the blowdown cases. The LP flare is very different. The changes that affect capacity alone (rather than implied through radiation calculations) are insufficient to offset the large change required to remove the blowdown stagger. Therefore this change would force the design rate of the system to be increased and would therefore require detailed hydraulic analysis to be undertaken. The difficult aspect will be the superimposed back pressure on the LP separator. If this is too high there will be the undesirable consequence of raising the pressure in the LP separator when the blowdown valve opens. This would have the effect of increasing inventory and reducing the time to failure of the LP separator if exposed to fire. Some mitigating measures would likely be required in this instance. Given this and the apparent inherent capability of the injection compressor components to survive the pause period before blowdown commences, suggests that the stagger in the system should be retained. For the relief cases other than blowdown, two out of three of the capacity opportunities (i.e. relief cases which were overestimated during design) are negative. The worst of the problems relates to the spillover valve failure cases as these have the potential to significantly exceed the HP flare system design rate. This is shown on Table 9.27. which follows.


Page 128 of 135


Table 9.27 Effect of Changing Flare System Design Philosophy on the Apparent Design Capacity (Relief Cases) Issue


Case

Meets current code req’s?

Two-phase relief (See Section 5.3 and 6.5)

New sizing method increases valve size required for this case

Design - Old additive API method

Best practice - New API method

Missed relief cases (See Section 5.2)

Blowby cases methodology flawed (See Section 5.3.1)

Failure of spillover valves (open) exceeds flare system capacity. Blowby cases are over conservative. This would prevent the installation of larger LCVs if this proved necessary.

Safety

Cos t

Failure potential


Recommendation

No longer



N/A

If the design case is the sizing case the vessel can be overpressured.











Valve size may be to high and valve will chatter.

The design rate which can be accommodated in the existing valves reduces dramatically. For comparison max single well rate for HP separator is ~ 54 kbopd.

Adopt best practice. This issue requires the maximum well rate and maximum number of wells to be redefined as they are likely to compromise the RV size on the HP separator. The test separator RVs are being replaced.

Flare system capacity was not dimensioned for the dimensioning case.

Adopt best practice and use measures to limit peak load.

As there will be no desire to change the existing valve, there will be a latent capacity in the system which can be used for future upgrades. The capacity change available (which would translate to an increase in separator LCV size) is approximately 20%.

Add note to RABS update to describe the spare capacity.

Design - missed a valid relief case

No.



N/A

If valve fails open the flare system design rate is significantly exceeded.

Best practice - Design for any single valve failure.







N/A





Design - Over conservative case assumed.





N/A

Valve is likely to chatter if faced with the blowby case.

Best practice:



N/A

A valve, properly sized for the case in question, will not chatter when faced with the design case.

•

Use settleout pressure for shutdown case

•

Take account of downstream control valve positions and fluid properties in production case.

  

 = acceptable - + = most acceptable  = least expensive -  = most expensive * by making change to best practice


Page 129 of 135


In the above tables the issues which add capacity are optional. In other words these are issues that HMDC can adopt or decline at will. The issues which have a negative capacity effect, for obvious reasons, will require some work to resolve. 9.3

Impact on the Design Documentation The outcome of the technical audit indicates the following aspects of the design will need to be revisited / revised. The table is a significantly shortened version of the table presented in Section 5.4 and represents the most important changes that should be considered. Repetitive items (including those in tables 9.1 and 9.2) and issues requiring simple comment in the RABS update are omitted. The table should be read in this light.


Page 130 of 135


Table 9.28 Calculations Requiring Revision (System 34) Number 34005 / A

006 / A


Blowdown Summary

Number 34005/1

Description

Action



005/3

Were the real settle out pressures ever used?

006/1

HP Blowdown calculation higher than vendor aware of. Radiation level for case is underestimated. Correct isentropic efficiency used?

Compare real settleout conditions with design to ensure blowdown rates are appropriate Update RABS.

006/2

010 / A

Calculation of allowed cooldown before hydrate formation & minimum temperatures achieved in flare gas from critical blowdown sections Review of HP flare KO Drum size

010/1

Was the calculation sufficiently robust?

011/1

015 / A

Calc to review options for reducing HP to MP Separator and MP to LP Separator Blowby Cases

015/1

022 / C

HP Flare Network Sizing (HP Separator - Max Relief Case) 3rd Stage Compressor Max Relief Case - Network Analysis

022/2

A note on the front of calc 34-064 states that Rev 7 of Design Basis gives max well flow of 20,000 bpd + average well of 10,000 bpd, i.e. 30,000 bpd total. The individual well design rate has changed. What are the implications for the platform? Relief & Blowdown Study Report Rev C1 non-concurrent maximum allowable LP and HP Flare loads are 110,874 kg/h and 244,897 kg/h respectively. Rates used in these calculations exceed design. Effect of increased production / production fluid GOR

025/2

Include in updated RABS cases which are not catered for, i.e. consider relief from both compressor trains

Coalescer & LP Separator Heaters Simultaneous Fire Relief - Network Analysis

033/1


011 / A

025 / C

033 / G


Page 131 of 135

methodology

An optimistic isentropic efficiency was used to calculate the minimum system temperature. Recalculate the temperatures. See also 34.010/1. There are flaws in the method used to calculate the minimum temperatures in the system. These should be corrected. Use resultant more realistic figure to implement alarms on high pressure areas to avoid low temperatures. Update RABS. Select number and design rate of the well failure to shut in case. Update RABS. Develop operational procedure to cater for time to fill HP flare KO vessel.


Update RABS to mention link between GOR and the compressor capacity. Check modifications to avoid injection compressor RVs lifting prevent coincident case. Update RABS to explicitly mention the cases which are not designed for. Construct an LP flare network model to calculate the back pressure on relief valves when the system is depressuring.


Table 9.29 Calculations Requiring Revision (System 31) Number 31.37

Title Relief Valve Calculations - LP Separator

Number 31.37/1

Description Is it possible for the Test Separator manifold to be connected to the LP Separator when operating in high pressure mode?

Action Ensure positive method of ensuring isolation from HP system exists. Update RABS to reflect this.

In Granherne’s opinion none of the above items are optional. 9.4

Optional Changes The following changes could be considered to increase the integrity and traceability of the design work. Table 9.30 Technical Audit Optional Changes (System 34)

Number 34045 / E

Title Total HP Blowdown Initial Conditions (Checks blowdown line sizes for individual system blowdowns)

Number 34045/1

045/2

Description

Action

There is no network analysis run with common HP Blowdown at initial conditions

Consider constructing a HP flare network model to assess future modification projects against.

Consistency error in the number and flows in the gas injection flowlines ''As Built' P&IDs show bursting discs in this service (calc considers PSVs) therefore calc is no longer valid

Add a note to the RABS clarifying the injection manifold rate basis. There is no replacement calculation for the installed bursting discs. The bursting disk calculations should be reviewed to identify implications for the flare system.

046 / G

Fuel Gas Cooler / Heater tube rupture relief line size check

046/1

050 / G

3rd Stage Suction Scrubber A (D-3303A) PSV Discharge Line Size Confirmation Comparative Program check of INPLANT Single Phase Simulation vs ESI

050/1

Rev C2 PSV datasheet states set pressure = 8200 kPa(g), 'As Built' P&ID shows set pressure = 7000 kPa(g)

P&ID set pressure error?

059/1


Revisit ESI calculations and replace as necessary

059 / G


Page 132 of 135


Table 9.31 Technical Audit Optional Changes (System 31) Number 31.36

31.38

Title Relief Valve Calculations - MP Separator Inlet Line Size Checking for Relief Valves

Number 31.36/6

Description Are the gas blowby cases are methodologically flawed?

Action Add note to RABS update

31.38/1

Inlet line sizes should have been recalculated using 'Final' relief data and isometrics.

Check / redo inlet line sizing calculations as necessary.

These items are optional as the inconsistencies are minor. The other area that could be improved is the overall level of as built of the design calculations. Generally the calculations were never revised for key design data late in the project. This included the calculation of inventory and the use of vendor supplied settleout pressures. The latter item becomes more important if the changes above are pursued. When the relief valve and control valve data sheets were prepared superseded design data was also used. Our initial analysis of these combined effects suggests that they are benign. For example we expect, but cannot be sure, that the inventory assumptions will actually be conservative; Our analysis of the valve calculations shows that in some cases the valves may have ended up being slightly smaller than desired but if this were a problem it would have shown up by now. This type of inconsistency is relatively common; there is never the perfect design project. HMDC will need to decide whether they can accept the inconsistencies. 9.5

Miscellaneous Requirements

9.5.1

Updating the Design Documentation The above changes generally point to a requirement to rerun some of the key flare system design calculations. Whether or not this uncovers areas where hardware changes will need to be made will have to be seen; nevertheless there will still be the requirement to update the design volumes and make the calculation changes traceable. This will be in addition to making the new calculated information obvious in the updated RABS.


Page 133 of 135


The following summarises the type of changes to the design documentation that will be necessary: •

Relief and Blowdown Study Report

Fairly extensive rewrite of the report. •

Design Calculations

For each change prepare a calculation revision which revs up the existing calculation (in other words building on the existing work). This would include: -

Calculations identified above.

-

Flare radiation calculations (for windspeed and allowable radiation levels)

-

Continuous radiation cases. Analysis of allowable production rate vs wind speed. Blowdown inventory calculations (for removed inventory)

• Reliability analysis of the system that controls the compressor stagger, to ensure the system is sufficiently reliable to ensure the design integrity. 9.5.2

Implementation Projects In this section there are some projects mentioned which will in all likelihood require hardware changes to be made (resulting from the above there may be more). • Insulation conformance - The explicit ability of the platform to cope with a jet fire hazard requires the insulation around the vessels to remain in place during jet flame impingement. This may require the insulation strength to be improved. •

Modifications to limit peak flaring rate during spillover valve failure.

• Instrument modifications to warn operators when the requirement to blowdown compressors is becoming imminent (to avoid low temperature problems).


Page 134 of 135


10.0

REFERENCES

1. Canada-Newfoundland Atlantic Accord Implementation Act Newfoundland Offshore Petroleum Installations Regulations, February 21,1995. 2.

Concept Safety Evaluation, Cremer and Warner, October 1991.

3.

Fire Risk Analysis, Cremer and Warner, May 1992.

4.

Fire Risk Analysis Update, Cremer and Warner, February 1993.

5.

Design Phase Risk Assessment, Caldwell Consulting, May 1995.

-

6. Design Phase Safety and Environmental Assessment, Doc No. CM-E-F-RM00-RP-104 Rev C0, May 1995. 7. 1993.

Structural Passive Fire Protection Analysis, Aker Engineering, 21 February

8. Review of Emergency Systems for the Proposed Hibernia Platform, Cremer and Warner, Report No. 93432, 15th March 1994. HMDC Doc No: CM-YF-R-M00-RP-008.000 Rev 001. 9.

Deleted.

10.

Deleted.

11. Gayton P.W. and Murphy, S.N. (1995) Depressurisation System Design, IChemE workshop, “The Safe Disposal of Unwanted Hydrocarbons”, Aberdeen 1995. 12.

Deleted.

13. Kaldair Design Data Dossier, Doc. No. CM-Z-M-Z-210-ZM-1083-002.0, December 1995.


Page 135 of 135


APPENDIX I CALCULATION TECHNICAL AUDIT


Appendix I Page 1 of 42


Calculation Descr Number / Calculation Book 34-005 / A

Blowdo

(Provid Audit Tasks

Method

Key Assumptions

Blowdown volumes calc

Included between 10 - 2

8266-HIB-TN-C-0001





Blowdo

(Provid Audit Tasks

Method

Key Assumptions

See 34-005 Rev 6 and 3 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc




Blowdo

Audit Tasks

Method

Key Assumptions

Blowdown model isentrop

Blowdown from PSHH to 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc




Blowdo

Audit Tasks

Method

Key Assumptions Superseded by Rev 5 Key Results 8266-HIB-TN-C-0001





Metal S

Audit Tasks

Method

Key Assumptions Metal temperature model Ambient Air Temp = 20C Emissivity = 0.7

8266-HIB-TN-C-0001





Calcula

temper Audit Tasks

Method

Key Assumptions

Ref. Process simulation 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc



Calculation

Descr

Number / Calculation Book 34-011 / A

Review

Audit Tasks

Method

Key Assumptions

Liquid volume sizing basis:

Overall sizing basis: Drum 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc


z = 0. Revision: B October 2000


HP Fla

Audit Tasks

Method

Key Assumptions

HP Flare Drum size is 2

Total drum volume is 58

8266-HIB-TN-C-0001





Flare p

Audit Tasks

Method

Key Assumptions Sweep velocity 0.2 m/s

Sweep gas MW = 20.21

8266-HIB-TN-C-0001





Compa

Audit Tasks

Method

Key Assumptions

Windspeed = 0 or 27 m

Flame Emissivity Value

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-020 / B

LP Flar

Audit Tasks

Metho

Key Assumptions

Masoneillan sub-critical Installed CV (LV-0009)

8266-HIB-TN-C-0001




Calculation Descr Number / Calculation Book 34-060 / B

Indicati

Audit Tasks

Method

Key Assumptions

Internal B&R program 'C

Injection Compressor set 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc



Calculation Desc Number / Calculation Book 34-062 / B

Sensiti

if inject Audit Tasks

Metho

Key Assumptions

Calc for indicative only, Wind speed = 27 m/s

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-022 / C

HP Fla

(HP Se Audit Tasks

Metho

Key Assumptions

HP Flare system iso rev

HP Separator Blocked O

8266-HIB-TN-C-0001




Calculation Descr Number / Calculation Book 34-024 / C

MP Se

Audit Tasks

Method

Key Assumptions

HP Flare system iso rev

MP Separator Max Relie

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-026 / C

Injectio

Audit Tasks

Metho

Key Assumptions HP Flare system iso rev

Injection Compressor K

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-028 / D

West T

Audit Tasks

Metho


West Test Separator M

8266-HIB-TN-C-0001





East Te

Audit Tasks

Metho


East Test Separator Ma

8266-HIB-TN-C-0001





1st Sta

Audit Tasks

Metho


1st Stage Compressor K

8266-HIB-TN-C-0001




Calculation

Descri

Number / Calculation Book 34-045 / E

Total HP

(Checks Audit Tasks

Methodo


HP flare headers and sub-he

Laterals are sized by individu

Blowdown simulations HIBBD

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-039 / F

LP Sep

Audit Tasks

Metho

Key Assumptions LP Flare system isomet

Max Spill-off = 60,147 k

8266-HIB-TN-C-0001




Calculation

Descri

Number / Calculation Book 34-041 / F

Produce

(From M Audit Tasks

Method

Key Assumptions LP Flare system isometric

Produced Water Degassing

Based on max CV of installe

Calc uses operating pressur

8266-HIB-TN-C-0001




Calculation

Descrip

Number / Calculation Book 34-043 / F

Injection

Audit Tasks

Methodo

Key Assumptions LP Flare systemisometric

Blowdown simulations HIBBD2

Injection Compressor 'A' blowdo

No other equipment blows down

Compositions fromblowdown s

8266-HIB-TN-C-0001




Calculation

Descri

Number / Calculation Book 34-035 / G

3rd Stag

Audit Tasks

Methodo

Key Assumptions HP Flare system isometric

Considers pressure at end of

coincident with any other rele

Maximum allowable built-up b

8266-HIB-TN-C-0001




Calculation Desc Number / Calculation Book 34-037 / G

HM & C

Audit Tasks

Metho


Considers pressure at e

8266-HIB-TN-C-0001





Total L

Audit Tasks

Metho


Blowdown simulations H

8266-HIB-TN-C-0001




Calculation

Descrip


Simultan

Audit Tasks

Methodo

Key Assumptions HP Flare systemisometric

Considers pressure at end of s

coincident with any other relea

62-PSV-0040A/B stated to be c

- others are balanced for simila

8266-HIB-TN-C-0001




Calculation

Descr


Inj Stag

Audit Tasks

Method


Considers pressure at end

coincident with any other r

8266-HIB-TN-C-0001




Calculation

Descr


HP Fue

Audit Tasks

Method


Considers pressure at end coincident with any other

8266-HIB-TN-C-0001





E-3303

Audit Tasks

Metho

Issues None

8266-HIB-TN-C-0001





Simulta

Audit Tasks

Metho

Key Assumptions HP Flare system isome Balanced valves

8266-HIB-TN-C-0001




Calculation

Descr


Individua

Audit Tasks

Method


Total blowdown rate (initial r Tip ∆P estimated from Kald

ESI compressible flow anal

8266-HIB-TN-C-0001





E-6201

Audit Tasks

Metho

Key Assumptions HP Flare system isome

Considers pressure at e

8266-HIB-TN-C-0001




Calculation

Descr


2nd Sta

Audit Tasks

Method


Considers pressure at end o

coincident with any other re 8266-HIB-TN-C-0001



33-PSV-7124 balanced valv


Book H General

Book H contains a n significant commen These 'Check Prin

Calculation Desc Number / 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc



Calculation Descr Number 31.35 Audit Tasks

Relief V

Method

Four Cases Considered

Gas Blowby From Injec Key Assumptions Fire Case 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc



Calculation Number

Descr

31.36

Relief V

Audit Tasks

Method

Six Cases Considered; Fire

Gas Blowby From HP Sepa Key Assumptions Fire Case

Vessel dimensions: 4.5m x

No credit taken for vessel i

8266-HIB-TN-C-0001





Relief V

Method

Four Cases Considered Gas Blowby From 2nd Key Assumptions Fire Case 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc




Inlet Lin

Method

Key Assumptions

Inlet line equivalent leng

Preliminary data used fo 8266-HIB-TN-C-0001 /opt/scribd/conversion/tmp/scratch2682/37533791.doc



Calculation Number 31.41

Descri

Relief Va

Audit Tasks Methodo Equipment Considered: Key Assumptions Only fire case considered Exchanger dimensions: 1.75 Wetted area calc takes into a PSV set pressure 1380 kPag Shell is liquid full Latent heat of vaporisation =

8266-HIB-TN-C-0001




Calculation Descr Number 31.43

Gas Blo

from HP Audit Tasks

Method

Gas Blowby From HP t

Key Assumptions MP Separator PSVs orif

MP Separator spill off va

8266-HIB-TN-C-0001




APPENDIX II STAGE 2 PROPOSAL Flare System Revalidation Study - Stage 2 Proposal Rev C (27 pages)


Appendix II Page 1 of 1


Hibernia Study (Flare)

Recommend Documents